feat(fs5.5): add display connector activation proofs

README.md

@@ -45,6 +45,8 @@ ZAR-Zig-Agent-Runtime is the Zig runtime port of OpenClaw, with parity-first del
 - `src/baremetal/edid.zig`, `src/baremetal/display_output.zig`, and `src/baremetal/virtio_gpu.zig` now provide EDID-backed display capability export plus bounded render/present/flush proof for the first real controller-specific path, `virtio-gpu-pci`, including digital-input, preferred-timing, CEA, DisplayID, HDMI-vendor-data, and basic-audio capability flags when present in EDID data
   - `src/baremetal/display_output.zig` now derives the exported connector type from EDID capability flags instead of hard-coding the virtio-gpu path as always `virtual`
   - the same display-output surface now exports bounded per-output entries through `oc_display_output_entry_count` and `oc_display_output_entry`, and the broad host/tool surface now exposes `display-outputs` and `display-output <index>` on top of that table
+  - the real display surface now also supports explicit connector-targeted activation through `display-activate <connector>` and typed `DISPLAYACTIVATE <connector>`, and launch profiles now actively select the requested connector on the real virtio-gpu path instead of only passively rejecting mismatches
+  - `scripts/baremetal-qemu-virtio-gpu-display-probe-check.ps1` now also proves explicit re-activation of the connected connector succeeds and a mismatched connector request is rejected on the live controller path
   - `scripts/baremetal-qemu-framebuffer-console-probe-check.ps1` now proves live MMIO banner pixels plus exported adapter metadata against the freestanding PVH artifact at `640x400`, `1024x768`, and `1280x720`
   - `scripts/baremetal-qemu-virtio-gpu-display-probe-check.ps1` now proves live `virtio-gpu-pci` EDID/controller capability export plus output-entry count/entry metadata and resource-create/attach/set-scanout/flush behavior with non-zero scanout pixel readback over QEMU with `edid=on`
   - real HDMI/DisplayPort connector-specific scanout paths are still future depth and are not claimed by this branch

docs/zig-port/FS5_5_HARDWARE_DRIVERS_SYSTEMS.md

@@ -147,6 +147,7 @@ Current local source-of-truth evidence:
   - EDID parsing now also exports capability flags for digital input, preferred timing, CEA extension presence, DisplayID extension presence, HDMI vendor data, and basic audio when those descriptors are present
   - `src/baremetal/display_output.zig` provides the exported display-output ABI surface plus EDID byte export and a bounded per-output entry table
   - `src/baremetal/virtio_gpu.zig` probes the first real controller-specific path, `virtio-gpu-pci`, through modern virtio PCI capabilities plus `GET_DISPLAY_INFO`, `GET_EDID`, bounded multi-scanout enumeration, connector-aware scanout selection, bounded 2D resource creation, guest-backing attach, transfer-to-host, and flush
+  - the same path now also supports explicit connector-targeted reactivation through the runtime surface, so the selected connector is no longer only inferred/exported but can be actively reselected on the real virtio-gpu path
   - `src/pal/framebuffer.zig` now also exposes the display-output state and EDID byte surface through the PAL seam
 - host regressions now prove the framebuffer export surface updates host-backed framebuffer state, glyph pixels, supported-mode enumeration, high-resolution mode switching, per-output entry export, and preservation of the last valid mode on unsupported requests
 - a live bare-metal PVH/QEMU proof now passes:
@@ -160,6 +161,7 @@ Current local source-of-truth evidence:
   - `scripts/baremetal-qemu-virtio-gpu-display-probe-check.ps1`
   - exported display-output state has `magic=display_output_magic`, `api_version=2`, `backend=virtio_gpu`, `controller=virtio_gpu`, an EDID-derived connector type, and a real EDID header over `virtio-gpu-pci,edid=on`
   - runtime now also reports the selected virtio-gpu PCI vendor/device, PCI location, active scanout, current mode, preferred mode, physical dimensions, manufacturer/product IDs, exported EDID byte surface, the exported capability flags derived from the EDID payload, and the bounded per-output entry export for the selected scanout
+  - the same proof now also validates that explicit activation of the connected connector succeeds and that an explicit mismatched connector request is rejected on the live controller path
   - the same proof now also validates non-zero present statistics plus non-zero scanout pixels from the guest-backed render pattern after resource-create/attach/set-scanout/flush
 - current real source-of-truth rendered display support now covers bounded Bochs/QEMU BGA mode-setting plus virtio-gpu present/flush over the virtual scanout path
 - real HDMI/DisplayPort connector-specific scanout paths are not yet implemented and are not claimed by this branch
@@ -373,9 +375,9 @@ Notes:
   - `scripts/baremetal-qemu-rtl8139-udp-probe-check.ps1`
   - `scripts/baremetal-qemu-rtl8139-tcp-probe-check.ps1`
   - `scripts/baremetal-qemu-rtl8139-gateway-probe-check.ps1`
-- `src/baremetal/package_store.zig` now persists canonical package metadata beyond the entrypoint alone, including manifest fields for `name`, `root`, `entrypoint`, `script_bytes`, `asset_root`, `asset_count`, and `asset_bytes`, and `src/baremetal/tool_exec.zig` now exposes matching `ls`, `package-info`, `package-ls`, `package-cat`, `display-info`, and `display-modes` builtins on top of the same bare-metal filesystem/package layout
-- `src/baremetal_main.zig` host regressions now also prove TCP zero-window block/reopen behavior, framed multi-request command-service exchange on a single live flow, structured `EXEC` request/response behavior, bounded long-response chunking under the advertised remote window, bounded typed batch request multiplexing on one live flow, typed `PUT`/`GET`/`STAT`/`LIST` service behavior, typed `INSTALL` / `MANIFEST` runtime-layout service behavior, typed `PKGAPP` / `PKGDISPLAY` / `PKGPUT` / `PKGLS` / `PKGGET` / `PKGDELETE` package/app-manifest/package-asset/uninstall behavior, typed `APPLIST` / `APPINFO` / `APPSTATE` / `APPHISTORY` / `APPSTDOUT` / `APPSTDERR` / `APPTRUST` / `APPCONNECTOR` / `APPRUN` / `APPDELETE` app-lifecycle behavior, typed `DISPLAYINFO` / `DISPLAYMODES` / `DISPLAYSET` display-query/control behavior, typed `TRUSTPUT` / `TRUSTLIST` / `TRUSTINFO` / `TRUSTACTIVE` / `TRUSTSELECT` / `TRUSTDELETE` trust-store behavior, persisted `run-script` execution through the framed TCP service seam, and package/app install/list/info/run/delete behavior on the canonical package layout
-- those proofs now cover live ARP request transmission, IPv4 frame encode/decode, UDP datagram encode/decode, TCP `SYN -> SYN-ACK -> ACK` handshake plus payload exchange, dropped-first-SYN recovery, dropped-first-payload recovery, dropped-first-FIN recovery on both close sides, bounded four-way close, bounded two-flow session isolation, zero-window block/reopen, bounded sequential payload chunking, bounded sender congestion-window growth after ACK and timeout collapse back to the initial window, framed TCP command-service exchange, bounded typed batch request multiplexing on one flow with concatenated framed responses, typed TCP `PUT` upload, direct filesystem readback of the uploaded script path, typed `INSTALL` / `MANIFEST` runtime-layout service exchange with `/boot/loader.cfg` readback, typed `PKG` / `PKGLIST` / `PKGINFO` / `PKGRUN` / `PKGAPP` / `PKGDISPLAY` / `PKGDELETE` package-service exchange, typed `APPLIST` / `APPINFO` / `APPSTATE` / `APPHISTORY` / `APPSTDOUT` / `APPSTDERR` / `APPTRUST` / `APPCONNECTOR` / `APPRUN` / `APPDELETE` app-lifecycle exchange with persisted runtime-state readback, persisted history-log readback, persisted stdout/stderr readback, and uninstall cleanup, typed `TRUSTPUT` / `TRUSTLIST` / `TRUSTINFO` / `TRUSTACTIVE` / `TRUSTSELECT` / `TRUSTDELETE` trust-store exchange, selected trust-bundle query/path readback, trust-bundle deletion, post-delete remaining-list readback, canonical package entrypoint readback, package manifest readback, package app-manifest readback, persisted package display-profile readback, package-directory listing, package output readback, live `run-package` display-mode application, explicit `DISPLAYSET` mode change/readback, and TX/RX counter advance over the freestanding PVH image
+- `src/baremetal/package_store.zig` now persists canonical package metadata beyond the entrypoint alone, including manifest fields for `name`, `root`, `entrypoint`, `script_bytes`, `asset_root`, `asset_count`, and `asset_bytes`, and `src/baremetal/tool_exec.zig` now exposes matching `ls`, `package-info`, `package-ls`, `package-cat`, `display-info`, `display-outputs`, `display-output`, `display-modes`, and `display-activate` builtins on top of the same bare-metal filesystem/package layout
+- `src/baremetal_main.zig` host regressions now also prove TCP zero-window block/reopen behavior, framed multi-request command-service exchange on a single live flow, structured `EXEC` request/response behavior, bounded long-response chunking under the advertised remote window, bounded typed batch request multiplexing on one live flow, typed `PUT`/`GET`/`STAT`/`LIST` service behavior, typed `INSTALL` / `MANIFEST` runtime-layout service behavior, typed `PKGAPP` / `PKGDISPLAY` / `PKGPUT` / `PKGLS` / `PKGGET` / `PKGDELETE` package/app-manifest/package-asset/uninstall behavior, typed `APPLIST` / `APPINFO` / `APPSTATE` / `APPHISTORY` / `APPSTDOUT` / `APPSTDERR` / `APPTRUST` / `APPCONNECTOR` / `APPRUN` / `APPDELETE` app-lifecycle behavior, typed `DISPLAYINFO` / `DISPLAYOUTPUTS` / `DISPLAYOUTPUT` / `DISPLAYMODES` / `DISPLAYSET` / `DISPLAYACTIVATE` display-query/control behavior, typed `TRUSTPUT` / `TRUSTLIST` / `TRUSTINFO` / `TRUSTACTIVE` / `TRUSTSELECT` / `TRUSTDELETE` trust-store behavior, persisted `run-script` execution through the framed TCP service seam, and package/app install/list/info/run/delete behavior on the canonical package layout
+- those proofs now cover live ARP request transmission, IPv4 frame encode/decode, UDP datagram encode/decode, TCP `SYN -> SYN-ACK -> ACK` handshake plus payload exchange, dropped-first-SYN recovery, dropped-first-payload recovery, dropped-first-FIN recovery on both close sides, bounded four-way close, bounded two-flow session isolation, zero-window block/reopen, bounded sequential payload chunking, bounded sender congestion-window growth after ACK and timeout collapse back to the initial window, framed TCP command-service exchange, bounded typed batch request multiplexing on one flow with concatenated framed responses, typed TCP `PUT` upload, direct filesystem readback of the uploaded script path, typed `INSTALL` / `MANIFEST` runtime-layout service exchange with `/boot/loader.cfg` readback, typed `PKG` / `PKGLIST` / `PKGINFO` / `PKGRUN` / `PKGAPP` / `PKGDISPLAY` / `PKGDELETE` package-service exchange, typed `APPLIST` / `APPINFO` / `APPSTATE` / `APPHISTORY` / `APPSTDOUT` / `APPSTDERR` / `APPTRUST` / `APPCONNECTOR` / `APPRUN` / `APPDELETE` app-lifecycle exchange with persisted runtime-state readback, persisted history-log readback, persisted stdout/stderr readback, and uninstall cleanup, typed `DISPLAYINFO` / `DISPLAYOUTPUTS` / `DISPLAYOUTPUT` / `DISPLAYMODES` / `DISPLAYSET` / `DISPLAYACTIVATE` exchange including explicit connected-connector activation and mismatched-connector rejection, typed `TRUSTPUT` / `TRUSTLIST` / `TRUSTINFO` / `TRUSTACTIVE` / `TRUSTSELECT` / `TRUSTDELETE` trust-store exchange, selected trust-bundle query/path readback, trust-bundle deletion, post-delete remaining-list readback, canonical package entrypoint readback, package manifest readback, package app-manifest readback, persisted package display-profile readback, package-directory listing, package output readback, live `run-package` display-mode application, explicit `DISPLAYSET` mode change/readback, and TX/RX counter advance over the freestanding PVH image
   - the live package-service extension required a real probe-stack fix: `runRtl8139TcpProbe()` now uses static scratch storage, reducing the project-built bare-metal stack frame from `0x3e78` to `0x3708` bytes before the live QEMU proof would pass with package install/list/run enabled
   - the routed UDP proof now also covers live ARP-reply learning, ARP-cache population, gateway next-hop selection for off-subnet traffic, direct-subnet gateway bypass, and routed UDP delivery with the gateway MAC on the Ethernet frame while preserving the remote IPv4 destination
 - A real DHCP framing/decode slice is now also closed locally:

docs/zig-port/PHASE_CHECKLIST.md

@@ -10,6 +10,7 @@ Registry status:
 - release evidence now also includes `release-status.json` + `release-status.md`, which snapshot package visibility plus the latest `zig-ci` / `docs-pages` / `release-preview` / `npm-release` / `python-release` workflow state for the target tag.
 - `FS5.6` repo-wide license refresh is now strict-closed locally: root/package license files, release evidence, package metadata, and Linux-style SPDX headers now use `GPL-2.0-only` to match the Linux-derived RTL8139 slice.
 - `FS5.5` framebuffer/console strict closure is now reached locally: `src/baremetal/framebuffer_console.zig` programs a real Bochs/QEMU BGA linear-framebuffer path with bounded mode support for `640x400`, `800x600`, `1024x768`, `1280x720`, and `1280x1024`, `src/baremetal/pci.zig` discovers the selected PCI display adapter as structured metadata, exposes the framebuffer BAR, and enables decode on that function, `src/baremetal/edid.zig`, `src/baremetal/display_output.zig`, and `src/baremetal/virtio_gpu.zig` now add the first real EDID-backed controller path over `virtio-gpu-pci` including exported capability flags for digital input, preferred timing, CEA, DisplayID, HDMI-vendor-data, and basic-audio metadata when present plus EDID-derived connector inference, bounded per-output entry export, and bounded resource-create/attach/set-scanout/flush behavior, `src/pal/framebuffer.zig` exposes the surface plus supported-mode enumeration and display-output state through the PAL, host regressions in `src/baremetal/framebuffer_console.zig`, `src/baremetal/virtio_gpu.zig`, `src/baremetal_main.zig`, and `src/baremetal/display_output.zig` prove framebuffer state, display-output state, adapter metadata, supported-mode enumeration, glyph pixel updates, bounded mode switching, present counters, non-zero scanout pixels, connector inference from EDID capability flags, and the output-entry table, and the live QEMU+GDB proofs `scripts/baremetal-qemu-framebuffer-console-probe-check.ps1` and `scripts/baremetal-qemu-virtio-gpu-display-probe-check.ps1` now read back real MMIO banner pixels plus BGA adapter metadata and real `virtio-gpu-pci` EDID/controller capability state with non-zero scanout pixels and validated output-entry metadata over the freestanding PVH artifact; real HDMI/DisplayPort connector-specific scanout paths remain future depth and are not claimed here.
+- Latest FS5.5 display connector activation slice: `src/baremetal/display_output.zig` now retargets the exported active output from bounded per-output entries, `src/baremetal/tool_exec.zig` now exposes `display-activate <connector>` and uses connector-targeted activation in launch profiles, `src/baremetal/tool_service.zig` now exposes typed `DISPLAYACTIVATE`, host/module validation proves successful activation of the connected connector plus explicit mismatched-connector rejection, and `scripts/baremetal-qemu-virtio-gpu-display-probe-check.ps1` now proves the same success/rejection behavior on the live `virtio-gpu-pci` controller path.
 - `FS5.5` keyboard/mouse strict closure is now reached locally: `src/baremetal/ps2_input.zig` has a real x86 port-I/O backed PS/2 controller path (`0x60` / `0x64` status/data/command handling, config programming, output-buffer drain, mouse-byte packet assembly), the PAL input surface remains wired through `src/pal/input.zig`, host regressions in `src/baremetal_main.zig` assert IRQ-driven queue/payload semantics, and the live QEMU+GDB proof plus wrappers (`scripts/baremetal-qemu-ps2-input-probe-check.ps1`, `scripts/baremetal-qemu-ps2-input-baseline-probe-check.ps1`, `scripts/baremetal-qemu-ps2-keyboard-event-payload-probe-check.ps1`, `scripts/baremetal-qemu-ps2-keyboard-modifier-queue-probe-check.ps1`, `scripts/baremetal-qemu-ps2-mouse-accumulator-state-probe-check.ps1`, and `scripts/baremetal-qemu-ps2-mouse-packet-payload-probe-check.ps1`) now fail directly on the mailbox baseline, keyboard payloads, modifier/queue state, mouse accumulator state, and mouse packet payload invariants over the freestanding PVH artifact.
 - `FS5.5` storage/disk strict closure is now reached locally: `src/baremetal/storage_backend.zig` provides the shared backend selector, `src/baremetal/ata_pio_disk.zig` provides a real ATA PIO `IDENTIFY` / `READ` / `WRITE` / `FLUSH` path plus bounded multi-partition MBR/GPT discovery/export, first-usable-MBR and protective-MBR GPT partition mounting with logical LBA translation, `src/pal/storage.zig` plus `src/baremetal/tool_layout.zig` route through that shared backend, `src/pal/storage.zig` now also exports logical base-LBA plus bounded partition count/info/select on the mounted storage view, `src/baremetal_main.zig` exposes that same partition-aware storage seam through the `oc_storage_*` ABI exports, partition selection now invalidates stale tool-layout/filesystem state and is paired with explicit `oc_tool_layout_format` plus `oc_filesystem_format` control on the selected partition, `src/baremetal/disk_installer.zig` seeds the canonical persisted install layout (`/boot`, `/system`, `/runtime/install`, bootstrap package) on the active backend, hosted/host regressions prove backend preference, identify-backed capacity, ATA mock-device read/write/flush behavior, multi-partition MBR/GPT discovery plus explicit selection, logical base-LBA translation, installer-layout persistence, ATA-backed export reporting, direct `oc_storage_*` partition export/selection behavior, rebind-safe tool-layout/filesystem invalidation, and per-partition persistence after switching between primary and secondary MBR partitions, and the live QEMU proofs `scripts/baremetal-qemu-ata-storage-probe-check.ps1` and `scripts/baremetal-qemu-ata-gpt-installer-probe-check.ps1` now boot real MBR and protective-MBR GPT raw images and prove raw ATA block mutation + readback, secondary-partition export/selection through the exported seam, secondary-partition tool-layout formatting + payload persistence, secondary-partition filesystem formatting + superblock persistence, ATA-backed tool-layout persistence, ATA-backed filesystem persistence, GPT-backed installer layout seeding, and persisted bootstrap package execution over the freestanding PVH artifact.
 - `FS5.5` Ethernet-driver strict closure is now reached locally: `src/baremetal/rtl8139.zig` provides the real RTL8139 PCI-discovered bring-up, MAC readout, RX ring programming, TX slot programming, and loopback-friendly datapath validation, `src/baremetal/pci.zig` discovers the I/O BAR + IRQ line and enables I/O plus bus mastering on the selected PCI function, `src/pal/net.zig` and `src/baremetal_main.zig` expose the same raw-frame PAL/export seam, host regressions prove mock-device init/send/receive behavior, and the live QEMU proof `scripts/baremetal-qemu-rtl8139-probe-check.ps1` now proves MAC readout, TX, RX loopback, payload validation, and TX/RX counter advance over the freestanding PVH artifact.