Jihad-Browser/docs/ENGINE-SOURCE.md

Engine Source & Modifications (MPL-2.0 compliance)

cavekit-licensing-branding R3 / R4 — engine origin, patches, and branding strip. Brought up to date 2026-10-08 (it had listed four patches under old names).

Jihad Browser renders with the UXP / Goanna web engine (MPL-2.0). This document records the engine's origin and every modification made to it, so the MPL-2.0 obligation to keep modified files under the MPL with their source available is met.

Origin

• Upstream: UXP — https://repo.palemoon.org/MoonchildProductions/UXP, pristine at the release RB_20261027 (6b18be917d462369593bfe611230a7003fd7d945, 2026-10-26) — UXP_TAG / UXP_BASE in build/engine/engine-version.env. (Until 2026-11-03: RB_20261006, 5f290d1, 2026-10-04; until 2026-10-12: master b2594a4, 2026-06-30.)
• Our modified engine: the branch jihad/uxp-RB_20261027 of the fork NotAlexNoyle/UXP-Jihad, at UXP_PIN (52ad9ab66ebbc1c28133a330ee2f35819565d61e), present in this repository as the submodule third_party/uxp. The device build compiles that tree.
• The modifications as patches: build/desktop/patches/ holds every change as a patch against UXP_BASE. build/engine/patch-queue.sh --check proves the patches, applied in order, produce exactly the UXP_PIN tree. How the two are kept in step: docs/ENGINE.md §2.

Modifications to the engine (all MPL-2.0, source here)

Every modified UXP file stays under the MPL-2.0. These patches are the source of the modifications; the same changes are the commits of jihad/uxp-RB_20261027, one per patch.

Patch	Files	What it changes
0001-js-format-overflow.patch	js/src/jit/x64/BaseAssembler-x64.h	GCC 9: source pragma for -Wformat-overflow (js/src re-escalates it)
0002-configure-warnings.patch	build/moz.configure/warnings.configure	GCC 9: warnings.configure adjustment
0003-gfx-init-and-omtc.patch	gfx/thebes/gfxPlatform.cpp, gfx/thebes/gfxPlatformGtk.cpp, toolkit/xre/nsEmbedFunctions.cpp	JIHAD_DISABLE_OMTC forces the in-process BasicLayerManager; gfx started inside XRE_InitEmbedding2
0004-gtk-headless-guards.patch	widget/gtk/gtk2drawing.c, widget/gtk/nsLookAndFeel.cpp, widget/gtk/nsNativeThemeGTK.cpp	GTK realize/theme/look-and-feel paths guarded so libxul runs with no X server
0005-puppetwidget-offscreen-zoom.patch	widget/PuppetWidget.cpp, widget/PuppetWidget.h	PuppetWidget offscreen render, zoom and damage tracking; the jihad_offscreen_* exports
0006-headless-toolkit.patch	embedding/components/printingui/moz.build, gfx/2d/2D.h, gfx/2d/Factory.cpp (+19 more)	MOZ_WIDGET_TOOLKIT=headless: gfxPlatformHeadless, widget/headless, build wiring
0007-nss-mainthread-marshal.patch	security/manager/ssl/nsNSSComponent.cpp	NSS EnsureNSSInitialized main-thread fast path; the jihad_init_nss export
0008-plugin-headless-nativehandle.patch	dom/plugins/ipc/PluginInstanceChild.cpp, dom/plugins/ipc/PluginInstanceParent.cpp, dom/plugins/ipc/PluginMessageUtils.h	NativeWindowHandle for the headless platform so plugin IPC compiles
0009-misc-headless.patch	ipc/chromium/src/base/message_loop.cc, toolkit/xre/nsXREDirProvider.cpp	Headless build fixes (message loop, XRE directory provider)
0010-branding-strip.patch	docshell/base/nsAboutRedirector.cpp, modules/libpref/init/all.js, toolkit/xre/nsAppRunner.cpp	Pale Moon / Basilisk / Moonchild branding stripped (cavekit-licensing-branding R3)
0011-appcompat-guid.patch	xulrunner/configure.in, xulrunner/confvars.sh	The AppCompat GUID (xulrunner configure)
0012-popup-instrumentation.patch	layout/xul/nsXULPopupManager.cpp	XUL popup instrumentation and offscreen compositing of popups
0013-xpi-install-embedding.patch	toolkit/mozapps/extensions/AddonManager.jsm, toolkit/mozapps/extensions/amInstallTrigger.js	AddonManager / amInstallTrigger work without a browser element
0014-badcertlistener-embedding.patch	docshell/base/nsDocShell.cpp, embedding/browser/nsDocShellTreeOwner.cpp	Certificate errors reach the embedder (bad-cert listener)
0015-find-embedder-no-jscontext.patch	embedding/components/find/nsWebBrowserFind.cpp	Find-in-page without a JS context
0016-npapi-windowless-headless.patch	dom/plugins/base/nsNPAPIPlugin.cpp	NPAPI windowless plugins under the headless toolkit
0017-npapi-webos-palm-host.patch	dom/plugins/ipc/JihadNPNInterpose.cpp, dom/plugins/ipc/PluginInstanceChild.cpp, dom/plugins/ipc/PluginInstanceChild.h (+2 more)	The webOS (Palm) NPAPI host: NPEvent union, JihadNPNInterpose
0018-npapi-child-process-loader.patch	ipc/glue/GeckoChildProcessHost.cpp	The plugin child process launched through our loader
0019-bhm-null-manager-guard.patch	xpcom/threads/BackgroundHangMonitor.cpp	BackgroundHangMonitor null-manager guard
0020-npapi-composite-without-imagebridge.patch	dom/plugins/ipc/PluginInstanceParent.cpp	Plugin compositing without ImageBridge
0021-npapi-windowless-invalidate-offscreen.patch	dom/plugins/base/nsPluginInstanceOwner.cpp	Windowless plugin invalidation into the offscreen widget
0022-npapi-recvshow-copy-frameid.patch	dom/plugins/ipc/PluginInstanceParent.cpp	Plugin RecvShow copies the frame id
0023-npapi-operational-logging.patch	dom/base/nsObjectLoadingContent.cpp, dom/plugins/base/nsNPAPIPlugin.cpp, dom/plugins/base/nsPluginHost.cpp (+5 more)	Plugin operational logging
0024-npapi-webos-plugin-input.patch	dom/plugins/base/npapi.h, dom/plugins/base/nsPluginHost.cpp, dom/plugins/base/nsPluginHost.h (+6 more)	webOS plugin input, the frozen plugin YAP commands, the frame path
0025-npapi-pmlog-named-semaphore-abi.patch	ipc/app/moz.build, ipc/contentproc/JihadPmLogSem.c, ipc/contentproc/moz.build (+1 more)	PmLog named-semaphore ABI shim for the plugin container
0026-npapi-plugin-repaint-rate.patch	dom/plugins/ipc/PluginInstanceChild.cpp	Plugin child repaint rate (frame clock)
0027-npapi-plugin-cpu-boost.patch	dom/plugins/ipc/PluginModuleParent.cpp	CPU boost while a plugin plays
0028-npapi-plugin-frame-seq.patch	dom/plugins/ipc/PluginInstanceParent.cpp	Plugin frame counter export (jihad_plugin_frame_seq)
0029-npapi-plugin-pull-frame.patch	dom/plugins/ipc/PPluginInstance.ipdl, dom/plugins/ipc/PluginInstanceChild.cpp, dom/plugins/ipc/PluginInstanceChild.h (+1 more)	Plugin frames pulled from the daemon's clock (JihadRequestFrame IPDL)
0030-cubeb-pulse-webos-virtual-sink.patch	media/libcubeb/src/cubeb_pulse.c	cubeb Pulse: the webOS virtual sink (JIHAD_PULSE_SINK)
0031-npapi-JIHAD_PLUGIN_SELF_DRIVE-0-turns-the-plugin-chi.patch	dom/plugins/ipc/PluginInstanceChild.cpp	JIHAD_PLUGIN_SELF_DRIVE=0 turns the plugin child's own repaint timer off
0032-videocontrols-fix-scrubber-flicker-settle-interpolat.patch	toolkit/content/widgets/videocontrols.xml	Video controls: scrubber flicker and settle, interpolated thumb
0033-videocontrols-surface-media-errors-for-audio-only-co.patch	toolkit/content/widgets/videocontrols.xml	Video controls: media errors shown for audio-only content
0034-cubeb-classify-media-streams-export-a-playing-stream.patch	media/libcubeb/src/cubeb_pulse.c	cubeb: media.role classification; jihad_pulse_active_streams export
0035-gfx-BasicPlanarYCbCrImage-CopyData-must-not-report-f.patch	gfx/layers/basic/BasicImages.cpp	gfx: BasicPlanarYCbCrImage::CopyData no longer reports failure under delayed conversion
0036-extensions-a-link-or-navigation-to-an-.xpi-must-reac.patch	toolkit/mozapps/extensions/amContentHandler.js	A link or navigation to an .xpi reaches the install flow without a browser window
0037-plugins-an-instance-with-no-window-to-be-given-is-wi.patch	dom/plugins/base/nsPluginInstanceOwner.cpp	A plugin instance with no window is windowless instead of a null dereference
0038-plugin-container-do-not-hand-the-bundled-library-pat.patch	ipc/contentproc/plugin-container.cpp	plugin-container does not hand the bundled library path to what the plugin runs
0039-addons-an-add-on-naming-both-the-AppCompat-GUID-and-.patch	toolkit/mozapps/extensions/internal/XPIProvider.jsm	XPIProvider: an add-on naming the AppCompat GUID and the toolkit matches the entry that fits
0040-gpu-compositor-an-in-process-OpenGL-compositor-behin.patch	gfx/layers/client/ClientPaintedLayer.cpp, gfx/layers/composite/LayerManagerComposite.{h,cpp}, gfx/layers/ipc/CompositorBridgeParent.{h,cpp}, gfx/layers/opengl/CompositingRenderTargetOGL.{h,cpp}, gfx/layers/opengl/CompositorOGL.{h,cpp}, gfx/layers/opengl/TextureHostOGL.cpp, gfx/thebes/gfxPlatform.cpp, gfx/thebes/gfxPlatformHeadless.{h,cpp}, gfx/thebes/gfxPrefs.h, modules/libpref/init/all.js, widget/PuppetWidget.{h,cpp}	T-502: with JIHAD_GPU_COMPOSITOR set, an in-process OpenGL compositor (an EGL pbuffer, two renderbuffer window targets) behind the offscreen widget, pulled a frame at a time by the daemon (jihad_offscreen_compose_start/_poll/_forget, jihad_offscreen_compositor_seq, jihad_offscreen_set_view); the layer tree's own diff drives band readbacks and scissored partial composites; the window's flipped view kept and the rows reversed in the read; tiled content layers on by default (layers.enable-tiles); the read thread, the GPU swizzle pass and the snapshot road are opt-in (docs/RENDERING-OPTIONS.md); nothing changes without the env
0041-gl-the-Adreno-220-whole-texture-uploads-BGRA-uploads.patch	gfx/gl/GLContext.{h,cpp}, gfx/gl/GLContextEGL.h, gfx/gl/GLContextProviderEGL.cpp, gfx/gl/GLTextureImage.{h,cpp}, gfx/gl/GLUploadHelpers.cpp	GLRenderer::AdrenoTM220; CanUploadSubTextures() false for the Adreno 2xx "(TM)" spellings and the 220 (a sub-image update costs 16x a whole upload); an EGL context prefers BGRA uploads where GL_EXT_texture_format_BGRA8888 exists, with GLES-legal types (4x faster than RGBA when the GPU is idle); GLContextEGL::JihadCreateSharedContext (a 1x1 pbuffer context sharing the compositor's objects, for a readback thread); fresh texture names per upload opt-in (JIHAD_GPU_FRESH_TEX=1)
0042-gpu-compositor-the-card-s-scroll-applied-in-the-comp.patch	gfx/gl/GLContext.h, gfx/gl/GLContextEGL.h, gfx/gl/GLContextProviderEGL.cpp, gfx/layers/LayerTreeInvalidation.{h,cpp}, gfx/layers/Layers.cpp, gfx/layers/composite/AsyncCompositionManager.{h,cpp}, gfx/layers/composite/LayerManagerComposite.{h,cpp}, gfx/layers/ipc/CompositorBridgeParent.{h,cpp}, gfx/layers/opengl/CompositorOGL.{h,cpp}, layout/base/FrameLayerBuilder.cpp, layout/base/nsDisplayList.cpp, layout/base/nsLayoutUtils.cpp, layout/generic/nsGfxScrollFrame.cpp, widget/PuppetWidget.{h,cpp}	T-502: the card's scroll applied by the composition manager as APZ would (root scroll metadata and the scrollport as a scroll clip for a root scroll frame with a displayport, the displayport set from layout, no intermediate surface for a scaled container); the context's pbuffer at the frame's size (the Adreno 220 bins an FBO render by the surface's size); scroll-only frames composed band by band on their own 768x256 pbuffer and FBO with the row shift behind the GPU; a done-fd that wakes the daemon when a job finishes; the diff treats the root-content layer's scroll as a shift and is scaled to frame pixels
0043-npapi-the-Palm-event-paths-only-where-npapi.h-define.patch	dom/plugins/ipc/PluginInstanceChild.cpp, dom/plugins/base/nsPluginHost.cpp	T-387: the Palm gain-focus system event and the spotlight export built only where npapi.h defines Palm's NPEvent (the headless toolkit the device builds), so the desktop GTK engine builds again for the desktop tests; the desktop spotlight export returns 0
0044-gpu-compositor-tile-textures-converted-at-1x1-and-ke.patch	gfx/gl/GLTextureImage.{h,cpp}, gfx/layers/opengl/CompositorOGL.cpp	T-504: on the GPU path a new tile texture is converted while it is 1x1 (a framebuffer clear and a 1x1 write) and a texture image's texture goes to a pool instead of being deleted: the Adreno 220 converts a texture's storage on its first write after its first draw (~18 ms a 256x256 tile, measured in tools/device/gpu-bench.c sections 12-15), which every new tile paid on its first change
0045-gpu-compositor-no-edge-antialiasing-for-an-axis-alig.patch	gfx/layers/opengl/CompositorOGL.cpp, gfx/layers/ipc/CompositorBridgeParent.cpp	T-504: on the GPU path an axis-aligned scale gets no edge antialiasing (its shader variants compiled on first use, ~150 ms each, in the first frame of a zoom); JIHAD_GPU_PHASES also logs each slow composite's phases and each slow draw
0046-gpu-compositor-the-root-scroll-frame-s-clip-widened-.patch	layout/base/nsLayoutUtils.{h,cpp}, layout/generic/nsGfxScrollFrame.cpp	T-505: jihad_layout_set_overscan widens the root scroll frame's clip on the GPU path by the rows the daemon's frame carries above and below what the card shows (overscan), so the card has content to pan into between frames
0047-gpu-compositor-a-given-up-frame-writes-nothing-test-.patch	gfx/layers/ipc/CompositorBridgeParent.cpp, gfx/layers/opengl/CompositorOGL.{h,cpp}, widget/PuppetWidget.cpp	T-509: a compose job the daemon forgot writes nothing into its slot (cancelled); test switches JIHAD_GPU_TEST_NO_EGL (no GL context, as an EGL failure) and JIHAD_GPU_TEST_STALL (a job held 6 s)
0048-gpu-compositor-the-frame-s-paint-and-its-compose-pos.patch	widget/PuppetWidget.{h,cpp}	T-515: the frame's layer paint (jihad_offscreen_paint_layers, the main thread) and its compose job (jihad_offscreen_compose_post, any thread, at a view and scroll it is given) apart, so the daemon's express lane composes and publishes frames while the main thread runs the page's script; the job list under a mutex (a poll without a wait holds it throughout); jihad_offscreen_compose_peek (a job's state without its result); a forgotten job's cancelled flag only with abandoned
0049-layers-a-composite-acknowledged-after-the-widget-is-.patch	gfx/layers/client/ClientLayerManager.cpp	T-515: DidComposite returns when the widget is gone (a card closed while a compose job it had asked for was waited out; its acknowledgement reached the main thread after the page was torn down: SIGSEGV at 0)
0050-gpu-compositor-every-compose-job-compose-and-read-on.patch	widget/PuppetWidget.cpp, gfx/layers/ipc/CompositorBridgeParent.cpp, gfx/layers/opengl/CompositorOGL.cpp	T-516: with JIHAD_GPU_TIMELINE=1 every compose job, compose and read logged with a timestamp on the daemon's clock (otherwise sampled), so a slow frame's time can be placed
0051-webgl-contexts-on-the-device-s-GPU-on-the-GPU-path-s.patch	dom/canvas/WebGLContext.cpp, dom/canvas/WebGLContextValidate.cpp, widget/headless/GfxInfo.cpp, gfx/gl/GLContextEGL.h, gfx/gl/GLContextProviderEGL.cpp, gfx/gl/SharedSurface.cpp, gfx/layers/client/ClientCanvasLayer.cpp	T-511: WebGL on the GPU path asks EGL for its context (the headless default provider is null) and is not blocklisted there (headless GfxInfo); the Adreno 220's GL_INVALID_ENUM for GL_STENCIL_BACK_WRITEMASK queried in its own error scope; every pbuffer context on the GPU path in one share group under a 1x1 root, a WebGL canvas handing the compositor its texture (SurfaceFactory_GLTexture, zero copy; JIHAD_GPU_NO_SHARE=1: unshared, read back through a canvas-sized pbuffer); a context released from its thread before it is destroyed (the next teardown faulted in libGLESv2)
0055-gpu-compositor-a-band-frame-s-regions-composed-in-on.patch	gfx/layers/composite/LayerManagerComposite.{h,cpp}, gfx/layers/ipc/CompositorBridgeParent.cpp	T-517: a band frame's bands and column chunks composed as regions of one composite (JihadSetRegions: the transaction and BeginFrame/EndFrame once, per region its world, Prepare and RenderLayer); JIHAD_GPU_PASS_PER_REGION=1 as before
0056-layers-a-tile-wholly-outside-the-clip-is-not-locked-.patch	gfx/layers/composite/TiledContentHost.cpp	T-517: a tile whose transformed bounds miss the clip (in the render target's coordinates) is skipped before its texture is locked and bound; JIHAD_GPU_NO_TILE_CULL=1 for A/B
0057-gpu-diagnostics-off-by-default-behind-JIHAD_GPU_LOG-.patch	gfx/2d/JihadGpuLog.h (new, exported), gfx/2d/moz.build, the GPU path's files in gfx/gl, gfx/layers, layout/base/nsLayoutUtils.cpp, widget/PuppetWidget.cpp	T-512: the [jihad-gpu] diagnostics behind one gate (JIHAD_GPU_LOG=1, or a device round's JIHAD_GPU_TIMELINE/VERIFY/DUMP_EVERY), failures and fallbacks unconditional; T-517: the page's layer transactions and every compose job's tile uploads on JIHAD_GPU_TIMELINE
0058-gpu-compositor-the-review-of-Tier-87-fixed-scratch-p.patch	gfx/gl/GLContextProviderEGL.cpp, gfx/layers/composite/AsyncCompositionManager.{h,cpp}, gfx/layers/ipc/CompositorBridgeParent.cpp, gfx/layers/opengl/CompositorOGL.{h,cpp}, gfx/layers/opengl/TextureHostOGL.cpp, widget/PuppetWidget.cpp	T-513: the review of Tier 87 (context/impl/impl-review-findings-gpu-2.md E1-E7 and Codex's C1): the band scratch is each compositor's own (two cards shared one and overran it); a closed card's frame-sized and band pbuffers and the window targets', band target's and swizzle pass's GL objects are freed (16 MB of GPU memory a card before); a band frame of 257-320 rows stacked in the frame-sized target makes that surface current first; a WebGL canvas's texture name is the producer's to delete; the reads carry their request's cancel flag (JihadSetCancel), so a read given up past the daemon's bound stops after glReadPixels and never copies into the slot, on the opt-in scratch, swizzle and read-thread paths too, counted by jihad_offscreen_late_writes(); a frame whose chunks pass the 12-band cap takes the whole path; a sticky layer's stuck probe reaches twice the composite's scroll step
0059-layout-the-GPU-path-s-root-displayport-and-clip-at-a.patch	layout/base/nsLayoutUtils.cpp, layout/generic/nsGfxScrollFrame.cpp	T-524: once the pres shell has a resolution the root's displayport base and clip are layout device px: jihad_layout_set_displayport2 takes the card's shift and gives the base and margins times the resolution, and the root's display-list clip (the scroll port) is no longer divided by it (desktop Wikipedia at 2.33: the card's right third white, nothing past 479 CSS px hit-testable)
(0060 until 2026-11-03: security-the-built-in-roots-rolled-forward-to-UXP-release, T-529's certdata.txt from the release branch at 037cc5f614)	security/nss/lib/ckfw/builtins/certdata.txt	DROPPED at the move to RB_20261027 (the owner, 2026-11-02): the tag ships that very file (byte-identical: [NSS] Update certdata to Sept 2026 status 4a68bbbd53 and [NSS] Remove emSign roots (eMudhra compromise) 037cc5f614 are in the base), so the built-in roots are the base's; audit-roots.py checks them against it. The patches after it moved up one number
0060-security-a-certificate-error-is-not-TLS-intolerance-.patch	security/manager/ssl/nsNSSIOLayer.cpp	T-534: a SEC_ERROR_* / mozilla::pkix / bad-cert-domain failure is never retried at a lower TLS version (the retry tripped a TLS 1.3 server's downgrade sentinel and a revoked certificate read "SSL_ERROR_RX_MALFORMED_SERVER_HELLO")
0061-layout-the-GPU-path-s-root-displayport-base-is-the-d.patch	layout/base/nsLayoutUtils.{h,cpp}, layout/generic/nsGfxScrollFrame.cpp	T-527: on the GPU path the root's displayport base set by the daemon (0059's jihad_layout_set_displayport2) is kept by the paint (nsLayoutUtils::JihadKeepsDisplayPortBase): nsLayoutUtils::PaintFrame's DecideScrollableLayer replaced it on every paint with the composition size at the origin in CSS px, and a zoomed-in card's first paint without margins covered 660 of the 531..861 CSS px shown (docs/rounds/t527-2026-10-25/notes.txt)
0062-gpu-compositor-a-tall-band-surface-for-a-change-that.patch	gfx/gl/GLContextEGL.h, gfx/gl/GLContextProviderEGL.cpp, gfx/layers/ipc/CompositorBridgeParent.cpp, gfx/layers/opengl/CompositorOGL.{h,cpp}	T-527 (R8): a change that does not fit the 256-row band surface takes a second, 512-row band surface (JIHAD_GPU_BAND_TALL, its own pbuffer and target) instead of the frame-sized target; frames are packed for the band surface first. The 480 px WebGL cube's job 15-30 ms where it took ~45
0063-widget-a-GPU-path-layer-paint-with-nothing-pending-i.patch	widget/PuppetWidget.{h,cpp}, layout/base/nsLayoutUtils.cpp	T-527: the daemon's layer paint returns at once after the first when nothing is pending (no invalid region, no paint task, no view-manager flush owed): the display list is not built again for nothing (JIHAD_GPU_PAINT_ALWAYS=1: every time); a moved displayport base schedules the root's paint (the margins' comparison saw no change). Desktop Wikipedia's pan 23.6 fps and the long page's 33.1, verify 0 rows wrong: the compositor thread stays the bound
0064-gpu-compositor-a-band-surface-that-cannot-be-made-at.patch	gfx/layers/opengl/CompositorOGL.{h,cpp}	T-527 (review): a band surface or its target that cannot be made at a width is not made again every band frame (a line each into /var); the frame's own surface does the pass
0065-widget-the-layer-paint-skip-repaints-after-a-resolut.patch	widget/PuppetWidget.{h,cpp}, gfx/layers/opengl/CompositorOGL.{h,cpp}	T-527 (review 2026-10-26): 0064's skip repaints when the pres shell's resolution differs from the one painted (SetResolution schedules no paint, and a page with no root scroll frame — about:addons — stayed at the old resolution after a zoom across 1.1) and asks the whole widget chain (invalidations land on the child); 0065's failed band surface is tried again after 30 s
0066-gpu-compositor-a-compose-that-asks-for-its-bands-onl.patch	widget/PuppetWidget.cpp, gfx/layers/opengl/CompositorOGL.h, gfx/layers/ipc/CompositorBridgeParent.cpp	T-516: compose flag 16 — read only the bands asked for, not the rows the tree changed (still reported); the daemon's first frame at a new zoom reads the card's view alone (942 of 1224 rows): double taps by finger 40/40 within 250 ms, the slowest 227 ms where 276-301
0067-gpu-compositor-a-frame-s-fixed-and-stuck-rects-go-ba.patch	widget/PuppetWidget.{h,cpp}, gfx/layers/opengl/CompositorOGL.h, gfx/layers/ipc/CompositorBridgeParent.cpp	T-544: jihad_offscreen_compose_poll2 returns a frame's fixed and stuck rects with its poll; the daemon passes them to the card (JihadStuckBlock), which holds desktop Wikipedia's sticky sidebars still between frames of a pan (they moved with the page and jumped back)
0068-gpu-compositor-the-overview-s-windows-and-parts-the-.patch	widget/PuppetWidget.cpp, gfx/layers/opengl/CompositorOGL.{h,cpp}, gfx/layers/ipc/CompositorBridgeParent.cpp, gfx/layers/composite/AsyncCompositionManager.{h,cpp}	T-504: compose flags 32 and 64 (jihad_offscreen_overview_ok) — an overview window (fixed and stuck layers at opacity 0, cleared transparent, read with its alpha, so rows no tile covered read alpha 0) and the overview's parts (only the fixed and stuck layers, with their alpha); a fixed sticky probe for both, and the verify guard keeps the probe's state; the daemon stitches a half-size picture of the page around a zoom-in point for a double tap out after a pan
0069-gpu-compositor-a-frame-without-its-parts-flag-128-an.patch	widget/PuppetWidget.cpp, gfx/layers/opengl/CompositorOGL.h, gfx/layers/ipc/CompositorBridgeParent.{h,cpp}, gfx/layers/ipc/CompositableTransactionParent.cpp	T-505: compose flag 128 (jihad_offscreen_overview_ok answers 2) — a frame without its parts: every fixed and sticky layer at opacity 0 in the composite and the diff, no fixed rows, keeps or columns, each part reported as its layer's whole rect; the parts' generation (compositable updates under a fixed or sticky layer) as the poll's thirtieth int; JIHAD_GPU_REQLOG=1 names each composite request's source
0070-gpu-compositor-the-diff-leaves-the-card-s-scroll-out.patch	gfx/layers/ipc/CompositorBridgeParent.cpp	T-505: the diff leaves the card's scroll out of a frame with no base to copy (built on its slot's own frame) too, kept only when the shift it measured is the card's since the last composite; a layer transaction during a pan is no longer the whole frame changed for such frames
0071-gpu-compositor-the-parts-picture-in-the-frame-s-own-.patch	widget/PuppetWidget.{h,cpp}, gfx/layers/opengl/CompositorOGL.{h,cpp}, gfx/layers/ipc/CompositorBridgeParent.{h,cpp}, gfx/layers/composite/LayerManagerComposite.{h,cpp}	T-505 (E2): jihad_offscreen_compose_post2/start2 (overview_ok answers 3): a frame without its parts reads the parts' picture in its own job when their signature (layers, content, attributes, sizes) is not the daemon's — the parts alone, packed on the band surface, read with their alpha; the poll's 49 ints (signature, the pass's bytes, flags: a content layer above a part / too big, the card's hold set); no column reads without the parts; 0071 only without the parts or without fixed rects
0072-gpu-compositor-a-frame-without-its-parts-composes-th.patch	gfx/layers/composite/LayerManagerComposite.{h,cpp}, gfx/layers/ipc/CompositorBridgeParent.{h,cpp}	T-505: a frame without its parts reads the changed rows whole, so its diff-driven partial composite covers them across the frame's width (JihadWholeRows; the columns beside a narrow change used to be the window target's last composite: the long page's wrong verify frame, 2026-11-02); the inspector's review fixes: one sample time per job, fixed rects joined again after the reduction, the parts' signature over a cut part's slice, every part's clip and mask, blend modes as covered; the parts pass under the job's cancel flag
0073-gpu-compositor-the-parts-picture-by-part-each-rect-i.patch	gfx/layers/ipc/CompositorBridgeParent.{h,cpp}, gfx/layers/ipc/CompositableTransactionParent.cpp, gfx/layers/opengl/CompositorOGL.h, widget/PuppetWidget.{h,cpp}	T-505 (the owner's "cheaper part pictures", 2026-11-03): each rect of a frame's parts list carries a signature of its own (its outermost fixed or sticky layer's subtree, every subtree layer's last paint as the stamp of one counter that only goes up — every compositable update stamps its layer, part or not — the part's scale and quarter-pixel phase, where it sits inside the rect and its size; a rect no part's rect meets takes every part's with its index and place); jihad_offscreen_compose_post3/start3 (overview_ok 4) take the list of signatures the daemon holds and the pass composes and reads only the rects not in it, packed in rect order; the poll's 54 ints carry each rect's signature and the rects read. The whole signature keeps post2/start2's meaning. The inspector's review 3 (F2, F3, F6) folded in
0054-gpu-compositor-kept-rects-all-saved-before-any-is-wr.patch	gfx/layers/opengl/CompositorOGL.cpp, widget/PuppetWidget.cpp, dom/canvas/WebGLContext.cpp, widget/headless/GfxInfo.cpp	T-517/T-511 review: a window-moved shift saves every kept rect before writing any; jihad_offscreen_gpu_given_up() / jihad_gpu_compositor_on(), so WebGL makes no EGL contexts once the daemon has given the GPU path up
0053-gpu-compositor-a-shift-that-is-the-daemon-s-window-m.patch	gfx/layers/opengl/CompositorOGL.{h,cpp}, widget/PuppetWidget.cpp	T-517: a compose job's shift may be the daemon's move of the frame's window in its segment (flag 8): the rows are in place, only the kept rects are copied from where they were
0052-gpu-compositor-the-frame-s-bands-read-as-one-column-.patch	widget/PuppetWidget.{h,cpp}, gfx/layers/ipc/CompositorBridgeParent.cpp, gfx/layers/opengl/CompositorOGL.{h,cpp}	T-511: a compose job may give its bands' stale columns (flag 4); with no shift, kept rows or fixed columns, the bands are read as the one column the change and they span when it is under three quarters of the width; the poll reports the change's columns (twelve ints); JIHAD_GPU_NO_COLUMN_READ=1 reads whole rows

The move to RB_20261027 (2026-11-03)

update-engine.sh RB_20261027 / --finish (docs/ENGINE.md §6): 12 upstream commits since RB_20261006, 11 files, one overlapping the queue (certdata.txt, patch 0060, byte-identical — dropped, above). The owner's word (2026-11-02): the certificate and HTTPS changes get special attention. Each commit and its disposition:

Upstream commit	What it changes	Disposition
037cc5f614 [NSS] Remove emSign roots (eMudhra compromise)	security/nss/lib/ckfw/builtins/certdata.txt	certificate: taken with the base; the device had it since 2026-10-25 through patch 0060 (now dropped); audit-roots.py 0 findings against the base
4a68bbbd53 [NSS] Update certdata to Sept 2026 status	certdata.txt	certificate: the same
6b18be917d [js] Avoid OOB array copy	js/src/vm/SelfHosting.cpp	memory safety: taken; the desktop JS-driven tests and the device checklist
d42616bb12 Remove the URI_LOADABLE_BY_ANYONE flag from the jar: protocol	modules/libjar/nsJARProtocolHandler.cpp	security hardening: taken; Jihad's own jar: pages (about:settings, about:personas, the start pages, the add-on pane) checked on the device
bae7a6ec8f [gfx] Prevent feTile rect calculations from overflowing	gfx/2d/FilterNodeSoftware.cpp	memory safety: taken; an SVG filter page on the device
8fea2ad823 [layout] Ensure frame table is valid after adjusting selection	layout/generic/nsSelection.cpp	memory safety: taken; selection on the device
c4339b14dc Use strong ref for animation mutation observer batch targets	dom/base/nsDOMMutationObserver.h	memory safety: taken
e86caa48f5 [XPCOM] Lock during nsComponentManager memory reports	xpcom/components/nsComponentManager.{h,cpp}	taken
5762097bc2 Update SQLite lib to 3.54.1	db/sqlite3/src/sqlite3.{c,h}	taken; cookies and history across the update checked on the device
612a8991df, 38e09d2368, 5c991eadc0 the executable extensions list	xpcom/io/nsLocalFileWin.cpp	Windows only: no effect here

No PSM, TLS protocol, HSTS or certificate-UI change is in the range; Jihad's TLS floor (patch 0060, formerly 0061) and the Trust dialog's error gate apply unchanged.

Branding strip (cavekit-licensing-branding R3) — patch 0010

Part of the engine branch since the patch series was committed (patch 0010; it was once a sed step in build-goanna.sh). The UA product is already Goanna (netwerk/protocol/http/nsHttpHandler.cpp mProduct); this removes the residual Pale Moon / Basilisk / Moonchild strings so a strings(1) scan of the shipped artifacts is clean:

File	Change
modules/libpref/init/all.js	extensions.blocklist.url (basilisk-browser.org) → about:blank; captivedetect.canonicalURL (detectportal.palemoon.org) → example.com; two comment URLs neutralized
docshell/base/nsAboutRedirector.cpp	about:credits target (palemoon.org Contributors) → the Jihad credits URL
toolkit/xre/nsAppRunner.cpp	dead MOZ_APP_NAME == "basilisk"/"palemoon" literals (always false for the xulrunner app) → "n/a" — behavior identical, literals removed

How the strip is verified, and its result, is an acceptance criterion — context/kits/cavekit-licensing-branding.md R3. The check itself is a strings scan of libxul.so, jihad-browserserver and goanna.js for basilisk/palemoon/moonchild.

Trademark note

Per the UXP redistribution terms, an engine build shipped under a name other than Pale Moon / Basilisk must strip that project's branding. "Jihad Browser" is the product name of this fork and implies no endorsement by any upstream. See the top-level LICENSE for the full component/license breakdown and the Apache-2.0 ↔ MPL-2.0 compatibility statement.