fix: an unparsable COCOON_MACOS_LOG_LEVEL prints its error before the exit

cmd/root.go

@@ -23,10 +23,11 @@ import (
 // Execute runs the cocoon-macos CLI.
 func Execute() {
 	ctx := context.Background()
-	logger := log.WithFunc("cmd.Execute")
 	if err := setupLog(ctx); err != nil {
-		logger.Fatalf(ctx, err, "setup log")
+		fmt.Fprintf(os.Stderr, "setup log: %v\n", err)
+		os.Exit(1)
 	}
+	logger := log.WithFunc("cmd.Execute")
 	// run() owns the signal context + its deferred cleanup, so os.Exit never strands a pending defer
 	if err := run(ctx); err != nil {
 		logger.Error(ctx, err, "command failed")
@@ -73,12 +74,8 @@ func resolvePaths(cmd *cobra.Command, _ []string) error {
 	return nil
 }
 
-// setupLog swaps stderr in because SetupLog binds whatever os.Stdout is at call time.
 func setupLog(ctx context.Context) error {
 	level := cmp.Or(os.Getenv("COCOON_MACOS_LOG_LEVEL"), "info")
-	origStdout := os.Stdout
-	os.Stdout = os.Stderr
-	defer func() { os.Stdout = origStdout }()
 	return log.SetupLog(ctx, &types.ServerLogConfig{Level: level, UseJSON: !stderrIsTerminal()}, "")
 }
 

docs/e2e.md

@@ -36,7 +36,7 @@ Args: `--real` (run `[DUMMY]` then `[REAL]`), `--real-only` (skip straight to `[
 (skip the root/bridge `--net` auto-create rows), `cleanup` (tear down and exit). Env vars beyond
 `CM_BIN` / `CM_HOME` / `CM_OPENCORE` / `CM_OVMF_CODE` / `CM_OVMF_VARS`: `CM_BRIDGE` (test bridge for
 `--net tap|bridge`, default `cmsmoke0`), `CM_TAHOE_REF` (ghcr ref for `[REAL]`), `CM_SSH_PORT` (host
-port forwarded to guest `:22` in `[REAL]`, default `2299`). The `[REAL]` tier also needs `sshpass`.
+port forwarded to guest `:22` in `[REAL]`, default `2299`). The `[REAL]` tier also needs `qemu-system-x86_64`, `socat` and `sshpass`.
 
 The `[DUMMY]` tier is the behavioral gate today's CI structurally can't give (CI is pure `go test` /
 `vet` / build — nothing opens `/dev/kvm` or mutates netlink); it belongs on a privileged self-hosted

docs/image-pipeline.md

@@ -10,8 +10,8 @@ separately on a KVM testbed, keeping image and Go CI apart.
 
 ## `macos` — which OS
 
-`macos` selects the OS to build and where it lands on ghcr (the build script derives
-`MACOS_SHORTNAME` / `GHCR_REPO` / `GHCR_TAG` from it):
+`macos` selects the OS to build and where it lands on ghcr (the workflow derives
+`MACOS_SHORTNAME` / `GHCR_REPO` / `GHCR_TAG` from it, and the build script reads them):
 
 | `macos` | fetch-macOS shortname | ghcr repo:tag |
 |---------|-----------------------|---------------|

docs/networking.md

@@ -100,4 +100,4 @@ VNC shows a blank white/black screen with just the cursor even though the guest
 WindowServer is up). It is *not* a GPU/driver problem — a mouse move repaints it. The golden image's
 first-boot daemon runs `pmset -a displaysleep 0 sleep 0 disablesleep 1` system-wide (covering the
 pre-login loginwindow and disabling system sleep too) to keep the framebuffer painted; older images
-need a `setup`-stage rebuild. See also the GPU/video note in [Boot, Firmware & GUI](vm.md).
+need a `setup`-stage rebuild. See also the GPU/video note in [Known Issues](known-issues.md).

docs/roadmap.md

@@ -6,7 +6,7 @@
   yet wire to QEMU; port it the same way as networking (Linux-tagged, reusing cocoon types):
   - **Hardware passthrough (VFIO)** — cocoon's `extend/vfio` (`vfio.Spec`/`Attacher`, BDF/sysfs) and
     `cmd/vm device attach`. Maps to QEMU `-device vfio-pci,host=<BDF>` for GPU/NIC passthrough — the real fix
-    for hardware-accelerated video (see [Boot, Firmware & GUI](vm.md)).
+    for hardware-accelerated video (see [Known Issues](known-issues.md)).
 - **GUI boot-to-desktop** — finish the Setup-Assistant mouse/OCR click-through so `:26` boots straight
   to `cocoon`'s desktop with auto-login (see [Boot, Firmware & GUI](vm.md)).
 

qemu/launch.go

@@ -90,7 +90,7 @@ func (s Spec) Args() []string {
 	case s.Tap != "":
 		a = append(a, "-netdev", "tap,id=net0,ifname="+escapeOptValue(s.Tap)+",script=no,downscript=no")
 	case s.SSHPort > 0:
-		a = append(a, "-netdev", fmt.Sprintf("user,id=net0,hostfwd=tcp::%d-:22", s.SSHPort))
+		a = append(a, "-netdev", fmt.Sprintf("user,id=net0,hostfwd=tcp:127.0.0.1:%d-:22", s.SSHPort))
 	default:
 		a = append(a, "-netdev", "user,id=net0")
 	}

qemu/launch_test.go

@@ -15,7 +15,7 @@ func TestArgsNetModes(t *testing.T) {
 		want   string
 	}{
 		{"user-mode without ssh-port is bare SLIRP", func(_ *Spec) {}, "user,id=net0"},
-		{"user-mode with ssh-port adds hostfwd", func(s *Spec) { s.SSHPort = 2222 }, "user,id=net0,hostfwd=tcp::2222-:22"},
+		{"user-mode with ssh-port forwards a loopback port", func(s *Spec) { s.SSHPort = 2222 }, "user,id=net0,hostfwd=tcp:127.0.0.1:2222-:22"},
 		{"tap attaches to the pre-created TAP", func(s *Spec) { s.Tap = "tap0" }, "tap,id=net0,ifname=tap0,script=no,downscript=no"},
 	}
 	for _, tt := range tests {