// reference

Versions

Every release, and what each one brought.

1.5.9 — TPM hang guard, quieter early boot & self-exclusion latest release 2026-11-02

Machines that used to freeze now boot, Visor stops listing itself, and the early boot path says where it stopped instead of leaving a 0-byte log.

• TPM hang guard (issue #38) — firmware whose TPM is enabled but unusable could hang forever inside LocateProtocol(EFI_TCG2_PROTOCOL) or GetCapability(). Visor now writes a small VisorTpmStage NVRAM marker before the probe (1, probing) and clears it after (2, done). If a boot finds the marker still at 1, measured boot is disabled for that boot and every boot after it — deliberately, because retrying would make a machine that hangs every Nth boot. Clear /sys/firmware/efi/efivars/VisorTpmStage-9f1c2d34-5a6b-4c7d-8e9f-a0b1c2d3e4f5 to re-enable it, or set tpm=0 permanently. If the marker cannot be stored at all, the probe is skipped instead of run unguarded.
• Validated capability block — the block is prefilled with 0xFF, so firmware that returns success without writing anything cannot pass as a block of zeroes. Size must match the full struct, ManufacturerID must not be 0 or 0xFFFFFFFF, and an empty bank mask only falls back to GetActivePcrBanks() when that call succeeds.
• Early boot diagnostics (issue #8) — Visor no longer touches the console at PE entry; ConOut->OutputString is the first privileged protocol call the image makes and is a plausible hang point. Diagnostic builds still print the earlier line behind EARLY_DIAG=1.
• boot.log checkpoints — the first log write now happens before the first GetTime call, because EnhancedFatDxe stamps file timestamps with GetTime and a hang there can leave a 0-byte log. Four console checkpoints bracket early boot — Visor loading..., Visor: reading boot.conf, Visor: opening boot.log and Visor: log ready, reading the firmware clock — so the last line on screen names the step that died; no line at all means firmware never reached Visor. Two checkpoints were also added around the TPM probe.
• Log failure latching — a failing write, flush or rotation disables file logging for the rest of the boot instead of retrying into the same wedged driver on every line. The failure is reported once on the console and re-printed after the screen clears; rotation failures latch the same way, including a failed re-create after the delete.
• Self-exclusion (issue #44) — Visor no longer offers itself as a boot entry. After discovery, entries whose kernel or EFI path resolves to the running image are dropped across the UKI scan of \EFI\Linux, vendor loader scanning, raw kernel scanning, BLS deployments and explicit entry { } blocks. Matching is per volume (LoadedImage->DeviceHandle, with a partition-UUID fallback for boot.conf entries) and case-insensitive, so an identical path on a second ESP is left alone. BLS/ostree groups lose only the deployment that points at Visor; defaults are renumbered against the pre-prune indices and the group's default command line is carried over. Set exclude_self=0 to restore the old behaviour.
• Autoboot key (PR #39) — new autoboot_key: any (default), none, a printable character or a function key. With autoboot=1 the menu is skipped unless that key is pressed during the countdown. Escape is matched by name again during autoboot, so it interrupts the countdown like every other key.
• USB installation guide (PR #41) — a step-by-step guide for installing Visor on a removable USB drive, including the EFI/BOOT/BOOTX64.EFI fallback path, was added to the docs and linked from the README.
• Packaging — the visor package version now tracks the release tag, and .SRCINFO was regenerated after drifting to 1.5.2.

1.5.8 — Stability, security & boot hygiene 2026-10-26

A hardening release: a safer entry point and file-replacement path, bounds checks across the media decoders, and a rebuilt command-line editor. It also carries the Windows, BLS and Secure Boot fixes merged from PR #37.

• Early startup diagnostics — a new x86_64 entry point writes one line through ConOut before gnu-efi self-relocates the image. Enable it with EARLY_DIAG=1. If the line appears and the machine still freezes, the fault is after console setup; if it never appears, firmware never handed control to Visor. The custom _entry now runs constructors before efi_main and destructors afterwards, matching the gnu-efi contract.
• Boot option editor — full-screen centered card with word wrapping, vertical scrolling, a scrollbar and a visible caret. Long kernel command lines wrap and scroll instead of truncating. Password fields mask input with asterisks and toggle reveal; Home, End and Delete work. The existing card styling and accent colors are kept.
• Menu layout and text — custom and per-entry icon_size values are clamped to two fifths of the shorter screen edge (32–512 px) so an oversized icon cannot push the name row or underline off-screen. Long entry names truncate with an ellipsis; paged-menu chevron spacing is fixed; intro labels, the center-info block, the snapshot header and the version string clip to the available width. When the width is smaller than an ellipsis, the text fitter packs as many characters as fit instead of rendering nothing.
• SHIM_LOCK ABI fix — the Verify function pointer now uses the platform C ABI rather than EFIAPI/ms_abi, because 64-bit shim uses the platform ABI. The mismatch introduced in 1.5.6 could crash or corrupt the call on x86_64.
• MP4 sample-table validation — stsz, stts, stsc, stco and co64 are checked for minimum box size and entry count before any offset is read. Every sample offset and length is bounded against the file size, and the final check is overflow-safe.
• Safer file replacement — efi_file_set_size() and efi_write_file() truncate the destination to zero, write the full buffer, verify the byte count and flush. efi_rename_file() only deletes the old name after the new file is complete, so a partial write leaves the original intact.
• Self-heal hardening — a malformed or oversized BootOrder is left untouched instead of being collapsed to a single Visor entry. A zero-size fallback binary is rejected, and the fallback restore uses the atomic write path, succeeding only after the full write and flush.
• Config parser — empty kernel, initrd or icon values now produce NULL paths instead of resolving to the config directory. A leading #RRGGBB color is no longer eaten as a comment, with or without a space after =, while trailing comments still work. This completes the fix started in PR #24.
• BLS boot counter — after a successful decrement rename the in-memory BLS path is updated, so the next decrement targets the new file.
• GPT scanning — an entry with a non-zero type GUID counts as used even when its LBA range is zero; that case is diagnosed as a half-used entry instead of being silently ignored.
• TPM probe — a missing TCG2 protocol is no longer cached as a negative result, so a protocol installed later in the boot sequence is still discoverable.
• Linux raw handover — handover_offset must fit inside the kernel image (<= source_size - 0x200), preventing an out-of-bounds jump into the kernel stub.
• PNG capture — dimensions above 0xFFFFFFFF are rejected, and row-stride and total allocation arithmetic are checked for wrap before the raw and compressed buffers are allocated.
• HDA cleanup — a DMA map failure, or a mapped address above 4 GiB, now unmaps and frees the allocated buffers immediately. This avoids a leak on the error path and a later double free in hda_cleanup.
• Windows chainload and BootNext (PR #37) — handoff only to a firmware entry on the selected partition; the BootNext marker is skipped when its EFI variable cannot be stored; chainload proceeds after a handoff that did not start Windows. Optional windows_bootnext=1 starts Windows from its firmware entry, and Boot#### variables are named with exactly four hex digits.
• Shim-loaded drivers (PR #37) — when a filesystem driver carries shim's SHIM_LOADED_IMAGE protocol, Visor calls its PE entry point directly so the driver stays resident. shim >= 16's StartImage frees the image when the entry point returns, which left the driver running from freed memory.
• Feature-off LUKS (PR #37) — Linux entries still boot when the luks feature is compiled out; the stub no longer blocks them.
• BLS and ostree (PR #37) — records without an (ostree:N) index sort after indexed ones, and (ostree:0) is treated as the default deployment.
• Secure Boot and SBAT (PR #37) — documentation for shim + MOK, BitLocker and TPM notes, with the MOK signing steps run in a root shell. An .sbat section is embedded in the EFI image.
• Build — the Makefile rebuilds the early-diagnostic object only when EARLY_DIAG changes, and the x86_64 entry point is _visor_start. The AArch64 build is unchanged.

1.5.7 — Boot intro, read-cache drivers & whole-boot recording 2026-10-06

The animated intro handoff, a faster EfiFs driver build, a themed pointer, and a recorder that captures the whole boot.

• Boot intro — intro_media plays a still or clip once before the menu: PNG, BMP, GIF, MJPEG MP4/MOV/M4V or VBG, using the same decoders as animated backgrounds. Any key skips it; intro_auto_continue, intro_duration and intro_action control the handover. An unset, unreadable or undecodable path falls through to the menu. Contributed by @4ceWolf.
• EfiFs read-cache drivers — the installer fetches EfiFs from the Visor fork with a lazily allocated, direct-mapped read cache, cutting firmware block reads on a btrfs image boot from 1165 to 4.
• Themed pointer — cursor image support, with themed pointer assets and the cursor keys documented in the schema.
• Whole-boot recording — recboot records the fade-in, menu and boot to an AVI.
• Clock time sync — clock_sync=1 applies the correction published in \EFI\visor\time.sync; the host side is visor time-sync with --publish, --write-rtc and --install.
• Menu sound volume — menu_sound_volume scales the boot sound from 0 to 100 in software, clamping values above 100.
• Early banner and slow-open logging — Visor prints a banner before loader_mark_init(), so a hang inside the firmware GetTime call is distinguishable from never starting. Slow Open calls are logged.
• Config overread fix — reading a config file without a trailing newline no longer overreads the buffer.
• Tooling — visor convert options are documented in the top-level usage, and PKGBUILD is bumped to 1.5.7.

1.5.6 — Modular builds & the HD Audio fix 2026-09-14

The audio driver leaves the codec in a clean state now — no more static noise after the boot sound while booting Windows or Linux — and corrupt UEFI boot entries are found and fixed instead of ignored. The big one: Visor is now modular. Every optional feature is a named build-time option in a single registry, so you compile exactly the Visor you want, from a tiny text-only menu to everything.

• Modular build — 28 named features in the features/ registry (GUI, fade, blur, clock, pointer, editor, accent, screensaver, animations, capture, file browse, audio, and every boot/security/self-heal piece). Six ready-made profiles: minimal, standard, hardened, ricer, full, custom. Go a la carte with make PROFILE=… FEATURES=-blur,+capture (add/remove flags with dependency checking — you can't cut something another feature relies on), or pick a profile at install/update time. Feature-off builds compile no-op stubs in place of whatever you dropped and still link cleanly.
• HDA audio fix — after the boot sound, the codec was left powered/unsynced and you'd hear a static/hiss during Windows/Linux boot. Teardown now leaves the codec quiet. The driver also adopts a firmware-brought-up controller as-is instead of force-resetting it (guarding inherited codec state), and probing uses a lean 2 ms timeout budget so absent codecs are skipped fast.
• Corrupt boot entry detection — malformed (non-4-digit Boot####) Visor entries are now separate from valid ones; a corrupt entry triggers a fresh valid re-create, visor status reports present (corrupted — run visor update --boot-entry to fix), and visor update --boot-entry is the one-command fix.
• Boot order sanity — self-heal default changed from first to ensure (recreate a missing entry; append it back to BootOrder if removed), and BootOrder rewrites are rate-limited by an ESP stamp file (.selfheal) instead of NVRAM, so firmware/OS reorder wars stop wearing out the store.
• Source tree — src/ is clustered by domain (arch/, audio/, boot/, browse/, capture/, config/, core/, decoders/, gpt/, gui/, security/, text/) with per-feature stubs and 9 internal-only headers; make check-features validates the registry.
• Config & docs — boot.conf.schema.json regenerated with per-key x-feature tags; boot.conf.example updated for boot_order=ensure/selfheal_order=ensure; version bumped to 1.5.6; donations now accepted via Ko-fi.

1.5.5 — HDA audio driver & boot sound 2026-09-08

The built-in Intel HD Audio driver and the menu_sound= boot sound — jack-detecting output selection, a single-plays-and-drains stream, synced with the menu fade-in — plus fixes to animation timing, a stronger VBG encoder, and Visor Studio editing your real, installed config.

• Built-in HDA audio driver — self-contained Intel HD Audio driver (src/audio/hda.c) plays a short sound before ExitBootServices on x86_64 (AArch64 builds get no-op stubs); headphone priority (a plugged-in headphone pin beats the built-in speakers; speakers are the fallback), output pins sharing a converter are muted for the duration, plays once with silence-padded prepared stream that drains to the audible end.
• Boot sound — new menu_sound= key: a 16-bit PCM .wav (max ~4 s, truncated beyond that, resampled to 48 kHz) played once at startup while the menu initialises; on by default but only plays when a path is set; off/0/n/f = silent. Starts at the same instant the menu fade-in begins (sound_start/sound_poll hooks) so picture and audio arrive together.
• Animation timing — a late frame no longer shoves every later frame out: the animation deadline advances by whole frame steps (dropping backlog) instead of re-phasing, so animated wallpapers no longer lurch on slow redraws.
• VBG encoder — stronger default temporal denoiser, and the auto dead-zone is capped so slow, low-contrast motion is no longer frozen out.
• Visor Studio local mode — Studio now hands the editor the actual installed boot.conf (resolved from VISOR_DIR or the ESP via --esp PATH), plus a --native flag to force the local python3+npm runtime when Docker is present (mutually exclusive with --docker).
• Config & docs — menu_sound added to the schema and example config; selfheal_order shown in the example. Feature by @Versedcamel153 for Stream local mode (#31).

1.5.4 — Visor Studio companion & tooling fixes 2026-09-04

Visor Studio — the visual boot.conf configurator — becomes a first-class companion: visor studio runs it locally, install.sh pre-fetches it, and the installer/CLI stop mis-detecting over-mounted ESPs.

• Visor Studio — the official visual boot.conf configurator (Visor Studio) is now a first-class companion. New visor studio command clones, updates (--update), and launches the configurator on http://127.0.0.1:8000 (--port PORT), using Docker when available (single visor-studio container) or a python3 venv + Vite frontend otherwise; --docker forces the Docker path, --detach runs it in the background.
• Offline install — install.sh pre-fetches Visor Studio during install so it runs offline: a --studio/--no-studio flag (or an interactive prompt) clones the companion into the host cache (~/.cache/visor-studio), resolving the real user's home under sudo and handing ownership back.
• Over-mount fix — install.sh and the visor CLI no longer mis-detect over-mounted ESPs: findmnt -U (unique) ignores bind/over-mounts, so the EFI System Partition, its device, and the boot-filesystem type resolve correctly (fix by Tom Hale, #27).
• visor status on unreadable ESPs — reports cleanly when the ESP isn't readable (no sudo): prints unreadable for the installed binary, config and boot log, unknown for the UEFI entry and sha256, and hints to re-run with sudo.
• visor clean --all — also removes the cached ~/.cache/visor source checkout (and the legacy ~/.cache/visor-src path) with per-directory confirmation.
• Credits — Tom Hale for the findmnt -U over-mount fix (#27); Visor Studio built by Farid (BSD-2-Clause).

1.5.3 — GPT repair, self-heal, BLS support 2026-09-02

Fast boots from slow disks and a boot manager that looks after itself: GPT corruption is caught and repaired before it bites, OS updates can no longer silently walk off with the boot entry, and BLS deployments gained proper support.

• GPT corruption detection and repair — at menu startup Visor scans whole-disk block devices for GPT damage; a disk with a valid backup header but a damaged primary gets a warning modal before the menu with confirm (type YES). Rebuilds the primary GPT from the verified backup only when safe; scan runs once per boot instead of on every hotplug poll. Text-mode equivalents: gpt, gpt N, gpt repair N. New boot.conf options: selfheal, boot_order, restore_fallback.
• Boot self-heal — every startup can repair boot-manager damage left by OS updates (Windows and others): missing or reordered NVRAM Boot#### entry and BootOrder (boot_order=first|ensure|off), and a \EFI\BOOT\BOOTx64.EFI fallback path that another OS overwrote (restore_fallback=1). Nothing written when nothing to fix; removable media never touched.
• BLS deployment support — efi/uki efistub and UKI entries are accepted and chainloaded; architecture skips entries for another arch; sort-key groups by ostree index then sort-key; repeated initrd and options lines accumulate in order.
• Booting from slow filesystems — the entry's volume is held open and reused across all reads instead of reopening it four times per boot (#22); the redundant existence re-check is removed. efi_volume_open_count() is logged at handoff; big-file reads (≥ 16 MB) log progress and MB/s.
• Screenshots — F6 saves a PNG screenshot to \EFI\visor\shots; F10 records a GIF/MJPEG animation.
• Config parsing — #RRGGBB colour values are no longer eaten as inline comments: a # inside a value only starts a comment when preceded by whitespace (fix by moeKiwiSAMA).
• Tooling fixes — MP4/MJPEG box parsing validates the full 64-bit-size extension; visor_encrypt.py rejects weak PBKDF2 parameters; visor-snapshot-sync handles comma-containing snapshot descriptions.

1.5.2 — Hardening, interlaced PNG & snapshot watchdog 2026-08-26

A hardening and resilience pass: constant-time crypto on the password path, a watchdog-guarded snapshot scanner that can't freeze on a broken volume, Adam7 interlaced PNG support, and quiet internal cleanup.

• Constant-time password checks — the confirmation field now compares with a constant-time equality function (mem_equal(), now public for any module) so a timing side-channel can't leak against the confirmation buffer.
• Secrets don't linger — the SHA-256 context is zeroed after finalizing so key material isn't left on the stack, and PBKDF2 iteration counts below 100,000 are rejected on decrypt, closing off weak derivation parameters.
• Snapshot scanner won't freeze — auto-detection enforces a per-volume budget of 8 seconds; the watchdog kicks so a hang is attributable to a single volume (#21). The scanner logs each volume as it's scanned and explicitly reports when a volume holds no snapshot instead of silently moving on.
• Interlaced PNG support — the decoder gains full Adam7 support, so images saved by most editors now load correctly as backgrounds and icons instead of falling back to defaults or failing silently.
• Cleanup — efi_strlen16() is one shared implementation instead of three local copies, and efi_fread() drops a redundant clamp that UEFI's Read() semantics made pointless.
• First outside contributor — @Apple-QAQ lands the build fix from 1.5.1, the first contribution from a non-maintainer.

1.5.1 — Build fix 2026-08-24

A one-line patch release: a stale include of a nonexistent version.h in src/include/loader_iface.h broke the build. Removed (767254b, merging #19). Also our first outside contributor ever — @Apple-QAQ — and, on the maintainer's behalf, they'd like you to know they are aware. T_T

1.5 — Clock, screensaver, TPM & Loader Interface 2026-08-24

Polished, measurable and OS-aware: a live clock that ticks for free, an idle screensaver, TPM2 measured boot and full systemd Boot Loader Interface interop — plus VBG wallpapers.

• Live clock — firmware-RTC overlay outside the scene cache (1 Hz band, or every second with clock_seconds=1). Position clock_position (topright … center, hyphen/space tolerant, header-aware), format clock_format (24h/12h), clock_date/clock_date_format (long/iso/dmy/mdy), size, frost (clock_blur) and shadow (clock_shadow), palette role clock via accent_clock/clock_color. See Configuration → Clock.
• Screensaver — two-stage idle: dim to background + clock after screensaver_delay (60 s) then blank to black after screensaver_blank (600 s); any key/pointer wakes and restarts the countdown. Animated wallpapers play while dimmed and idle while blanked. Configure with screensaver (or screensaver=60 shorthand) and screensaver_clock.
• TPM2 measured boot — EFI_TCG2_PROTOCOL HashLogExtendEvent for boot.conf (PCR 5, EV_EVENT_TAG 0xf5bc582a) and the exact cmdline (PCR 12, NUL-inclusive, systemd-compatible), plus LoaderTpm2ActivePcrBanks publishing. Keys tpm/measure, tpm_pcr_config/tpm_pcr_cmdline (0–23).
• Boot Loader Interface — full systemd Boot Loader Interface (GUID 4a67b082-0a4c-41cf-…): publishes LoaderInfo/DevicePartUUID/Entries/EntrySelected/FirmwareInfo/Type/TimeInitUSec/MenuUSec/ExecUSec/Features and honors LoaderConfigTimeout[OneShot] / LoaderEntryDefault/OneShot (OneShot consumed, remember_last defers). Toggle loader_vars/loader_interface.
• VBG animated wallpapers — background= now also MP4/MOV (MJPEG) and compact VBG (tiled-quantized delta + motion compensation, ~10–20× smaller, cheaper to decode). Accent palette still from frame 0; frost blur reused while animating. New host tool tools/vbg_encode.py and visor convert --vbg (also packaged to /usr/share/visor/tools).

1.4 — Animated backgrounds & file browser 2026-08-16

Animated wallpapers, a file browser in both interfaces, and an installer that finally works straight out of an AUR package — plus a round of audit-driven hardening.

• Animated GIF backgrounds — background= accepts GIF as well as PNG and BMP; animated GIFs play full-screen in a loop. A self-contained GIF89a decoder (LZW, frame disposal, loop handling) runs inside the boot manager with bounded memory, the accent palette is taken from frame one, and the frosted-glass panels reuse their blur while the animation plays so the menu stays fast.
• File browser — press B in the graphics menu or run browse in the recovery shell to list every readable volume (boot volume first, labelled by partition UUID) with sizes, directories first, sorted with a merge sort. Enter boots what you pick: a kernel (auto-paired with a sibling initrd*), an initrd, or a .efi chainload — pinned to the volume it was picked from (GUID and volume handle, so MBR sticks behave too).
• Packaged installs — visor install and visor doctor work right after an AUR install, where no source tree exists: install runs from the packaged files (/usr/lib/visor + /usr/share/visor) and doctor understands packaged state. Non-root runs re-exec through sudo with the correct user's home resolved.
• Honest clock — timing now comes from the architecture clock (calibrated TSC on x86, generic counter on ARM) instead of the firmware's periodic timer, which some firmwares never fire; countdowns and animations stay accurate everywhere, QEMU under TCG included.
• Hardening — the PNG decoder validates the zlib header length before allocating against it; the browser no longer force-connects every block controller mid-menu (a real-hardware freeze source), its directory reads are bounded, and the centre-info panel no longer collides with the browser panel.

1.3.3 — Text rendering & packaging 2026-08-06

A rendering and packaging release: menu text is resampled properly at every size, and the installer knows which architecture it is installing for.

• Area-average glyph scaling — glyphs are baked from a 128px master and downscaled by integrating the source coverage each destination pixel actually covers, instead of point-sampling one value per pixel. Thin stems keep their weight rather than dropping out.
• Subpixel positioning — advances are carried in 1/64 px and glyphs render at one of four horizontal phases, so a run of text no longer accumulates rounding error and letter spacing stays even.
• Glyph cache — rasterised glyphs are memoised per (codepoint, size, phase) in a 512-slot table, so the extra filtering happens once per distinct glyph instead of once per draw.
• Installer architecture detection — install.sh derives the target from uname -m (overridable with --arch) and uses it for the build, the binary name, the boot entry and the EfiFs driver suffix. Previously it always installed visor_x64.efi while the driver suffix followed the host, so an ARM64 machine got an x86_64 loader and a mismatched driver.
• Installer output — one scheme for step/OK/warn/error lines, colour only on a TTY (honouring NO_COLOR and TERM=dumb), ASCII fallback outside a UTF-8 locale, and a failed step reports the line and exit status. New flags: --arch, --color, --no-color.
• Arch package tracks releases — the PKGBUILD builds from the tagged release tarball with a real checksum instead of fetching the repository URL as a plain download with verification disabled, and now builds for aarch64 as well as x86_64.
• Config schema — docs/boot.conf.schema.json describes every key the parser accepts (types, defaults, enums, aliases, grouping) as JSON Schema draft 2020-12, generated from src/config.c, as one source of truth for editors, validation and the wiki.
• Void dependency — get.sh and the install page install gnu-efi-libs, the name that actually exists in the Void repository.

1.3.2 — Security & config fixes 2026-08-03

A maintenance release on top of 1.3.1: a scan-scope option, Arch packaging, and hardening fixes across the boot and config paths.

• scan=deep|quick — auto-detection scope: deep opens every exposed filesystem (default), quick only the boot volume, ESPs and XBOOTLDR partitions, falling back to a deep scan rather than an empty menu.
• Arch package — Visor is packaged for the AUR with a proper PKGBUILD/.SRCINFO/visor.install.
• LUKS keyfile alignment fixed — the cpio builder padded to a miscomputed boundary, so a keyfile could sit one byte off the offset the kernel's newc parser expects and silently hand a corrupt passphrase to the initramfs; padding is now computed once and exactly.
• sha256= pins really pin — the pin is verified on the buffer and a pinned entry boots that buffer directly, instead of the firmware re-reading the file by device path (possibly from a different volume).
• PNG decoder stricter — interlaced (Adam7) images and non-standard compression/filter methods are rejected with a clear error.
• Config parser — entry { } blocks tolerate blank lines and comments; duplicate keys keep the last value without leaking; auto-detection no longer overrides an explicit show_names=/center_info=; title_color=#7AA2F7 is no longer read as a comment.
• Per-entry colors — color= accepts an accent role (tertiary, ...) as well as #RRGGBB.
• Unified accent grammar — every color/accent key takes 0/1, a role name, or #RRGGBB; a per-element key beats its group, which beats accent=.
• Hotplug teardown — unplugging media frees the entry's LUKS fields and wipes any typed passphrase from memory.
• Docs — boot.conf.example regrouped into labelled sections with a syntax header; the wiki's configuration page regrouped to match.

1.3.1 — Bug fixes from v1.3 2026-07-30

Targeted fixes for issues found in the field and during testing.

• Snapshot file naming — Visor now falls back to \EFI\visor\snapshot.conf (singular) when snapshots.conf is missing, and logs which name it found so users don't get confused when the V panel has nothing to show.
• Pre-connected USB detection — hotplug now scans volumes that are already present when the menu arms, not just future plugs. Combined with scan_existing, pre-plugged USB sticks appear in the menu without needing to unplug and reinsert.
• Log escape hatch — log=0 is honored before any ESP write, so firmware with a broken ESP write path can still reach the menu and be diagnosed (the boot.log is never created or modified).
• Log rotation — boot.log now preserves prior sessions (keeps the last 3, caps at 128 KiB) instead of deleting and recreating each boot, so early-hang diagnostics survive across reboots.
• Wrong passphrase handling — luks_confirm=1 asks for the passphrase twice and reprompts on mismatch instead of silently booting. luks_verbose=1 removes quiet splash so the initramfs retry prompt is visible when verification fails.
• Password prompt visibility — F2 at the passphrase prompt toggles showing what you typed, so you can verify your keyboard layout before submitting.
• Rescue console from the menu — Esc at the boot menu now opens the options / rescue console (same console as after a failed boot), even when no entry has failed. Esc there returns to the menu.
• Icon auto-detection — auto-detected raw kernels now derive icons from their name (restored v1.2.1 behavior), so entries like vmlinuz-linux show the Linux icon instead of unknown.
• Volume-pinned loading — entries detected on a volume now load their kernel and initrd from that volume's handle, fixing multi-disk setups where the ESP's fallback loader would be found instead of the correct one on the target volume.
• cmdline defaulting — the global cmdline= now only applies to entries that accept a default cmdline (raw kernels). Chainloads and foreign volumes no longer inherit it, so Ventoy-style stick booting works correctly without unwanted root= parameters.
• Secure Boot driver connect — firmware block devices that already expose a filesystem are skipped in the driver connect pass, reducing the delay when Secure Boot is enabled and the unsigned EfiFs driver is refused.
• Menu logo — logo=, logo_mode= (title/only/above/none), logo_size= and logo_gap= draw the bundled \EFI\visor\logo.png (or your own) in the menu header; accent_logo= tints it with the wallpaper palette.

1.3 — Cross-platform, snapshots, hotplug 2026-07-26

The big one: ARM64, wallpaper accent colors, snapshot booting, live USB hotplug, and a pile of real-hardware fixes.

• AArch64 build — make ARCH=aarch64, architecture-neutral GUI core, arch layer for clock and framebuffer write-combining.
• Accent colors — Material You palettes extracted from the wallpaper in fixed-point math, with 7 variants.
• Btrfs snapshot booting — snapper/Timeshift/plain layouts, manifest or direct detection, one-shot boot from the menu.
• Live USB hotplug — sticks appear in the menu with a pop-in animation while it is open, and leave when unplugged.
• Filesystem drivers — EfiFs download/install integrated (pinned + hash-verified), started lazily so the menu stays fast.
• Smarter detection — raw kernels are found alongside UKIs, and detected kernels get an automatic, accurate cmdline (UKI .cmdline → fstab → GPT root partition type).
• Simplified encryption — visor encrypt kernel initrd: one password, ESP install, generated entry with LUKS auto-detection.
• Diagnosable failures — LoadImage status codes logged, Secure Boot rejections named, device-path quirk fallback.
• Hardening — firmware file-size-0 workaround, no config size limits, partition pinning, decode budgets, long-filename handling.

1.2.1 — Firmware fixes 2026-07-18

A field-report release: fixes driven by real machines.

• Raw kernels no longer rejected with "file size is zero or implausibly large" on firmware with broken seek-based size probing (Acer and others) — sizes come from GetInfo() with the seek probe as fallback (#3, #5).
• Auto-detect falls back to chainloading distro loaders (shimx64.efi/grubx64.efi) from \EFI\<vendor>\ when no UKI, BLS entry, or raw kernel is found — fixes Ubuntu-style installs (#6).
• "Visor loading…" prints before log rotation, to help diagnose early-init freezes (#8).
• Size warnings log the value the firmware actually reported; README gained the "Booting from non-FAT filesystems" section (#7).

1.2 — Requested Features 2026-07-03

The community-requests release.

• Encrypted kernel/UKI/initrd support (VISORENC) with tools/visor_encrypt.py.
• LUKS password prompt and initrd keyfile handoff.
• Boot-failure recovery console with log viewer and retry/menu options.
• OSTree/BLS deployment detection, version browsing, and boot-count rollback support.
• autoboot, animation, and fade_speed config options.
• Safety work: boot handoff, file reads, config parsing, PNG/BMP bounds checks.

1.1 — A lot of fixes 2026-06-27

No new features — a hardening release from a full security and stability review.

• Malformed/oversized PNGs rejected cleanly; sane decode limits.
• Filesystem drivers verified under Secure Boot like kernels are.
• NVRAM preferences writable only from Visor at boot, not by a running OS.
• Graceful failure on malformed config and low-memory paths; corrupt kernel handoff headers refused.
• Performance: boot log opened once per boot, faster image assembly, quicker scans.

1.0 — Stable Release 2026-06-24

Rebuilt, cleaned up, and tested across distros.

• Mouse, trackpad, and touchscreen support with click-to-boot.
• Theme rotation (random/cycle) and remember-last.
• Recovery: one-shot cmdline editing with e and auto (recovery) entries.
• Secure Boot awareness (verification before starting images).
• Unified entry { } blocks with automatic boot-method detection; config comments.
• Reliability: shim/GRUB chainloading fixes, firmware compatibility fixes, safer installer.

Where the details live