font: the console draws outlines now, and a byte could not have held Ą

"Ą Ę Ś Ł Ż" drew as "?????" and the obvious diagnosis -- the font has no
glyphs for them -- was wrong twice over. `struct vtcell.ch` was **one byte**
holding a CP437 index, and the console mapped UTF-8 down to it on the way in.
U+0104 does not fit in a byte. No font could have fixed that; the cell had to
get wider first.

So: `ch` is a uint32 codepoint, the mapping on the way in is gone, and the cell
draws through kernel/dev/ttf.c against JetBrains Mono linked into the image.
Cell size comes from the font's measured advance instead of a hardcoded 8x16.
The grid costs 864 KB of BSS instead of 432 KB, which is the honest price of
holding a codepoint per cell for six terminals at 240x75.

The rasteriser needed three fixes before it could be trusted with this.

**21 KB of locals on a 4 KB kernel stack.** `ttf_render` held an outline (512
points as three arrays) and a raster (1024 edges) as automatics. KSTACKSIZE is
4096. They walked off the bottom of the stack into whatever was underneath,
which surfaced as user processes faulting on addresses they never touched and
then a panic inside freevm() on an overwritten page directory. Nothing pointed
anywhere near a font.

**And then again, recursively.** load_outline() held a 4736-byte outline as a
local *and recursed* for composite glyphs. Composite glyphs are exactly Ą, Ę,
Ś, Ł, Ż -- so the second crash arrived the moment the first fix let Unicode
reach the screen, looking like a fresh bug. Now a static outline per recursion
level with a depth cap of 4 (the font's deepest real nesting is 2), and the
leaf parse split into load_simple() so its 512-byte flag array is not
multiplied by the depth. Worst chain measured from the object file: ~2.3 KB.

Neither showed in tools/ttftest, which has an 8 MB stack. That is the standing
hazard of one source file built for host and kernel: the host is most forgiving
about exactly the resource the kernel is strictest about.

**Component transforms were being skipped**, on the stated theory that a wrong
transform is worse than none. It is not. `‘` in this font is the comma glyph
with a scale of -1 -- a 180-degree rotation -- and the offset that ships with
it only lands correctly after the rotation. Without it the mark went twelve
pixels into a ten-pixel cell and was clipped away entirely, so the character
read as missing from the font rather than as misplaced. F2Dot14 2x2 now, with
SCALED_COMPONENT_OFFSET honoured.

The glyph cache was ASCII-only, so every accented letter re-rasterised on every
repaint: a screenful of Polish did hundreds of bezier flattenings per scroll
where the same screenful of English did none. 95 reserved ASCII slots plus 224
shared slots keyed by codepoint, 64 KB pool. Verified 13680 cached renders
byte-identical to direct ones across collisions and a pool flush.

tools/ttftest speaks UTF-8 now. Iterating bytes meant it could only ever ask
for ASCII, and ASCII is entirely simple glyphs -- it could not reach the code
path that mattered.

Also: resolvconf's success line moves behind /proc/bootmode, same rule as
vgpud. A quiet boot opened with "resolvconf: nameserver 10.0.2.3" where the
one line was supposed to be "Welcome to SchOS!". Failures stay loud.

Verified on screen, not just on the host: Ą Ę Ś Ł Ż ć ń ó ź, Ω λ π Œ Ð Æ ß,
∞ ‘x’ → ≤ all render, panic=0 across four boots.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -724,9 +724,10 @@ qemu-iso: schos.iso
 # where a function is, the table is silently wrong for every address, and a
 # debugger that lies is worse than one that says nothing -- so the build stops.
 KERN_LINK = $(BUILD)/kernel/arch/x86_64/entry.o $(KERN_NOENTRY) \
-	    $(BUILD)/kernel/initcode_obj $(BUILD)/kernel/entryother_obj $(RAMDISK_OBJ)
+	    $(BUILD)/kernel/initcode_obj $(BUILD)/kernel/entryother_obj \
+	    $(BUILD)/kernel/consfont_obj $(RAMDISK_OBJ)
 
-$(BUILD)/kernel/kernel.pass1: $(KERNOBJS) $(BUILD)/kernel/initcode_obj $(BUILD)/kernel/entryother_obj $(RAMDISK_OBJ) kernel/kernel.ld
+$(BUILD)/kernel/kernel.pass1: $(KERNOBJS) $(BUILD)/kernel/initcode_obj $(BUILD)/kernel/entryother_obj $(BUILD)/kernel/consfont_obj $(RAMDISK_OBJ) kernel/kernel.ld
 	@mkdir -p $(BUILD)/kernel
 	$(LD) $(LDFLAGS) -T kernel/kernel.ld -o $@ $(KERN_LINK)
 
@@ -772,6 +773,32 @@ $(BUILD)/kernel/ramdisk_obj: $(BUILD)/fs-ram.img
 	    --redefine-sym _binary_build_fs_ram_img_size=_binary_ramdisk_size   \
 	    $@
 
+# The console font, linked into the kernel.
+#
+# In the kernel image rather than loaded from disk, because the console has to
+# work before there is a disk: a panic during boot has to be readable, and the
+# only alternative is keeping the 8x16 bitmap around for early messages and
+# switching later, which means two fonts and a seam where they disagree.
+#
+# 115 KB of kernel for every glyph in a modern font is a trade this makes
+# gladly. The 8x16 bitmap it replaces is CP437 -- 256 glyphs, no Ą, no Ę, no Ś,
+# no Ω -- and they did not render as something wrong, they rendered as `?`,
+# because a codepoint the grid could not hold was mapped to one.
+#
+# JetBrains Mono is SIL OFL 1.1, which permits this and requires the name be
+# kept; see NOTICE. The regular static weight, not the variable font -- a
+# variable font needs `fvar`/`gvar` interpolation, which ttf.c does not do and
+# which would render every glyph at the wrong weight without saying so.
+CONSFONT = ports/JetBrains_Mono/static/JetBrainsMono-Regular.ttf
+
+$(BUILD)/kernel/consfont_obj: $(CONSFONT)
+	@mkdir -p $(BUILD)/kernel
+	$(LD) -r -b binary -m elf_x86_64 -o $@ $<
+	$(OBJCOPY) \
+	    --redefine-sym _binary_$(subst .,_,$(subst /,_,$(subst -,_,$(CONSFONT))))_start=_binary_consfont_start \
+	    --redefine-sym _binary_$(subst .,_,$(subst /,_,$(subst -,_,$(CONSFONT))))_end=_binary_consfont_end     \
+	    $@
+
 # AP startup blob
 $(BUILD)/kernel/entryother: kernel/arch/x86_64/entryother.S
 	@mkdir -p $(BUILD)/kernel