main
425 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Chris Tate
|
bd3aab4b48 |
feat(canvas): add reusable code component (#235)
* feat(canvas): add reusable code component - Add highlighted code surfaces with optional line numbers and horizontal scrolling. - Route Markdown fences through Code while preserving indentation and first-line list alignment. - Cover the markup API with tests, documentation, previews, and changelog fragments. * fix(canvas): preserve multiline code rendering * fix(canvas): bound code layout capacity * fix(canvas): bound code span retention * fix(canvas): address code component review feedback * fix(canvas): polish code block rendering * fix(canvas): address remaining code review feedback * fix(canvas): preserve long code rendering * fix(canvas): preserve numbered code selection * fix(canvas): fold long span selections * fix(canvas): preserve empty code and paged selection * fix(canvas): address code rendering review findings * fix(canvas): resolve remaining code review issues * fix: bound transformed code rendering |
||
|
Chris Tate
|
6a871356b4 |
ci: harden Windows canvas snapshot reads (#234)
- Retry structural snapshot reads that race frame publication. - Preserve Wine caption-offset geometry for reliable textbox input. |
||
|
Chris Tate
|
c1bad63c5f |
chore: prepare v0.6.3 release (#233)
- Sync all CLI, core, platform, and example version references to 0.6.3. - Merge the textarea fixes into the marked v0.6.3 changelog entry.v0.6.3 |
||
|
Chris Tate
|
3636af4b45 |
fix: improve textarea editing shortcuts (#231)
* fix: improve textarea editing shortcuts - Align Command and vertical arrow navigation with native multiline behavior. - Add bounded undo and redo while keeping controlled text buffers synchronized. - Cover retained runtime and markdown-viewer editing paths. * fix: harden textarea editing behavior * fix: harden textarea editor lifetimes * fix(canvas): harden textarea history and navigation * fix textarea wrap navigation and macOS undo menu * fix textarea navigation and history edge cases * fix textarea reconciliation failure atomicity * fix(runtime): make canvas text history replay transactional * fix: preserve textarea indentation and shift-click selection * fix: harden textarea navigation and selection * fix: harden textarea caret boundaries * fix: harden textarea history and CRLF editing * fix(canvas): keep carets outside CRLF boundaries * fix(core): keep CRLF edits atomic * fix(canvas): preserve CRLF editing boundaries * fix(canvas): match native selection navigation * fix(runtime): reroute compound textarea history events * fix(runtime): normalize reconciled CRLF selections * fix textarea left navigation across soft wraps * Fix IME history across CRLF boundaries |
||
|
Chris Tate
|
ef1f8d9cdd |
chore: prepare v0.6.2 release (#230)
- Bump CLI, core, and platform package versions to 0.6.2. - Merge overlay and container background notes into the release changelog. - Credit release contributors and rotate release markers.v0.6.2 |
||
|
Chris Tate
|
868d0116b0 |
feat: support reliable desktop overlay windows (#228)
* feat: support reliable desktop overlay windows - Add transparent, always-on-top, click-through, and passive-show window options across manifests and runtime APIs. - Apply overlay state before first visibility on macOS, Windows, and Linux, including first-present reveal behavior. - Cover the contract with runtime tests, SDK typings, documentation, and a changelog fragment. Co-authored-by: Jason Kneen <502002+jasonkneen@users.noreply.github.com> * fix: honor desktop overlay window options * fix: harden desktop overlay window presentation * fix: preserve overlay activation and alpha * Fix overlay window presentation * fix: correct overlay focus and transparency * fix: keep overlay windows sourceless * fix: use current GTK CSS loader * fix: make transparent overlays honest * fix(macos): preserve transparent canvas fallback * fix(windows): preserve transparent resize hit testing * fix(macos): activate before making window key * fix(linux): own transparent window CSS provider * fix: let transparent overlays idle * fix: keep transparent overlays canvas-only * fix(macos): activate app before focusing window --------- Co-authored-by: Jason Kneen <502002+jasonkneen@users.noreply.github.com> |
||
|
Chris Tate
|
d866d922eb |
Fix layout container background rendering (#227)
- Paint explicit stack, row, and column backgrounds before their children. - Preserve configured corner radii in tree and retained-layout emission. - Cover all three container kinds with regression tests. Co-authored-by: Sepehr Safari <25853688+sepehr-safari@users.noreply.github.com> |
||
|
Chris Tate
|
a7509a7fa6 |
chore: prepare v0.6.1 release (#214)
- Sync CLI, core, platform, and example package versions to 0.6.1. - Merge pending fixes into the marked v0.6.1 release notes and credit contributors.v0.6.1 |
||
|
Chris Tate
|
ea98365a2d |
fix: sync pointer text selections to model (#213)
- Route pointer caret and selection changes through on-input. - Cover workbench address deletion with an end-to-end regression. - Update session replay expectations and changelog. |
||
|
Chris Tate
|
7b5b226fb2 |
ci: parallelize native example coverage (#212)
- Split native example tests across four build-graph-backed CI shards. - Run the Windows web-layer audit in parallel while preserving the aggregate required check. |
||
|
Chris Tate
|
5f48ec3f67 |
fix: respect layered webview cursors (#211)
- Yield macOS GPU cursor regions to higher-layer embedded webviews. - Prevent canvas cursor updates from overriding WebKit link and text cursors, with regression coverage. |
||
|
Chris Tate
|
514ce820da |
chore: prepare v0.6.0 release (#210)
- Sync CLI, core, platform, and example package versions to 0.6.0. - Merge pending fragments into the marked v0.6.0 release notes. - Credit release contributors and retire the v0.5.4 markers.v0.6.0 |
||
|
Chris Tate
|
db34c23ea5 |
fix: sync webview focus with canvas panes (#209)
* fix: sync webview focus with canvas panes - Report native webview focus changes across macOS, Linux, and Windows. - Preserve and journal canvas focus state with a workbench pane regression. * fix: sync CEF webview focus - Report actual Chromium browser focus through the shared runtime event. - Guard stale child generations and cover the CEF host seam. |
||
|
Chris Tate
|
daefe82106 |
fix terminal macOS shortcuts (#208)
* fix terminal macOS shortcuts - Map Option/Cmd navigation and Cmd+Delete to shell-native sequences. - Route Cmd+V through the bracketed-paste-aware terminal input path. - Add runtime and example regressions for modified keys and paste. * fix terminal key release handling on macOS |
||
|
Chris Tate
|
4c3fb0bc30 |
fix: add terminal copy/paste context menu (#207)
* fix: add terminal copy/paste context menu - Present standard Copy and Paste actions for terminal widgets. - Route emulator selections to the clipboard and pasted text to PTY input. - Add regression coverage and a changelog fragment. * Fix terminal context menu paste handling |
||
|
Chris Tate
|
a43855001a |
fix: hide workbench terminal focus rule (#206)
* fix: hide workbench terminal focus rule - Blend the full-bleed terminal focus ring into the pane while preserving autofocus. - Pin the styling with a workbench regression and document the user-visible fix. * fix: reflect terminal focus in cursor * fix: complete terminal focus handling * fix terminal cursor keyboard ownership * fix: preserve terminal keyboard focus on Windows |
||
|
Chris Tate
|
a0947a227d |
fix: keep terminal Tab input in the PTY (#204)
* fix: keep terminal Tab input in the PTY - Keep focus on active terminal components while routing Tab and Shift+Tab to the PTY. - Prevent focus-entry keys from reaching the shell and add router plus live-session regressions. * fix: preserve terminal Tab traversal boundaries * docs: clarify terminal Tab gesture handling |
||
|
Chris Tate
|
d84536d04a |
Fix terminal text selection (#203)
- Add drag, word, and line selection backed by Ghostty's tracked cell model. - Copy active terminal selections without forwarding the clipboard chord to the child. |
||
|
Chris Tate
|
beb1d8712a |
Compiled-core parity: every core fixture built externally and proven against the transpiler (#197)
* Add per-fixture compiled-core parity batteries and contract staging - PairedCore lockstep module: a fixture's e2e battery runs over both lanes, byte-comparing commands, snapshots, subscriptions, channels, and helpers per cycle - build.zig gains env-gated test-compiled-core-parity (per-fixture archive/sidecar pairs) and stage-core-contracts for external toolchains - paired roots are generated from each transpiled module's own export surface, so channel detection never goes stale * Compile the ai-chat core with an external toolchain and pass its battery - adds a hand-authored adapter entry, core profile, shared wire codec, and a static restatement of the core module for library-mode compiles - build_core.sh stages author sources with specifier resolution, readonly-array erasure, and byte-alias folding, then records cold and warm compile times - ai-chat update always returns the [model, cmd] tuple and api.ts iterates bytes by index * Compile the host fixture's core externally and pass its full battery - hand-authored host-fixture adapter and profile: 53 arms, four record payloads, the boot command, and the model-gated timer subscription - the fixture's update returns the [model, cmd] tuple on every arm - staging drops any SDK type alias the author's own sources declare; the mirror conversion walk raises its comptime branch budget * Corpus cores return the [model, cmd] pair on every update path - soundboard and system-monitor update signatures drop the bare-model union arm; every return carries an explicit Cmd - behavior is unchanged: the paths that produced no command now say Cmd.none * Compile the soundboard core externally and pass its battery - hand-authored soundboard adapter and profile: 19 arms, 35 model helpers, the chrome and env channels, and the frame/key channel ABI entries - channel ABI entries take flat parameters and answer the contract's channel flags through their export suffixes, listed after the unconditional exports - staging spells the SDK's event and text records as object-literal aliases so host-constructed channel arms carry value-stored records * Compile the system-monitor core externally and pass its battery - hand-authored system-monitor adapter and profile: 25 arms, 23 model helpers, the boot probe command, and the chrome channel - the sample sorts are explicit stable insertion sorts and the byte scans index instead of iterating, both lanes over one source * Compile the markup fixture's core externally and pass its battery - Add the markup adapter, profile, and build_core.sh case: the corpus's first three-function-channel core (frame, key, and pinch). - Add the markup compiled-core battery entry, the mirror image of the host one: the markup core pairs, the host fixture rides transpiler-only. - Return the [model, cmd] pair on every markup update path so the contract's shape flags read from a declared return type. |
||
|
Chris Tate
|
2209f022ee |
Live <terminal> sessions, and examples/workbench: a terminal beside a browser (#198)
* Bring libghostty-vt back behind a consumer-safe terminal_vt seam
- The framework module imports terminal_vt everywhere: a ghostty-vt wrapper where the dependency is safe to traverse, a stub (enabled=false) elsewhere
- Root builds resolve a lazy ghostty pin gated on being the build root, so consumers running this build script as a dependency never touch ghostty's graph
- Apps opt in via addAppArtifacts .ghostty_vt with their own pin; scaffolded builds keep the stub and stay free of harfbuzz/translate_c
* Live <terminal> sessions: the runtime-owned emulator behind a bound pty key
- terminal_session.zig: per-pty-key libghostty-vt sessions publishing resolved TerminalGrid snapshots, with the example tier's lossless outbound ring, query-answer write-back, key encoding, and theme-derived palette promoted into the runtime
- The effects engine grows a pty delivery tap (live drain and replay feed alike), so emulator state derives from exactly the journaled stream; outbound bytes ride the journaled ptyWrite verdict path
- The app loop installs the builder's terminal grid lookup, reconciles cols/rows from each element's laid-out frame into ptyResize, applies the scrollback source-wins echo, routes focused keys/IME text and wheel scrollback to the session, and dispatches on-terminal states
* Terminal session store tests: the element contract at the store seam
- Lookup-driven session creation, fed output as resolved cells, stdin-ordered write-back (keys, text, DSR answers), retained-ring flush, resize reconcile, scrollback source-wins, respawn reset, and wide-cell spacer backgrounds
- Fix the snapshot sizing multiply: @min against a comptime bound refines its result type, so the product needed explicit widening
* The terminal emulator is an app-owned pin, opted into per app
- Replace AppOptions.ghostty_vt with terminal_sessions: bool; the framework resolves the app's own lazy ghostty pin with the app module's target/optimize and the safe flags, so an app asks for live <terminal> sessions with one field instead of threading a module
- Drop the ghostty pin from this package's build.zig.zon: a pin here materializes into every consumer's package directory even when lazy and unused (measured 27 packages / 585 MB in a scaffolded app's package dir, now zero), so the toolkit's own builds always carry the terminal_vt stub
- Add src/terminal_session_tests_root.zig so an emulator-wired app build can run the session store's tests, which skip in this package's own suite
* examples/workbench: a live terminal beside a browser in one split
- Add the workbench example: a <split> with a <terminal pty={key}> pane and a browser pane (back, forward, reload, address bar), app-owned navigation history, and a hidden-inset titlebar with per-pane drag bands
- The app spawns a shell with fx.ptySpawn and binds the key in markup; no emulator wiring, key encoding, or grid plumbing lives in the app
- Register test-example-workbench, whose build also runs the runtime session store's tests since this build wires the emulator
* Document live terminal sessions and how a build opts in
- Terminal docs: the runtime owns the emulator behind a bound pty key, plus an "Enabling live sessions" section covering the app-owned lazy pin, terminal_sessions = true, and the terminal_sessions_enabled flag apps can gate tests on
- Add the changelog fragment for the live sessions, the opt-in emulator, and the workbench example
* Workbench: the shell owns the keyboard when the window opens
- Mark the terminal element autofocus, so typing lands in the live session without a click first — a terminal window's keyboard belongs to its shell
* Terminal runs measure the face they actually ink with
- Derive the cell width from a 16-glyph mono probe divided by its length — the advance a merged run walks — and leave it unrounded, so glyphs stay on the cells the painter's backgrounds, cursor, and selection draw from
- Carry the measurement seam on each run: a command's raster extent is its own declared bounds, and the estimator's 0.6 em mono pitch falls short of a wider host face (macOS resolves the mono id to the system monospaced face at 0.618 em when Geist Mono is absent), which sheared a full-width row's last cell to a two-pixel sliver
- Cover both with a painter test that paints a full-width row against a wide-pitch provider and asserts every run's bounds hold its ink
* Workbench README: what the divider drag does to focus
- `stty size` named as the visible proof that the pty re-grids with the pane
- the divider keeps the keyboard after a drag; clicking the terminal returns it
|
||
|
Chris Tate
|
cce5359d5b |
corewire --profile: the library-mode compiler profile beside the facade (#196)
* Facade channel entries take the wire shape; the packer becomes nsc_core_pack_msg
- Each wired channel now exports a wire-shaped entry mirroring the ABI
header's C declaration (bytes as buffers, u8 modifier booleans, the
pinch phase as its declaration-order member index) that builds the
event record, runs the channel-function gate, and packs the result.
- The produced-message-or-null packer moves to one export,
nsc_core_pack_msg, freeing the nsc_core_<channel>_msg names for the
wire shapes; conformance drives both surfaces.
- Wired channels fence their new facade declarations (event records,
channel-function names, PinchPhase) against type-table collisions.
* corewire --profile emits the library-mode compiler profile
- emit_profile.zig projects the sidecar into the profile JSON: the abi
block's mode symbols, an export map binding every attested facade
export to its marshalled signature (wire-shaped channel entries
included), and the contract-sidecar section with echoed generations
and identity-getter symbols.
- The determinism block carries the SDK policy as release-pinned data:
deny-fences over the ambient surfaces with teachings naming the
sanctioned Cmd/Sub routes, the shared async teaching, and trap
remediations; emission is deterministic byte-for-byte.
- main.zig grows --profile beside --out/--facade with the same staging,
alias nets, and check-runs-everything discipline.
* Facade slices spell plain arrays; flattened records stay undeclared
- Sequence types spell T[] (the declaration site's readonly already pins
immutability; the readonly-array operator has no contract projection).
- Single-use synthesized records flatten into their one arm literal and
no longer take an interface or a named encoder, keeping the
synthesized names free for consumers that re-derive them.
- The pinch wire entry's export-map signature drops a stray f64: six
parameters, six marshalling classes.
* Name the string constraints by their enforcer in the profile test comment
- The teachings/remediations comment points at the loader's rules
instead of restating provenance.
* Profile and facade carry the whole contract a library-mode consumer reads
- Export-map names keep the facade's fixed nsc_core_ spellings while
symbols take the contract's prefix; the profile's entry is the facade
path made relative to the profile's own directory, refusing pairs
with no relative spelling; --profile alone runs the facade emitter's
refusal checks.
- Facade entry stubs carry the contract's declared shapes (cmd-returning
init/update return the [state, effect] tuple, subscribing contracts
declare the subscriptions stub), the unbound facts also ride the split
modelUnbound/msgUnbound consts, and the appearance/chrome/env channel
conventions ride exported consts; the transpiler passes the split
unbound pair through unemitted like viewUnbound.
- The determinism fence table pins to the 0.0.11 surface manifest: the
wall clock (stdlib.date., perf_hooks.) and the process family join
with teachings naming the journaled clock and host-delivered inputs.
* Harden the split-const, entry-path, and profile-string edges
- The transpiler refuses a modelUnbound/msgUnbound constant that is not
a string-literal list: the names are reserved contract vocabulary, and
a data const under them would emit references without a declaration.
- The facade fences the split unbound names only when their consts
actually declare, so a contract type under either spelling projects
whenever no collision exists.
- The profile's relative-entry resolution carries the environment map
(drive-relative spellings resolve against the drive's own working
directory), and a non-UTF-8 entry spelling refuses with a teaching
before it can corrupt the JSON, with an emitter-side backstop.
* Declaration forms spell record storage; path and slot edges pinned
- The facade declares node-stored records as interfaces and value-stored
records as object-literal type aliases, and the transpiler's type
table learns the alias form (a struct exactly like an interface, with
storage still decided by the promotion walk) — a contract emitter
re-deriving storage from declaration form now lands on the contract's
own classes.
- Profile-relative entry spellings convert separators only on Windows
(a POSIX backslash is a filename byte), and the emitter's
release-pinned note records why integer-slot declarations stay
absent: the pinned prover demands inline wholeness proofs at every
construction of a slot-declared shape and does not trust classed-slot
reads, refusing spread updates, structural twins, and the facade's
own constructors alike.
* Unbound vocabulary, singleton unions, and storage edges hold both ways
- The checker refuses references to viewUnbound/modelUnbound/msgUnbound
as module data (the build reads them without emitting, so a reference
would name a missing declaration), symbol-resolved to the module
consts.
- A bare kind-tagged object literal classifies as a one-arm tagged
union, never a struct holding a textual kind.
- The facade fences viewUnbound only when the const declares, refuses a
record referenced by node and value at once (one declaration cannot
state both storages), and refuses a host-constructed channel arm
whose named record cannot flatten into the arm the host fills.
* Reserved-list references resolve by symbol; alias records stay whole
- The reserved-const reference check resolves through import aliases and
shorthand value symbols, catching a renamed binding or `{ modelUnbound }`
by what it declares rather than its spelling; the split pair joins the
entry-only export set and the rename guard.
- Object-literal aliases classify as structs only when every member is a
plain record property (identifier-named, annotated, non-optional);
quoted or optional properties refuse as unsupported aliases instead of
registering a struct with silently missing or wrongly required fields.
- A kind-tagged shape with an optional discriminator is no union: the
source permits the untagged value, so the shape refuses instead of
projecting a mandatory tag.
* Alias form pins value storage in promotion; false attestations refuse a profile
- markPromotions reads declaration form: an object-literal alias keeps
its by-value layout however the Model reaches it (the alias spelling
IS the value-storage form), while interfaces stay with the
reachability walk; pinned with the value/pointer pair test and the
emitted Zig compiles with a by-value model record.
- The profile is enforcement data, so a contract attesting
deterministic: false or async_free: false refuses emission with a
teaching naming the attestation — a compile under the fences attests
true by construction, and emitting would move the contradiction
downstream.
- The transpiler test suite gains pins for the alias/singleton/split-
const behaviors landed this branch.
* Value-record aliases refuse the shapes value storage cannot carry
- NS1061 teaches the whole family at check time: the model root stays
an interface, a model-kept alias holds scalar fields only (heap-backed
fields would dangle across frame resets under the shallow commit),
model arrays carry reference-stored records, identity comparison over
a value record refuses (no reference to compare), and an alias that
reaches itself by value refuses (no finite layout).
- Scalar aliases the model keeps directly and heap-carrying aliases
outside the model tree stay clean; pinned across all six shapes in
the checker suite.
* Entry roots keep their contract shapes; by-value recursion and wrapped identity refuse
- NS1062 teaches at check time when Model does not declare a record or
Msg does not declare a kind-tagged union, whatever declaration form
produced the wrong shape (a plain object alias, an interface Msg, or
a tagged singleton Model), instead of failing inside the emitted
module's dispatch and commit machinery.
- The by-value recursion walk covers every by-value node — value
records and tagged unions alike — so a singleton union reaching
itself refuses; arrays still break cycles by indirection.
- The identity-comparison guard unwraps union operand types and follows
plain type aliases, so a nullable or alias-wrapped value record
refuses the same as a bare one.
* Presence checks pass the identity guard; optional arms and class roots refuse
- The value-record identity guard fires only when BOTH comparison sides
can carry a record at once: a nullable presence check compares the
option and stays exact, so generated optional encoders and idiomatic
null gates compile.
- An optional payload property keeps a shape out of the kind-tagged
union classification (the source permits the absent member while the
emitted arm would demand it; absence spells | null), so the Msg root
teaches instead of requiring an unrepresentable payload.
- The entry-root shape rule covers class declarations: a class named
Msg is a struct and refuses with the union teaching.
* Flattening stays a value move; the root seeds node storage; assertions cannot shed identity
- Synthesized single-use records inline only when referenced by VALUE:
a node-stored payload keeps its named declaration and pointer in both
projections, however its name is spelled.
- The model root seeds the node-stored set (reference storage by
contract), so a value reference to it refuses as mixed storage
instead of re-deriving as node downstream.
- The identity guard's other-side test is structural: an
assertion-erased operand still counts as a record, so shedding the
alias name cannot slip a value-record comparison past the teaching.
* Integer-fixture envelopes pack through nsc_core_pack_msg
- The mixed-class envelope test drives the packer under its own name
and adds the wire-shaped key entry's nothing-produced route, so the
integer fixture exercises both channel surfaces.
* Identity peels assertions; record writes, inert lists, and skewed splits refuse
- The value-record identity guard types the peeled operand expressions
(assertions erase at emission), so a structural respelling on both
sides cannot shed the record's name.
- Record fields have no in-place write in the emitted layout: mutation
through a mutable interface or alias property refuses with the
reconstruction teaching instead of emitting an unassignable store.
- The facade refuses model-kept value records with non-scalar fields
and model sequences of value records, so corewire --check agrees
with what the facade's compilers accept.
- The split unbound consts must restate viewUnbound's resolved facts
exactly (unresolvable and missing entries both teach), and a
reserved-list const declared in an imported module refuses whether
exported or not.
* Identity stops at emission too; singleton unions claim syntactic literal tags only
- Equality emission gains the NS1061 re-derivation: a by-value struct
operand stops the build with the identity teaching, so comparisons
reaching emission through generic instantiation or erased assertions
stop the same way the checker teaches directly (pointer records keep
their identity ==).
- The checker guard reads each operand through both the peeled and the
spelled view, so an assertion that NAMES the record refuses at check
time as well.
- The singleton-union reading claims only a syntactic literal tag: a
record whose kind field resolves through a named literal union stays
the attested struct.
|
||
|
Chris Tate
|
dbe15a7472 |
The <terminal> markup built-in: snapshot painter, widget kind, and element surface (#195)
* Canvas terminal grid: the resolved cell model and painter - TerminalGrid snapshots carry resolved cells (cluster bytes, final colors, wide/spacer occupancy) so the painter needs no emulator: real text runs, geometric box drawing, selection wash, cursor register, keyboard caret, and the scrollback thumb, with row-atomic command/text/glyph budgets - terminal_box.zig promotes the example's exact-cell-bounds box geometry (U+2500-259F) into the canvas - TerminalState is the app-visible view-state record (scrollback, history, cols, rows) the terminal element's event delivers * The .terminal widget kind: grid rendering, focus, and the editable-text register - Stable code 62; renders the bound TerminalBinding's grid snapshot through the terminal grid painter (full-bleed background, inset text region, shared per-view budget reserves) and the honest empty surface unbound; the house focus ring when focused - Joins the editable-text register everywhere but the TextBuffer pipeline: hit target, press claimer, focusable, I-beam cursor, textbox role — the emulator, not an editor state, owns the input model - Markup-inexpressible for now (documented exclusion); the <terminal> element entry lifts it * The <terminal> element: registry, both engines, contract, and teachings - Element 69 (widget kind terminal, a11y control) with pty (88, binding-only, required — dead markup otherwise) and scrollback (89, the scroll value source-wins echo); event terminal (13) delivers the new terminal_state payload (canvas.TerminalState) on the element only - Validator, interpreter, and compiled engine stay in lockstep: pty scoping/grammar, scrollback and on-terminal scoping, leaf rule, and the declared-record mirror (declaredTerminalStateRecord) for transpiled cores; contract classifies terminal_state arms and checks on-terminal payloads - Ui.terminal sugar, terminalMsg/translatedTerminalMsg constructors, msgForTerminal, and the TerminalGridLookup seam the app loop installs to resolve bound pty keys into published grid snapshots; re-pinned registry fingerprints via print-pins * Wire libghostty-vt into native framework builds - Adds the ghostty pin to build.zig.zon and imports the ghostty-vt module into every native instantiation of the framework module (desktop, print-pins, and the user-app graph in build/app.zig); the wasm docs preview and pty-unsupported targets leave the comptime-gated import unresolved - Two terminal_grid.zig comments now state the concrete degrade mechanism they describe * Document the <terminal> element and its state contract - Adds the declarative <terminal> section to the terminal docs page (both authoring tiers), covering the pty-key binding, the TerminalState echo, and layout-derived sizing - Changelog fragment for the element, the state contract, and the teachings * Painter lifetime, id/budget correctness, a11y, and saturation fixes - Rounded box corners allocate path elements from the builder's own store (strokePath retains the slice by reference; a stack local dangled for the retained renderer) - Box-cell command ids use an 8-command stride and the per-row reserve counts nine per column (eight box segments plus a background run): a 4-stride collided adjacent double-cross ids and the reserve under-counted, risking a frame-failing overflow instead of row-atomic degrade - Text preflight compares against the builder's live cumulative counter, so a grid sharing the store with earlier widgets degrades against the remaining space - Terminal widget floors its command budget to a positive value (0 means unbounded to the painter); a positive budget below the fixed prologue overhead paints nothing, checked before the prologue emits - A torn row (builder store exhausted mid-row) does not count as painted and stops further rows, so the cursor never draws over dropped content - Screen text rides the widget's text VALUE (semanticTextValue), not the accessible name, so an author label stays the stable control name - translatedTerminalMsg saturates instead of trapping on narrow declared fields - screen_text doc states its true scope (plain-text coverage, not colors/cursor/selection) - Regression tests for path lifetime, adjacent double-cross id uniqueness, and the shared-store text preflight * Terminal painter budget accuracy, id disjointness, and contract completeness - Command budget is checked per row against that row's actual upper-bound cost (rowCommandCost) instead of a flat worst-case-per-column reserve, so a wide cheap terminal paints its rows instead of reserving them all away - Per-row path-element preflight for rounded corners, plus a row-atomic rollback that drops a torn row's partial commands whole so nothing half a row reaches the glass - Box/block cells keep SGR underline (geometry replaces the glyph, not its decoration) - The focus ring on a bound terminal takes its id from the painter's reserved offset, disjoint from every grid command id - Contract validates the pty binding (undefined field caught, valid one marked used) and requires a bare on-terminal tag (an authored payload is dead data); contract format bumped to 3 so stale artifacts regenerate - TerminalBinding.grid documents its borrowed-pointer lifetime contract - Regression tests: wide-terminal painting, focus-ring id disjointness, on-terminal bare-tag * Terminal id-arithmetic wrapping, focus reachability, and audit registration - The prologue budget check accounts for commands already in the builder, so a full builder degrades to nothing instead of overrunning its absolute ceiling - All command-id arithmetic wraps (paintIdBase spans the full u64 space, so a base near maxInt no longer traps on a checked add) in both the grid painter and the box geometry - Horizontal box/block merging breaks on an underline mismatch, so a run keeps each cell's decoration instead of spreading the first cell's - Pointer, autofocus, and automation focus reveal the terminal's ring (a new canvasWidgetShowsPointerFocusRing predicate covers editable text plus terminal), so the ring is reachable by click, not only Tab - The focus-paint dirty-bounds register and the minimum hit-target audit both include the terminal, so a focus enter/leave damages the ring region and an undersized terminal is flagged - Regression tests for the builder-aware prologue guard and near-maxInt id wrapping * Terminal budgets count view-global text and path totals; merge-aware cost - rowCommandCost mirrors horizontal box merging: a long mergeable run (a border of identical box glyphs) costs one geometry command plus an underline, not nine per column, so a wide box row paints instead of being skipped on a bogus estimate - Text and path-element preflights degrade against the whole display list (every draw_text and fill/stroke_path, referenced sibling and static content included), matching the runtime's per-view CanvasResourceCounts limits, so a terminal sharing a view with text or icon widgets cannot push the frame over CanvasTextTooLarge/CanvasPathElementLimitReached - A builder smaller than the widget command reserve gets the whole capacity as its budget, so a small buffer paints what fits instead of flooring to a below-prologue budget that painted nothing - Regression tests: merged wide box row, referenced-sibling text preflight * LSP doc tables cover the terminal vocabulary - Hover/completion docs for the terminal element, its pty and scrollback attributes, and the on-terminal event, satisfying the doc-table conformance test that holds the tables equal to the registry * Terminal id namespaces by stride, nested double corners, and name honesty - Command ids follow the widget part-id convention scaled to a 24-bit slot space (id * 2^24 + offset, every painter offset below the stride), so two terminals' commands are disjoint by construction — the multiplicative spread let one widget's offsets land in another's namespace; an anonymous grid (id 0) now emits every command with id 0, the unkeyed convention, through the box geometry included - Pure-double corners (2554/2557/255A/255D) draw as two nested L joins — the double frame a terminal face draws — instead of both bars riding through the joint as hash crossings with inward stubs - The merged-run cost charges a double piece's two bars plus its underline, so a row of unmergeable underlined doubles stays under the hard ceiling - text= on terminal is a teaching error in the validator and both engines: the text channel is runtime-owned (the live screen rides it), so an authored value would rename the control every frame and falsely satisfy the accessible-name lint — the name comes from label - elementHoldsChildren classifies terminal as a leaf, so container roles that promise child structure are refused on it - Regression tests: budget ceiling under unmergeable underlined doubles, the anonymous-id convention, cross-grid id disjointness with the adversarial id pair, nested-corner geometry, and the text/role teachings * Glyph preflight charges atlas entries, not code points - The runtime atlas keys on (font, glyph, size, subpixel_x, subpixel_y) with four x buckets, so one distinct scalar can occupy four entries across a row's columns under a fractional cell width; the preflight now charges every new code point at that variant multiplier, so a grid within its budget can never undercount its own atlas usage and fail the frame with GlyphAtlasListFull - The glyph budget option and the widget mirror are documented in atlas-entry units; the budget regression test asserts the 4x charge * Box cost per glyph and zero-add rows pass the shared ceilings - rowCommandCost charges each non-merged box glyph its own worst case (box.maxCommands, kept lockstep beside the paint switch): a wide row of one-bar pieces costs what it paints instead of a flat joint worst case that rejected it whole - A row adding no text or path elements paints even when earlier widgets already spent past the grid's reserved share — the ceilings bound what the grid adds, never what siblings consumed - Regression tests: a 198-column row of one-bar pieces paints under the widget budget; an all-box row paints beside a text widget that exhausted the share * Terminal build-time leaf enforcement, a path reserve, and a scoped id claim - Both markup engines refuse a pty-less terminal and terminal children at BUILD time (the image-leaf policy), so hot reload — which skips the validation pass — fails the build instead of silently rendering an unbound surface or dropping the child; interpreter regression test added - The painter holds back a path-element reserve (widget_path_reserve, 512) for the widgets emitted after the grid, so rounded-corner rows degrade instead of starving a following chart into ChartPathElementListFull - paintIdBase's doc states its guarantee precisely: the widget part-id convention scaled to a 24-bit slot space, with the identical accepted residual (ids agreeing modulo the shifted range share a namespace, as they do for widgetPartId) * Cluster-isolated runs, engine-scoped scrollback, terminal-aware widget diff - Multi-codepoint clusters (combining marks) paint as their own single-cell run at their exact cell origin, so a text layout that advances a mark by a full glyph can never shift later cells off the grid; plain single-scalar runs keep the merged fast path - Both markup engines refuse scrollback off a terminal at build (validator parity for unvalidated paths), instead of storing an inert generic option - The widget-tree diff reports paint damage for terminal bindings: pty/scrollback changes compare, and a BOUND grid is never reported clean (its snapshot may be republished or refreshed in place), so partial-invalidation consumers never leave stale terminal pixels - Regression tests: cluster neighbor keeps its cell origin, misplaced scrollback fails the engine build, changed bound grids diff paint-dirty * Scope the libghostty-vt dependency to the terminal example - Drops the framework-wide ghostty wiring (root dependency, module imports in the repo and user-app build graphs): no framework code imports the module yet, and resolving ghostty at configure time runs its full build script — whose bench tooling pulls SharedDeps regardless of the lib-vt emit option, walking lazy dependencies (wuffs, translate_c) whose build scripts fail in consumer package stores that carry the whole transitive closure - Scaffolded and consumer builds no longer traverse ghostty at all; the terminal example keeps its own pin (the merged slice-A wiring), and the runtime session slice will bring the dependency back behind a consumer-safe seam when framework code actually imports it * Derive the terminal path reserve from the chart series ceiling - widget_path_reserve now derives from max_chart_points_per_series (stroke polyline plus area fill with closure slack): a flat 512 fell three elements short of one maximal filled-line series, so rounded-corner rows could still starve a following chart into ChartPathElementListFull - A lockstep test pins the reserve to the derivation |
||
|
Chris Tate
|
19f2933e08 |
Validate integer-class attestations and decode boundary slots by class (#194)
* Validate integer_slots structurally with the u64 class in the checker
- Resolve every leftover integer_slots entry against the sidecar's own tables, teaching unresolvable paths, wrong-spelling slots, and the grammar's slice-element gap distinctly (V10)
- Accept the closed integer-class set {i64, u64}; f64 and unknown classes refuse with their own teachings
- Message-side slot paths spell the union's authored name in both the reader's bijection and the extractor's emission
* Carry the u64 wire class through the canonical codec
- Encode/decode accept u64 beside i64: 8-byte unsigned LE, total over the full wire range in both classes
- exactF64Unsigned holds the one-sided 2^53 exactness line for u64-attested dispatch payloads
- Golden vectors pin the +-(2^53 - 1) extremes, sign handling, and full-range round trips byte-for-byte
* Decode integer slots per their attested class in the generated mirror
- The spelling authority consults integer_slots by slot path: a u64 attestation refines the i64 spelling to the unsigned twin (8-byte unsigned LE decode), every non-attested slot stays f64
- Dispatch narrows u64-attested payloads through exactF64Unsigned; i64-attested slots keep the signed guard
- Tests pin every attestable path form with mixed classes and the empty list generating no integer slot anywhere
* Exercise attested integer classes through generated mirrors in the harness
- New hand-written integer fixture with mixed i64/u64 attestations; its generated mirror decodes envelope, dispatch, and snapshot bytes over the +-(2^53 - 1) extremes and the full 8-byte wire range, byte-exact against hand-computed vectors
- The external-core parity suite drives the i64-classed arms through real dispatch at the provable extremes and reads the exact integers back from the decoded mirror
- The parity build runs corewire --check over the supplied external sidecar before the tests; everything still skips cleanly when no archive is supplied
* Host adapters accept the u64 number class beside i64
- Event-record shape checks, the number/number_bytes routing entries, and the channel-record validation take u64 fields exactly where i64 stands; widening assignments were already class-agnostic
- The mini core grows u64-classed now and fetch arms proving both routing paths deliver the exact unsigned values
* Facade routes u64-attested slots through an unsigned encoder
- nscfU64 (emitted only when a slot attests the u64 class) refuses negative, fractional, and past-2^53 values instead of encoding two's-complement bytes a mirror would read as huge unsigned values
- Slot paths thread through the facade's encoders and value builders; u64-attested sample values stay non-negative so the deterministic sample model encodes
- The integer fixture's compiled facade joins the conformance parity axis: snapshot and envelope bytes match the canonical encoder for mixed classes
* Parity boundary script follows each slot's attested class
- The integer-extremes script includes negative crossings only for signed-attested arms, so a supplied sidecar attesting u64 on those slots still compiles and runs
- The decoded-mirror comparison widens both classes into one comparison type
* Refuse u64 attestations on host-supplied signed slots
- The checker refuses the u64 class on scroll-state axes and text-selection bounds: the host supplies negative values there, which the unsigned class cannot carry
- The pty event shape keeps code and signal signed (non-exited terminals deliver -1 sentinels); droppedWrites still takes either integer class
- The parity boundary script and its comparison handle f64-classed slots, so a sidecar predating integer attestation still compiles and runs
* Narrow the signed-slot refusals to values the host actually signs
- Two distinct slots spelling one path refuse as unaddressable (a message union named helpers can collide with a helper's return slot), so one attestation can never silently govern two slots
- Scroll refusal covers only offsets and velocities; extents, selection bounds, and pty signal take the unsigned class (the host supplies them non-negative), while pty code and chrome geometry stay signed
- Chrome geometry refuses u64 at check time and in the channel-record validation (embedders report signed content coordinates)
* Pin the signed-slot rules to the exact host domains
- The scroll refusal applies only to records a message arm routes (a model-only scroll-shaped record keeps its attestation), and the chrome refusal narrows to the control cluster's x/y position — insets and sizes are non-negative extents and take the unsigned class
- Channel-record validation takes a per-field signed list instead of a blanket switch
- A negative host number reaching a u64-classed arm or field (a pre-epoch clock, a -1 exit sentinel) teaches at the crossing instead of faulting in the cast
* Clamp audio scalars into the exact-integer delivery window
- Audio positions and durations clamp below 2^53 at every delivery entry (live platform events, fed fake/replay events, spectrum reports) — the video scalar clamp's twin, so integer-classed Msg fields and the mirrors never see an out-of-window host value
- The parity script's selection sample follows the supplied sidecar's classes: signed keeps the negative-value coverage, unsigned exercises a backward selection instead
* Refuse out-of-window audio records at replay instead of reshaping them
- The audio twin of the video scalar damage gate: a journaled position or duration at or past 2^53 can only be a damaged or hand-edited journal now that the delivery boundary clamps, so replay refuses it before the feed
- Predicate pinned at the window edges in the existing damage-gate test style
* Bump the journal semantic epoch for the audio scalar window
- Epoch 5: audio scalars now clamp below 2^53 at delivery and replay refuses wider journaled values as damage, so an older recording carrying one refuses as a different generation instead of being misreported as damaged
|
||
|
Chris Tate
|
3a188de6b7 |
Windows pty: ConPTY behind the shared transport seam (#193)
* Windows pty transport: ConPTY behind the shared seam - pty_windows.zig: CreatePseudoConsole over an overlapped named-pipe pair, flags 0 (no inherit-cursor handshake), UTF-8/VT both directions per the pseudoconsole pipe contract; EOF manufactured by closing the console at the first quiet moment after the process handle signals - pty.zig becomes the dispatch seam (one Pty shape, wait takes the transport); exit semantics are exit-code-only on Windows (signal always 0), kill is TerminateProcess plus console teardown, and handle-close discipline replaces the posix zombie table - effects wiring: the io loop is unchanged, the env policy snapshots the live Windows environment through the same flatten seam, and the live suite gains ConPTY twins (containment assertions where conhost renders, byte-exact stays posix-gated) * Terminal example: deterministic shell pick covers Windows - cmd.exe joins the per-platform default-shell table (interactive by default, so the posix shells' -i rides a per-platform argv const) * Docs: Windows pty moves from staged to supported - platform matrix names the ConPTY backend and a Windows-semantics section states the differences plainly: exit codes only (signaled never occurs), rendered VT stream rather than raw child bytes, kill reach via console teardown, case-insensitive env names, no-CWD PATH resolution - changelog fragment for the Windows transport; the terminal fragment stops calling Windows staged * ConPTY: null std handles and an exit-quiet grace - STARTF_USESTDHANDLES with null handles blocks CreateProcess's std-handle duplication from a console-less parent (sshd/CI pipes), so the child's stdio binds to the pseudoconsole instead of bypassing it - the console close now waits out a 50ms quiet grace past the child's exit (short poll beat while it pends), so conhost's asynchronous final render is not cut off the frame it was painting - transport tests: mode.com by full path (the minimal test env carries no PATH) and the quoting expectation pins the lone-backslash no-quote rule * Fix the image-cache probe test's fake handle for Windows natives - std.Io.File.Handle is pointer-shaped on Windows; the fake the noop close never dereferences now matches per platform, so the runtime-core test shard compiles on a Windows host * ConPTY hardening: teardown reach, drain-before-close, env fidelity - reapEnding now tears the console down on every path behind a bounded discard-drain, so a kill fells attached descendants at the reap (not a retire the host may never drain to) and ClosePseudoConsole can never meet the full pipe that wedges pre-rework conhosts - State moves to process-lifetime backing (an abandoned io thread must outlive the caller's allocator), the exit quiet grace measures from the later of exit and last output, hidden =X:= drive-directory entries ride the env snapshot verbatim, and the no-PATH fallback derives the real Windows root - docs state the 32767 console-geometry clamp, the Windows 10 1809 floor, and the direct-child session-lifetime policy (measured: the pipe never breaks on its own, so the manufactured EOF is the only ending) * ConPTY: off-thread console close, batch-argument refusal, exact resolution - ClosePseudoConsole moves to a detached helper so the reader thread keeps draining while conhost tears down (a client's CTRL_CLOSE handler can write past the pipe capacity; closing inline on the reader is the documented deadlock), and the teardown drain now runs behind the initiated close until EOF or its bound - batch targets refuse argv bytes cmd.exe would reinterpret (a .cmd command line is reparsed by cmd's own grammar, which no CRT quoting neutralizes), extension probing appends suffixes only to extension-less names (a missing tool.cmd can never start a co-located tool.cmd.exe), and direct executables pass lpApplicationName so long paths start (batch keeps the null-application form that reroutes through cmd.exe) - synchronous read completions stamp the exit quiet grace like event-delivered ones, and the environment block sorts names case-insensitively by code point through the OS BMP uppercase fold (raw WTF-8 bytes misorder folded non-ASCII names) * ConPTY: safer failure-path closes, cmd-convention resolution, OS-order env block - spawn-failure cleanup breaks the pipe before ClosePseudoConsole (a terminated child may have filled it; a blocked conhost would block the close), and the teardown drain runs quiet-first so the close's inline OOM fallback can only meet an emptied pipe - extension-less names probe runnable suffixes before the bare spelling (a plain file named tool cannot mask tool.exe/tool.cmd), the probe's wide copy sizes to the candidate (long \\?\ PATH components resolve), direct executables keep the caller's argv[0] spelling in the command line (the module rides lpApplicationName), and a batch target's resolved path faces the same hostile-byte refusal as its arguments with plain space-guarding quotes (cmd reads backslashes literally, so CRT trailing-run doubling would corrupt them) - the environment block sorts by uppercase-folded UTF-16 code units (surrogate halves order below private-use BMP, the OS's own comparison), pinned by test * ConPTY: explicit cmd.exe for batch, deadlock-free close fallbacks, tighter quiet close - batch targets launch through an explicitly resolved cmd.exe with /d /s /c (AutoRun cannot splice around the script), every batch argument is quoted (a bare closing parenthesis could join cmd's block grammar), and the refusal policy is stated in the docs - the console-close fallback breaks the output pipe before closing inline (a reader that cannot spawn the detached closer never meets the blocked-conhost wait), spawn-failure cleanup closes on the same detached form, and retire guards the broken read handle - the quiet close re-probes the read event after the pipe peek, so a completion landing between the two restarts the grace instead of racing the close * ConPTY: pin the batch interpreter to the system cmd.exe - the batch command processor now resolves as <windows root>\System32\cmd.exe (GetWindowsDirectoryW first, env root then literal as fallbacks) and is probed for existence - a PATH-planted cmd.exe can never answer for a trusted script, and a PATH without System32 no longer breaks batch spawns - the no-PATH resolution fallback derives from the same shared windowsRoot helper |
||
|
Chris Tate
|
72ed3644c6 |
Channel entries return the bytes envelope through corewire's ABI seam (#192)
* Rebind channel entries to the bytes envelope - The out-record channel shape is superseded: entries return [produced u8][tag u8][payload...] on the ordinary out-pointer pair, keeping the one-return-slot rule intact - shim_rt.channelEnvelope splits the header and panics with a teaching on malformed framing (short buffer, produced byte past 1, payload behind a nothing-produced header); the generated msgFromEnvelope unpacks and refuses out-of-range tags - The stub core's channel entries now hand back real envelopes (nothing-produced by default, test-settable), so generated shims' unpack paths execute without a compiled core * Emit channel envelope packing in the TypeScript facade - Wired channel entries export as nsc_core_<channel>(msg: Msg | null): the facade packs [produced u8][tag u8][payload...] onto one bytes return - The shared packer encodes each arm's payload with the sidecar's classes and flattened field orders, so the envelope tail matches the arm's mirror decoding - Unwired sidecars carry no envelope surface * Prove the channel envelope round-trip in the conformance suite - Facade-packed envelopes must equal [1] ++ the canonical union encoding of the produced message, across the corpus's payload families (bare, i64 number, bytes, flattened records, enum members); null packs exactly [0, 0] - The generated shims' channel entries execute against the stub core's test-settable envelope: produced gating, bare-arm and payload-arm decoding - All wired entries route one packer; unwired channels stay out of the facade surface * Drive channel entries through the envelope in the parity suite - Both lanes' channel functions run over gating and producing events: null gates must agree, and produced messages compare by canonical bytes in the mirror layout - Every produced message dispatches through both lanes as a full cycle (command bytes and committed snapshot byte-identical), and the frame channel re-gates after its resize lands - The suite still builds only when a compiled-core archive is supplied * Give channel wrappers a defined pre-call out state - The generated wrappers point the out pair at shim_rt.channel_out_guard with length zero before calling, so an entry that returns without writing yields the zero-length envelope - That envelope lands on channelEnvelope's short-buffer teaching instead of slicing undefined memory * Refuse the length-only channel out-pair violation with a teaching - shim_rt.channelEnvelopeBytes assembles the returned envelope: a nonzero length on the guard address panics with a teaching before any slice forms - The generated wrappers route the out pair through it, so every non-writing shape (neither slot, pointer-only, length-only) reaches a teaching panic, never memory outside a written buffer * Name the exact refusal and reporting mechanisms in test and doc text - Envelope framing faults panic with a teaching; a short envelope is refused by the envelope reader; the tag-range refusal belongs to the generated unpacker - The queue-overflow test name states the mechanism: dropped lines ride a carried drop count on the next delivery and the exit report |
||
|
Chris Tate
|
f8c14c59c7 |
Terminal: pty effects, libghostty-vt, and a replayable terminal example (#191)
* Add the POSIX pty primitive: openpty, controlling-terminal fork/exec, resize, reap - One transport for terminal children: parent-built argv/envp (clean env plus TERM), async-signal-safe child path via login_tty/execve, group kill and waitpid decode - macOS and Linux-with-libc report supported; every other target compiles to loud PtyUnsupported stubs - Live tests prove the controlling terminal (test -t 0), exit codes, signal decode, and the env policy * Pin libghostty-vt and stage the terminal example skeleton - examples/terminal owns its build: ghostty pinned at 7aa9591 (the first upstream commit that builds under Zig 0.16.0; v1.3.1 still targets 0.15) with simd off so the vt module stays pure Zig - The pin is proven in-tree: the example's test round-trips VT parsing through the pinned module - zig-pkg/ (the project-local package store) joins .gitignore * Add the pty effect vocabulary: spawn, coalesced output, write, resize, kill, replayable exits - fx.ptySpawn/ptyWrite/ptyResize/ptyKill ride the keyed families' seams: one key space, the spawn argv budgets and env policy, exactly one exit per spawn, rejections staged loud and regenerating - Output coalesces through a per-pty staging ring paced by the drain (lossless back-pressure: a full ring parks the reader, never drops), delivered as bounded batches journaled via the content-addressed blob store; replay never spawns a process - The fake pty scripts the whole vocabulary headless (request/write/resize/kill mirrors plus output/exit feeds), and live POSIX tests pin coalescing, losslessness, controlling-terminal wiring, and teardown convergence * Render the terminal example: libghostty-vt grid on the canvas, keyboard-first, replayable - grid.zig wraps one emulator session (cell state, damage, scrollback, keyboard selection) and paints the viewport as real text: per-row background/text runs, theme-mapped ANSI-16 with exact 256-color and truecolor, wide CJK cells, a scrollback thumb - main.zig drives it on the pty vocabulary: typing rides the IME-correct text channel and the emulator key encoder, selection/scroll/copy chords, a variable-length chrome prefix for the grid, and the frame pump resizes the grid and pty together - UiApp gains on_text (the target-less committed-text seam) and a variable_prefix chrome mode; the gpu-surface layer routes unclaimed text_input to the app, the key_down fallback's twin - Tests pin the emulator round trip, CJK width, scrollback, line/block selection, palette honesty, and a fake-pty session that replays byte-identical offline * Document the terminal recipe, platform matrix, and replay story - docs/terminal: the pty vocabulary, coalesced output, the exit taxonomy, grid rendering, and the byte-identical offline replay story, with the honest macOS/Linux/Windows-staged/null matrix - Registered in the Core Concepts nav beside Dynamic Images - Changelog fragments for the pty vocabulary, the terminal example, on_text, and the TS Cmd family * Harden the pty transport: exec-failure detection, teardown, and write accounting - pty spawn distinguishes a failed exec from a real 127 exit via a close-on-exec self-pipe (a bad shebang interpreter now reports spawn_failed, not exited), and rejects argv entries with embedded NULs instead of silently truncating them at the C boundary - The io loop observes shutdown so a reader parked on a full staging ring exits promptly at teardown instead of forcing the abandon path - dropped_writes now counts outbound bytes lost to a write failure or a child that exits with input still staged; a kill racing a natural exit rewrites the terminal to cancelled with the -1 sentinel code - Bounded per-drain output: a delivered batch re-stamps the remaining backlog past the pass boundary, so a continuously writing child delivers one batch per drain instead of starving other events * Harden pty fd hygiene, the kill/reap races, replay provenance, and grid fidelity - pty spawn aborts if CLOEXEC on the exec self-pipe cannot be set (a leaked write end would hang the parent), and the wake pipe is now CLOEXEC so no descriptor leaks into the child; empty PATH components resolve as the current directory (POSIX) - ptyKill no longer signals a reaped pid (the OS may have reused it) and the io loop winds down on kill even when an escaped descendant holds the pty open, so the exit always delivers; dropped_writes counts each lost payload, not one lumped event - Platform-unsupported rejections are executor truth and feed under replay (a journal recorded where ptys are unsupported replays its rejection verbatim); the regenerating marker rides the record's truncated bit so a pty exit reason stays honest, with a replay damage gate for the pairing - feedPtyOutput refuses an over-bound batch instead of truncating, and every fake pty (not just replay parks) refuses a second feed after its exit is queued - Example: inverse-video cells paint text in the background color (not foreground-on-foreground), the grid self-limits to its chrome command budget so a pathological screen degrades to fewer rows, and the Linux default shell is /bin/sh (present on every install, unlike /bin/bash) * Wire the pty command family into the TypeScript tier - Cmd.ptySpawn/ptyWrite/ptyResize/ptyKill (wire opcodes 0x19-0x1C, additive over the current cmd format) expose the pty vocabulary to transpiled cores, with an event arm matched by field name (key/kind/bytes/code/reason/signal/droppedWrites) - The rt kernel encodes the four ops; the emitter lowers and validates them (argv and grid bounds) with teaching diagnostics; the ts-core host decodes them into the runtime Effects pty calls and dispatches events back to the core's event arm - Posting stays native-only (transpiled cores are single-threaded): the TS tier spawns, writes, resizes, kills, and receives. Covered by packages/core effects/conformance tests and the ts_core_host bridge tests, plus a cmdview decoder arm so the evals harness names the new commands * Harden pty close-on-exec fds, the pid-reuse guard, exact write accounting, and NUL-safe TERM - The pty parent end/child end (and the exec self-pipe read end) are close-on-exec, so a concurrent process or pty spawn on another thread cannot inherit another session's descriptors and hold its pty open; pipePair now aborts if either non-blocking fcntl fails instead of returning a pipe that could hang the UI thread in nudge - Closed the pid-reuse window: the io thread publishes a reaping flag under the mutex before waitpid, and ptyKill and teardown decline to signal once it (or exit_staged/io_done) is set, so a reaped child's reused pid is never signalled - dropped_writes now tracks per-payload boundaries: a fully-sent write pops as its bytes flush, so a discard counts only the writes that never reached the child, not already-delivered ones - ptySpawn rejects argv or TERM containing an embedded NUL (validated at the effect boundary so the fake executor and replay agree), never a silently truncated value * Bound the pty exec probe and reap, make kill signalling atomic, and cap the grid command budget - The exec-status probe polls with a timeout instead of a blocking read: a real exec failure writes its byte instantly (always detected), success is EOF, and the timeout is the net for the residual CLOEXEC window so a concurrent fork inheriting the pipe writer can never hang the spawn. Pipes are created close-on-exec atomically on Linux (pipe2); Darwin keeps the immediate fcntl behind the same timeout net - reapEnding replaces the unbounded reapBlocking after the stream ends: the normal case (child already exited) returns at once with no signal, and a child that closed its terminal but kept running is hung up and escalated to SIGKILL within a bounded window, so the exit always arrives and no kill is stranded - ptyKill and teardown signal the child UNDER the shared mutex, atomic against the io thread's pre-waitpid reaping publish, so a reaped pid's reuse is never signalled - dropped_writes stays exact: the outbound record ring is an admission bound (a write past it is refused and counted once, like a full byte buffer), so every accepted write owns a length record and none is folded - Example: the grid's per-row command reserve accounts for background + text + underline per cell (3/column) so a pathological screen truncates safely under the chrome budget; a resize allocation failure leaves the model dimensions uncommitted so the emulator and pty never disagree and the frame pump retries * Open the pty pair with an atomically close-on-exec child end, reset reused header flags - Replace openpty with posix_openpt + grantpt + unlockpt and open the child end O_CLOEXEC atomically: the child end is the descriptor whose inheritance across a concurrent fork's exec would hold the pty open and starve the exit event, and an atomic open closes that window on both platforms (the parent end's Darwin sub-syscall window is benign — an inherited parent end does not hold the pty open) - Reset every reused PtyShared flag on a new spawn (reaping, the outbound write records) so a prior session's state never steers the next: a stale reaping would make ptyKill skip its immediate SIGKILL - Declare ioctl variadic to match the C ABI — a fixed-arg declaration mis-passed the winsize pointer on arm64, silently dropping the initial grid and every resize; the resize test now verifies the applied size, not just the call * Handle already-reaped children, low child end fds, post-exit writes, and pre-output input - reap reports ECHILD (a child reaped by an embedder's own SIGCHLD handling) as a gone child, never as still-running, so the escalation path cannot signal a reused pid - Relocate a child end that lands on fd 0/1/2 to a high descriptor before login_tty: a same-fd dup2 does not clear close-on-exec, which would make the child's stdio vanish at execve when the host started with standard descriptors closed - ptyWrite drops a write once the reaper has staged the exit: there is no io thread left to send it, and mutating the finalized exit's dropped_writes would race the drain - The terminal example accepts input from spawn onward, not only after the first output batch — a shell with an empty prompt and no banner never flips to live, and gating input on it would strand every keystroke * Relocate low pty fds, wind down orphaned ptys, commit-only text, IME preedit, guarded restart - Relocate the child end AND the exec self-pipe write end above the standard descriptors before the fork: login_tty dup2's the child end onto 0/1/2, and a write end left on fd 1/2 would be clobbered, making an exec failure masquerade as a normal exit when the host began with stdio closed - Bind-time services-snapshot failure now winds down already-running ptys (bounded), not just channels, so their exit still delivers instead of stranding with no wake services - on_text delivers COMMITTED text only: an IME preedit (set_composition) or cancel routed through a focused non-text widget no longer types provisional bytes into a terminal - The targetless text path tracks the IME preedit and delivers it on commit — hosts emit an empty commit for unchanged marked text, so the composed bytes come from the buffered preedit; only committed UTF-8 reaches on_text - The terminal example restarts only a genuinely ended or failed session, never during starting/live, so a quiet shell is not duplicated onto its own occupied key * Non-blocking pty parent end, detach at retire, UTF-8-safe preedit truncation - The pty parent end is opened non-blocking and read/write surface WouldBlock: the sole io thread paces both directions through poll and never blocks inside a write when the child stops reading stdin while producing output, so stdout keeps draining and neither side deadlocks (ptyFlushOutbound writes at most one chunk per POLLOUT, leaving the rest staged) - Retirement detaches the io thread instead of joining it: retirement runs at exit delivery, inside the very dispatch a synchronous-marshal wake hook may be waiting on, and the thread's last act is that host wake — joining would recreate the deadlock ChannelWake forbids. By retirement the thread has published io_done and is past all transport/staging/pipe access, so detaching and reclaiming its fds is safe (conforming enqueue-only wakes have already returned; a violating one lingers against the process-lived header) - A truncated targetless IME preedit now cuts on a UTF-8 boundary, so an empty commit never forwards a split code point as committed text * Quiesce every pty wake at teardown, route IME to editable widgets only, chunk input - Teardown now quiesces the wake header of EVERY pty slot, idle included: the header is process-lifetime and reused, so a retired session's slow wake_fn can still be in flight when the services snapshot and platform are freed. A call still executing at the deadline is abandoned, counted, and the platform signalled to outlive it — the abandoned io-thread path accounts for its quiesce failure the same way, no longer silently - Text and IME route to a focused widget only when it is an editable text-entry widget; a focused non-text widget (a button, a list row) lets committed text fall through to the target-less on_text seam instead of dropping it - The targetless IME preedit buffer holds a full phrase-sized composition and the child's exec-failure report retries EINTR, so an interrupted one-byte report is never mistaken for a successful exec - The terminal example chunks committed text into per-write-bound pieces, so a long paste or IME commit types every byte instead of being refused whole * Free the pty header on clean teardown, honor emulator colors, bound the grid text store - A cleanly quiesced pty header is now freed at teardown: unlike a channel header (which an app thread may post to forever), the pty io thread is the sole toucher and is gone once quiesce confirms no in-flight wake, so repeatedly creating and destroying runtimes that used a pty no longer leaks ~64 KiB each; an abandoned header still leaks deliberately - The grid reads the emulator's resolved foreground, background, and cursor: the theme colors are pushed into the emulator's DEFAULTS so ghostty composes OSC 10/11/12 overrides and DECSCNM reverse-video itself, and the renderer honors an application's requested colors instead of forcing the theme - The grid degrades by whole rows when the display-list text store nears its budget (an emoji-dense screen), never blanking cells mid-frame with a swallowed allocation failure - Documented that an .exited pty terminal carries -1 only when the child was reaped outside the toolkit (an embedder installing SA_NOCLDWAIT / ignoring SIGCHLD / running its own reaper) — an already-broken parent/child contract where the real code is unrecoverable * Keep the pty header process-lived, serialize ptsname, honor OSC 4 by mask - Revert the teardown free of PtyShared: quiescing proves in_flight is zero, not that the io thread has RETURNED (it publishes its exit before calling requestHostWake, and a detached mid-life thread's late or violating wake still locks the header's mutex), so freeing risked a use-after-free. The header is now permanently retained like ChannelShared — a bounded per-slot leak that never grows during a runtime's life - ptsname's shared static buffer is resolved and copied under a process-wide spinlock, so concurrent pty spawns from independent runtimes on different threads never open each other's child end - The grid decides an ANSI slot is untouched by the emulator's override MASK, not RGB equality: a program that OSC-4-sets a slot to exactly the default RGB is honored instead of being replaced by the theme color * Stop macOS Option double-input and stage heavy graphemes whole - On macOS, Option is a compose key: Option+F commits the composed character through the text channel, so the key encoder no longer also treats Alt+printable as a chord there (which sent both the composed character and an Alt-escape to the child). Elsewhere Alt stays Meta - The grid's run staging buffer holds a full row plus a heavy grapheme cluster (8 KiB), so a cell with hundreds of combining marks stages whole; the run-break splits long runs across draw commands rather than overflowing, and any residual cut lands between code points (valid UTF-8) * Block for the exec verdict on Linux, refuse empty output records, make grid rows atomic - The exec-status probe blocks for a reliable verdict on Linux, where the report pipe is atomically close-on-exec (pipe2): a slow execve (an interpreter on a sluggish filesystem) is now awaited and correctly reported as spawn_failed rather than assumed successful. Darwin keeps the bounded poll — it has no atomic-CLOEXEC pipe, so blocking could hang on the fork-inheritance window (the documented residual every macOS terminal shares) - Replay refuses a .output pty record with a zero-length blob: the recorder journals output only for a non-empty batch, so a zero-length one is damage that would otherwise replay a synthetic empty event and diverge the fingerprint - The grid measures each row's exact text bytes and skips the row WHOLE when the display-list text store cannot hold them, and breaks a run before a cell whose grapheme would overflow the run scratch — so a heavy-grapheme row is never torn mid-way and a large cluster landing near the buffer's end keeps all its marks - The terminal-response staging buffer holds a large pipelined query burst (16 KiB); an overflowing reply is still dropped whole (never cut) and counted * Zero the signal on a cancelled pty, chunk query replies, grow the IME preedit to fit - A cancelled pty exit reports signal 0: the toolkit's own SIGKILL is what felled it, and the contract is "signal is nonzero only for a .signaled end", so the raw SIGKILL value no longer leaks into a cancelled terminal - Terminal query replies (DSR/DA/XTVERSION) flush through the chunking write path, so a batch that pipelined more than one write's worth of replies delivers every byte instead of being refused whole and leaving the child waiting - The targetless IME preedit buffer grows to fit the composition instead of truncating at a fixed size: each set_composition replaces it with the host's full string, reallocated only when a larger one arrives and freed at runtime deinit, so an unchanged commit of any length forwards the whole composition * Ignore empty pty output, clear stale preedit on OOM, reset on restart, map function keys - feedPtyOutput ignores an empty batch: the live drain only delivers non-empty output, so journaling a zero-length one would write a blob record replay refuses as damage - A failed IME preedit grow clears the buffer instead of leaving the superseded composition, so a later empty commit never inserts stale text the user has replaced - Restarting the terminal hard-resets the emulator (RIS + a fresh parser), so a shell that exited mid-escape or in a non-default mode does not corrupt the next session's key encoding or first output - The key map covers Insert and F1-F12, which carry no committed text and would otherwise be dropped before reaching the child * Bound the exec probe on both platforms, gate impossible exit records, clear selection on restart - The exec-status probe blocks up to a generous bound on every platform rather than forever on Linux: O_CLOEXEC closes an inherited pipe copy on the concurrent forker's exec, not its fork, so a forker slow to exec would delay EOF and an unbounded wait could hang the spawn thread. The bound caps that pathological wait; a timeout means our own child exec'd (an inherited writer merely delayed EOF) and is success. A slow-failing exec under the bound is still awaited and reported; only one that both blocks and fails past it misclassifies (an extreme filesystem pathology) — a self-pipe cannot distinguish that from a delayed EOF without the bound - Replay refuses a pty exit record whose code/signal contradict the delivered contract (signal nonzero iff .signaled; code -1 for every reason but .exited), so a hand-edited .cancelled with code 0 or signal 9 cannot dispatch a contract-violating event - Restarting the terminal leaves selection mode, so a restart while a selection caret is armed does not reject the new shell's typed input * Name the two ends of the pty pair parent and child - The controlling side the toolkit keeps is the parent end; the process side the spawned program adopts as its controlling terminal is the child end. Rename the transport field, the spawn locals, and the poll helper to parent/child, and rephrase every comment to match. - POSIX's own API names (posix_openpt, ptsname, grantpt/unlockpt) keep their C spellings at the call site; only the words the toolkit owns change. * Carry the session key on pty events, normalize fake exits, keep query replies lossless, and shrink the pty leak - The transpiled pty event arm now carries the app's own session key: two sessions routing one event arm were previously indistinguishable, so the arm gains a `key` field the host fills from the wire key (emitter, host bridge, and SDK type updated together). - `feedPtyExit` clamps its tuple to the event contract the live io loop guarantees — a signal only after a signaled end, a code only after an exited one — so a fake or replay can never stage an exit the recorder journals but replay's damage gate then refuses. - The terminal example feeds output in sub-slices and drains the emulator's query answers between them, so a burst of pipelined replies cannot outrun the write-back buffer and a child blocked on a DSR answer never hangs; a residual overflow surfaces on the status line instead of vanishing. - A pty session's ~64 KiB outbound ring and its per-write length ring move into a heap block freed at retire, so only a small header joins the process-lifetime leak (the channel header invariant), not the buffers; a teardown that abandons a stuck io thread still leaks the block with the thread that can reach it. * Make the pty rejection key self-contained and enforce the signaled-exit contract - A staged spawn-rejection Msg is delivered a frame after it is issued, past a frame-arena reset, so it can no longer copy the wire key into that arena: it carries the empty key (the self-contained-Msg rule the bytes field already follows), leaving the durable engine-key routing for live events untouched. - feedPtyExit now enforces the full exit contract as a biconditional — a signaled end REQUIRES a nonzero signal, not just a signal only on a signaled end — so a fake or replay feeding .signaled with signal 0 is refused loudly instead of journaling a record replay's damage gate would later reject. * Give replayed pty output the -1 code, keep the rejection key, and bound the exec probe by deadline - A replay-fed output batch now carries the -1 code sentinel the live drain delivers (the Entry default was 0), so an app that folds the event code into its model no longer diverges between a live run and its replay. - A staged spawn-rejection keeps the app's requested key: it is copied into a process-static ring (durable across the frame reset the staged Msg outlives) and referenced directly, so a duplicate-key or table-full refusal is correlated with the command that caused it instead of arriving keyless. - The exec-status probe bounds itself by a monotonic DEADLINE rather than a per-poll timeout, so signals interrupting poll (EINTR) can no longer each restart the full wait and defer the timeout indefinitely — the synchronous spawn stays bounded under a signal storm. * Make staged rejection keys grow with the batch, pace pty input to the FIFO, and reserve grid widget text - Staged spawn-rejection keys move from a fixed host ring to a growable engine store (stageLoopKey): each key gets its own stable heap buffer reclaimed when the staged stage next empties, so a Cmd.batch staging more rejections than any fixed ring holds can no longer overwrite a key still awaiting delivery and mis-correlate an exit. - The terminal example buffers typed and pasted input and drains it against the pty stdin FIFO's free space (new ptyOutboundFree query), so a paste larger than the 64 KiB FIFO no longer loses its tail when the child is not reading; it paces out as the child reads, with a per-frame flush covering a child that reads without echoing. Query replies stay direct and the flush reserves FIFO headroom for them, so bulk input never starves an answer the child blocks on. - Grid painting reserves display-list text bytes for the header and status widgets that share the per-view text store, so a grapheme-heavy viewport degrades to a few fewer rows instead of pushing the combined frame past the runtime limit and failing the whole update. - Any residual dropped input surfaces on the status line beside the reply-drop count. * Report pty write acceptance so the terminal never loses input or query replies - ptyWrite now returns whether the whole payload was accepted, since it alone knows the byte-FIFO and 256-record admission limits; a byte-capacity query could report room the record ring would still refuse, misleading a caller into treating a rejected write as sent. The misleading ptyOutboundFree query is removed. - The terminal example drains one stream-ordered outbound ring holding typed keys, pastes, AND emulator query replies, retrying any chunk ptyWrite refuses instead of dropping it. A paste larger than the FIFO paces out as the child reads; a reply refused by a full FIFO stays queued rather than being cleared, so a child blocking on a DSR answer is never stranded. A per-frame flush covers a child that reads without echoing, and a full-ring overflow is counted and shown, never silent. * Journal pty write verdicts for replay and free pty buffers through their allocating seam - A ptyWrite admission verdict is executor truth — whether the outbound FIFO and record ring had room depends on how fast the child was reading — so each one now journals (a .pty/.write record) and a replayed write returns the RECORDED verdict instead of recomputing optimistically against a fake with no child: an app that retains refused bytes takes the identical retain/remove path in both runs, pinned by a recorded session whose refused and accepted writes replay fingerprint-identical. The journal format fingerprint moves with the new record kind, refusing pre-verdict journals honestly. - Pty staging rings and outbound blocks now free through the channel_storage_allocator seam that allocated them, so a swapped-in tracking or arena allocator sees its own frees instead of a mismatched destroy against the default backing. * Scope target-less IME preedit per surface and gate command chords out of target-less text - The target-less preedit buffer now tracks its originating surface (window + view label), matching how a focused widget's editor scopes composition to the widget: only the owning surface's commit consumes the buffered bytes and only its events clear them, so a second surface's empty commit can never insert a composition typed into the first. - Target-less text_input now applies the same command-chord gate focused text widgets use (primary/command/control means shortcut, not typing; Alt stays out — Option and AltGr compose text), so Ctrl+C delivers the encoded chord alone and never a stray literal character; pinned at the runtime layer and against the terminal example's pty input. * Deliver key-carried typing target-less, count post-exit write refusals, and complete the terminal key map - Committed text carried on a key_down (hosts whose plain typing rides the key event, with no separate text event) now reaches the target-less on_text seam under the same command-chord gate the focused-widget path applies — ordinary typing was silently lost there, while specials carry no text on any host so nothing doubles with the key fallback. - A ptyWrite refused in the staged-exit window now counts into dropped_writes (the exit reads the count under the mutex at drain delivery, which has not happened yet), closing the one silent-refusal gap; only a write after the exit delivers finds no slot, the documented cancel race. - Every desktop platform now reports delete/home/end/pageup/pagedown/insert and f1-f12 as named keys (previously private-use strings or nothing), shortcuts and menu accelerators accept them, and the terminal example maps chorded punctuation and supplies the pressed character to the emulator's encoder — Ctrl+\ reaches the child as its C0 byte, Ctrl+[ as the encoder's fixterms CSI-u form, F1 as ESC O P. * Reset OSC colors on shell restart and honor widget precedence in target-less text - Session.reset now clears the palette and dynamic color overrides (OSC 4/10/11/12): the emulator's full reset leaves its color state alone, so a shell that tinted the palette and exited would otherwise color the next session; overrides drop while theme defaults stay. - The target-less committed-text fallback now honors the widget-precedence contract's structural-claim step: a key the focused widget answers as a control intent (Space pressing a focused button) no longer ALSO types its literal character through on_text, on either committed-text carrier, while unclaimed characters keep flowing to a terminal that happens to share focus with a button. * Wire the new named keys through every platform's menu accelerators - GTK translates them to accelerator names (Page_Up, F1, ...) so gtk_application_set_accels_for_action actually binds them; AppKit converts named keys to their NSMenuItem key-equivalent characters (function-key unichars, control characters) instead of passing the canonical string through, which also repairs the pre-existing arrow/escape menu bindings. - The Windows keydown path now dispatches menu-item accelerators alongside registered shortcuts — a menu item's key+modifiers emits its menu command exactly as if clicked; AppKit and GTK get this from their menu systems, and on Win32 the message loop is that system. * Settle replay feeds at the journal's end and make pty record accounting exact - Replay now verifies at the journal's end record that every journaled ptyWrite verdict was consumed and no write ran past them (the new .settle replay control): a write-count divergence changes no state when the caller is fire-and-forget, so fingerprint checkpoints alone could pass a diverged run — the settle check fails it loudly in both directions. - Output records journal the canonical scalar shape from BOTH drain sites (-1 code sentinel, no signal, no drops) and the replay damage gate refuses records claiming anything else — previously replay silently delivered defaults that differed from a damaged record's journaled fields. - A fed exit's dropped_writes now adds the refusals the fake itself counted (an oversized write against a scripted pty), so the counted-refusal contract holds without every script re-deriving the tally; under replay the slot count is always zero and the journaled count delivers verbatim. * Keep an IME sequence with the consumer it started over - A composition buffered by the target-less consumer continues target-less even when a text widget takes focus mid-sequence: routing its empty commit to the newly focused editor would resolve a composition that editor never saw and lose the composed text. Ownership ends with the sequence — the next composition belongs to the focused editor as usual. * Admit outbound terminal payloads whole or not at all - The pending-outbound ring's admission is now all-or-nothing: a payload it cannot hold whole is dropped whole and counted, never cut at the ring edge — a torn query reply or encoded key would feed the child a malformed escape sequence, which is worse than a counted loss. Reaching the drop at all means the child ignored 256 KiB of pending input, and the count stays on the status line. * Key the replay write verdicts by pty and grow the queue with the recording - The verdict queue now spills to the heap past its inline window (the pending-stage growth story): every verdict a dispatch recorded feeds before that dispatch replays, so a fixed bound would reject a valid recording whose one update wrote more times than the bound — a giant paste drained in per-write chunks is exactly that. - Each verdict carries the pty key it was recorded against, and a replayed write consumes only a matching-key verdict: the same call count and acceptance results against a DIFFERENT session is still divergent input, which a global boolean sequence would silently pass; a mismatch counts as divergence, strands its verdict, and fails the end-of-journal settle on both signals. * Canonicalize menu key case, teach the Chromium host the named keys, and state the reaping contract - Menu-item keys canonicalize to lowercase at each host's storage boundary, matching the shortcut stores that already did: key names validate case-insensitively, so a mixed-case spelling must still translate to a valid GTK accelerator name and a correct AppKit key equivalent (single characters lowercase there too — uppercase implies Shift, which the modifier mask already expresses). - The macOS Chromium host's key normalizer gains pageup/pagedown/insert and f1-f12, so shortcuts on those keys fire under that host exactly as under AppKit. - The kill fence's ownership premise is now stated at the signal site and in the recipe: the toolkit forks each pty child, is its sole reaper, and never touches SIGCHLD disposition — an embedder must not either, because POSIX offers no portable way to signal a pid once a third party (including a kernel auto-reap) can free it first; inside the contract the reaping fence is exact. * Settle the clock feed too, and retain query replies a full ring refuses - settleReplayFeeds now holds the clock feed to the write-verdict rule: a wallMs read past the journaled values (answered 0 optimistically) or a journaled value never consumed is divergence no checkpoint need see, and either fails the end-of-journal settle loudly. - A query reply the pending ring cannot take right now stays IN the emulator's buffer — uncleared, uncounted — and retries on the next output, resize, or frame nudge, so a child blocked on a DSR answer behind a full ring is never stranded by a discarded reply. Transient payloads (typed text, encoded keys) keep the counted-drop disposal since their bytes cannot outlive the dispatch; only a payload larger than the whole ring is impossible and counts immediately. * Align start-failure write verdicts, grow the reply buffer, and strip the primary alias from encoder chords - A write against a spawn whose transport failed synchronously now journals its refused verdict: the staged executor-truth terminal keeps the key occupied on the live side exactly as the parked slot does under replay, so the two verdict streams stay aligned where they previously diverged (live refused silently, replay consumed a verdict that was never recorded). - The emulator's query-reply buffer is heap-grown to fit (up to the outbound ring's own capacity): replies retained behind a full ring keep accumulating while further output feeds, instead of overflowing a fixed buffer into counted drops that could strand a blocked child; past the ceiling a reply still drops whole and counted, never cut. - The terminal encoder strips the runtime's primary-into-super fold when Ctrl raises it, so a bare Ctrl chord reaches the emulator clean and Ctrl+C delivers ETX — a stray super demoted it to a CSI-u chord no foreground shell treats as an interrupt. The GUI+Ctrl double chord encodes as plain Ctrl, the convention terminals follow. * Hold stdin order across a retained reply - A query reply retained behind a full outbound ring is older than any later keystroke, so transient input now gives the reply its retry first and refuses to jump the queue while it remains stuck (dropped counted, never reordered) — the child's stdin keeps the order a real terminal delivers: the answer it is parsing toward, then the typing. - The output arm retries retained replies right after its flush frees ring room, so the oldest bytes take that room before anything a later dispatch could enqueue. * Refuse and count fake writes after the staged exit, folding drops at delivery - A fake pty now mirrors the live admission path's staged-exit rule: a write after feedPtyExit staged the terminal refuses and counts as dropped, never a silent acceptance into a session that is already over. - The dropped tally folds the slot's count into the delivered exit AT DELIVERY (both the fed-exit queue drain and the start-failure stage), the same read-at-delivery rule the live staged-exit drain follows — so refusals landing between the feed and the drain still reach the delivered count; under replay the slot count is provably zero and the journaled count delivers verbatim. * Land start-failure write refusals in the staged exit's tally - A write refused in the synchronous start-failure window now counts onto the staged terminal entry itself: that terminal's slot was already released, so no slot tally could carry the drop to delivery, and the exit reported zero despite the refusal. The counting walk is the occupies-key predicate with the bump folded in, so the verdict journal and the delivered tally move together — the exit reports every refusal, never silence. * Settle undelivered pty feeds, serialize the spawn's descriptor window, and state the process-group kill limit - settleReplayFeeds now refuses fed pty results still queued at the journal's end: every result was journaled at its live delivery, inside an event that follows it in the stream, so a leftover means the journal was truncated past its consuming event — succeeding would silently omit a recorded delivery. Regenerating staged rejections stay exempt (the live run could end with one staged too). - The pty spawn's whole descriptor-opening window — posix_openpt through fork — now runs under one process-wide lock, and the parent end's close-on-exec fcntl is verified: Darwin ignores O_CLOEXEC on posix_openpt, so a concurrent toolkit fork landing inside another spawn's flag gap would gift its exec'd child a copy of that pty's parent end for the child's whole life. Our own forks can no longer land there; an embedder fork keeps the documented residual window the exec probe's timeout nets, and the probe still polls outside the lock. - The kill contract now states its real reach at every site: SIGKILL lands on the child's process group (the whole foreground job), and a descendant that re-grouped itself escapes — POSIX has no kill-whole-session primitive, the spawn family's documented limit. * Cover every descriptor window with the spawn lock, bound the surrendered reap, and carry an unresolved exec probe to the reap - Every toolkit fork and every Darwin flag gap now shares one lock: the wake pipe's creation and the job-spawn family's process start hold the pty spawn lock, so no toolkit child can inherit another spawn's not-yet-CLOEXEC parent end, pipe writer, or wake pipe across its exec — only embedder forks on threads the toolkit does not own keep the documented residual window. - reapEnding's final wait is bounded: a SIGKILL'd child the kernel holds in uninterruptible I/O cannot be waited out by any signal, so past a further deadline the reap is surrendered and the kill reported as the ending — the exit always reaches the app, and the eventual zombie is the bounded, documented cost that beats an io thread wedged forever. - An exec probe that times out no longer guesses success: the status pipe rides the transport (non-blocking) and is read at reap time, when a failing exec's byte — written before its _exit — is present by construction, so an executable that blocks past the bound and then fails still delivers spawn_failed, never a masqueraded normal exit. * Intern staged rejection keys for the model's life, bound failure-path reaps, and free the spawn lock from job starts - Staged rejection keys are now INTERNED and instance-lived: the TS commit walker shares non-frame pointers into the committed model rather than copying them, so a reducer that stored a rejection's key held memory the old reclaim could free mid-run. Interning bounds the storage by the app's distinct key vocabulary (repeat rejections of one key cost nothing) and the buffers outlive every model that references them. - The pty thread-start and wake-snapshot failure paths use the escalate-then-surrender reap: a child wedged inside an exec on a stalled mount cannot be waited out, and an unbounded waitpid there froze the UI loop instead of delivering spawn_failed. - The job-spawn process start no longer holds the pty spawn lock — it blocks on its own exec-status pipe, so a stalled execve would have wedged the lock and frozen the UI the moment a pty needed it. A job fork landing in a pty flag gap joins the documented bounded residual (inherited copies die at the job child's exec; a delayed exec-pipe EOF resolves through the carried reap-time verdict, never a guess). * Pin compositions to their starting editor, shorten the exec probe, and re-poll surrendered reaps - An IME sequence now routes its continuations to the text entry it STARTED in: a per-view owner is pinned when a set_composition routes and released when its commit, cancel, or a direct insertion closes the sequence — so a focus move mid-composition no longer strands the starting editor's marked text or leaks the commit through the target-less fallback, the mirror of the target-less ownership rule. - The exec probe's deadline drops to half a second: the unresolved verdict carries to the reap where a late failure still reports spawn_failed exactly, so the synchronous wait buys only the instant-failure nicety and no longer holds the loop for seconds; the PATH walk's access() probes remain the documented stalled-mount residual of the spawn-position verdict the replay contract requires. - A surrendered reap now parks its pid on a process-wide list re-polled (WNOHANG) at later spawns and at teardown, so a child that dies after its device or mount recovers is reaped then instead of zombieing for the process's life. * Decide the text claim before app rebuilds, swallow orphaned compositions, and state the Darwin pipe residual - The target-less committed-text claim is decided against the tree the input actually routed through, BEFORE the app dispatches that may rebuild it: a Space that pressed a focused button whose command removes that button still counts as claimed, so one physical keystroke can never double into a command and a literal space. - A widget-owned composition whose editor vanished mid-sequence resolves nowhere: its commit or cancel is swallowed (the newly focused editor never saw the composition, and the target-less consumer never composed it) and the stale pin clears, so a fresh composition reopens cleanly at the focused editor. - The Darwin pipe-then-fcntl window is stated fully at its site: pty forks are locked out, and the residual — a job or embedder fork landing inside it — is bounded on every axis (the copy dies at that child's exec, a wedged exec costs at most the half-second probe with the carried verdict keeping the outcome correct, a held wake pipe merely outlives its session's close until that exec). * Route converted commits to the composing editor, latch orphaned sequences whole, and keep EINTR'd surrendered pids - Every host encodes a converted commit (the composed result differs from the marked text) as cancel-then-text_input, so a cancel now holds the owner pin one event and arms a one-shot grace: the trailing text_input lands in the editor that composed it, never the newly focused one — while a plain cancel's own key_down disarms the grace before ordinary typing could inherit it. - An orphaned sequence swallows EVERY continuation: the pin holds through preedit updates (the sequence is still open, and the focused editor must not inherit them) and releases only at its commit or cancel, with an orphaned cancel arming the swallow grace so the converted commit's trailing text vanishes with the sequence instead of typing into a stranger. - reapSurrendered keeps a pid whose non-blocking poll was interrupted, rather than abandoning a live child to zombie unreaped; only a reap or ECHILD settles the entry. * Give target-less compositions the converted-commit grace too - A target-less composition's cancel now arms the same one-shot grace its widget twin got: the hosts encode a converted commit as cancel-then-text_input, so the trailing text still belongs to the surface that composed it — delivered target-less on that surface, never inserted into whichever text widget took focus mid-sequence. A plain cancel's own key_down disarms the grace before ordinary typing could inherit it. * Retry the late-failure read, orphan-check the commit grace, and die with the view - lateExecFailure retries an interrupted read instead of mistaking EINTR for success: the failure byte may be sitting right there, and reading past the signal is what keeps a delayed exec failure reporting spawn_failed. - The route-to-owner grace re-checks its owner at consumption: the cancel's own app dispatch can rebuild the tree away from the composing editor, and a dead owner converts the grace to a swallow — the converted commit's text resolves nowhere, never in whichever editor holds focus by then. - A target-less composition dies with its view: removing a surface clears any sequence it owned, so a later view reusing the same window and label never mistakes its first composition for a stale continuation that would bypass its own focused editor. * Disarm IME graces on blur and view removal, and re-anchor selection across a resize - A view losing focus disarms its cancel-to-commit grace (and the target-less twin) and releases the owner pin: hosts emit a standalone cancel when a composing view blurs, and after refocus an IM-consumed keystroke's text_input arrives before its key_down echo — a stale grace would route that fresh commit to the old editor or swallow it. - Removing a view clears the target-less grace even when the preedit length is already zero (cancellation zeroes it before arming), so a converted commit's trailing text can never leak target-less into a surface recreated under the same label. - Resizing the terminal re-anchors an armed selection at the clamped caret: reflow moves every cell, so coordinates into the old grid are dropped rather than copied, and Shift+Arrow keeps operating inside the new grid. * Share the blur-side IME hygiene across every focus path, fix the backspace key equivalent, and range-gate exit records - Every focus-mutation entry point — the pointer-driven focus move, the programmatic focusView, and the window-level clearFocusedView blur — now routes through one shared blur helper that disarms the cancel grace and releases its owner pin, closing the lifecycle class structurally instead of per path; audited all view-focus writers to exactly these three. - The macOS "backspace" menu key equivalent maps to 0x7f, the byte the physical Delete/backspace key actually emits (and the key-event normalizer maps back to "backspace") — the nominal BS control 0x08 never fired; every other named key in the table was audited against the normalizer and matches. - Pty exit records are range-gated to what waitpid's status word can produce — codes 0..255 plus the documented -1 externally-reaped sentinel, signals 1..127 — at both the replay damage gate and the feed boundary, refused as damaged rather than replayed into an event no live run can emit; pinned with hand-damaged records on both axes and both directions. * Honor the requested TERM, AltGr text, IME resolutions past claims, flush-first admission, and a clipped grid - The pty environment now replaces an inherited TERM with the spawn's requested value (the spawn declared what terminal the child is attached to; a stale TERM=dumb from the host would misdeclare it), pinned live; and the restart resets the previous session's copy feedback. - AltGr input survives both layers: the text-chord gate exempts Ctrl+Alt together (hosts represent AltGr that way, so a text event carrying both is composed text, not a shortcut), and the terminal's key mapper stops encoding Ctrl+Alt printables as chords for the same reason — the composed character rides the text channel alone. An IME resolution (an owned empty commit, or a converted commit's grace-ridden text) also bypasses the structural-claim gate: it ends a sequence the focused widget never participated in, so a button's Space claim cannot eat it. - Outbound admission flushes before refusing (stale occupancy must not drop a keystroke the drain would have made room for), with a fake full-FIFO test seam standing in for a child that stopped reading; and the grid paints under a clip to its frame with an exact bottom-row guard, so the one stale pre-resize frame degrades to a cropped grid instead of painting over the status bar and past the right edge. * Deadline the reap graces, carry claims across split events, and finish the exit accounting - reapEnding's grace windows are monotonic deadlines: usleep returns early on EINTR, so iteration counting let a signal-heavy embedder collapse the 500 ms hangup grace into an almost-immediate SIGKILL and shrink the surrender window; the surrendered list is also re-polled at every session end, so a recovered child is reaped at the next pty activity of any kind. - The committed-text claim carries across the event split: hosts that deliver a claimed key_down and its committed character as separate events (unlike the key-with-text shape) would recompute the claim against a tree the activation already rebuilt — a one-shot per-view carry keeps one physical keystroke from doubling into a command and a literal character. View blur now clears the composition owner unconditionally too: an active sequence's pin surviving a blur would redirect post-refocus typing to the stale editor. - The example's AltGr exemption narrows to the host that actually represents AltGr as Ctrl+Alt — elsewhere that combination is a genuine chord that must encode — and session end is accounted honestly: cleared outbound bytes count as dropped, retained replies drop with the dead key instead of retrying against it every frame, transport write refusals reach the status tally, and a signaled or cancelled end says so instead of rendering as exited (-1). * Never strand a pre-bind pty exit, and die the claim carry at blur - A failed bind-site snapshot publication now stages a live pty's cancelled terminal from the loop past the wind-down deadline, so the exit delivers instead of waiting on a wake that can never fire - The split-event claim carry clears at blur with the IME grace: a claimed activation that moves focus no longer swallows the refocused surface's first commit - A restarted shell starts its refused-write tally at zero instead of inheriting the dead session's drops * Give the input method its keys, and make the grid preflight measure what paints - A target-less composition now owns its surface's key_downs (candidate navigation, the trailing resolver key on hosts that run the IM filter first), so confirming a candidate with Enter never also sends CR; the buffered preedit and its graces die at the surface's blur - The split-event claim carry is keyed to the armed activation key's own literal, so a different key's committed text arriving next flows instead of feeding a stale latch - The grid's row preflight now counts only bytes painting emits (invisible cells suppress, clusters cap at the run scratch), a session exit counts retained reply bytes as loss, and each fix is pinned in both tiers * Free pty staging only on the io thread's own completion proof - Retirement defers the staging/outbound frees to the thread's io_done publish (same critical section as its staged exit) and leaks them past an abandon, so a detached thread can never observe freed blocks - The outbound flush re-checks open/generation after its unlocked write before touching the block or folding drop counts, closing the one ungated deref - A superseded thread (slot reused after an abandon) goes silent at its next loop head and never publishes reaping/io_done into the successor; pinned with a deadline-miss abandon carrying an in-flight write and a free-counting seam * Suppress IM-consumed composition keys at the GTK source, and bound the grid by what the renderer can hold - Replace the one-shot resolved-key grace with host-side suppression: GTK surfaces no key_down for a key its input method consumed while composing, so a mouse-committed candidate never costs the next genuine Enter or arrow - A styled wide character's spacer tail extends the primary cell's background run, covering both cells for SGR backgrounds and inverse video - Painting stops row-atomically before crossing a distinct-code-point budget (the glyph-atlas proxy), and the run scratch grows to the full text store so any cluster the emulator holds paints whole; each fix pinned * Let compositions own their keys before widget routing, and put real cells in the terminal's semantic surface - A live target-less composition suppresses unchorded key routing ahead of every widget pass (dismissal, focus moves, activation), so a confirming Enter never presses a freshly focused button; chorded shortcuts stay live - hostRequest's inline pre-flight now rejects keys held by live or staged ptys, matching the shared keyed-effect namespace every other issuer enforces - The grid's accessibility label is the viewport text, carrying real cell state into the session fingerprint (equal byte counters with different screens no longer verify), and a failed selection re-pin clears the emulator selection instead of leaving a stale copyable range * Settle every fed family, refuse fed overflow loudly, and keep the semantic screen honest - The end-of-journal settle now reports ANY fed result left undelivered (every family plus journaled env records), and a fed line against a full queue answers EffectQueueFull for the replay pump's drain-and-retry instead of silently converting a recorded delivery into a drop - GTK swallows a suppressed composition key's release too (no orphan key_up), and Windows lets AltGr-composed WM_CHAR text through the chord gate it raises Ctrl+Alt for - The terminal's semantic screen text is heap-exact (never truncated or cut mid-scalar), refreshes when a scroll moves the viewport, clears to unknown on a failed render instead of going stale, and a failed selection serialization surfaces as a failed copy with the selection kept * Close the key-suppression edges and keep selection, scrollback, and copy coherent - GTK dedupes suppressed composition keys under autorepeat and clears them at focus loss; Windows discards the WM_CHAR a dispatched shortcut already consumed (AltGr chords type only when no accelerator matched) - The surrendered-reap table evicts round-robin on overflow, so every wedged child keeps a retry seat instead of all forgetting behind slot zero - Scrollback chords pause while a keyboard selection is armed (viewport-relative caret vs absolute range), and a copy over a vanished emulator range reports failure instead of quietly keeping stale clipboard content * Track suppressed keys by keycode, disarm graces the suppression starved, and confirm before clearing - GTK tracks composition-suppressed keys by physical keycode (a lifted Shift cannot rename the release) and a plain cancel whose resolving key_down is suppressed emits a synthetic duplicate cancel, so the runtime's cancel-to-commit grace disarms instead of eating the next ordinary commit - The Windows shortcut latch holds across the keystroke's whole translated burst (ligature layouts post several WM_CHARs), disarmed by the message sequence at the next key transition - A terminal selection now anchors at the live cursor (never the last painted snapshot) and survives until the clipboard write CONFIRMS - a failed write keeps it standing for the retry the status promises * Paint the terminal where the user can see it - The grid region spacer is a stack, not a panel: the panel's surface chrome (fill, border, shadow, rounded corners) painted OVER the chrome-prefix grid, blanking the whole terminal - Grid text anchors its BASELINE (origin is not the glyph top), so rows land in their cells instead of one line high with row zero swallowed by the clip - The session-state indicator is a quiet muted label instead of a pill that read as a half-painted toggle, and a painted-output oracle now renders the retained frame to pixels headless and asserts the prompt's ink and the caret's cell * Build the terminal example on hosts with only the command-line tools - Disable ghostty's macOS app and xcframework artifacts in the dependency options: only the vt module is consumed, and their configure step resolves the iOS libc, which aborts without a full Xcode install * Fall back to FIONBIO when Darwin's pty parent end rejects F_SETFL - Some macOS releases return ENOTTY from fcntl(F_SETFL, O_NONBLOCK) on the posix_openpt fd while the FIONBIO ioctl succeeds; the shared setNonblock helper tries fcntl first and falls back, so a spawn no longer fails whole on those kernels * Set the pty parent non-blocking only after the replica opens - Some Darwin kernels answer ENOTTY to both fcntl(F_SETFL) and FIONBIO on a pty parent whose replica has never been opened, and accept the identical call once it has; the spawn now orders the non-blocking step after the child end opens * Scope the AltGr chord exemption to Windows and keep an armed selection on its text - Ctrl+Alt is a genuine command chord on Linux and macOS (AltGr rides its own level-3 shift there), so the text gate exempts the pair on Windows alone - a chorded key mid-composition now reaches the app instead of being swallowed - Output that scrolls the live screen rebases the keyboard selection from the emulator's absolute pins: the caret follows the selected text, and a range that leaves the viewport clears selection mode instead of desynchronizing copy from the caret * Arm the cancel-to-commit grace only while a composition owner is pinned - A duplicate cancel (the hosts' synthetic disarm for a consumed cancelling key) arrives after the grace probe already released the owner; re-arming ownerless converted the next ordinary character into a dead-owner swallow, so the arm now requires a live owner * Honor negotiated kitty modes for committed text and key releases, and admit one copy at a time - Committed single-scalar text routes through the emulator's key encoder: byte-identical raw text under legacy modes, CSI-u under a TUI's report-all; multi-scalar IME commits stay raw per the protocol - Key releases reach the encoder through an opt-in on_key phase (key_release_events), emitting kitty release events when negotiated and nothing under legacy; repeats stay presses, the one event type hosts do not distinguish - A copy while the clipboard write is in flight is a no-op, so a duplicate-key rejection can never overwrite the first copy's success; the non-Latin Ctrl-chord gap is recorded as an accepted tail pending base-layout key data in the platform vocabulary * Wheel scrollback, geometric box drawing, and a window that is just the terminal - Trackpad and wheel scrolls over the grid ride a new on_wheel app channel (the pinch channel's sibling) into whole-row scrollback with fractional accumulation; inert while a selection is armed - U+2500-259F render as geometry at exact cell bounds - lines, tees, crosses, doubles, quarter-arc rounded corners, diagonals, blocks, shades, and quadrants - with identical-piece runs merged into single bars, so borders join seamlessly where font glyphs showed seams - The window is a standard titlebar plus the grid: header and status bar removed, size readout gone, keyboard hints moved to the README * One seamless surface: hidden-inset chrome with the terminal running under the traffic lights - The window drops its title and titlebar strip (hidden_inset): the theme background fills edge-to-edge including the titlebar band, the grid's text starts below the reported chrome inset, and only the traffic lights float over the terminal * Shift the video tests' journal byte offsets past the appended pty trailer - The pty record fields append 33 bytes after the video fields in every effect payload, so the hand-patching damage helpers now offset from the pty trailer * Stitch the pty conformance fixtures after the video fixtures - Two fixture-list merge points kept both families' cases in sequence; the video entries close before the pty entries begin |
||
|
Chris Tate
|
501b59e490 |
Two-axis canvas scrolling with axis-aware routing (#190)
CI / Zig Core (push) Has been cancelled
CI / Linux Canvas Smoke (push) Has been cancelled
CI / Linux Dev Smoke (Debug scaffold) (push) Has been cancelled
CI / Windows Canvas Smoke (Wine) (push) Has been cancelled
CI / Windows Effects Smoke (Wine) (push) Has been cancelled
CI / Frontend Examples (push) Has been cancelled
CI / Mobile Examples (push) Has been cancelled
CI / Generated App Scaffolds (push) Has been cancelled
CI / macOS WebView (push) Has been cancelled
CI / macOS GPU Perf (push) Has been cancelled
CI / Linux WebKitGTK (push) Has been cancelled
CI / Windows WebView (push) Has been cancelled
CI / CEF Platform Tooling (push) Has been cancelled
CI / npm Package (push) Has been cancelled
CI / Native Examples (push) Has been cancelled
CI / Evals Typecheck (push) Has been cancelled
CI / Docs (push) Has been cancelled
Release / Check for new version (push) Has been cancelled
Release / Create GitHub Release (push) Has been cancelled
Release / Publish CLI to npm (push) Has been cancelled
* Make canvas scroll state and routing two-axis - Widen ScrollState to eight per-axis fields (ScrollAxisState carries the physics), route each wheel axis independently to the nearest ancestor scrollable on that axis, and step kinetic motion per axis. - Add the scroll axis declaration (attr 86 axis, attr 87 value-x, Widget.scroll_axes/value_x) through schema, markup validation, both engines, layout, clamping, reconcile, semantics, and the two-bar scrollbar renderer. - Break the one-axis on-scroll record consciously: the reflect vocabulary, contract class, and both engines now teach the per-axis migration by field name, and the scroll-driver ABI/journal carry offset_x. * Carry both scroll axes through hosts, docs, and the TS SDK - Widen the macOS native scroll driver ABI to offset_x with a horizontal overlay scroller; GTK and Windows wheel handlers already forward delta_x. - Update the TS SDK ScrollState to the eight per-axis fields and regenerate the markup vocabulary and scroll reference for axis/value-x. - State the ScrollState break and its one-sentence migration in the changelog fragment. * Pin two-axis scrolling with routing, driver, replay, and markup tests - Cover the nested independent-axis routing case (dy to the vertical child, dx to the horizontal ancestor), the horizontal wheel/keymap/scrollbar paths, and per-axis driver sync with pinned ranges on ungranted axes. - Ride a diagonal wheel through the reference record/replay session so a journaled two-axis scroll replays to identical per-axis offsets. - Migrate the example apps to the two-axis ScrollState fields. * Give the soundboard detail page a horizontal collection shelf - Rail every other album under the track list on an axis="horizontal" scroll region: the grid's quiet-hover cover tiles, one press from record to record. - Echo the shelf's offset_x into value_x (the controlled-scroll shape on the sideways axis) and reset the rail when an album opens. - Teach the widget-wheel automation verb an optional delta-x token so drivers can scroll both axes like a real trackpad gesture. * Harden two-axis scrolling per external review - Keep the vertical scrollbar's thickness formula byte-identical (per-axis derivation), exclude anchored/clip-scope/concealed-disclosure subtrees from horizontal extents, and stop region-anchored surfaces riding scrolled content. - Route macOS native wheel gestures by dominant-axis capability with an engine-wire fallback, and rewrite a queued driver report when a programmatic offset lands. - Pick scroll semantics by live range on both-axes regions, page every granted axis on assistive steps, carry fling velocity per axis only while its offset survived, refine the axis/virtualized validation to the horizontal grant, and migrate bench_render. * Split residual wheel axes on macOS and arm driver chrome per grant - Forward the axis a locked native driver cannot travel to the wire, so one diagonal gesture scrolls a vertical list natively while its delta_x reaches the horizontal ancestor through per-axis routing. - Carry the axis grants on the driver spec: elasticity and scroller chrome arm only on granted axes, so a horizontal-only region can never bounce vertically or report an offset the runtime would fight. - Accept the optional delta-x token in the automation CLI, and warn at the builder seam when a DYNAMIC value pairs a horizontal grant with virtualization or value_x with a vertical-only region (both engines share the seam, so the diagnostic stays engine-uniform where validation cannot see the resolved value). * Route every macOS wheel through the axis splitter and split set_offset per axis - Stop the driver view claiming wheel events at hit test: the surface's dominant-axis selection, gesture lock, and residual-axis split now own all wheel routing, so a diagonal gesture over a nested vertical list cannot swallow the horizontal component its ancestor owns. - Make the driver set-offset flag per axis end to end, so a programmatic vertical write can never push a stale horizontal offset over native motion whose coalesced report is still in flight. - Teach the a11y focus-reachability audit the axis grants (offscreen-right tiles on a horizontal shelf are reachable, below-viewport content there is not) and bump the model-contract format to 2 - a format-1 artifact classified the retired one-axis scroll record as a scroll_state payload, which would be a false pass today. * Pin the axis-aware focus-reachability audit - A horizontal shelf's offscreen-right tile is reachable by design while a below-viewport button inside it stays a finding. * Match native wheel routing to the engine walk and step the live axis - Route each gesture axis to the deepest native driver that can consume its delta right now (direction-aware, so a saturated inner region hands an outward swipe to its ancestor), falling back to the outermost elastic region — rubber-band regions bounce even with short content — and reconcile the driver array in layout pre-order so keyed reorders keep the walk honest. - Forward a residual axis only when the locked driver can neither move nor bounce on it. - Assistive increment/decrement on a both-axes region whose only live axis is horizontal now step sideways instead of paging a zero-range vertical axis; pinned through the accessibility action path. * Resolve wheel owners per axis with measured residuals and axis-keyed reach latches - Replace the single-winner gesture lock with per-axis owner resolution at the gesture's anchor point, re-evaluated per event against live scroller offsets: saturation hands an axis to its ancestor (elastic-take never outranks a consumer), cross-owner diagonals whose native recipient would eat the other axis ride the wire whole, and the residual is MEASURED (delta minus what the scroller actually absorbed) so a nearly saturated region can never double-spend. - Flush the coalesced driver report before any residual or cross-owner wire emission (offsets first, one clock), and route wheels over a visible overlay scroller through the same splitter instead of the knob. - Key reach-end/reach-start hysteresis latches by (id, axis) so a region whose primary axis changes re-arms honestly. * Flush driver offsets before the no-owner wire hand-off too - Every wire emission now rides the offsets-first clock, including wheel events no native region owns. * Size the collection shelf to actually overflow at desktop widths - 168-point tiles keep seven sibling covers wider than the regular shell's content row, so the rail scrolls where it ships. * Close the native-seam races and honesty gaps from the cycle-2 review - Restrict wheel-owner resolution to the hit region's ancestor chain (parent driver ids through the ABI), anchor wire hand-offs at the gesture point, carry sub-half-point residuals across events, and wire-bind any region the engine scrolled this gesture so a later absolute native report can never erase relative wire motion. - Skip subtrees anchored directly to the region in every VERTICAL extent walker (a stationary surface counted against a moving offset grew the range without bound), decide the assistive step axis from the semantics metrics (concealed-disclosure and anchored exclusions included), and page exactly one axis on widget-level semantic steps. - Flag content stranded before a horizontal region's origin in both audits (offsets clamp at zero), double the reach-latch capacity for the (id, axis) key space, and fire reach signals only when the latch stores. * Treat each discrete wheel as its own gesture - Legacy (phase-less) events reset the wire bindings and residual carries per event, so a binding can never demote a region to the wire forever. * Scope phase-less wheel gesture state to bursts, not events - A quiet gap (250ms, well past the input queue's one-frame coalescing) is the gesture boundary for discrete streams: residual carries keep accumulating sub-half-point deltas and wire bindings outlive any in-flight relative hand-off, while a fresh burst still resets both so no binding lives forever. * Honor overlays, phases, and revoked axes on the native wheel seam - Push OCCLUDER rects (anchored floating surfaces at their frames, modal catchers as the whole view) with per-driver masks through the driver sync, so the host's geometric wheel routing declines exactly the points the engine's hit test would give to an overlay's branch; drivers inside the overlay stay exempt. Pinned through the null platform. - Forward zero-delta phase events (begins, the terminal Ended/Cancelled) to the gesture's last native recipient so the scroller's overscroll bookkeeping always terminates, and scope residual carries to the hit region so fractional motion never leaks onto whatever chain the pointer wanders to next. - Pin REVOKED axes home on native-driven regions too (the range clamp stays the OS scroller's), so an axis flip behaves identically on every host instead of resurrecting a stale echoed offset on re-grant. * Make native wheel routing engine-exact: one owner or the wire - One owner takes the WHOLE event natively and clamps at the edge exactly like the engine's consume-and-drop rule; split owners, dead axes, and wire-scrolled owners ride the wire whole — the residual measurement, fractional carries, and partial-clamp forwarding are gone, and consumption uses the engine's exact bounds. - Zero-delta phase events forward only the gesture bookkeeping to the last native recipient; nonzero no-owner deltas go wire-only, so an overlay opening mid-momentum can no longer keep moving the obscured region. - Fix the occluder model on every reported edge: view-local modal rects, tooltip passthrough, scrim=false previews, hidden/concealed surfaces, render transforms, self- and paint-order exemptions for anchored scroll regions, and a fail-safe whole-view occluder when surfaces outnumber the budget; both-axes semantic steps read child-frame range so the stepped axis matches the exposed semantics. * Carry the two-axis scroll state through corewire's ABI seam - dispatch_scroll_state now carries the eight per-axis scalars in declaration order; the retired one-axis quartet rides the generic record entry - pin the new routing and the quartet's retirement in emit tests, and match the stub core's export to the widened symbol |
||
|
Chris Tate
|
7563a4e61a |
Letterbox video to its stream aspect and anchor the example's status bar (#189)
* Letterbox the video surface: contain is its one fit mode - The builder stamps contain fit and the LOADED report's stream dimensions on every media surface the video channel feeds; the emit computes the centered aspect-fitted quad over a black backdrop, so every host composites the same geometry with no fit math of its own - Unknown dimensions pre-LOADED keep the full-frame placeholder draw (no guessed geometry, no divide-by-zero); a source replacement re-fits from the new report - Paint-level pins: reference-rendered pillarbox/letterbox/exact-fit pixels and quads, the Ui stamp, and a null-platform end-to-end letterbox + re-fit test; the video doc states contain-by-default * Anchor the video-player status bar full-bleed to the window edges - The page padding wraps only the content column; the status bar is the root column's last child - flush left/right/bottom with its own padding and the token hairline separator, on both screens - A layout test pins the full-bleed frame at the window edges * Add the video contain-fit changelog fragment - One fix fragment: contain-by-default letterboxing on the video surface, placeholder pre-LOADED, re-fit on replacement * Scope stream geometry to the fed surface and keep the placeholder under the bars - Stream dimensions ride a dedicated Widget.stream_size stamped only on the surface the active playback feeds - a source-less <video> beside a custom-surface load keeps its placeholder, and image_src keeps its source-crop meaning on every widget - The letterbox paints black over exactly the remainder bars, leaving the deterministic id-derived placeholder under the picture quad for goldens and replay screenshots - A bar-inset quad drops the radius mask (its corners sit in the bars) while each bar rounds only its outer corners, keeping a rounded surface's silhouette * Harden the contain fit: diff coverage, seam-free quads, thin-bar masks, purge on video claims - stream_size joins the widget diff's content comparison so a LOADED report alone invalidates retained paint, and the known-geometry draw stretches into the engine's quad - a decoder whose true dimensions round off the report can never open a host-side contain seam - Bars thinner than the corner radius keep the frame's mask on the quad (a hairline bar cannot cover a rounded corner), pinned alongside the drop-the-mask case - A video-channel claim purges the previous playback's retained texture (entry, host copy, repaint) so a replacement's new fit never composites the old stream's stale frame; generic producer re-claims keep the adoption-boundary dedup contract * Draw the letterbox as a rounded black field with a tangent-masked quad - The fitted shape is now three commands: black across the whole frame at the frame's radius (the silhouette, exact by construction - no per-bar corner approximation), the placeholder confined to the quad, and the picture quad - The quad's mask is the tight inset radius max(0, corner - bar): internally tangent to the frame's corner circle, so hairline bars neither leak picture past the silhouette nor notch more corner than the silhouette demands - A declared image_src crop drives the fitted quad's aspect - the crop is what draws, never flattened into the full stream's proportions * Clamp the fit radius, clip crops to the stream, and end the picture on video release - The tangent-mask math starts from the renderer-effective corner radius (clamped to half the frame's short side), so an unbounded style radius can no longer round a fitted quad into a circle - A declared crop clips against the stream bounds before driving the quad's aspect, and the draw samples exactly the clipped region - an out-of-range crop never stretches its visible remainder - The video-channel release purges the adopted frame: stop/replace/failure drop the surface's contain stamp on the next rebuild, and a retained freeze-frame would composite distorted under "no playback" chrome; pause and natural completion keep their claim and picture * Keep crops off the fitted video draw and pin the binding's thread contract - The fitted draw always samples the whole texture at the stream's aspect: DrawImage.src is adopted-texture pixel coordinates and the video texture's size is unknowable at emit (macOS budget-fits large decodes), so a stream-coordinate crop cannot be translated - crops stay a generic-producer facility in texture coordinates - MediaSurfaceBinding is documented loop-thread-only on both halves: release purges loop-thread runtime texture state, matching its only callers (the video channel's update-dispatch paths); producer threads hold the sink, never the binding |
||
|
Chris Tate
|
dd9307656a |
Hover Msg bindings: on-hover-enter and on-hover-leave (#188)
* Add the hover-enter/hover-leave event pair to the markup vocabulary - Registry events 11/12 (on-hover-enter / on-hover-leave): payloadless Msg bindings, legal on any element like the press family. - Binding stamps Widget.hover_msgs — hover-hittable via the chart hover-details rule (no press claim, no wash, no a11y action) — and widgetHoverMsgChainFromNode collects nested listeners outermost-first for containment tracking. - Both markup engines, the builder handler table (UiHandlerEvent.hover_enter/hover_leave), and parity/chain tests; the markdown arena canary's linear factor absorbs the larger Ui.Node. * Track hover-Msg containment in the runtime and dispatch enter/leave - Each view keeps a standing containment chain recomputed at exactly the wash-resolution seams (pointer phases, scroll re-hit-tests, layout adoption, rebuild and dismissal prunes), so hover Msgs and the wash never disagree; cancel is the window-leave edge and unbound apps keep an empty chain. - UiApp diffs the chain against its delivered mirror at the tail of every runtime event — leaves innermost-first, enters outermost-first, leave Msgs captured at enter time so unmounted elements still deliver the pair; a pass cap bounds flapping apps. - Tests pin nested containment, cancel, enter-that-unmounts, scroll-under-stationary-pointer, and record/replay determinism through the reference session's raw pointer moves. * Prove the hover pair end to end over a transpiled TS core - The markup fixture's task rows bind on-hover-enter/on-hover-leave with for-each payloads into a hoveredId mirror; payloadless events need no TS SDK type surface. - The e2e test drives raw pointer moves through the null platform: enter with the row payload, row-to-row handoff, and the paired leave clearing the mirror. * Document the hover pair and give notes a status-bar hover preview - Markup reference, LSP/vocab doc tables, and the native-ui skill cover on-hover-enter/on-hover-leave: containment semantics, the pairing guarantee, wash separation, and the touch-honesty note. - examples/notes: hovering a note row previews its title, age, and word count in the status bar without committing the selection, with a real-pointer test. - Changelog fragment for the feature. * Harden hover-Msg capture, delivery, and the touch-honesty gate - Captured leave Msgs deep-copy their payload slices into slot-owned bytes (a standing hover outlives the build-arena pair), with live-tree fallback for payloads the budget cannot own; enters resolve from the live tree per edge. - Containment advances only while a hover-capable pointer is live (a hover-phase move, which touch contact cannot produce), so taps, scrubs, and post-fling re-hit-tests never synthesize hover while mice keep full click/drag fidelity. - Delivery degrades per edge (one failed dispatch no longer swallows sibling edges), the drain also runs on a handler's error path, and a transiently missing handler tree defers the transition instead of consuming enters as silence. * Close the hover delivery seams: direct dispatches, pointer identity, and unbounded captures - Public dispatch and drainEffects settle hover edges at their own tails (re-entrancy guarded), so direct dispatches deliver an unmounted element's leave without waiting for a platform event; drain passes degrade per pass and the flap cap is sized past any honest cascade. - The hover-capable proof is scoped to the pointer identity that earned it, and a consumed secondary-stream cancel retires containment like the tooltip machine's pointer-left-view reading — a touch contact can never ride a mouse's proof on hosts that distinguish pointers. - Leave captures are arena-backed (any payload size) and the standing view label is copied out of runtime storage before dispatches that can compact the view array. * Anchor hover containment to the proven pointer and reserve a touch id bit - A proven pointer's wheel refreshes the chain's re-hit anchor before the scroll reconcile, so a wheel arriving ahead of its coalesced motion event derives containment from where the pointer really is. - platform.touch_pointer_id_bit rides the existing pointer_id field: hosts stamp touch-sourced events and the runtime refuses hover proof to stamped ids, so an OS-synthesized mouse-shaped float for a tap can never make touch hoverable; host-side stamping call sites are documented at the bit. - Dismiss events drain hover edges at their tail (the automation dismiss verb dispatches one standalone), and the leave-capture copier handles error sets, error unions, and vectors. * Make hover containment per-listener and its captures slot-owned - The mirror diff is an id-set diff with capture slots decoupled from chain position: an outer listener unbinding (or binding) while an inner one stands dispatches edges for the changed id only — the retained entry never flickers and keeps its captured leave. - Point-blind scroll re-hit-tests use the proven pointer's own anchor, so containment hands off correctly even after another device cleared the shared pointer position. - Allocation failure while capturing a leave defers the enter (and the entering tail) to the next drain instead of dispatching an enter whose paired leave is already lost; the copier's non-transient refusal narrows to single-item pointers. * Close the enter/leave pairing seams: platform window-leave and tree currency - GTK connects the motion controller's leave signal and Windows arms TrackMouseEvent per hover session, both emitting the pointer cancel macOS already sends from mouseExited — window-leave retires hover state on all three desktop hosts (press-in-flight streams settle through their own release/capture change). - Rebuild and slot-rebuild wrap in one currency invariant: a failed build or publication marks the handler trees stale, entering edges defer until a rebuild lands (never resolving through a tree the runtime refused, never consumed as absent), and captured leaves dispatch regardless — a broken destination cannot withhold them. - Standing captures refresh whenever the build generation moves — a leave handler added mid-hover is captured before an unmount needs it, payloads deliver their latest binding, and unbinding retains the last capture; pinned by late-bind, failed-publication, and recovery tests. * Refine hover currency to per-tree families and harden capture copies - Tree currency splits per family: a main-only rebuild can never restore currency for a secondary-window tree whose publication failed — only a clean pass over the slots does — and every drain gate resolves the flag for its own destination. - Capture refresh is copy-then-swap into a spare slot, so a failed allocation keeps the still-valid capture it was replacing. - The slice copy preserves the payload type's own alignment and sentinel, pinned end to end by a builder-only app binding a 64-byte-aligned leave payload through capture, unmount, and delivery. * Carry slot-rebuild bookkeeping everywhere and honor host pointer hand-offs - Every slot rebuild path — the full pass and the direct resize/install sites — stamps the slot family stale on failure and ticks the build generation on success; only the clean full pass restores currency. - The GTK click gesture wires cancel: a transferred or broken grab rolls a pipeline-visible press back with a pointer cancel (a drag-claimed press rolls back silently), so a stale pressed flag can never suppress later leaves. - Windows WM_MOUSELEAVE skips the cancel while the cursor is still inside the client rect — the HTTRANSPARENT window-drag hand-off, not a real departure — so entering a hidden-titlebar drag header freezes hover instead of dispatching false leaves. * Stamp hover currency at the install window itself, per tree - Staleness marks exactly the window between publication and handler-tree adoption: a build or layout failure keeps the old, still-matching pair current (edges flow even when an idle app performs no further rebuild), and post-install follow-up failures never defer. - Each window slot carries its own currency, so one window's failed publication never defers hover into its siblings, and that window's own next successful rebuild restores it wherever it was driven from. - Capture-refresh allocation failures surface through the dispatch-error machinery instead of being swallowed; tests pin the enter-only deferral, leaves-never-wait, and build-failure-keeps-pair-live paths. * Open the hover staleness window at adoption and bound capture indirection - The currency stamps sit immediately after each setCanvasWidgetLayout: publication rejection is validated-then-atomic, so a refused chrome build, oversized-text rebuild, or slot budget overflow keeps the old still-matching pair current instead of deferring hover enters indefinitely. - The leave-Msg copier bounds slice indirection (64 hops): a cyclic value graph refuses as unsupported instead of recursing toward allocator exhaustion or stack overflow. * Track adoption exactly, drain standalone edits, and refresh captures per transition - The currency stamp keys on a per-view adoption counter incremented the moment copyWidgetLayoutTree replaces the retained tree, so a failure in the publication pipeline's post-adoption steps still marks the pair stale while a validated-then-atomic rejection never does. - Standalone keyboard events (accessibility selection edits, context-menu cut/paste/select-all) carry a flag the hover drain honors at their own tail — an edit that unmounts the hovered listener no longer waits for an input cycle that never comes. - Leave captures refresh at every rebuild commit, not just at drain time, so two dispatches in one cycle (payload moved, then unmounted) deliver the latest binding; a proven pointer's consumed secondary release outside the view retires containment — the leave the frozen right-drag stream suppressed. * Keep capture slots leak-free and refuse unownable hover pairs whole - The enter loop and the unwind release any slot a mid-batch capture refresh installed before assigning or dropping a position, so repeated re-entry with rebuilding edge handlers can never exhaust the slot budget; pinned by a 40-cycle churn test asserting zero slots held after exit. - An unownable leave payload (a single-item pointer) now refuses the PAIR: the enter never dispatches, the exit owes nothing, and the refusal settles with one warning instead of retrying every drain — no enter without a deliverable leave. - Capture-refresh failures at rebuild commits land in the dispatch-error ring, so a stale payload delivered after a swallowed allocation failure can no longer hide behind rebuilds that reported success. * Size the capture pool for both transition populations and stamp adoption at the tear - The slot pool covers the departing chain's held captures plus a fully refreshed standing mirror plus one swap slot, and claiming degrades like allocation pressure instead of trapping if the accounting is ever wrong. - The adoption witness moves inside copyWidgetLayoutTree at its destructive boundary, so a per-node failure mid-copy (an invalid command name escapes the pre-validation) counts as adopted-and-torn while up-front rejections leave it unmoved. - A leave rebind no copy can own on a STANDING element warns once and degrades to live-tree resolution (a later ownable rebind upgrades), and sentinel-terminated array payloads capture with their sentinel stamped; both pinned by probe-app tests. * Give hover containment its own hit-test policy and a half-open outside test - Hover-Msg listeners are invisible to the interactive hit test (wash, cursor, press routing, text selection) and resolvable only through the new hover-containment policy, so binding hover provably never paints a wash or steals a click — even from an overlapping sibling; pinned by a probe asserting the interactive hit test finds nothing where the containment chain stands. - The consumed-release outside test uses the engine's own half-open rectangle containment, so a release at exactly the right or bottom edge retires the chain like every hit test already treats that point. * Resolve hover state by view identity and prune with the hover predicate - Hover capture refresh and drain lookups key on window id plus canvas label, so a replacement window reusing a closed window's label (even with identical structural ids) can never answer for its predecessor's captures. - Chain pruning uses a hover-specific survival predicate — a hover-only listener is never evicted into a false leave, and a widget whose hover bindings a rebuild removed stops standing — and a torn mid-copy failure prunes containment against the partial tree so owed leaves dispatch at that failure's own drain. - Windows WM_MOUSELEAVE suppression requires the point's owner to be one of the child's own ancestors (the HTTRANSPARENT hand-off signature): an overlapping sibling pane taking the cursor is a genuine departure and cancels. * Own the dispatch-error event name and bump the journal semantic epoch - DispatchError keeps its event name in inline storage with an accessor (the detail pattern, 64-byte cap): records are copied by value into a ring that outlives every caller's buffer, so a name recorded through reusable storage can never dangle; pinned by a clobbered-buffer test and every consumer swept to the accessor. - Reserving pointer-id bit 63 as the touch-source stamp changes a journaled field's meaning: the session journal's semantic epoch bumps 3 to 4, so older recordings refuse with the standard re-record teaching; the changelog states the conscious break. * State the secondary-stream scope honestly in the input comments - Only the secondary down/up/cancel stream is consumed: hosts report drag motion without a button, so containment follows a right-drag on the primary path (the mouseenter/mouseleave convention), exactly as the wash does — the comments now say so instead of claiming a freeze. - The GTK leave handler's suppression comment scopes itself to click-gesture presses and names the settling paths (release, gesture cancel, the runtime's outside-release check). * Teach the markup fixture sidecar the hover pair - The hand-written contract sidecar (the schema's independent ground truth) gains the hoveredId model field and the hover_row/hover_off f64 arms in declaration order, so the corewire mirror stays fingerprint- and contract-byte-identical to the transpiled lane. - The facade wire-tag pins move with the union: zoomed sits at tag 11 behind the hover pair. * Retire containment when a proven primary release lands outside the view - A captured drag's release beyond the surface clears the chain and the hover proof instead of re-hit-testing: hosts held a grab through the drag (no motion-leave fired) and send no later cancel, so an overflowing listener could stay entered off-view and a parked off-view anchor could re-enter one on a later rebuild. - The primary rule mirrors the consumed secondary release; pinned by a down/drag-out/release-out test asserting the delivered leaves, the empty chain, and the retired proof. |
||
|
Chris Tate
|
b57224d0d1 |
Pair compiled cores with their own sidecars and pin the export attestation order (#187)
* Let the parity suite pair a compiled core with its own contract sidecar - NATIVE_SDK_EXTERNAL_CORE_SIDECAR points the generated mirror at the caller-supplied archive's own emitted sidecar, so the boot-time build_id fence checks the pairing the ABI ratified instead of always reading the committed fixture sidecar - the committed fixture sidecar stays the default for stub-shaped callers that restate its identity * Pin the normative canonical order for the sidecar's export attestation - The reader's expected-order array, the extractor's emitted list, and the fixture sidecar all state one order: version/identity entries, init, the mode-provided entries, the remaining unconditional suffixes, then wired channel entries - V11's teaching names the expected suffix at the diverging position |
||
|
Chris Tate
|
ac06f6c25e |
Add an env-gated behavior-parity suite for compiled core archives (#186)
Release / Check for new version (push) Has been cancelled
Release / Create GitHub Release (push) Has been cancelled
Release / Publish CLI to npm (push) Has been cancelled
CI / Zig Core (push) Has been cancelled
CI / macOS WebView (push) Has been cancelled
CI / macOS GPU Perf (push) Has been cancelled
CI / Linux WebKitGTK (push) Has been cancelled
CI / Windows WebView (push) Has been cancelled
CI / CEF Platform Tooling (push) Has been cancelled
CI / npm Package (push) Has been cancelled
CI / Native Examples (push) Has been cancelled
CI / Linux Canvas Smoke (push) Has been cancelled
CI / Linux Dev Smoke (Debug scaffold) (push) Has been cancelled
CI / Windows Canvas Smoke (Wine) (push) Has been cancelled
CI / Windows Effects Smoke (Wine) (push) Has been cancelled
CI / Frontend Examples (push) Has been cancelled
CI / Mobile Examples (push) Has been cancelled
CI / Generated App Scaffolds (push) Has been cancelled
CI / Evals Typecheck (push) Has been cancelled
CI / Docs (push) Has been cancelled
* Extract the mirror-value converter into a shared sidecar test module - tests/sidecar/mirror_value.zig now carries convertValue; the conformance suite imports it unchanged - prepares the compiled-core behavior-parity suite, which converts scripted messages and reference models the same way * Add an env-gated behavior-parity suite for a caller-supplied compiled core - NATIVE_SDK_EXTERNAL_CORE_ARCHIVE (path-delimiter-separated link inputs) builds a test binary pairing the transpiler lane with a fresh corewire mirror over the real archive; unset, the step skips and the suite never builds - one scripted sequence through both lanes, byte-comparing command, snapshot, and subscription bytes per cycle, plus collect invariance and deterministic re-init on the archive side - new test-external-core-parity step; wired into zig build test only when the archive is supplied |
||
|
Chris Tate
|
64ab5f205c |
corewire: generate core bindings from a machine-readable contract sidecar (#185)
* Add corewire: contract-sidecar reader, validator, and shim emitter - Parse core.contract.json (schema format 1) via std.json with teaching refusals naming exact field paths; unknown fields warn, unknown format/enum values refuse whole-file - Enforce the reader-checkable validation rules (V1-V11): hash encodings, one type namespace, reference resolution and reachability, acyclicity, tag bounds, descriptor consistency, unbound lists, channel/export biconditionals, and the integer-slot bijection - Emit core_shim.zig: mirror Model/Msg/channel types with the sidecar's names, order, and number classes, declaration-order tag table, descriptor-driven dispatch stubs, snapshot decoder, and helper forwarders; extern bindings isolated in core_abi.zig so an ABI revision is a one-file edit * Wire the sidecar-shim conformance harness into zig build - Pair every ts-core fixture (host, markup, soundboard, system-monitor, ai-chat) with a corewire-generated mirror: the markup fixture from a committed hand-written sidecar, the rest extracted from the transpiled modules at build time so corpus sidecars cannot go stale - Hold both lanes byte-identical by layout_fingerprint.describe of Model/Msg and by the serialized model-contract artifact (anonymous payload records mask only Zig's per-module instance counter) - Force full analysis of every generated shim against a stub core exporting the draft ABI's symbol set, so dispatch stubs, snapshot decoders, and channel forwarders compile and link; new sidecar-conformance step, wired into zig build test beside the ts-core e2e suites * Record sidecar schema gaps and observations from the conformance corpus - Four underdeterminations: number_bytes field order, integer-slot grammar coverage for slice elements and union arm payloads, and the synthesized-name container for anonymous helper returns - Observations on worked-example spellings, anonymous-type name counters, and the channel-entry payload encoding pin * Format corewire sources with zig fmt * Harden corewire emission edges and buffer lifetimes - Double-buffer the shim's model arenas so a previously returned root survives the decode that replaces it (the transpiler lane's one-generation grace at compaction), pinned by a test - Refuse sidecars whose type, message, or helper names collide with declarations the generated shim itself must make; keep authored types that merely spell like synthesized names as top-level declarations unless referenced exactly once - Escape every sidecar string landing in generated Zig literals and every reflected string the extractor writes into JSON; bound tabled unions and enums to the one-byte wire index; restate the deterministic/async_free attestations as shim constants for host policy gates * Keep corewire's checker as strict as generation and its errors honest - --check now runs the full pipeline and discards the text, so a sidecar can never pass the checker and refuse at generate time - JSON-parse memory pressure propagates as OutOfMemory instead of masquerading as malformed input; a diagnostic that cannot be recorded terminates loudly instead of vanishing - Record the synthesized-vs-authored table-entry ambiguity as a schema gap and document the fidelity-driven inlining bias at its site * Close corewire's remaining name and mode edges - model_unbound accepts exported helper names (the dead-state opt-out vocabulary spans fields and bindable model methods); schema wording gap recorded - --check and --out are mutually exclusive modes; combining them is a usage error instead of a checker that writes files - Channel forwarders and the wire-message decoder speak the sidecar's message union name instead of a hard-coded spelling; the void TypeRef is refused outside bare union arms and decodes as no value; optional glue names reserve only when their glue is emitted * Prove the attested export set at link time and tighten shape checks - boot() references every abi.exports symbol via doNotOptimizeAway, so an object missing an attested entry point fails at link instead of lurking behind lazy extern binding - Text-input routing applies the markup engines' full structural predicate (payload shapes, not just the eleven tag names); near-miss unions ride the record entry - Boolean and presence discriminants past 1 refuse as layout skew instead of decoding silently; UpdateResult reserves only when emitted; the view_unbound spelling is fenced against helpers, fields, and arms that would shadow the opt-out tuple * Alias the wiring's root spellings and reserve the attestation glue - A sidecar naming its roots something other than Model/Msg gets transparent aliases under the wiring's fixed spellings, so the staged main's re-exports and the reflecting seams keep compiling; the alias names reserve against colliding table entries - referenceAttestedExports joins the reserved emission names - State at the attestation site why the no-extra-exports direction is the producer's conformance obligation (a linker ignores unreferenced extras; the generator never opens the object) * Refuse un-buildable channel arms and the discard identifier at tool time - The appearance and chrome arms must carry the exact structural records the host builds by field name; a named-type payload of any other shape refuses with the shape teaching instead of a compile error inside generated wiring - A name spelled _ is the discard token, not a declarable identifier; it now takes the quoted form like keywords and primitives * Hold channel record checks to by-value storage and bare arms to empty payloads - The structural vocabularies the host constructs by field name (chrome insets/buttons, text-input payload records) accept by-value records only; a node reference mirrors as a pointer neither consumer's shape takes - A channel message on a bare arm must carry zero payload bytes; stale bytes refuse as layout skew instead of dispatching silently * Sharpen the number_bytes and helper-return gap records - State the wire consequence of the missing field-order fact and why the generated shim itself cannot skew (one mirror type feeds both encode and decode) - Record that anonymous helper returns lack a pinned mirror spelling as well as a container rule; the generator deliberately keeps them named until a producer ratifies an inline convention * Reserve channel detection names unconditionally - The host wires channels by probing declaration names, so subscriptions/commandMsg/frameMsg/keyMsg/pinchMsg/appearanceMsg/ chromeMsg/envMsgs are off limits even when the channel is absent — a type under one of those names would falsely activate the channel and fail as a non-function - Event-record names (FrameEvent/KeyEvent/PinchEvent/PinchPhase) stay conditional; they are plain declaration collisions, never probes * Fold the ratified core-ABI deltas into the binding layer - helper_call traps on an unknown index through the panic sink instead of returning a status; the shim glue drops its check - Lifetimes follow arena truth: boot_cmd bytes live until the next frame_reset, dispatch, or init; the snapshot buffer is transient and does not survive a frame reset; collect folds the transient-arena reset and joins the runtime-owned mode symbols - Narrow signature integers are documented as C plumbing for host-produced values, never payload crossings; the sink covers detected traps only (escaped exceptions arrive with an Uncaught prefix; hardware faults stay with the host's process-wide handler) * Emit core_facade.ts: the TypeScript projection of the contract sidecar - One sidecar, two projections: corewire --facade emits a subset-TS module carrying the mirror types (interfaces, literal-union enums, kind-tagged message union), per-arm wire-tag constants and typed constructors, the generator-carried viewUnbound list, identity constants, and deterministic zero/sample model builders - The canonical value encoding rides subset arithmetic: byte values stay integer-derived end to end (owned Uint8Array runs concatenated by copy), and the f64 bit pattern extracts exactly by halving scans and comparisons, covering denormals, signed zero, the infinities, and the canonical quiet NaN; nsc_core_probe_i64/f64 expose the scalar encoders for parity proofs - Emission is deterministic, TS-identifier and nsc-name-space fences refuse collisions with teachings, and the module compiles through the shipped checker as a validation proxy (boundary-fed scans stay out of shared helpers and sparse writers zero their buffers explicitly, per the emitted lane's allocation and number-model rules) * Prove facade byte parity in the conformance harness - Compile every fixture's generated core_facade.ts through the shipped transpiler in-graph (the compile is the subset-acceptance proof) and execute its encoders: scalar probes across f64 edge cases (signed zero, denormals, the infinities, the canonical quiet NaN, the 2^53 bounds) and i64 two's complement must match native bit patterns - Facade-encoded zero and sample model snapshots must byte-match the canonical encoder over the shim's sidecar-classed mirror, via a by-name value conversion that normalizes inference-decided classes and reference storage; constructor tags ride declaration order - Record the FACADE-GAPS section: each surface the projection cannot carry, pinned to the subset rule that excludes it * State the facade generator's input model in its module doc - The generator consumes contract facts (author-module declarations plus profile constants), which precede compilation in production; the conformance harness feeds those facts from corpus sidecars as its adapter * Reword the helper-return gap note to name the missing emitter convention * Close facade projection edges: paths, parens, fences, fallbacks - corewire refuses aliased generation paths (--out/--facade naming one file, or any output naming the sidecar itself) - Composite slice element spellings parenthesize (a bare number | null[] would type the null as the array) - The generated NscfContractError and NSCF_POW declarations join the facade's name fence, and field names may not take the reserved nsc space (constructor parameter fallbacks live there, collision-proof) * Normalize output-path checks and refuse valueless contract shapes - Generation-path aliasing compares lexically normalized paths, so ./x and x cannot slip past the overwrite fences - Empty message unions, tabled unions, and enums refuse at read time: a valueless union or enum has no declarable mirror form in either projection - number_bytes descriptor fields join the reserved-nsc-space fence (they become constructor parameters and record members without ever entering the type table) * Canonicalize NaN in both encoders and fence the remaining shadows - The canonical value encoding maps every NaN — negative or payload-bearing — to the one quiet pattern: payload bits are not values in either source language and engines may rewrite them at any store, so a bit-preserving encoder could never be deterministic across producers; both encoders and the parity suite pin it - A type named Uint8Array refuses (it would shadow the ambient byte type out from under every facade encoder) - Comment sanitizers also blank U+2028/U+2029, the line terminators a TypeScript scanner honors * Keep both projections declarable under renamed and exotic contracts - The Zig emitter fences every parameter and local name its generated bodies bind (a module-level type under any of them would shadow) - The facade declares its roots under the profile's designated Model and Msg exports whatever the contract calls them, aliasing the contract names — the root commit machinery and dispatch wiring key on the exact spellings (renamed-root facade transpiles end to end) - viewUnbound carries only names the facade declares (message arms and model fields); nested optionals refuse with a teaching (one null, one absence level); strict-mode reserved words join the identifier fence * Key synthesized flattening on the contract's message name and fence unbound homonyms - Constructor-side synthesized-record detection patterns on the contract's own message name, so renamed unions flatten consistently with their arm types (pinned end to end for an Event_loaded payload) - A name that is an unbound arm and a bound field (or the reverse) refuses: the projection's single name-resolved viewUnbound list would mark both declarations; names unbound on both sides ride once * Flatten synthesized union payloads and fold case in path aliasing - Synthesized inline records inside tabled unions flatten beside kind (the authored multi-field arm shape), in the arm type, the union encoder, and the value builders alike; single named payloads keep the erased-member value spelling - Output-path aliasing folds ASCII case: the default volumes on two of the three desktop platforms are case-insensitive, so differently cased spellings of one file count as aliases everywhere * Ask the filesystem about output aliases the spelling checks cannot see - Beyond lexical and ASCII-case checks, an output path that already resolves to the sidecar's own file (Unicode case folding, links) refuses via inode identity, and the facade write re-checks against the shim file the same invocation just wrote * Compare output aliases by canonical path, before any write - sameExistingFile resolves canonical paths instead of comparing bare inode numbers, which collide across volumes; canonical paths are unique per volume, so distinct files can never compare equal (hard links keep distinct canonical paths and stay noted as out of scope) - The out/facade pair check runs in the preflight loop too, so two existing links to one file refuse before the shim write, not after * Land outputs by rename so aliased entries can never truncate shared content - writeOutput writes a sibling temp file and renames it over the target: a rename replaces the destination's directory entry and never writes through it, so a hard link to the sidecar (invisible to canonical-path preflight) keeps the input intact under its other names — verified with a hard-linked output - The identity helper's note states why hard links passing it are harmless by construction * Claim staging spellings in preflight and refuse inexact integer crossings - The .corewire-tmp staging names join the alias checks, so a sidecar spelled as an output's staging path refuses before anything writes - Scalar dispatch entries route integer payloads through a checked narrowing: values at or past 2^53 alias on the f64 wire, so they trap with a teaching instead of corrupting silently (number, number_bytes, and scroll-state paths alike), matching the bridge's shipped bound * Stage outputs exclusively under unique names and widen synthesized identities - The staging file is created exclusively with a per-invocation nonce: exclusive creation can never truncate an existing entry whatever it links to, and concurrent invocations stay off each other's bytes (a hard-linked staging-prefix entry now survives generation intact) - The extractor's synthesized source_hash and build_id cover the complete reflected surface — unbound lists, channel wiring, entry-shape flags, and the export set included — so any contract-visible fixture edit moves both identities * Pin the two schema-underdetermination dispositions as tests - number_bytes mirrors number-first (the one order every producer of the shape declares; the descriptor carries no order fact), and a bytes-first record rides the record family with its order carried explicitly — both directions now executable - A single-use pattern-named record inlines to mirror the emitted module's anonymous records — the direction every corpus fixture requires while the schema carries no synthesized marker * Stage both projections before committing either - A combined --out/--facade run writes both staging files completely before the first rename, so a write failure can never leave a fresh shim beside a stale facade; a failure between the two renames names both files as a possibly skewed pair and exits nonzero so the caller regenerates - Concurrent invocations aimed at one output path remain the caller's serialization to provide, stated at the commit site * Canonicalize existing ancestors for future outputs and clean sibling staging - Alias comparison canonicalizes the deepest existing ancestor directory and carries the not-yet-existing tail verbatim, so two spellings of one future file through symlinked or case-folded parents refuse before generation (verified with a symlinked output directory) - A staging failure deletes the sibling projection's already-staged file instead of leaving it beside the exit * Canonicalize per component, recheck after the shim commit, keep samples linear - Path canonicalization walks components against the filesystem, so .. applies to the real parent instead of lexically across a symlink (verified: link/../core.contract.json refuses as the sidecar itself) - Once the shim rename lands, the facade target re-resolves against the now-existing file, catching aliases no spelling check can see — filesystem Unicode normalization included (verified with NFC/NFD spellings on the default macOS volume) - Sample sequences emit two elements at the outermost level and one per nested level, keeping generation linear in TypeRef nesting depth * Fence helper names against the generated glue they would shadow - Model methods shadow file-scope declarations inside the struct, so a helper named after generated glue (callHelper above all) would capture the forwarders' own call sites; such names refuse at tool time with a teaching * Walk paths with the native component parser and record the arm-storage gap - canonicalSpelling parses roots and separators with the platform's component iterator, so drive and UNC spellings normalize to one prefix instead of splitting on a single separator - Any facade-staging failure shape deletes the already-staged shim file; helpers may not shadow the mirror's own type names inside the model struct (field types resolve against methods first) - A record reused as a bare message arm rides by reference in the emitted lane, which the named-type payload family cannot say: the extractor refuses the construct with a teaching and SCHEMA-GAPS records the missing storage-kind fact and its closure * Keep drive-relative spellings lexical and refuse dishonest integer bytes - A drive-relative Windows path (C:foo) names a file under that drive's own working directory, which cannot resolve portably; canonicalization keeps it lexical instead of folding it under the drive root into false aliases - The facade's i64 encoder throws the kind-tagged teaching value for non-integer or out-of-range input instead of truncating into wrong canonical bytes (probes and misclassified slots alike) * Resume canonicalization after a dot-dot pop and reserve the field capture - A .. that unwinds a nonexistent tail re-probes the filesystem, so a symlink after the pop resolves instead of riding unresolved past the alias guard (verified with a nonexistent scratch segment) - The tag-table consistency block's field capture joins the reserved emission names * Refuse contract shapes the projected subset cannot author - Quoted (non-identifier) property names and one-member enums have no accepted spelling in the shipped subset (probed: both refuse at the emitter), so the facade refuses such contracts with teachings instead of emitting members the compile would drop or misread; the Zig mirror keeps expressing both - FACADE-GAPS records the pair * Fence flattened kind fields and escape TS line terminators in literals - A number_bytes field or synthesized inline record field spelled "kind" would declare the flattened arm's discriminator twice (message arms and tabled-union arms alike); such contracts refuse with a teaching — named record payloads ride a value member and stay unaffected - tsString escapes LS and PS, the scanner's remaining line terminators beside the already-escaped LF and CR (NEL is ordinary text), so exotic member names cannot end an emitted string literal early; both pins ride the unit suite * Refuse model-reachable records as message arm payloads in the mirror - The compiled core stores a model-graph record by reference when it doubles as an arm payload, a storage fact the record family cannot carry; mirroring by value would silently change the reflected layout, so the generator refuses the shape with a teaching until the schema says storage — message-only records stay by value, matching the emission and the conformance corpus * Reserve view_unbound as a type name and the intrinsic TS type keywords - The unbound-list tuples nest inside Model and Msg, where a same-named top-level type would be shadowed at every field-type resolution; such a type now refuses at tool time - any/unknown/never/bigint/symbol join the facade's reserved words: a declaration under an intrinsic type keyword would bind every reference to the built-in and erase the contract silently * Key the arm-storage refusal on node storage, not model reachability - The sidecar itself says which records ride by reference (node TypeRefs); only those keep reference storage when doubling as arm payloads, so the refusal now targets node-stored records exactly — value-promoted model records (a text-input union's caret and selection payloads) pass through by value as the emission keeps them, pinned in both directions * Note the facade-constructor consequence of the missing synthesized marker - Gap 4 now records that the inline bias is visible in constructor parameter shapes as well as in type-name artifacts, and why the compiled layouts agree either way (a collapsed named record and a flattened anonymous one carry the same fields in the same order) * Pin anonymous-name detection to digits and make codecs strictly positional - Anonymous container names carry the compiler's instance counter to the end of the name; an authored type merely containing the marker keeps its declared identity in extraction - The canonical codec's enum and union discriminants ride declaration-order positions on BOTH sides, never numeric values (explicit-valued types round-trip, pinned by test) - tsString and the comment sanitizers propagate allocation failure instead of returning unescaped or empty text * Hold facade names legal through the whole proxy pipeline - One authority validates every name category the facade declares (types, arms, fields, enum members) against BOTH languages: the compiled module takes identifiers verbatim, so its charset, keyword, primitive, and discard rules apply on top of TypeScript's — with the TypeScript reserved words scoped to declarations only (reserved words are legal members, as the corpus's own number field proves) - Anonymous-type detection keys on the FINAL compiler suffix, so an authored name containing the marker keeps its identity while an anonymous member nested under it is still recognized (pinned both ways); the string escaper is pinned directly as defense in depth * Anchor anonymity to the parent name and widen file-identity checks - Synthesized classification requires two fields (smaller inline arms collapse at emission and never table), so the two projections can never diverge on a one-field pattern-named record - Extraction recognizes an anonymous member only when its name prefix IS the enclosing parent's own name beside the final counter suffix, so authored marker-bearing names keep their identity at any nesting - Existing-file identity falls back to full metadata agreement (inode, kind, size, links, both timestamps) when canonical paths differ, the honest net for mounts that expose one directory twice * Reflect aliased root names, disambiguate slot paths, consume attestations - Extraction takes the root type names from the reflected types, so an aliased root export tables and names its real type consistently - Names containing dots refuse wherever they would join an i64 slot path (two different slots could spell one path), and the V10 bijection now consumes entries one-to-one so a single attestation can never cover two slots * Harden identity hashing, alias checks, and graph-walk bounds - Frame the synthesized identity surface with labeled NUL-separated sections covering both root type names, so renaming the message union or moving an unbound name between lists moves source_hash and build_id - Treat same-directory-entry aliases as conflicts while letting hard links pass: rename lands on the entry, so only the entry's identity matters - Bound TypeRef nesting at 256 levels in the reader and validate the named-type graph iteratively with a chain-depth ceiling, refusing pathological documents with a teaching instead of exhausting the stack * Bound expanded value depth, vet abi.prefix, gate all corewire suites - Depth validation now sums optional/slice wrapping with record chaining, so compound nesting refuses at 256 expanded levels instead of overflowing downstream walks - abi.prefix must be a linker-symbol-safe spelling (ASCII letters, digits, underscores, non-digit start); embedded NULs and spaces refuse with the offending byte and offset - Register sidecar.zig and emit_facade.zig test roots in zig build test - imported files' tests never ran under an importer's root |
||
|
Chris Tate
|
87fa3f92d0 |
Video playback: AVFoundation through the media surface, replayable end to end (#184)
* Add the video playback tier: platform seam, effects channel, journal v9
- One video channel mirroring audio end to end: loadVideo with the local-then-URL cascade and surface claim, transport verbs (play/pause/stop/seek/volume/mute/loop), key-stamped events, honest failed/rejected degrades, and automation-snapshot mirrors
- Pixels never enter the core: the platform decoder pushes RGBA8 through a copyable VideoFrameSink into the media-surface texture channel the load claimed
- Journal format v9: the .video effect-result kind (code 13) and platform-event tag (code 25) append the video fields after the v8 channel fields and journal every event verbatim for byte-identical replay with no producer attached
* Cover the video tier: lifecycle, frames, teardown, replay identity
- Fake and real executor batteries mirror the audio suite: request capture, event round trips, transport mirrors, rejection classes, cascade order, staged-host degrade, straggler swallowing, and the quit-while-playing stop hook
- Sink coverage proves decoded frames reach the claimed surface, replace/stop release the claim, and a stale sink push lands inert
- A recorded playback replays byte-identical into a decoder-less host with no producer attached, fingerprint and model equal; journal codecs round-trip the video event and effect shapes
* Export the video effect types and decline video on the embed host
- native_sdk.EffectVideo/EffectVideoEventKind/EffectVideoSource ride the SDK roots like their audio twins
- The mobile embed host declines video_playback until a shim registers a real decoder, the audio honesty rule
* Decode video on macOS with AVFoundation; teach on Windows and Linux
- One AVPlayer in the AppKit host: AVPlayerItemVideoOutput frames fitted to the sink's pixel budget, BGRA-to-RGBA vImage swizzle, a 1/60s run-loop frame pump plus the audio tier's 0.5s position clock, loop wraps without a completion, and paused seeks still paint their frame
- The frame sink crosses the C ABI as a callconv(.c) trampoline over the runtime's VideoFrameSink; a released claim answers 1 and the host stops its pump
- Windows and Linux stage the capability honestly: video_playback reports false and the load verbs answer a named teaching plus error.UnsupportedService; the CEF host stubs the video C ABI like audio
* Add Cmd.videoLoad and videoCtl to the TypeScript tier at opcodes 0x17/0x18
- videoLoad claims the named media-surface, resolves the local-then-URL cascade, and bakes autoplay/loop/muted into one flags byte; videoCtl drives play/pause/stop/seek/volume/muted/loop by verb ordinal with an f64 value
- The event arm is the seven-field record matched by NAME with the exact five-member state union both directions, the audio arm convention; refusals teach with the NS1027/NS1029/NS1030 vocabulary
- The host routes events on the TSVI key namespace, parks loads under the fake executor like audio, and covers the wire byte-for-byte in the package, host, and e2e suites
* Declare video from markup: the <video> element, house chrome, reconciler
- Element code 68 with flag attrs controls/autoplay/loop/muted at codes 82-85 (src rides the existing attr name; registry law keeps names unique); a leaf on all three surfaces — validator, interpreter, compiled engine — rejecting children like image
- ui.video composes the playback surface on the framework-owned surface id plus runtime-consumed transport chrome (ghost play/pause, proportional scrub slider, clipped time readouts in the built-in bar's register); presence IS playback: the ui-app reconciler loads on src change, applies loop/muted deltas, and stops when the element leaves the view
- Handler-less playback stays honest under replay: platform video events steer the channel mirrors while journaled effect records remain the only Msg source, so house-chrome sessions replay with live readouts and identical fingerprints
* Scope declarative video ownership to the playback it started
- The reconciler stops or retunes the channel only while the active key is the declaration's own: an update handler that loaded its own playback owns the single player, and a departing <video> element must not kill it
* Add the video-player example: house chrome and custom controls
- Player screen is one declarative ui.video with the house transport chrome; Custom screen composes its own bar (transport, +/-10s, proportional scrub, volume, mute, loop) from the command vocabulary over a bare media surface
- No bundled media: the launch argument or the source field names a local clip or http(s) URL, so a live macOS check is one command away
- Headless tests drive the whole transport with the fake executor's synthetic events, the automation widget path, and the null decoder behind the declarative screen
* Document the video element across the docs surfaces
- Components page, catalog entry, native-ui element table row, and the LSP/vocab doc strings for src/controls/autoplay/loop/muted
- Deterministic preview scenes render the placeholder with the house chrome (regenerated video webps only; the untouched catalog keeps its committed renders)
- Changelog fragment states the new element, the command vocabulary, the staged platforms, and the journal v9 break
* Resolve video attribute docs in the markup LSP hover path
- attributeDoc consults the video scoped table so controls/autoplay/loop/muted hover like every registry attribute; the coverage pin now names the video composite
* Make the video-player example's docs and status line honest
- README run instructions use the real CLI verbs: native dev for build-and-run, or native build plus the zig-out binary with the clip argument (the argument passthrough shape)
- The status line now matches each screen's ownership model: the declarative Player screen shows a static teaching (its transport state lives in the runtime-owned chrome, so an event-fed status there could only lie or stall), while the Custom screen keeps the event-fed loading/dimensions/finished/failed line it owns; tests pin both across load, playback, pause, and completion
- Direct-SDK examples handle the runtime's video event in their exhaustive event switches
* Stage video events non-lossily and deliver fed terminals under replay
- Video events leave the lossy pending ring for their own non-lossy stage (the image/channel discipline): a loop-side .rejected or .failed is its load call's only terminal and a fed event is one recorded delivery, so a burst past the ring's capacity must never evict one — pinned by a 40-rejection burst test
- Fed events capture the handler at feed time and deliver their journaled values verbatim when the channel no longer resolves them: under replay the platform .failed event that follows the record applies the channel reset first, and delivery-time resolution silently dropped the Msg the recording dispatched — pinned by a recorded mid-playback failure replaying fingerprint-identical
- loadVideo's deterministic refusal classes extract to the pure videoLoadRejected, one source of truth a caller-side validator can consult
* Refuse an invalid video_load before it re-routes the bridge entry
- The engine keeps the current playback when it rejects a load, but the bridge re-keyed its single routing entry optimistically first: a refused replacement left the surviving stream's events and transport verbs answering to the refused key and arm
- The bridge now consults the engine's own videoLoadRejected gate before committing the entry and stages the rejection Msg to the refused arm directly (stageLoopMsg, the channel-admission precedent), leaving the entry and the engine untouched
- Pinned: a rejected replacement delivers its rejection while the live stream keeps its events and its wire-key gate
* Drive the house video chrome from keys and rebuild it in every window
- Keyboard activation (Enter/Space) of the transport's play/pause control now drives the video channel exactly like the pointer release: the control advertises Play/Pause to focus and accessibility, so the intent must act instead of being consumed silently — pinned beside the pointer-toggle test
- Runtime-consumed control paths and handler-less video events rebuild through one helper that follows dispatch's discipline: the main canvas against ITS window (a control event from a secondary window used to target that window with the main canvas label and error) and the window slots after it, so a <video controls> declared in a secondary window's tree repaints from the moved mirrors
* Fail a macOS video load whose conversion buffer cannot allocate
- The frame tap's reusable BGRA-to-RGBA conversion buffer failing to allocate used to degrade to a silent zero-frame pump while the load still acknowledged LOADED: playback reported positions forever and could never deliver a pixel
- videoAttachOutputForItem now reports the failure and the status hop answers with the FAILED terminal instead of the acknowledgment - the honest degrade; an audio-only item (no video geometry) keeps its documented honest-absence path
* Journal handler-less video terminals and quarantine stale fed events
- Loop-side video terminals now stage and journal with no Msg handler bound (the image arm's rule): a declarative playback binds no handler, but its synchronous .failed is executor truth — the record is what replays the channel reset, and the staged delivery's wake re-renders the chrome
- A fed event whose staged key no longer names the live playback (replaced before its drain, or a replayed platform .failed already applied the terminal) delivers its staged values verbatim and leaves the live channel alone — applying a replaced stream's terminal would reset the replacement
- A journal-fed video record claiming a millisecond or dimension scalar at or past 2^53 refuses replay as a damaged record at the gate (no recorder writes one, and the TS tier's exact-integer widening would trap on it) — pinned by a hand-patched journal
* Route every video event by the key of the load that produced it
- The bridge's engine key now carries the issuing load's event-arm tag in its low byte (videoKeyForTag): a staged synchronous .failed that delivers AFTER a replacing load re-keyed the single entry still routes the arm of the load it answers, instead of handing the old stream's failure to the replacement's arm
- videoEventMsg routes by the event's own key tag, never the mutable entry's; the wire-key gate on transport verbs is unchanged
- Pinned: a replaced load's straggling terminal routes its own arm while the replacement's stream keeps its own; the request-key pins move to the tagged shape
* Reconcile <video src> from every window's tree and repaint Msg-less failures
- Secondary-window builds now feed the video reconciler: Ui.video promises that declaring the element IS the playback in every window's tree, but slot builds discarded the declaration — the main canvas wins when both declare (one player, one owner), the first declaring slot keeps ownership until it stops declaring or its window closes (reconcile-close included)
- The main build stamps the video mirrors it rendered; drainEffects compares that stamp after a Msg-less drain and re-renders the chrome when they moved — a handler-less declarative playback's synchronous failure no longer leaves controls advertising a playback that is gone
* Paint the poster frame for paused macOS video loads
- A load acknowledged while paused (autoplay = false, the documented poster-frame shape) ran no frame timer and never pumped its first decoded frame: the surface held the placeholder until the user played, paused, or seeked
- LOADED now arms a bounded first-frame hunt: the frame timer polls until the first frame pushes (a paused load then stops the timer; a playing one keeps it), surrendering honestly after ~3s if the output never yields one
* Restart the macOS frame timer when buffered playback actually begins
- The poster hunt could stop the pixel clock while AVPlayer was still waiting to play (a remote autoplay stream yielding its poster mid-buffer, or a hunt surrendering past its bound), and nothing restarted it when the waiting phase ended: audio played and positions ticked with no frames flowing
- The timeControlStatus hop now arms the frame timer whenever playback reports rolling (idempotent beside videoPlay's own arm), for local and remote sources alike
* Deliver a staged video terminal past stop instead of panicking
- A Cmd.batch([videoLoad, videoStop]) on a host whose load fails at once stages the .failed before stop retires the bridge entry; the drain then hit the entry gate's panic even though the terminal is the load call's only answer
- videoEventMsg drops the entry gate: every event reaching it was produced by a bridge-issued load and carries its arm tag in its own key (the engine swallows its post-stop stragglers itself), so routing needs no entry at all - pinned by the load-then-stop batch shape
* Retain every window's video declaration and promote on the owner's close
- The reconciler kept only the owning window's <video src>: closing that window (or its declaration vanishing) stopped playback and left another window's mounted video inactive until an unrelated rebuild
- Slot declarations now retain one entry per window (the table matches the window budget); when the owner closes or stops declaring, the next retained declaration promotes inside the same dispatch - pinned by a two-window close-promotes test with no on_close Msg and no rebuild
* Retry the frame wake for identical pushes still awaiting adoption
- A refused frame-wake request leaves pending clear so a retry can land, but the push-boundary fingerprint short-circuit returned before the wake: a static frame pushed again after a transient request_frame_fn refusal short-circuited forever and the staged bytes were never adopted
- An identical push now falls through to the wake while bytes are still staged; only an adopted frame's repeat stays a pure no-op
* Expose videoPlayback through the bridge alias and the TS feature type
- platformFeatureFromString gains the videoPlayback camel-case alias every other feature carries, so window.zero.platform.supports("videoPlayback") answers the platform truth instead of InvalidPlatformFeature
- NativeSdkPlatformFeature adds video_playback/videoPlayback so TS clients can compile the support query
* Stamp every platform video event with the load that produced it
- The engine mints a token per loadVideo, passes it through the load seam, and every host echoes it in each event: takeVideoMsg swallows an event whose token is not the current load's, so a replaced playback's queued terminal can neither reset the replacement, release its claim, nor route through its handler - pinned by a stale-failed-after-replace regression
- macOS hardening on the same theme: the item end/failure notification blocks re-check note.object against the current item (a removeObserver cannot recall a block already enqueued on the main queue), and the host carries the token across its terminal emits' teardown
- The journaled video platform event carries the token, so replay's mirror steering swallows stale recorded events exactly as live (the re-run loads mint the same deterministic sequence); the null platform echoes tokens like the real hosts and its fake position advance saturates instead of trapping on hostile deltas
* Pair replayed video deliveries with their events; token-gate fed entries; stop abandoned players
- A recorded video Msg dispatched synchronously inside its platform event's dispatch, but replay delivered the fed record at the NEXT drain: an update loading the next clip from its completion handler ran too late and the new clip's .loaded event was swallowed against the old load's token - takeVideoMsg under replay now pops the fed head (the journal's contiguity puts each event's record immediately before it) and dispatches it during the same event, pinned by a chained-load playlist session replaying byte-identical
- Pending video entries carry the load token that staged them, and delivery resolves against the live channel only while it still IS that load: the public key alone cannot tell two loads under one app key apart, and a stale fed terminal resolving against a same-key replacement would have reset it
- failVideoChannel silences the platform player it abandons (best effort): a load that succeeded before a later step refused kept its player decoding while the reset channel forgot it, and the inactive channel skipped it at teardown too
* Keep refused and uninstalled declarations out of the video reconciler
- A declared src the engine's own gates refuse (a malformed URL, say) no longer commits the reconciler's tracked ownership: the running playback keeps its identity - so removing the element later stops IT, instead of hashing the refused source and stranding the playback forever; the refused src is remembered separately and taught once, never re-attempted every rebuild - pinned by a refused-declaration ownership test
- A secondary window's declaration is captured only after its build pass and layout succeed and the tree installs: a build whose layout errors never displays, so its declaration never steers the playback either
* Link CoreVideo wherever appkit_host.m builds standalone
- The frame pump's CVPixelBuffer calls are real CoreVideo symbols: the central build gained the framework, but the generated-app template and the standalone example builds still linked only AVFoundation - a generated macOS project failed to link
- The template and every example build.zig that compiles the AppKit host now link CoreVideo beside AVFoundation
* Gate the poster hunt on a real push and clamp millisecond CMTimes
- videoPumpFrame initialized its push result to the success code, so a NULL base address or failed vImage permutation ended the poster hunt and stopped the frame timer with nothing on the surface; a sentinel now keeps the hunt alive until a push actually returns success
- NativeSdkCMTimeFromMs narrowed the u64 millisecond position straight into the signed CMTimeValue, turning absurd seeks negative; the value now clamps at INT64_MAX so AVFoundation clamps to the duration as documented
* Retire the null video player when a non-looping playback completes
- advanceVideo left the fake player loaded after its completion, so post-completion transport calls succeeded where a live host's torn-down player refuses them (and a replayed play could emit a second completion)
- the completion now unloads before the event returns, matching the live hosts' retire-before-emit order; tests pin the unload and the failed-play degrade path
* Stop the custom playback when an empty source commits
- loadCustom returned early on an empty committed source, leaving the previous video rolling under a status line that said "no source"
- an empty commit now stops the playback and resets the transport mirrors, with a test pinning the stopped channel and the honest status line
* Route replayed video records by the journaled load identity
- Every .video effect record now carries the producing load's token; replay feeds through feedVideoRecord, which resolves the token against the live channel or a retired-load park instead of binding the record to whatever the channel holds at feed time.
- loadVideo and stopVideo park the outgoing load's identity under replay, so a synchronous terminal staged inside the very dispatch that then replaced or stopped its playback still delivers the recorded Msg with the recorded identity - never EffectNotFound, never a reset of a same-key replacement the recording kept playing.
- The replay pairing in takeVideoMsg now token-gates fed entries against the platform event, and two session tests pin the batch shapes: load-then-stop and load-then-replace under one app key.
* Check the Core Video lock result before touching the pixel buffer
- A failed CVPixelBufferLockBaseAddress never maps the buffer, so reading the base address was undefined and the unconditional unlock unbalanced the lock count; the frame now drops with the buffer released.
- The poster hunt stays latched across the dropped frame - only an actual push verdict may end it, the converted-but-unpushed rule.
* Document why rate > 0 is transport intent at the playing derivations
- Per the AVPlayer.h contract, a playback waiting in AVPlayerTimeControlStatusWaitingToPlayAtSpecifiedRate keeps rate at the requested value ("not currently effective but instead indicates the rate at which playback will start or resume"), so a stalled-but-unpaused stream already reports playing=1 + buffering=1 and the transport control offers Pause.
- AVPlayer resets rate to 0.0 on its own only with waits-to-minimize-stalling disabled - the local-file configuration, where playback would not self-resume and offering Play is the honest affordance.
* Keep the controls-bearing video element zero-intrinsic
- The <video controls> wrap column now adopts the media sizing contract (WidgetLayoutStyle.zero_intrinsic): the transport bar's intrinsic size never leaks into the element, so an unsized element in a hug container measures zero like the bare surface instead of rendering a controls-only strip.
- The wrap clips its content, so chrome cannot paint past a box the layout granted nothing; declared width/height stay definite through the frame and min/max bounds.
- A ui test pins both shapes: zero in a hug container, surface-above-bar inside a declared 320x180 box.
* Bound video scalars at delivery, sweep replay parks, republish flag deltas
- Platform video events clamp position, duration, and dimensions into the exact-integer delivery window (max_effect_video_scalar_exclusive, 2^53) at takeVideoMsg, whatever a host or embedder reports - the engine-side guarantee behind replay's damage gate, so an honest recording can never be refused as damage; a past-window readout now records and replays clamped, pinned by test.
- Replay-side retired video identities release at the first drain-pass boundary after parking (any journaled record for them feeds before that pass's event dispatches), so a long replayed playlist parks and releases one entry per clip instead of accumulating them; pinned at the channel level.
- Same-src declarative loop/muted deltas republish the runtime mirror in the same reconcile, so an automation snapshot taken after the flip reports the new value instead of the one published before the rebuild.
* Journal the video cascade's resolved source for replay
- loadVideo now journals a Msg-less .video_load record (the .clock/.env discipline) carrying which source the recording host's cascade resolved - a missing local file that fell through to the url is filesystem truth the replayed fake load cannot re-probe.
- Replay queues each record and the replayed load consumes it by its deterministic token, so videoSnapshot() and the automation mirror report .stream with the optimistic buffering flag exactly as the recording did, handler-less declarative playbacks included.
- Pinned by a record/replay test on an assets-absent host; the handler-less house-chrome pin now expects exactly the one Msg-less record.
* Keep buffering honest across paused streams and widen the fake's loop wrap
- Buffering means an un-paused stream waiting for bytes: a fresh URL load now starts the flag from the autoplay intent (engine mirror and replayed cascade resolution alike), the macOS host derives it purely from timeControlStatus instead of presetting it, and pauseVideo clears it - a conforming host emits no pause acknowledgment that could.
- The macOS time-control observer stays silent when the transition lands on paused: pause emits nothing by contract and position reports are for playback in motion; waiting and playing transitions still emit.
- The null platform's advanceVideo runs its loop wrap in widened arithmetic so a past-u64 delta lands on the exact residue instead of a saturated one; pinned along with the paused-stream and pause-clears-buffering shapes.
* Spill the replayed cascade-resolution queue past its inline capacity
- Loads per dispatch are unbounded by contract and every .video_load record lands before the dispatch's event, so the replay-side queue now grows geometrically past its inline 64 (freed when it empties and at deinit) instead of refusing the 65th record as a false divergence - the pending stages' non-lossy discipline.
- Pinned by a record/replay burst one past the inline capacity on an assets-absent host.
* Cross-check the journaled key on every replayed video pairing
- Reminted tokens pair records with replayed loads by position; the journaled key now proves the load at that position is the one the recording issued - feedVideoRecord refuses a mismatch as divergence, and a cascade resolution consumed under a different key latches one for the finish check.
- Replay now ends with a consistency check (the .finish replay control): a structurally valid journal whose queued cascade resolutions the replayed timeline never claimed fails as ReplayEffectDivergence instead of reporting success.
- Pinned at the channel level: wrong-key feeds refuse, an unclaimed or misclaimed resolution fails finishReplay, and the honest pairing stays silent.
* Copy the captured video declaration and verify the load bijection under replay
- The main-canvas <video src> capture now copies the source out of the build arena into app-owned storage (the slot captures' rule): a later failed rebuild resets the arena the old capture borrowed, and a window-close reconcile could hash or load overwritten bytes.
- Every non-rejected real load now journals exactly one .video_load record - refused cascades included (failVideoLoad) - so the replayed loads and the journaled records form a bijection: a replayed load with no record at its position, and a record whose position was never issued, both latch divergence for the finish check.
- The journal semantic epoch bumps to 2: identical bytes, changed replay meaning - an earlier recording's failed loads would replay as false divergence, so old journals refuse with the re-record teaching. Pinned: the extra-load shape fails finishReplay and the captured src aliases the app-owned buffer.
* Run the replay finish check even when no records were fed
- A latched video-load divergence can exist with zero fed effect records (the recording journaled nothing; the replayed timeline loaded anyway), so the end-of-journal consistency check now runs unconditionally; hookless apps answer ReplayUnsupported, which is honestly nothing-to-check.
- Pinned: a zero-record recording replayed into a build that declares a video fails as ReplayEffectDivergence instead of reporting success.
* Refuse non-http(s) schemes at the videoLoadUrl seam
- The seam documents streaming-only and promises to reject bad arguments before the platform is asked, but forwarded any scheme - a direct caller could hand file:///... to a host whose media stack opens it (AVPlayer does); the scheme gate now holds at the seam for every caller, matching the engine's own load validation.
- Pinned: file:, ftp:, and unparseable URLs refuse as InvalidVideoOptions without reaching the platform; https passes.
* Retire the null platform's video player before the load probes refuse
- The macOS host stops the previous player before the file-existence probe, so a refused load leaves no playback behind; the null platform now models the same ordering in videoLoad and videoLoadUrl instead of returning early with the replaced player still emitting frames and events under its old token.
- Pinned: a VideoSourceNotFound load leaves nothing loaded, no pending acknowledgment, and no position ticks.
* Fail frame-less video loads and keep the seek mirror on platform truth
- An asset with no video geometry (an audio-only file loaded as video) now fails the load instead of acknowledging a playback that can never paint - sound over a permanently blank surface is the same broken promise as the conversion-buffer failure the attach path already refuses.
- seekVideo applies the platform seek before moving the mirror: a player the host already retired (a completed non-looping playback) refuses the call, and the snapshot and house slider must stay on the frame actually on the glass; pinned in the post-completion transport test.
* Refuse post-completion seeks on the fake video channel too
- A non-looping natural end retires the platform player (retire-before-emit), so a later seek refuses live and the mirror keeps the terminal position; the fake executor now latches the completion and refuses identically, so replayed chrome and snapshots land exactly where the recording left them instead of scrubbing a player that no longer exists.
- Pinned by a record/replay parity test: a scrub after the natural end keeps position at the duration on both sides, model and fingerprints identical.
* Pair replayed video deliveries from any stage position; stop cancels the TS stream
- The replay pairing in takeVideoMsg now scans the pending stage for the event's fed entry instead of checking only the head: a regenerated loop-side rejection staged earlier in the same dispatch keeps its own drain-time order and no longer reverses the recorded Msg order; pinned by a record/replay ordering test.
- VideoMsgFn may return null - the adapter tier's cancel gate - and the TS bridge uses it to honor Cmd.videoStop's wire contract (stop CLOSES the stream, no events for the key after this): a staged synchronous terminal from the very batch that stopped the stream drains through the engine but never reaches the app, and reopening the tag lifts the latch.
- The house videoMsg constructor never returns null, so Zig-native apps keep the one-terminal-per-load delivery whole; the bridge pin now asserts the swallow and the reopen.
* Cancel the key's staged video answers inside the engine at TS stop
- Cmd.videoStop's cancel now runs where the answers live: stopVideoCancel removes every staged-but-undrained entry for the key before the channel goes idle, so nothing for a stopped stream can reach the app - even the synchronous terminal of a load-fail-stop batch, and even when a later load reuses the same event tag before the drain (a bridge-side tag latch could not tell those generations apart).
- A cancelled answer never journals, so replay regenerates and cancels the same entries and the timelines stay identical with no extra machinery; the VideoMsgFn seam returns to plain Msg and the Zig-native stopVideo keeps its one-terminal-per-load delivery.
- The bridge pin now covers the same-tag reopen-before-drain shape.
* Mirror synchronous load refusals under replay; token-scope ownership and cancel
- The .video_load record's video_kind now carries the load's outcome: a refusal reset the live channel before loadVideo returned, so the replayed fake load resets at the same instant (parking its identity for the journaled terminal) and a snapshot an update reads inside the very dispatch matches the recording's; semantic epoch bumps to 3 (same bytes, the field gained meaning). Pinned by a record/replay probe test.
- Declarative video ownership now rides the load token the reconciler captured at its own load, never the derived key alone - the key is a pure function of the source string, and a manual load carrying it must survive declaration removal and flag deltas untouched; pinned.
- stopVideoCancel is token-scoped: the stopped stream is the latest accepted load, so a replaced predecessor sharing the arm's public key keeps its owed terminal - only stop cancels; pinned at the channel level.
* Refuse post-completion play on the fake video channel too
- A non-looping natural end retires the platform player, so play meets an absent player live: one .failed terminal and the channel resets before playVideo returns; the fake executor now models the same refusal (failVideoChannel on plain fake; under replay just the identity park and reset, because the journaled terminal delivers itself), so a snapshot an update reads right after its own play answers the same on every executor.
- Pinned by a record/replay probe test: the mid-dispatch snapshot reads inactive on both sides, the terminal delivers at its recorded wake, and models and fingerprints match.
* Break the video timer retain cycles and gate video-load outcomes at replay
- Both video timers (the 1/60 pixel clock and the 500ms readout) are now weak-host block timers that self-invalidate when the host is gone: a target-selector repeating timer retains its target through the run loop, so a host destroyed mid-playback without an orderly stop could never dealloc - leaving AVPlayer, the timers, and the conversion buffer permanently retained.
- Replay refuses a .video_load record whose video_kind is neither .loaded nor .failed as a damaged journal: the recorder writes exactly those two outcomes, and anything else would steer the replayed fake load into a state the recording never had; pinned by a hand-patched-journal test.
* Commit the video declaration at install; provenance-gate video rejections
- The main-canvas <video src> capture now stages during the build and commits only when the rebuild installs: a build that fails downstream never mounted, and the retained tree on the glass still shows the old declaration - a later reconcile acting on the unmounted capture would stop or replace a playback the presented tree still declares.
- Replay refuses a .video record whose kind and token are recorder-impossible: rejections stamp token 0 (a refused load never minted one) and every delivery carries its minted token, so a .rejected re-stamped onto a delivered record can no longer slip through the regeneration skip and silently omit the recorded Msg; pinned by a hand-patched-journal test.
* Fail the replay finish check on undelivered fed video results
- A fed record is one recorded delivery, and the event that consumed it live follows it in every honest journal - so a fed entry still staged when the journal ends means truncation or hand-editing, and finishReplay now refuses instead of reporting success; regenerated loop-side answers may honestly outlive the last drain on both timelines and stay exempt.
- Pinned: a fed-but-undelivered result fails the finish check and the same result delivered makes it silent again.
* Restart a finished playback from Play instead of failing it
- A non-looping natural end retires the player, so Play answered with one failed event and the seek was guaranteed to spring back - a broken response to a valid finished state. Effects.restartVideo is the resume path: a fresh load of the channel's own remembered source with autoplay, keeping key, surface, handler, and the loop and mute flags, journaling like any load.
- The house transport's toggle restarts when the completion latch is set and its scrub disables (Play is the live affordance); the snapshot and chrome state expose completed so custom players can do the same - the video-player example's Play now restarts its finished clip.
- Pinned: clicking the house toggle after the natural end issues a fresh platform load and the playback runs again.
* Validate replayed video payloads and source shapes; retire the example's dead seeks
- The replay pairing now requires the fed record's payload to equal what the platform event resolves to: the recorder journals every delivery verbatim from that event, so an altered kind or scalar around an intact identity refuses as divergence instead of handing the app a Msg the mirrors contradict; pinned by a hand-patched-journal test.
- A journaled cascade resolution must be one the load's request shape could select (.local needs a path, .stream needs a url); an impossible pairing latches divergence for the finish check, pinned at the channel level.
- The video-player example's seek-family controls (slider, back, forward) disable after a natural completion - a retired player refuses seeks and the thumb would spring back; Play stays live and restarts.
* Document the video output's vended-size contract at the frame tap
- The pixel-buffer width/height attributes are client requirements AVPlayerItemVideoOutput satisfies by scaling every vended frame, not hints: a 3840x2160 H.264 source tapped with fitted 1866x1050 attributes vends 1866x1050 buffers, so a 4K playback never hits the oversized-frame drop - that guard is defense in depth against a hypothetical non-conforming host, and the comment at the attributes site now says so.
* Keep declared ownership across restart; saturate past-window seeks
- The house transport's restart mints a fresh load identity, so the declarative reconciler re-captures its ownership token when the finished playback was its own - removal and same-source flag deltas keep working after a replay-from-end; pinned in the restart test.
- The TS bridge no longer rewinds a finite seek past the exact-integer window to zero: it saturates just below the window, where the engine's duration clamp lands it at the end - an oversized forward seek means the end, and only NaN and negatives (not millisecond offsets at all) seek to 0; pinned at the bridge level.
* Class non-finite seeks as invalid offsets, never oversized forward seeks
- Infinity reached the past-window saturation branch and sought an active video to its end, though the literal validation rejects non-finite offsets: the saturation now requires a FINITE value, so Infinity seeks to 0 like NaN and negatives - not millisecond offsets at all.
- Pinned at the bridge level beside the finite past-window seek.
* Keep the reserved video surface id inside the f64 exact window
- Surface ids ride the TS wire as f64, and a source-less <video> with custom controls is fed by the app's own Cmd.videoLoad naming exactly the reserved id - the old value sat near 2^63, so the bridge's exact-integer validation rejected it and the element could only ever show its placeholder from TypeScript.
- The id moves below 2^53 (mnemonic preserved, bit 63 clear, still a valid producer id reserved by convention); pinned: in the window, outside the derived-texture namespace, and round-trips the f64 wire unchanged.
* Deterministic seek mirror, journaled handler presence, and baked rotation
- The seek mirror now gates on the deterministic completion latch on every executor: a completed playback keeps its terminal position live and replayed alike (the platform is not even asked - the retired player could only refuse), and residual platform verdicts are fire-and-forget so an exotic host's answer can never diverge replay's mirrors from the recording's.
- Every .video record journals whether its delivery dispatched a Msg, and feedVideoRecord requires the replayed handler presence to agree - a record whose Msg silently vanished, or a Msg live never dispatched, refuses as divergence instead of a silent consume.
- Rotated media renders upright: a track with a non-identity preferredTransform gets a properties-of-asset video composition baked into the vended frames (verified against a portrait-flagged H.264 asset: the raw tap vends encoded orientation, the composition vends display orientation); identity-transform assets skip the render pass and track-less streams have no transform to bake.
* Repaint the chrome when the reconcile moves playback; seek on slider key steps
- A src change loading an autoplaying replacement reconciles after the build installs, so the just-installed chrome advertised the OLD transport state while its control acted on the new one - Play on the label, pause in effect. The rebuild now runs one guarded repass when the reconcile moved the mirrors the build rendered; the repass reconciles an unchanged declaration, so the mirrors are a fixed point. Pinned: the replacement's pause glyph shows in the same build.
- Keyboard and assistive steps on the house seek slider arrive as set_value intents with no widget change event behind them; they now map their fraction onto the duration and drive the channel like the pointer scrub instead of being consumed silently for the next tick to snap back. Pinned with a focused arrowright step.
* Repaint secondary-window chrome when its own reconcile moves playback
- The slot rebuild reconciles its captured declaration after the slot tree installs, so a first mount of an autoplaying <video controls> in a secondary window rendered its chrome from the still-inactive snapshot - disabled Play over a playing video - until some later platform event, seconds away on a slow stream. The slot path now runs the main rebuild's guarded repass when the reconcile moved the mirrors the build rendered; the repass reconciles an unchanged declaration, so the mirrors are a fixed point.
- Pinned: the slot's first installed build shows an enabled pause toggle.
* Latch missing video records; scope bridge verbs to their own stream
- A recorded video event arriving under replay with a handler bound and no fed record before it now latches divergence for the finish check: the recorder journals every handled delivery immediately before its event, so absence is truncation or hand-editing - never a Msg to drop silently; pinned at the channel level.
- Bridge video verbs now prove ownership with the load identity their own accepted load minted (Effects.videoMintedToken): a wire key whose stream was since replaced by a load the bridge never issued - a declarative element's - no-ops its transport verbs, and its stop cancels only its own stream's staged answers while the playback on the channel survives untouched; pinned at the bridge level.
* State the replace-is-not-stop rule at the videoLoad contract
- A replaced load still delivers the terminal it owes, routed to its own event arm - the never-silent promise applies to the replaced stream's failure exactly as to any other, and only Cmd.videoStop cancels undelivered answers. The wire contract now says so explicitly where the open-or-replace semantics are defined; the bridge's routing and the arm-separation pin already enforce it.
* Remember volume across a failed load; gate impossible terminal payloads
- Volume is a remembered preference the next load re-applies, so the bridge's ownership gate now lets videoSetVolume through when the channel is IDLE - a failed load's handler routinely sets it before retrying, and with nobody's playback on the channel there is nothing to protect; a foreign live playback still gates it. Pinned both ways.
- Replay refuses a .video record whose payload shape the recorder never writes for its kind: terminals deliver with playing and buffering false and no dimensions, and a completion pins position to the duration - a synchronously failed load's record has no platform event behind it to cross-check, so the gate is where a hand-set width refuses; pinned by a hand-patched-journal test.
|
||
|
Chris Tate
|
2d23d6f449 |
Cover anti-aliasing bleed and grid misalignment in incremental canvas damage (#183)
* Cover anti-aliasing bleed in incremental canvas damage - Reflowed content left stale fringes: rasterizers ink up to one device pixel past a command's bounds (antialiased edges, glyph overshoot — the packet host's raster cache carries a one-pixel apron for exactly this), but incremental dirty bounds were cut to the exact bounds, so pixels vacated by removed, shrunk, moved, or keyed-replaced commands kept their old edge ink. - Inflate every finalized incremental dirty rect — the refined union, each refined cluster, and the summary fallback, in both frame planners — by one device pixel before surface clipping; full repaints already cover the surface. - Regression test pins removed, shrunk, moved, and keyed-replacement reflows: damage must cover the vacated extent plus the bleed, on the scissor and on the refined rect list a retained host clears. * Prove incremental reflow presents match full renders pixel-for-pixel - Widget-tree oracles swap keyed subtrees (pills removed, shrunk, moved) and byte-compare the incrementally maintained pixel buffer against a fresh full render, on both the summary and refined dirty paths. - A markup-driven oracle covers the ui-app loop end to end: model dispatch, keyed for/if reconciliation, and incremental pixel presents against a retained baseline, for an if-arm swap inside a stable key and a whole keyed-subtree replacement. * Adopt the AA-bleed allowance in canvas frame-plan dirty expectations - Incremental dirty bounds, scissors, and profile dirty areas now carry the one-device-pixel bleed inflation; the pinned rects and JSON move with it. * Add the reflow stale-fringe fix to the changelog - One fragment: incremental damage now carries the one-device-pixel AA bleed allowance. * Hoist the frame-helpers import in the ui app tests - The reflow oracle's pixel-size lookup now rides a file-level import like its peers. * Widen presented damage when the effective scale coarsens the device pixel - Presentation-scale overrides land after planning, so a present at a coarser scale than the plan carried less than one of ITS device pixels of AA bleed allowance - the stale-fringe hole reopened for scale-overriding hosts. - Both override sites now widen the frame's dirty bounds and refined rect list by the allowance difference before the packet build, so the scissor-culled command subset rides the widened scissor. - Regression test plans at scale 2, presents at scale 1, and pins that a removed pill's damage carries the full presented-scale device pixel. * Snap incremental damage outward to the device-pixel grid - Clears land on whole pixels while command culling tests the float dirty rect, so a fractional dirty edge erased the boundary pixel's antialiased coverage without redrawing the unchanged neighbor that painted it - a missing fringe beside every reflow. - Finalized dirty rects (refined union, refined clusters, summary fallback, both planners, and the presentation-scale widening) now snap outward to the device-pixel grid before surface clipping, making the cull region identical to the cleared pixels. - Pixel regression: a mid-pixel dirty edge beside an unchanged antialiased neighbor must leave the incremental buffer byte-identical to a full render. * Re-align presented damage on any differing presentation-scale grid - Pixel grids need not nest across scales: a plan-grid-aligned dirty edge sits mid-pixel at a fractional finer scale (plan 1, present 1.5), so the present's clear wiped a boundary pixel whose antialiased coverage came from an unchanged neighbor the plan-aligned scissor culled. - The presentation-scale rework now re-snaps the dirty bounds and refined rect list outward on the presentation grid whenever the scales differ, keeping the coarser-scale bleed growth. - Pixel regression plans at scale 1, presents at 1.5, and byte-compares the incremental buffer against a full render. * Keep snapped dirty edges on their device boundary through the f32 round trip - ceil(v*s)/s can land on an f32 whose product with the scale rounds back past the device boundary (65 points at 1.75x becomes 65.14286, product 114.00001), so consumers re-deriving pixels cleared one more pixel than culling against the rect admits - erasing an unchanged neighbor's boundary coverage. - The device-grid snap now nudges each edge ulp by ulp until its product lands on the intended boundary, never moving inside the original rect. - Pixel regression pins the 65-point/1.75x round trip: the dirty edge's product must ceil to its own boundary and the incremental buffer must match a full render byte for byte. * Decide damage pixels on integer device boundaries, not rounded logical insets - The AA bleed moved by a rounded 1/scale in logical points, which can multiply back to the original boundary and fall a whole device pixel short (a pill at x=170 removed at scale 1.3 never dirtied column 219); the bleed is now whole device pixels applied to the floor/ceil boundaries directly. - Stored rects re-derive their max edge as x + width, and re-encoding a nudged edge as a width could push the reconstructed product past its boundary; spans are now chosen by testing the reconstructed edge itself, so stored fields round-trip onto exactly the intended pixels in both directions. - A property sweep pins the stored-field round trip across fractional scales, and a fractional-scale removal pins the whole-pixel bleed reach. * Clamp damage boundaries before the device-grid edge walk - A far off-screen coordinate can floor/ceil to infinity once scaled, and a nextAfter walk from infinity never terminates - frame planning hung instead of clipping the damage away. - Boundaries clamp into f32's exact-integer range (2^24) before the edge search, and NaN degenerates to zero; surface clipping owns everything past the clamp. - Regression pins finite results for damage rects near f32's range on both sides. * Walk the damage edge value, never the span, when re-encoding widths - With both boundaries collapsed onto the off-screen clamp, the span walk started at zero and stepped denormal ulps that never moved the sum - over a billion iterations before incremental frame planning could continue. - The span derivation now walks the reconstructed EDGE value (ulp proportional to magnitude, a few steps), re-encodes it as the stored span, and gives up the sub-ulp sliver when a step cannot move the sum - an empty rect surface clipping discards. - Regression pins the collapsed case: a small far off-screen rect must settle immediately into a finite, discardable result. * Judge damage boundaries in double precision and keep far damage a superset - Retained hosts reconstruct and scale the wire rect in double precision: an f32 edge whose product merely rounds onto its boundary can sit past it exactly (64 wide at 1.75x lands 115.0000019), so the host cleared a pixel the engine culled for. The edge and span walks now judge products and reconstructed sums in f64 - exact for f32 operands and precisely what hosts compute - which implies the f32 behavior too. - The off-screen clamp collapsed legitimate unclipped damage to empty (a change near x=20M with the frame planner's default empty surface reported nothing to repaint). Out-of-walk-range boundaries now keep a finite, non-collapsed superset instead; exact cull/clear equivalence only matters within presentable surfaces, far below the walk range. - The round-trip property sweep now pins the double-precision boundaries as well, plus the known 1.75x seam case and the far-off-screen superset. * Clip damage on device boundaries and keep the far-damage superset in place - Surface clipping ran as a rect intersection AFTER the exact snap, and even a no-op intersection reconstructs the width - the stored edges' round trip could cross their device boundary again (a 5.89-wide change at 2.5x re-encoded from a ceil of 20 to 21, clearing a column the packet's culled command list never repaints). Clipping now happens on the integer device boundaries inside the snap, and the finished rect is never re-encoded. - The far-coordinate fallback clamped edges to 3e37, parking damage away from far-but-representable content; only NaN and the infinities are replaced now, and the reconstructed max edge is shaved back to finite at the f32 range edge. - The property sweep pins the surface-clamped path's double-precision boundaries, and the superset tests pin damage staying AT far content. * Canonicalize signed zeroes out of snapped damage edges - A zero boundary's edge walk steps below zero and back, settling on negative zero; serialized scissors then printed a signed zero. Snapped edges and spans normalize to plain zero. * Say list-detail for the selection-pane pattern - Wording only: the changelog fragment and two test comments; no behavior. |
||
|
Chris Tate
|
e48af75fcc |
Replace journal and protocol version counters with layout fingerprints (#182)
* Replace the automation protocol version with a comptime layout fingerprint - The CLI/app handshake identity is now a Wyhash over a canonical comptime description of the protocol surface (the Action enum reflected with names and values, the Command shape, dropbox and queue naming, budgets), so shape changes move it automatically - no counter to remember, no next integer for parallel branches to contend over; a manual semantic_epoch stays for changes the description cannot see. - Snapshots stamp protocol=0x<fingerprint>, the CLI parses hex or the retired decimal counter (a stale app gets a NAMED mismatch, never .missing), and skew teachings, the journal header, replay's refusal, and native version all name fingerprints instead of version numbers. - The +1-skew handshake fixtures perturb the fingerprint; new tests pin that an added field, a rename, a reorder, and an epoch bump each move the identity. * Replace the journal format version with a comptime layout fingerprint - The preamble now carries a u64 fingerprint hashed from a canonical description of the on-disk layout: record kinds, event tags, every record struct and the effect record reflected field-by-field (journaled enums with names AND values), each event payload type, and deliberate constants for the hand-written codec facts reflection cannot see (framing, string/optional/enum encodings, modifier bits, the accessibility verb's i32, the gpu_surface_frame journaled subset - each commented at its codec). - JournalUnsupportedVersion becomes JournalFormatMismatch and the teaching now says what is true: the journal was recorded by a build whose journal format differs from this one - re-record with this build; a format_semantic_epoch covers the rare meaning-only change with identical bytes. - Skew tests perturb the fingerprint (including a retired-counter-era preamble refusing as mismatch, never corruption), and a new test pins that an epoch bump moves the combined fingerprint. * Print both layout fingerprints from print-pins and note the conscious break - zig build print-pins now leads with the session journal format and automation protocol fingerprints (with their semantic epochs), the same values native version and the skew teachings name, so coordination and debugging can quote a build's wire identities exactly. - print-pins builds against a HOST clone of the framework module for the journal constant (one compilation cannot hold a source file in two modules, and the run step must stay executable when -Dtarget cross-compiles everything else); the fingerprints are layout identities, identical across targets. - Changelog fragment states the deliberate break: journals and automation sessions from earlier builds refuse with the re-record teaching; identity beats ordering because no compat path exists. |
||
|
Chris Tate
|
2eb9424c63 |
Native context menus on Windows and Linux; point-anchored fallback everywhere (#172)
* Anchor the context-menu fallback surface at the click point - Thread the secondary click's pointer location through the fallback request into Ui.finalize, so the synthesized surface opens at the click like a native menu instead of the target row's bottom-left corner - Give WidgetAnchor a point mode: a zero-size anchor rect at an explicit window-space point, reusing the existing flip-above and window-clamp edge rules - Cover the point mode's placement, bottom-edge flip, and horizontal clamp at the geometry level, and the click-point mount end to end on a wide row Co-authored-by: startewho <898009+startewho@users.noreply.github.com> * Present native Windows context menus through TrackPopupMenu - Mirror the tray popup discipline for the runtime's declared items: presentation defers to a fresh loop turn, TPM_RETURNCMD | TPM_NONOTIFY with SetForegroundWindow and the WM_NULL post, logical view-local request coordinates inverted through the presenting HWND's DPI scale and ClientToScreen - Selection and dismissal emit the same journaled context_menu_action payload the macOS host produces (token echo, item id, 0 for dismissal), so session replay stays shape-identical across platforms - Flip .context_menus to the tray's system-engine gate and unit-test the pure seam parts (item translation with separators and disabled flags, the action-event mapping); the TrackPopupMenu modal loop itself is only exercisable on a live Windows session Co-authored-by: startewho <898009+startewho@users.noreply.github.com> * Present native Linux context menus through GtkPopoverMenu - Build a sectioned GMenu from the declared items (separators split sections, disabled items ride action enablement) wired to a per-invocation GSimpleActionGroup inserted on the presenting view widget, pointed at the click with a 1x1 rect in the widget's logical coordinates - the same space the inbound pointer path reports in - Emit exactly one journaled context_menu_action per request (selection from the item action, dismissal from a one-turn-later teardown idle after the popover closes), the same token-echo payload the macOS and Windows hosts produce; refs stay balanced with weak pointers covering widgets that die while the menu is up - Flip .context_menus to the system-engine gate, keep the new code outside the WebKitGTK stub fences, and update the docs, skill, and README claims that named native context menus macOS-only Co-authored-by: startewho <898009+startewho@users.noreply.github.com> * Gate context-menu resolution on per-request tokens - Mint a fresh correlation token per presented (or automation-armed) request and check it before clearing the pending request, so a superseded menu's late dismissal can never resolve or clear its successor - even when both target the same widget. - Give each GTK popover menu a per-invocation action-group namespace: the deferred teardown of a superseded menu now removes only its own group instead of the one the replacement just inserted on the same parent. - Windows and macOS need no gate by construction (TrackPopupMenu blocks the loop thread and emits inline from a moved-out request; the macOS presentation block captures its token as a local while popUpMenuPositioningItem blocks the main queue) - noted at both fix sites. * Add the native context-menus changelog fragment - One feature fragment covering the Windows and Linux presenters, the .context_menus capability on both system-engine hosts, and the fallback surface's click-point anchoring. * Cancel pending GTK context-menu teardown idles at host destroy - Track every queued teardown idle on the host, linked through the menu states themselves: the popover's closed handler pushes the receipt the moment it exists, and native_sdk_context_menu_free unlinks on every exit path - A superseded menu's deferred teardown captures its state and the host raw while host->context_menu tracks only the current menu, so destroy now removes each pending source and frees its captured state inline instead of letting the idle fire into a freed host - The weak pointers keep covering widgets dying before the menu state; this covers the host dying, and cancelling deliberately drops the superseded request's owed dismissal since the runtime gating on that token is torn down with the host * Re-point the notes context-menu token assertions at the recorded token - Context-menu correlation tokens are minted per request and opaque, so the tests assert the null platform recorded a nonzero token instead of expecting the widget id * Escape mnemonic ampersands in Windows context-menu and tray labels - AppendMenuW treats & as a mnemonic marker, so an authored label like "R&D" rendered with the ampersand eaten and an accidental mnemonic armed; labels now cross the ABI with & doubled - The escape lives in the shared translation helper covering both the app context-menu path and the tray path, whose labels are app-supplied too; a label the pool cannot hold passes through raw rather than truncated - Pin the escaped output and the pool-exhaustion passthrough in the item-translation unit tests * Escape mnemonic underscores in GTK context-menu labels - GtkPopoverMenu treats _ in an item label as a mnemonic marker, so an authored label like "Save_As" rendered with the underscore eaten and an accidental mnemonic armed; labels now cross the ABI with _ doubled - The escape lives in the context-menu translation helper (the GTK host strndup-copies every label before returning, so the caller stack pool is safe); a label the pool cannot hold passes through raw rather than truncated, and the menu bar keeps _ untouched as its intentional GTK mnemonic convention - Pin the escaped output, the underscore-free pointer passthrough, and the pool-exhaustion passthrough in the item-translation unit tests * Map GDK pointer buttons explicitly to the runtime's ordering - GDK numbers secondary=3 and middle=2; the old subtract-one sent right clicks to the runtime as middle (never opening the menu) and middle clicks as secondary (opening it); press and release now share an explicit GDK-to-runtime switch, and the interactive-move stash keeps raw GDK numbering for gdk_toplevel_begin_move - The Linux canvas smoke now owns its Xvfb display and drives a real xdotool right-click through a task row's declared context menu, asserting the selection's Msg dispatch ('1 done') in the snapshot - ui-inbox task rows declare an honest one-item menu (Toggle done) so the smoke exercises an app-declared menu end to end * Resolve context-menu selections from a present-time snapshot - GTK popovers are asynchronous: a rebuild while the menu is open (timers or effects reordering conditional items) could redirect the visible selection through the live tree's handler table - The runtime now emits canvas_widget_context_menu_shown after a native present; UiApp snapshots the shown items' dispatch Msgs keyed by the request token, and a token-matching selection resolves from that snapshot on every platform - never the rebuilt tree - The automation verb and the fallback surface keep live-tree resolution: both validate against the tree they show * Bump the automation protocol to v8 for per-request menu tokens - Recorded context_menu_action tokens changed from widget ids to per-request generations; a v7 journal's selections would be silently swallowed by the token gate instead of refused - The version handshake now turns that into the loud preamble mismatch, and the changelog fragment states the break deliberately * Deep-copy context-menu snapshot slice payloads at present time - The present-time selection snapshot copied MsgT by value, so a menu held open across two rebuilds dispatched slice payloads pointing into reset build-arena storage - Snapshot Msgs now deep-copy every reachable slice into a token-scoped arena, released on resolve, supersession, and teardown - Regression test presents a menu over an arena-derived payload, rebuilds twice with sentinel bytes, and asserts the dispatched Msg carries the bytes the user saw * Drive the smoke's context-menu popover by pointer under Xvfb - Xvfb has no window manager, so the GTK popover never receives keyboard focus and xdotool Down/Return died on the canvas beneath it; the menu's shown event fired but no selection ever dispatched - Locate the popover's override-redirect X window by diffing the root's children across the right-click (topmost new viewable window) and click its center — the row declares exactly one arrowless item, so the center is the item - Failure diagnostics now dump the X window list alongside the snapshot and app log; the workflow installs x11-utils for xwininfo * Sharpen the snapshot copy: const slices only, exact types, loud OOM - Mutable slice payloads pass by reference (update may write through app-owned storage; a copy would swallow the writes), while const slices copy with their declared alignment and sentinel and error unions recurse into successful payloads - An out-of-memory copy now logs which item it disarmed instead of failing silently - Direct unit test pins the copy semantics per shape; the integration test drives the error-union arm through the two-rebuild race * Refuse un-copyable context-menu payload shapes with teaching errors - A mutable slice's aliasing is unknowable to the deferred snapshot (arena bytes must be copied, model-owned storage must not be), so it is a compile-time teaching error instead of a silent guess either way - Slice-bearing fixed arrays are refused too: an array's length says nothing about which elements are initialized, so walking a count-plus-buffer payload would interpret its undefined tail as slices; slice-free arrays and untagged unions still pass by value as plain bytes - typeCanReachSlice gates the refusals so only genuinely un-copyable shapes are rejected; the unit test now covers the scalar count-plus-buffer shape with an undefined tail * Scope the snapshot copy to const slices with a hop budget and a loud fallback - The copier now walks only the blessed arena payload shape (const slices through structs, tagged unions, optionals, and error unions); mutable slices, fixed arrays, untagged unions, and non-slice pointers pass through under the deferred-Msg rule that their storage outlives the menu, so no payload shape is a compile error - A slice-hop budget bounds the walk, turning cyclic or absurdly deep payload graphs into a handled error instead of unbounded recursion - A failed copy (out of memory or over budget) keeps the visible item live: it dispatches the uncopied value with a warning naming the item, never a silent no-op * Pin the presenting build's arena while its context menu is open - Replace the snapshot payload copier outright: while a presented menu's token-keyed snapshot is armed, the arena generation that built the presented tree is exempt from the rebuild reset, so selection dispatches the ORIGINAL Msg value - same bytes and same pointer identity as the fallback surface and the automation verb, with no payload-shape restrictions, no copy allocation after present, and no recursive walk - A new canvas_widget_context_menu_dismissed runtime notice releases the pin (and disarms the snapshot) when the menu closes without a selection; selection and supersession release it as before, and growth while a menu is open is bounded by its open span - The regression test now also asserts pointer identity end to end and the pin's release on selection and dismissal * Key the menu pin by window identity and double-buffer rebuilds under it - The pin names its canvas by stable window identity, never slot index: removing a window swap-moves another slot into its place, and an index-keyed pin would protect the wrong arena; the pin-owning window's teardown now releases the snapshot and pin before its arenas deinit - While pinned, every rebuild of that canvas routes through the partner arena on its normal reset cadence (the consecutive-build pattern the clearance retry already runs), so memory under an open menu holds at two trees regardless of rebuild count - ANY superseding presentation or dispatch releases the previous app-menu request - a default edit/copy menu and the automation verb's direct dispatch now send the dismissed notice, not just app-over-app presentations - Tests: pin follows its window across slot compaction (bytes and address), window removal releases, cross-kind and automation supersession release, and capacity stays flat across 14 rebuilds under an open menu * Name the superseded menu's view in its dismissal and commit the successor first - The pending request now carries a bounded copy of its view label, so the superseded-menu dismissal notice names the canvas it was presented on instead of an empty label (raw apps tracking per-canvas menu state need the correlation, and the view may already be gone) - The replacement pending commits before the fallible dismissed-notice dispatch: if an app handler errors on the notice, the runtime's expected token still matches the menu the platform accepted, so the successor stays selectable - Runtime-level test pins both: the notice carries the old token and the real view label, and the successor menu resolves after the supersession * Keep the automation menu verb's synthetic selection ahead of a failing dismissal notice - The widget-context-menu verb captures the superseded-menu dismissal notice's error and re-raises it only after the synthetic selection dispatches: unlike a presented menu, whose outcome the platform delivers later regardless, that dispatch is the armed request's only outcome, so no error path may leave a pending token with no presented menu and no delivered outcome - The notice keeps its place in the event order (the old menu's dismissal before the successor's outcome), and its error still surfaces after the runtime's bookkeeping settles - Test pins the supersession under an erroring dismissal handler: the selection still dispatches, the error still propagates, and no pending request survives * Keep menu state sound when rebuilds fail or handlers close views - A rebuild routed into the live tree's arena under an open menu's pin now drops the tree reference when the pass fails after its reset: handlers go quiet until the next successful rebuild instead of dangling into reset, partially rewritten storage, and the pinned snapshot still resolves the presented payload - The superseded-menu dismissal notice runs arbitrary app code that can close views and compact their indices, so the shown event and the automation verb's synthetic selection now name their view from the committed request's own copy (showMenu returns it) instead of re-reading a cached index that a compaction can point at another view or another window's canvas - Tests pin all three seams: the failed over-budget rebuild under a pin drops then restores the tree with the presented menu intact, and both supersession paths keep naming the presenting view after the dismissal handler closes a different one * Restore a dropped tree on menu resolution and refuse a superseded automation verb - A menu resolution that dispatches no Msg (dismissal, out-of-range or unmapped-item swallow) now restores a live tree the pinned-rebuild guard dropped: no Msg-driven rebuild is coming, and without a handler table every event silently no-ops until an unrelated resize or effect rebuilds - The widget-context-menu verb now checks its freshly armed token survived the dismissal notice: a handler that synchronously presents a superseding menu replaces the pending request, so the verb refuses with ContextMenuSuperseded instead of reporting success while the token gate swallows its synthetic action - Tests pin both: a dismissal after the failed over-budget rebuild rebuilds the tree once the model fits again, and the superseded verb errors by name while the handler's successor menu stays resolvable * Announce nothing for a presentation superseded during its own notice - showMenu now reports a three-way outcome: shown, refused, or superseded — the dismissal notice's app code can synchronously present a successor menu that replaces the freshly committed request, and a late shown event for it would overwrite the successor's snapshot with a token the action gate no longer accepts, stranding the stale pin - A superseded presentation announces nothing and never falls back to the anchored surface, which would mount a second menu under the successor's native one - Test pins the chain: menu A superseded by B whose notice presents C — three presentations, two announcements, the last carrying C's token, and C resolves normally * Release the menu pin before its selection dispatches and refuse a closed-view verb - A snapshot selection's Msg is stored by value and its pinned-arena payloads are consumed by update itself, so the pin now releases before the dispatch: the rebuild routes into the partner arena naturally, and a Msg whose update breaks a build budget fails the rebuild without resetting the live arena — input keeps working on the previous tree and the app's controls can recover the model - The widget-context-menu verb revalidates its target view after the dismissal notice: a handler that closed it leaves a request that can never resolve, so the verb disarms it and refuses with ContextMenuViewClosed instead of reporting success while the action dispatch silently drops the selection - Tests pin both: the poison selection leaves the tree live and a real click on the recovery control rebuilds in budget, and the closed-view verb errors by name with no orphaned token * Disarm a presentation whose view died mid-notice and restore the tree before menu resolution - showMenu now rechecks the presenting view after the dismissal notice: a handler that closed it leaves a request whose action can never deliver (or never arrive), so the request disarms with a view_closed outcome — never announced, never the anchored fallback on a dead view - Arming a shown snapshot and resolving a snapshot-less selection both restore a live tree the pinned-rebuild guard dropped: a menu presented while the model was unbuildable still resolves once the model recovers, instead of falling through a null tree and dispatching nothing - Tests pin both: the closed-view presentation stays silent, its token inert, a fresh present arms cleanly — and the snapshot-less selection dispatches the restored build's payload --------- Co-authored-by: startewho <898009+startewho@users.noreply.github.com> |
||
|
Chris Tate
|
e67d3bd9c5 |
External-source channels: journaled events from app threads, sockets, and watchers (#165)
* Add the external-source channel effect family to the engine
- fx.openChannel/closeChannel with a generation-stamped thread-safe ChannelHandle.post that stages into a per-channel non-lossy FIFO, wakes the host, and reports back-pressure through per-channel drop counters
- channels share the keyed families' key space (occupied from open until the .closed terminal delivers) and deliver every event through the ordinary drain, journaled at the boundary
- journal format v8: the .channel effect-record kind with inline post bytes; replay feeds recorded events verbatim (no source thread), regenerates admission rejections, and damage-gates impossible records
* Cover the channel family: lifecycle, back-pressure, key space, replay
- direct-channel tests: open/post/deliver/close order, thread posting, duplicate-key and full-table rejects, drop accounting, post-after-close/teardown safety, shared key space with fetch and spawn
- record/replay acceptance: a session recorded with a live posting thread (one honest drop aboard) replays fingerprint-identical offline with no source thread; the duplicate open's rejection regenerates
- damage gates: over-bound post bytes and byte-carrying terminals refuse replay as damaged records
* Give transpiled cores the channel family: Cmd.channelOpen/channelClose
- wire opcodes 0x15/0x16 (additive within cmd_format_version 3) with rt builders, SDK types (ChannelState/ChannelEventArm/ChannelEventKind), and emitter lowering with the image-id literal gates
- ts_core_host routes every event through a five-field by-name arm (key/state/bytes/droppedPending/droppedTotal) on a non-retiring bridge entry; duplicate live keys reject at the post-cycle boundary echoing the key
- posting stays native-side API (Effects.channelHandle) - transpiled cores open, close, and receive; the bridge test drives a real handle post through the drain
* Add the channel-monitor example: a worker-thread source, zero polling
- an app-owned std.Thread samples its own process (uptime, peak RSS) and posts each reading through the channel handle; the UI updates only when events arrive
- Stop closes the channel and the detached worker winds down on the handle's false answer - safe past close and past teardown by the handle's construction
- tests swap the worker for a handle-capturing stub: posted samples land, no fx timer is ever armed, close kills the handle, a refused open reports rejected
* State the channel family and its journal v8 bump in the changelog
- one fragment covering the Zig surface, back-pressure contract, the conscious v8 format break, the TS tier, and the channel-monitor example
* Answer channel posts with a four-way PostResult instead of a bool
- ChannelHandle.post now returns PostResult { accepted, dropped_full, dropped_oversized, closed }: a producer can tell transient back-pressure (skip and continue) from closure (exit the loop) instead of guessing at a false; both drop answers keep the exact drop-counter semantics, and oversized gets its own member because its remedy differs (no retry of the same bytes can ever land)
- channel-monitor's worker now reads the answer honestly: dropped_full skips the sample and keeps sampling (the status line reports the delivered drop counters), closed winds the thread down - a transient 32-entry stall no longer stops monitoring forever while the UI says "monitoring"
- unmerged API, clean break: every post site, the SDK doc comment, the handle-lifetime docs, and the example's tests/README move to the enum
* Park replayed channel opens so a re-run source thread cannot diverge the stream
- under armReplay, openChannel registers the occupancy exactly as live (duplicate opens keep rejecting symmetrically, the shared key space holds) but allocates no staging and returns an INERT handle: every post answers .closed immediately, so app code following the documented open-and-spawn pattern sees its re-spawned worker exit on its first post instead of interleaving live posts with the journal-fed events
- closeChannel tolerates the parked occupancy's missing posting header; the fed .closed terminal retires the parked slot at its recorded position, the same causal instant live delivery frees the key
- new acceptance regression records the open-and-spawn pattern with a real posting thread and replays it offline fingerprint-identical (pre-fix the re-run worker's accepted posts diverged the checkpoints), plus direct coverage that inert-handle posts stage nothing and count no drops and that duplicate opens under replay still reject
* Teach the evals Cmd decoder the channel opcodes
- decode channel_open (0x15: key f64 LE + event_tag u8, exactly the bytes rt.zig's cmdChannelOpen builds - no max_pending rides the wire) and channel_close (0x16: key f64 LE) into new Op arms
- batch test pins both records' lengths so a trailing record still decodes; the unknown-op panic already names the offending byte and offset, so the next opcode gap stays a one-line diagnosis
* Never wake the host for a refused channel post
- A producer continuing through .dropped_full (the documented contract) enqueued one host wake per refusal, growing the main-loop queue without bound while the stage itself stayed bounded.
- The post site now documents the invariant: a wake is issued only when a post makes new work drainable - a full stage's entries already carry their accepted posts' wakes and the drop counters ride the next delivered event, an oversized post stages nothing, and a closed post stays a pure no-op.
- New regression test pins the pending-wake count flat across a 65-refusal storm and pins the accepted path's exactly-one-wake behavior before and after the stage refills.
* Document the channel family across the TS and skill surfaces
- The TypeScript-cores page gains Cmd.channelOpen/channelClose in the command table, a five-field event-arm example with the exact ChannelState union, and the channel stream in the Sub-vs-stream teaching.
- Both shipped skills now teach the family: native-ui gets the fx.openChannel section (verbs, event arm, back-pressure and replay contracts, test surface) and ts-core adds the channel ops to its streaming-ops set.
- A stale OpenChannelOptions comment still said overflow posts return false; it now states the .dropped_full PostResult, and the changelog names the refused-post-never-wakes contract.
* Never hold the channel staging mutex across the host wake
- Split the channel post's host wake out of ChannelShared.mutex into a ChannelWake half behind its own mutex, mirroring the media-surface producer's data/wake split: posts stage under the staging mutex, release, then wake, so drain, close, and teardown never contend with a slow or blocking platform wake hook.
- Arm the binding at openChannel and disarm it under the wake mutex on every close path (closeChannel, terminal retire, teardown) — the abandon fence: after a disarm returns, no post is inside the host call and none can start one.
- Document the lock-order invariant at ChannelShared.mutex (the staging mutex is never held across a host callback; the two locks never nest) and pin it with an injected wake hook that probes the poster's lock state.
* Coalesce channel post wakes behind one latched host wake
- Latch an atomic wake-pending flag in the channel's wake half on the first accepted post and ride it for the rest of the burst, following MediaSurfaceWake exactly: a fill/drain/refill producer now costs one host-queue entry per drain instead of a standing backlog of redundant wakes.
- Clear the latch at the drain pass boundary BEFORE snapshotting the post order (adoptMediaSurfaceFrames' clear-before-sample placement), so a post racing the drain either lands inside the pass's snapshot or observes the cleared latch and wakes afresh — nothing staged is ever left wakeless; the flag is per-channel, riding the generation-fenced binding the lock split introduced, and checked lock-free so a reentrant wake hook coalesces instead of deadlocking.
- Gate the contract in tests: a full-stage burst latches exactly one wake, a post after the pass boundary wakes afresh and delivers next pass, refused posts still never wake, and a wake hook posting back into its own channel completes instead of deadlocking.
* Surface a failed sampler start in the channel-monitor example
- Claim "monitoring" only after the source thread actually starts: the spawn reports failure through the start seam instead of silently returning with a live channel and no producer.
- On failure, close the just-opened channel (the .closed terminal frees the key for a retry) and render "sampler failed to start" in the status line.
- Exercise the failure branch through the injected-source seam the tests already use — std.Thread.spawn cannot be made to fail deterministically — including full recovery on a retry with a healthy source.
* Reserve channel-table capacity for an alloc-failed open until its rejection drains
- Live table admission now counts staged executor-truth channel rejections as occupied capacity, matching the slot replay parks for the same open until the journaled terminal feeds; regenerating refusals (occupied key, full table) deliberately never reserve, the same line the key window draws
- Route channel storage creation through a swappable allocator seam so tests can fail one open's start surgically
- Cover the reservation window, the table-limit record/replay boundary, regenerating no-reserve accounting, and teardown with a reservation pending
* Dispatch bridge-refused rejections in command-stream order across families
- Merge the TS core host's per-family rejection staging (spawn, image, channel) into one kind-tagged stage drained in wire order, so a mixed Cmd.batch's refusals reach update under the performed-in-order contract; a future family joins with one enum member and one switch arm
- Spawn rejections now share the spill discipline: a batch carrying more refused spawns than the effect table holds slots yields one rejection each instead of a panic
- Pin the order at both tiers: bridge tests drive mixed, reversed, and three-family refused batches, and the transpiled e2e fixture records a mixed-rejection session that replays with identical cross-family order
* Preserve mixed-provenance channel rejection order under replay
- A replay-parked open now reserves its pending-order slot at dispatch: the park consumes the pending_seq stamp a live executor-truth refusal would have staged at, and the fed park-retiring .rejected delivers through the pending stage at that stamp (ordered insert, slot retired at delivery) instead of trailing every younger regenerating refusal through the completion queue.
- Accepted opens stamp too - refusal-vs-accepted is only knowable at the first feed - but any non-.rejected feed vacates the stamp unused, so their fed streams keep riding the queue unchanged.
- Cover the mixed sessions end to end: alloc-fail-then-table-full replays in live order, the regenerating-first shape keeps its lead, and a rejection handler that opens a third channel sees the same table state on both sides.
* Publish the channel wake's services binding and sweep staged work at bind
- Posting threads now read the services binding through an atomically published mirror (release store at bind, acquire load under the wake mutex) instead of racing the loop thread's plain-field write; the release/acquire pair is the publication contract that makes the host state fully visible to the first cross-thread wake.
- bindServices sweeps: a post accepted before the binding could neither wake nor latch, so the bind issues one catch-up host wake when anything is staged - without it a one-shot producer that posted early stranded forever.
- Cover both shapes: the pre-bind post delivers off the bind sweep's wake with no further post, and an idle bind wakes nobody.
* Give channel occupancies a channel-owned u64 generation
- Channel handles now stamp from a dedicated monotonic u64 counter instead of the shared wrapping u32 effect counter: the permanent-closed guarantee is absolute, and a u32 wrap after 2^32 occupancies would let a long-lived stale handle match a reused slot and post into another producer's channel (the media-surface producer handle's width, mirrored).
- Fed channel entries carry the u64 generation on their own queue field; the slot families keep the shared u32 counter for their loop-internal gates.
- Pin the width, the counter's independence, and the wrap case itself: a seeded counter reproduces the exact u32 truncation collision and the stale handle still answers closed.
* Add ChannelHandle.live() and state the replay re-run honestly
- live() is the producer-launch check: false for parked replay handles, refused opens, closed or reused occupancies, and torn-down runtimes - advisory only, the post's own answer stays authoritative. The replayed open parks, but the opening update re-executes, so a producer launched unconditionally really starts (connects and blocking setup before its first post included) and is stopped only at that first post; gating the launch on live() keeps replay fully offline.
- The channel-monitor example consults live() before spawning the sampler - the Msg stream and model are identical either way because nothing model-visible branches on it - and its tests pin that a replay-armed start never invokes the source seam.
- Say it honestly everywhere it was claimed: the changelog fragment, the openChannel doc comment, the test-suite header, and both skill surfaces now state that replay never NEEDS the source rather than that no source thread runs, and one journal replays identically under both producer disciplines (acceptance-tested).
* Repair the bind/post wake handshake with a seq_cst store-buffer pairing
- bindServices' services publish, hasPending's mirror loads, the post's pending increment, and requestHostWake's services load all carry seq_cst: release/acquire never orders a store before the same thread's later load of another location, so both sides could read stale values and strand an accepted post with no wake
- Document the total-order argument at each of the four operations: whichever store lands later in the seq_cst order, that side's subsequent load sees the other's store, so the poster wakes or the binder sweeps
- Add a bounded concurrent regression (300 iterations, one post racing one bind) asserting a wake is always observed and the post drains, documented as probabilistic-but-real for this race class
* Deliver bridge refusals through the engine's one seq-ordered rejection stream
- A batch mixing an engine-refused record (cross-family occupied key, staged into the pending FIFOs for the next drain) with a bridge-refused one (host-side stage, dispatched at the cycle boundary) delivered the second rejection before the first, breaking Cmd.batch's performed-in-order contract across layers
- Add Effects.stageLoopMsg: a non-lossy caller-staged Msg stage sharing the pending seq stamp, never journaled and regenerating by contract; the TS bridge now stages its spawn/image/channel refusals there at refusal time and its finishCycle rejection stage retires, so one seq-ordered drain delivers every rejection in command order
- Pin the engine-then-bridge and bridge-then-engine compositions, the three-family mix, the journal provenance (bridge refusals journal nothing, engine refusals journal marked regenerable), and record/replay identity for mixed-authority rejection order
* Run the channel host wake with the wake mutex free
- An embedder wake_fn has no enqueue-only contract: holding wake.mutex through the call deadlocked against drainBoundary (and post's never-blocks contract) whenever a wake synchronously marshaled to the loop thread.
- Posts now mark an in-flight count under the mutex, release it for the host call, and re-acquire to clear; disarm clears the binding under the mutex and waits for in-flight to reach zero, so a returned disarm still means no producer is inside the host call.
- Gate the invariant with a wake hook that takes the drain's own pass boundary (deadlocked before, completes now) and asserts the wake mutex is free during the call.
* Refuse terminal feeds into a live channel occupancy
- feedChannelEvent is the replay/test seam and replay parks its opens with inert handles; feeding a terminal into a LIVE occupancy (open posting header, staged backlog, or armed close marker) raced the producer: the terminal's delivery destroyed the staging FIFO and stranded channel_pending_count, leaving hasPending() true forever.
- Feed answers error.ChannelLiveFeed for that shape instead; live occupancies end through closeChannel, and teardown already reconciles the count to zero when it discards staged entries.
- Tests pin the loud refusal (open and .closing shapes), the reconciled count after teardown-with-staged-entries, and the parked replay feeds staying green.
* State the bridge refusal timing break and align the TS replay claim
- The changelog names the rejection-timing change deliberately: bridge-produced refusals (duplicate-spawn keys, image validation, channel admission) moved from the command cycle's own boundary to the next host drain so every rejection arrives in one seq-ordered stream, and a frame may now render between the cycle and the rejection Msg.
- Cmd.channelOpen's doc drops the last 'no source thread at all' overclaim: replay never NEEDS the source, an unconditional producer is stopped at its first post, and a live()-gated one keeps replay fully offline.
* Reset the channel-monitor drop total on restart
- The start path reset samples and visible rows but not dropped_total, so a fresh run showed the previous run's drops until the first data event.
- The restart test now ends a run with a counted drop and pins a zeroed readout immediately after the fresh start.
* Split channel wake disarm into a non-blocking revoke and a teardown quiesce
- closeChannel and retireChannelSlot now revoke the wake binding without waiting out in-flight host calls: a supported wake hook that synchronously marshals to the loop deadlocked against the old spin-wait when the marshaled dispatch's handler closed the channel
- teardown keeps the blocking quiesce but bounds it (injectable deadline, abandoned-call counter): deinit runs as the loop stops servicing dispatches, so it cannot guarantee an in-flight marshal ever returns, and everything the abandoned call still touches lives in the process-lifetime header
- gate tests: the synchronous-marshal close completes with one .closed terminal, a stale in-flight call outliving close and reopen cannot unlatch the fresh occupancy, and teardown both waits out a slow hook and abandons a stuck one safely
* Release the wake coalescer latch when a takeMsg sweep observes an empty stage
- only drainBoundary cleared the latch, so a caller on the public bare-takeMsg drain stranded the next accepted post: it saw the stale latch and never woke the host
- the sweep clears the latch exactly when a channel's staged queue is observed empty, then re-checks the queue: a post racing the clear either re-latches a fresh wake or its entry is visible to the re-check and delivers — one redundant wake is acceptable, a stranded event is not
- gate tests: a bare-takeMsg drain to empty is followed by a fresh wake on the next accepted post, and an event-driven consumer that only drains on wake movement never strands a concurrent producer's accepted posts
* Condition the channel post never-blocks guarantee on an enqueue-only wake contract
- Document PlatformServices.wake_fn as bounded, non-blocking, and enqueue-only — the shape every first-party host already implements (macOS dispatch_async, GTK g_idle_add, Win32 PostMessageW) and the same contract the media-surface frame request documents — and condition ChannelHandle.post's never-blocks promise on it: the runtime holds no channel lock across the call, so a violating wake hangs only its own posting thread, never the runtime's lock graph.
- Reframe the loop-marshaling wake tests as violator-containment pins rather than supported-usage examples: the pinned behavior (no lock-cycle deadlock through drain, close, or reopen) stays, and the revoke/quiesce rationale now names the marshal shape as out of contract.
- Sweep the never-blocks wording in the TS SDK channel docs, the native-ui skill surface, and the changelog fragment's back-pressure bullet to carry the same conditioning.
* Leak the platform when teardown abandons a stuck channel wake call
- An abandoned in-flight wake_fn call still holds PlatformServices.context past Effects teardown, and the process-lived channel header only protects runtime bookkeeping after the call returns — so the quiesce-abandon path now reports the abandon to the platform through a new note_channel_wake_abandoned_fn services seam, synchronously, while the platform is still alive.
- Every first-party platform latches the report and gates its destruction on it: MacPlatform/LinuxPlatform/WindowsPlatform deinit (the app runner's and the generated runner's one destroy path), the null platform's reference-model deinit, and the mobile ui host's destroy all skip destruction and deliberately leak the host, process-lived, with one loud log — the abandoned-worker idiom, applied to the platform itself. A conforming enqueue-only wake never meets the teardown deadline, so the gate is violator containment only.
- Tests: the quiesce-abandon test now binds a real null platform behind the stuck hook and asserts the destroy path is suppressed (latch set, destruction skipped), and a new non-regression twin pins the healthy half — a conforming wake quiesces fast, nothing is abandoned, and the platform destroys normally.
* Make an abandoned channel wake call's whole dereference chain process-lived
- bindServices publishes an immutable process-allocator snapshot of the services table, so a poster suspended before its services.wake() dereference never reads Runtime-owned memory; a rebind swaps in a fresh snapshot and never writes the old one
- runners heap-allocate the desktop platform wrappers (createWithOptions/destroy) and gate the free on the abandon latch, extending the deinit gate to the wrapper storage the wake context actually points at
- new coverage: a stuck wake whose first context dereference happens only after teardown completes and the owning scopes die (poisoned), plus rebind-generation snapshot coverage
* Resolve a replay park's pending-order stamp exactly once
- A .rejected record targeting a park already vacated no longer reuses the stamp and appends a duplicate terminal to the one-entry-per-open pending ring; it refuses as journal damage (error.ReplayDamagedRecord) with a teaching that names the key and the one-terminal-per-open rule.
- Pins the refusal and the single delivered terminal in effects_channel_tests.
* Gate channel record provenance against recorder truth at replay
- A .data or .closed channel record stamped with .rejected provenance no longer slips into the regeneration skip and silently drops from the Msg stream; the damage gate refuses it, naming both fields.
- Channel records can only carry .exited or .rejected exit reasons (the two journal sites), so any other decoded value refuses as damage too; .rejected kind with .exited provenance stays the executor-truth feed path.
- Pins both mismatch directions, the out-of-range stamp, and the executor-truth positive path in effects_channel_tests.
* Materialize the services snapshot lazily and free it on clean teardown
- bindServices records the loop-thread services pointer only; the process-lived snapshot allocates at whichever comes last of the bind and the first live openChannel, so apps that never open a channel never allocate one, and the seq_cst publish-then-sweep Dekker pair holds at both sites.
- A clean teardown (every wake header quiesced, zero abandons this deinit) frees the snapshot through the channel-storage seam; it stays deliberately process-lived only past an abandon, and the ownership rule is documented at the new wake_snapshot field.
- Re-points the abandon and rebind coverage (an abandoned generation's snapshot stays intact for stale calls; a rebind's fresh snapshot never writes the old one) and adds laziness and clean-free pins in effects_channel_tests.
* Refuse any channel record fed past the open's terminal at replay
- A fed terminal now marks the park .terminated until its delivery retires the slot, so a damaged journal's post-terminal .data/.closed/.rejected records refuse as ReplayDamagedRecord instead of enqueueing events the retire would silently discard from an unverified replay's stream.
- A .rejected fed after the stream proved the open accepted live stays damage and leaves the park intact, so the real terminal still lands.
- Pins data-after-rejection, data-after-closed, and rejection-after-data in effects_channel_tests.
* Refuse an open that cannot publish the services snapshot
- openChannel pre-flights the snapshot before committing the occupancy and rejects as executor truth on allocation failure, so no live channel can exist whose accepted posts strand with producer wakes disarmed.
- The one remaining live-through-failure shape, a channel opened before bindServices whose bind-time publication failed, heals at every drain pass boundary: the retried publication's Dekker sweep un-strands posts accepted in the disarmed window.
- Pins the refusing open (with recovery on the next open) and the boundary heal in effects_channel_tests.
* Resolve a fed park only after its event actually enqueues
- A .closed refused by completion-queue back-pressure no longer marks the park .terminated first, so the replay pump's drain-and-feed-again retry of a valid journal lands instead of refusing as damage.
- The .data vacate moves behind the same commit point; the .rejected path stages through the pending ring, which never back-pressures, and keeps its transition.
- Pins the back-pressured terminal's clean retry in effects_channel_tests.
* Close open channels when the bind cannot publish the services snapshot
- A failed bind-site publication no longer leaves pre-bind channels accepting posts that may never deliver (the pass-boundary retry needed a loop event that idle apps never produce); the bind closes them, flushing backlogs and delivering .closed terminals through its own loop-side wake.
- Together with the open-site refusal this pins one invariant: no live channel ever runs with producer wakes disarmed while services are bound - so the now-unreachable drainBoundary heal is removed.
- Re-points the bind-failure test: pre-bind backlog flushes ahead of the terminal, the producer's next post answers .closed, and a later open republishes and wakes normally.
|
||
|
Chris Tate
|
349618a138 |
chore: prepare v0.5.4 release (#164)
- Synchronize CLI, core, platform, and example package versions to 0.5.4. - Merge release notes and contributor credits from the pending changelog fragments.v0.5.4 |
||
|
Chris Tate
|
f4b9d26258 |
Lower spread-arm ternaries into per-branch blocks instead of hoisting (#160)
* Lower spread-arm ternaries into per-branch blocks instead of hoisting
- The R7 narrowed-ternary paths emitted both arms into the surrounding ctx, so a spread literal's statements landed above the conditional: the capture was read before it bound (use of undeclared identifier) and both arms ran unconditionally; arms that lower statements now take the R17b temp lowering with the capture substitution active, while pure arms keep the tight if/orelse expression forms.
- Union payload captures of optional fields registered in memberSubst like null-narrowing captures, so zTypeOfExpr unwrapped ?f64 payload reads to f64 and routed reducers around the narrowing lowering; stillOptionalSubst records rename-only substitutions by exact replacement.
- The orelse fusion emitted its miss arm with no expected type, failing spread/plain literal arms with an internal NS9001; the arm now gets the unwrapped expected (or the target's inner type) and falls through to the narrowed lowering when it needs statements.
* Narrow optionals and union payloads after break/continue guards
- if (r === null) break; — and the continue, labeled, multi-statement, throw-exit, and if (x !== null) {...} else { exit } spellings — now narrow like the early-return guard: alwaysExits covers every statement tsc's flow analysis treats as never-falling-through, with breaks bound to the switch itself recognized as fall-through.
- Narrowing maps are flow-scoped at block boundaries now, so a guard's captures end with the loop body or branch they narrow instead of leaking into code where the Zig capture is out of scope and the narrowing wrong in TS.
- An unlabeled break that exits a switch from inside a clause body teaches at transpile time instead of emitting a Zig break that would jump past the enclosing loop; conformance pins every fixed shape in both optimize modes, and a run-fidelity case holds the loops byte-identical to node.
* Restore still-optional markers when scoped kind-narrowing exits
- withKindNarrow snapshotted memberSubst and narrowedUnion but not stillOptionalSubst, while narrowUnion mutates all three: a redundant kind guard inside a switch payload capture overwrote the optional marker for good, so the capture read as non-null and null tests routed around the narrowing lowerings (emitting ?f64 into float arithmetic).
- The kind-switch arm restore now drops its stillOptionalSubst additions alongside the memberSubst ones, keeping the marker map paired with the substitutions it annotates.
- Conformance pins the reviewer's shape (a redundant kind guard, expression and statement spellings, before a null test on the payload) in both optimize modes.
* Type inferred locals from narrowed ternaries by the non-optional arm
- zTypeOfExprRaw typed `q === null ? { ...fallback, price: 0 } : q` by the raw optional arm, so an UNANNOTATED local declared a `?Quote` temporary whose first non-optional use failed Zig compilation ("expected type 'Quote', found '?Quote'"); the annotated spelling masked it by supplying the expected type, which every fusion and lowering site then forwarded unwrapped.
- The conditional's computed type now applies the condition's own null test to the arm that reuses the tested value (both polarities), keeping the optional when the other arm is itself optional — its null still flows through.
- Conformance pins the inferred-local shape in both polarities and both optimize modes; runfidelity drives both branches of both polarities against node.
* Pin shadowed-name kind guards leaving the subject's payload optional
- The narrowing maps key on the tested expression's text, so a shadowing declaration of the same union-typed name collides the switch subject's key: a kind guard over the shadow overwrites the subject's optional-payload marker, and only the full-map restore in withKindNarrow puts it back on exit.
- The subset accepts variable shadowing, so the shapes pin directly: a callback parameter shadowing the subject with a ternary kind guard inside `.some` before a null test on the subject's payload (reverting the full-map restore emits the optional into integer arithmetic — "invalid operands to binary expression: 'optional' and 'int'"), plus the block-scoped statement spelling of the same shadow.
- Test-only: both cases compile in both optimize modes with the restore in place.
* Keep reassigned let bindings out of const orelse fusion
- The adjacent-declaration orelse fusion consumed reassigned `let` bindings and emitted `const`, so the later assignment failed Zig with "cannot assign to constant"; fusion now consults the reassignment tracking and skips them.
- The plain-path exit guard bound a capture that went stale at the assignment; reassigned targets now keep the plain null test and narrow through the live-variable `.?` spelling, which non-null writes keep alive.
- Pins: emitter shapes (no-fusion + const-fusion regression), conformance compile, and a runfidelity case asserting the spread reassignment lands.
* Repopulate switch-arm narrowing maps from the snapshot on exit
- The arm cleanup deleted keys absent from its snapshot but never restored OVERWRITTEN entries, so a redundant nested switch on the same subject left the inner capture name active and the continuation emitted it after its Zig block closed ("use of undeclared identifier").
- Both snapshotted maps (memberSubst, stillOptionalSubst) now clear-and-repopulate, matching every other restore in the family; audit found no remaining delete-only restore.
- Pins: emitter shape (continuation reads the outer capture) and a conformance compile case.
* Apply post-if narrowing on the else-if exit path from emitIf
- The else-if chain path returned from emitIf before the post-if narrowing ran, so an exiting null guard heading a chain left fall-through reads on the still-optional value ("optional type does not support field access").
- The narrowing tail is now a helper applied on both exit paths; conformance covers else-if, else-if-else, chained else-if-else-if, and the present-test polarity, plus an emitter shape pin.
* Keep branch-killed null narrowing dead past the merge
- Scope exits restore their narrowing-map snapshots for containment, which also resurrected a narrow an assignment inside the branch had killed; post-merge null checks then emitted `p.? == null` (Zig: comparison of 'f64' with null).
- Invalidation frames now ride the ctx: the assignment path records each permanently deleted memberSubst key into the innermost frame, and every snapshot/restore scope (blocks, switch arms, kind guards) re-applies its frame's kills after the restore and merges them outward through nested exits.
- Conformance pins the reassign-to-null, optional-call, else-branch, nested-block, read-then-kill, switch-arm, and kind-guard shapes plus a containment regression pin; runfidelity drives the null path whose output would differ under a resurrected narrow.
* Bracket chain-substitution scopes with the narrowing kill-frame protocol
- withSubsts and emitNullGuardChainUnwrap restored their full memberSubst snapshots after the branch had re-applied assignment kills, resurrecting a narrow killed under a compound null guard (post-merge re-check emitted `p.? == null`).
- Both scopes now push/pop kill frames like branch and switch-arm exits, so every full-map narrowing restore in the emitter re-deletes killed entries and merges them outward.
- Conformance pins the reviewer repro plus else-branch and kind-guard-nested variants; runfidelity drives the compound-guard kill path against node.
* Drop an always-exiting branch's narrowing kills at the merge
- A branch that killed a narrow and then always left the function (return, or a throw no enclosing try catches) merged that kill outward anyway, deleting the substitution a surviving read depends on: `if (p.v < 0) { p = null; return -1; } return p.v;` emitted field access straight onto the `?P` — tsc keeps p narrowed there because the killing path cannot reach it.
- emitBlockStatements now asks the existing alwaysExits predicate the stronger function-leaving question (returns count only where they emit as real returns, not the `break :label` lowering inside lifted callbacks; throws only where ctx.tryLabel is null; break/continue never — a break-guarded kill resumes after the loop, where it must hold) and pops its kill frame in drop mode when the list cannot fall through.
- The other kill-frame pops keep the unconditional merge: withKindNarrow, the chain-condition emitter, and withSubsts bracket branch or expression scopes whose statement bodies already made the drop/merge decision at their own block frame, and the switch-arm frame only ever receives kills from paths that resume at the arm's merge (a clause-terminating break binds the switch).
* Keep a lifted callback's trailing return inside its prefix's flow scope
- The straight-line callback lifting emitted the statement prefix under emitBlockStatements — whose exit restores the narrowing maps — and then emitted the trailing return's expression outside that scope, so a prefix guard's narrowing unwound before the expression it covers: `xs.map((p) => { if (p === null) throw bad; return p.v; })` read `p.v` against the raw `?P`.
- The flow-scope bracket now lives in withNarrowScope (snapshot, kill frame, restore, merge-or-drop), emitBlockStatements delegates to it, and the callback path brackets prefix plus trailing expression in ONE scope — the restore still runs before the callback's siblings in the emitted loop body, so its narrowing cannot leak.
- Conformance pins the throw-guard and kind-guard prefix spellings plus the labeled-block early-return lifting; runfidelity drives a throw-guarded map trailing read against node.
* Merge a try body's narrowing kills when its catch can fall through
- A try body ending in return still exits from any throwing call, so its kill frame drops only when no local catch can resume past the merge; a catch that itself always leaves the function re-enables the drop.
- try/finally adds no fallthrough of its own: the body inherits the enclosing handler's answer, stated at the emit site.
- Conformance pins the fall-through-catch, catch-always-returns, and finally shapes; runfidelity drives the thrown path through a swallowing catch to the post-try re-check.
* Decide narrowing-kill drops with an all-routes escape analysis
- Replace the final-statement leavesFn question and alwaysExits's fnExit flavor with allRoutesLeaveFunction: a list's kills drop only when every route out of it leaves the function — fallthrough, lowered returns, break/continue bound at or outside the list, and throws (or throwing calls) with a resumable handler all merge them outward instead.
- Compute a catch arm's resumability with the same analysis against the outer handler, so a throwing call inside an exiting catch that lands in an outer fall-through catch keeps the try body's kills alive at the outer merge.
- Pin the escaped break/continue, labeled break, do-while, and nested-try shapes in conformance plus a run-fidelity case for the break path, with inner-loop, switch-bound-break, and exiting-outer-catch drops as controls.
* Treat never-completing loops as terminal in the narrowing analysis
- alwaysExits now recognizes a constant-true loop no break binds (literal-true while/do-while, literal-true or omitted classic-for condition), so a kill sealed behind an infinite loop drops at the merge the way tsc's reachability keeps the surviving narrow.
- bindsBreak generalizes from switches to loops: a break bound to the loop makes its end reachable, so those kills still merge.
- Gate the callback whose every path loops forever or throws with a teaching; its labeled value block would carry a label no break uses, which Zig rejects.
* Trace a caught throw into the code after its try when classifying routes
- A fall-through catch resumes at the statements following the try, so the throw route's destination is the handler plus that continuation: allRoutesLeaveFunction now scans statement lists positionally and asks whether catch-then-rest leaves before calling the route resuming
- The catch's own routes still classify against the handler visible outside its try, and loop bodies, switch clauses, and inline callbacks keep a conservative resuming continuation
- Pins the drop, the fall-through-continuation merge, and the returning-catch composition in the kill-fallthrough corpus, plus a byte-fidelity run driving both the throw and no-throw routes
* Strip parentheses before matching narrowed targets in the ternary machinery
- normalize() folds top-level parens so keys and comparisons collide for (q) and q: the ternary value narrowing, the orelse arm match, and every memberSubst key/lookup site now treat parenthesized spellings as the tested target
- emptyTestOf and kindGuardOf skip parens on the condition, both operands, and the returned target, so guard recognition and downstream shape checks see the bare expression
- Pins the parenthesized spread arm, the fused statement-free arm, the doubly-parenthesized arm, and the parenthesized tested side in the ternary conformance corpus
* See through wrapped null literals in ternary and nullish decisions
- A parenthesized or assertion-wrapped null arm ((null), ((null)), null as T) typed the ternary non-optional, so the later guard's unwrap was skipped and field reads hit the raw optional
- New isNullLiteral helper strips value-preserving wrappers before every null-literal decision; applied to the ternary arm checks and the nullish-coalescing fold
- Conformance pins the wrapped spellings on both arms and the doubly-wrapped one
* Let narrowing flow through plain lexical blocks
- tsc's narrowing is flow-based and survives a fall-through block, but the emitter bracketed every block with a snapshot/restore, so a guard inside { } left the post-block read on the raw optional
- Plain blocks in a statement list now flatten into the enclosing list (name uniquing is function-wide, so Zig block scope was never load-bearing), which also keeps unwrap captures in scope for post-block reads; merge contexts (arms, loops, clauses, try/catch, labeled blocks) still bracket
- followingStatementsOf walks out through enclosing plain blocks so end-of-block guards still install their narrows; conformance and run-fidelity pin narrows, kills, nesting, arm containment, and name collisions across block boundaries
* Route caught-throw kills to the post-try continuation
- A branch whose only in-function routes are caught throws merged its narrowing kills into intra-try flow, stripping the surviving path's unwrap and emitting a field access on the raw optional
- Kills now travel the same edges control does: such a branch's kills wait in the enclosing try's pending set and apply at the post-try merge, alongside the body's normal-exit kills; nested tries land them at the inner continuation
- Branches with any normal fallthrough still merge intra-try, catch-block kills still post-try-merge, uncaught throws still drop; conformance and run-fidelity pin all four compositions
* Join sibling arms' narrowing kills at the construct exit
- An if/else arm's assignment kill applied to the shared maps before its
siblings emitted, stripping them of narrowings tsc keeps (arms are
alternatives from the entry state, not a sequence); merge-class kills
now collect per construct and apply once after the last alternative,
while always-leaving arms still drop and caught-throw-only arms still
route to the try continuation.
- The join covers every multi-arm construct: if/else, else-if chains,
the R7 dual/present capture forms, null-guarded chains, and all three
switch lowerings (clauses are pure siblings under
noFallthroughCasesInSwitch; stacked labels share one body).
- Exception-routed kills now apply at the catch's entry rather than
after it: a narrow killed before an always-throwing arm's throw is
dead inside the catch (tsc types the catch from the throw points), and
the catch's fallthrough still carries the kill to the post-try state.
* Subtract joined branch kills from post-construct narrows
- applyPostIfNarrow and the tailored R7 dual/present installs applied
the exiting arm's narrow unconditionally after the statement,
resurrecting a narrowing a surviving arm had killed; every
post-construct install (including the exit-dual guard chain's) now
subtracts the statement's joined kill set — tsc's post-if state is
the guard-implied narrow minus the arms' kills.
- Assignment kills now record whenever the assigned value can be null,
not only when a substitution was live: the subtraction needs the
semantic kill even before any narrow spelling was installed.
- branchReadsTarget now counts READS only: a write-only arm (a pure
kill) declines the capture form instead of binding a capture the arm
never uses — an unused-capture compile error in Zig.
* Key the narrowing maps by declaration identity
- memberSubst/stillOptionalSubst/narrowedUnion keys were normalized
source text; emission flattens plain lexical blocks with no restore
point, so a block-local shadow's entries stayed live for the outer
name after the block — its null checks and reads bound the inner
capture (invalid Zig at best, wrong values at worst), and an outer
capture rewrote same-named callback parameters' reads.
- narrowKey qualifies the base identifier with a per-declaration id
(member chains qualify the base: q#3.v); every key-derivation site —
guard installs, narrowUnion, the switch scrutinee baseKey, assignment
kills, the ?.-receiver, post-if narrows, builder/filter length keys —
now goes through it, and unresolvable bases keep the plain-text key.
- Shadow suite covers the flattened block, an if-arm shadow under an
active outer capture, a shadowing callback parameter (run-fidelity
pins the behavior — the text-keyed emission compiled but filtered on
the outer value), and two-deep nested shadows.
* Stage narrowing kills at the edges break, continue, and callback returns travel
- A scope exiting only along non-local edges no longer merges its kills at the fall-through: they stage per destination (break target's post-state, loop exit join, post-callback continuation, the try's pending catch set) via edge-kill stages the loop/switch/label/callback emitters bracket their emission with, generalizing the caught-throw channel into one routing.
- Continue edges need no separate back-edge machinery: tsc widens the loop-entry state for back-edge kills and the checker rejects unguarded reads, so the exit join is the one destination left to serve; pinned at tsc level.
- Clause-terminating switch breaks keep riding the sibling join to the same post-switch point the switch stage applies at, so a kill is neither applied twice nor dropped between the two mechanisms.
* Canonicalize erased wrappers in the narrowing key
- narrowKey now strips non-null assertions, as, and satisfies alongside parentheses, so every key consumer at once matches q! and (q as Quote) to the tested q — ternary arm identity, orelse fusion, and substitution lookups included.
- emptyTestOf and kindGuardOf strip the same wrappers on the condition and its operands, so a wrapped tested target (q! !== null) narrows through the capture form exactly like the bare spelling.
- The statement-level orelse fusion matches its guard by declaration identity instead of name text, and the ternary read gates use declaration identity too (a wrapped read is still a read of the declaration).
* Treat the global undefined as an empty in ternary and nullish arm decisions
- An undefined arm's internal type is void, so the ZType-based arm check read it as a non-empty value: the ternary typed non-optional, the later === undefined guard's unwrap was skipped, and the field read hit the raw optional (invalid Zig on a shape main compiles)
- New isEmptyLiteral helper (wrapper-stripped null keyword OR the global undefined identifier) replaces isNullLiteral in the ternary arm-emptiness checks and the nullish-coalescing fold, making the undefined path symmetric with the null path in both arm positions
- Conformance pins both arm positions plus the as-wrapped and doubly-parenthesized spellings; runfidelity drives both polarities and both branches against node
* Isolate probe and sibling-arm flow state in expression lowerings
- Throwaway probe ctxs shared the narrowing maps and kill-frame stack by reference, so a probe processing a callback assignment to an outer narrowed local deleted the narrow before the sibling arm emitted — the sibling read the raw optional, invalid Zig
- Every probe now brackets in withNarrowScope, and ternary arms follow the statement-level sibling law: each arm probes and emits from the entry state, real kills joining once after the last arm via applyJoinedNarrowKills; the isolation law is documented at childCtx
- Conformance pins the generic and capture-lowered flavors; runfidelity drives both arms and the empty-input corner against node
* Gate property-read detection on declaration-qualified keys, not source text
- The capture gates matched property chains by getText().includes, so a shadowed spelling inside a nested callback counted as a read of the outer target: the capture bound, the declaration-keyed substitution correctly declined to rewrite the shadow, and Zig rejected the unused capture
- New anyReadsKey walks the nodes' property accesses and compares canonicalized narrowKeys — the same identity substitutions are looked up by — and replaces the text gates in anyReadsTarget, branchReadsTarget, followingReadsTarget, and the switch payload-use check; diagnostics keep text
- Conformance pins shadow-only (no capture), outer-plus-shadow (used capture), guarded-branch, exit-guard, and payload-field shapes; runfidelity drives hit/miss and empty inputs against node
* Stage finally-clause kills until the try construct's exit
- A finally emits as a Zig defer whose text precedes the try body's but whose flow follows it: its assignment kills previously applied at emission time, stripping the body's reads of narrows tsc keeps there and emitting field accesses against raw optionals.
- The finally now emits in a bracketed scope whose kills stage until the construct's exit, and its entry state drops every key the try or catch may assign null to — tsc types a finally path-insensitively (an exception can enter it between any two statements), so such reads re-check the live variable, never a stale capture.
- Pins the emission-order case, the finally-reads-killed-narrow case, and three-region kills in conformance plus a byte-fidelity run against node.
* Route pending exception kills through the catch's own control flow
- Kills riding throw edges into a catch previously applied to the post-try state unconditionally, poisoning the normal fallthrough when the catch leaves by break, continue, or return — paths tsc types with the narrow intact, since only clean flow reaches the continuation.
- The pending set now enters as the catch list's input state: its reads still see the kills, and they ride the list's kill-frame routing out — post-try on fallthrough, the edge stage on break/continue, dropped when every catch route leaves the function.
- Pins catch-break in a loop, a labeled break out of nested loops, a re-killing fallthrough catch, and an always-returning catch in conformance plus a byte-fidelity run against node.
* Key element-access narrows by declaration and canonical index
- narrowKey qualifies element accesses recursively: literal indexes canonicalize by value, identifier indexes key their own declaration, and computed indexes decline narrowing entirely instead of falling back to raw source text, which let a shadowed declaration's narrow rewrite the outer name's reads across flattened blocks.
- Every consumer honors the keyless decline (no substitution, capture gates off, live optional reads); the optional-call receiver rewrite keeps working through an explicit node-scoped key.
- Conformance pins both chain directions, shadowed identifier indexes, and the computed-index decline; the run-fidelity corpus pins the outer read's value against node.
* Keep narrowing through provably non-null reassignments
- A capture substitution now transitions to the live-slot `.?` spelling when the assignment's value is provably non-null, matching tsc, which keeps the target narrowed; possibly-null assignments still kill.
- Guarded branches choose their form up front (captureServesBranch): a capture binds only when every reassignment is straight-line and a read precedes it; otherwise the branch takes the plain test with `.?` reads, which stay valid through nested reassigns, sibling joins, and loop back edges.
- Conformance pins all-reads-after, reads-around, conditional, else-arm, loop, and possibly-null shapes; the run-fidelity corpus pins the reassigned values against node.
* Emit a do-while's trailing test inside its body's narrowing scope
- tsc evaluates the do-while condition after the body and carries the body's flow state into it, but the while(true)+trailing-exit-test lowering closed the body's narrowing scope before emitting the lowered `if (!(cond)) break;` — a terminal guard's narrow unwound before the test it covers, and `do { if (p === null) return -1; n += p.v; } while (p.v > 0);` read `p.v` on the raw `?P` (transpile reported success; Zig rejected the field access). Body and test now share one scope via emitBlockStatements' trailing hook, restored only at the loop boundary.
- The early-exit guard's follower walk now sees that trailing test (trailingDoWhileTestOf), so a guard read only by the condition still binds its capture — and binds none for the first-pass-flag form (a body binding `continue` hoists the test ahead of the body, where the capture would be an unused Zig const) or an always-exiting body (no test emits). Continue-carried kills still widen the hoisted test onto the live optional (tsc rejects the bare read — pinned), and break-carried kills still land only post-loop.
- Conformance pins the guard/capture-only/back-edge-re-narrow/continue/break/nested spellings, emitter tests pin the tsc-level widenings (continue edge into the test; no body narrow across the back edge into the body top), and runfidelity drives the trailing-test read through zero, one, and multiple iterations against node.
* Judge terminality through stacked case labels and statement labels
- alwaysExits read each switch clause alone, so an empty stacked label
(case "a": case "b": return x) judged non-exiting and the branch's
narrowing kills merged into flow that cannot reach the merge — valid TS
emitted raw optional arithmetic. Clauses now group to their
statement-bearing tail, matching the switch emitters' label coalescing;
a trailing run of empty labels keeps the switch nonterminal.
- A LabeledStatement always read as non-exiting, defeating the
constant-true-loop and terminal-block judgments under it. A labeled
statement is now terminal iff its wrapped statement is terminal and no
break names the label (a break to the label resumes right after it).
- Conformance and run-fidelity cases pin both shapes and the
merge-preserving variants: a stacked group that falls out of the
switch, trailing empty labels, and break-to-label loops and blocks.
* Judge exhaustive defaultless value switches terminal through the scrutinee's type
- alwaysExits read every defaultless value switch as nonterminal, so a
branch ending in a switch whose case labels cover the scrutinee's
literal-union type merged kills from flow that cannot reach the merge -
valid TS emitted raw optional arithmetic. The predicate now consults
the checker's flow type at the scrutinee (string/number/boolean literal
unions with literal case labels only; anything wider keeps the
conservative merge) before applying the stacked-group exit rule.
- The lowering closes the same path the claim closes: a covered-by-type
defaultless switch whose arms all exit emits `else => unreachable` for
the never-reached fallthrough (string enums already emitted a
Zig-exhaustive switch with no else), so an exhaustive switch can end a
value-returning function with no reachable missing-return path.
- Conformance and run-fidelity cases pin full coverage (separate cases,
a stacked group, numeric literal unions, function-final position) and
the merge-preserving variants: one member uncovered, a plain-string
scrutinee, and the boolean-scrutinee emission gate.
* Judge value-switch exhaustiveness against a sound scrutinee type, never the raw flow type
- tsc never widens a local's narrowing for assignments inside callbacks, so trusting its flow type at the scrutinee let a defaultless switch claim coverage real execution escapes — the lowering then armed the fallthrough with an `else => unreachable` that non-empty input REACHES (safety panic in Debug, undefined behavior in ReleaseFast) while node falls out and returns.
- Coverage now judges by the scrutinee's declared union (sound unconditionally: a local can hold any declared member at runtime), keeping the flow type only for an identifier local/param no nested function assigns, where the straight-line CFA is exact; property reads judge by the declared property type and unjudgeable shapes decline.
- Both consumers demote together through the one memoized judgment: when it declines, emitValueSwitch closes the fallthrough with a completing `else => {}` and alwaysExits answers nonterminal, so the kill merges and post-switch re-checks stay live.
* Count only tsc-reachable, same-scope assignments when widening a finally's entry narrows
- finallyEntryKills scanned the raw syntax of the try and catch, so assignments tsc's CFA never counts — code under a keyword-literal false condition, callback bodies — killed narrows tsc typed the finally with, stripping the substitution and emitting member access on a raw optional Zig rejects.
- Probed the checker provider and matched it exactly: `if (false)`, the else of `if (true)`, a `while (false)` body, and the short-circuited side of `false &&` / `true ||` keep the finally narrowed, while a `const NEVER = false` alias condition widens (so only bare keywords skip); a callback defined in the try that assigns the target never widens, called there or not.
- Genuinely conditional assignments (`if (flag) p = null`) still kill path-insensitively, and everything unpinned (do-while, non-literal conditions) stays on the conservative walk.
* Gate narrowing captures on reads, not uses, in ternary arms and guard chains
- anyReadsTarget counted a plain assignment's bare identifier target as a consuming use, so a write-only ternary arm bound a payload capture nothing reads — Zig rejects the unused capture; the arm now takes the plain comparison while reading arms keep the capture.
- The identifier walk now uses identifierRead, the same judgment branchReadsTarget and captureServesBranch already apply: compound assignments and ++/-- still read the slot, and property-chain targets are immutable model data, so their key walk is unchanged.
* Exclude tsc-unreachable branch arms from kill joins via one shared judgment
- Kills under a bare keyword-literal condition — `if (false)`, the else of `if (true)`, a `while (false)` body — merged at branch joins and stripped narrows tsc keeps, emitting member access on a raw optional; the arms still emit, only the flow bookkeeping skips them.
- Factored the judgment into tscExcludedArm, shared by the finally-entry scan and the join layer (if/else arms, else-if chains, the while body merge, and the loop's staged break edges).
- Pinned the boundaries: a do-while(false) body runs once (the test follows the body), so its kills still count, and a `const NEVER = false` alias condition never excludes.
* Judge scrutinee flow trust by whether a nested assigner can have run yet
- scrutineeFlowTrustable declined flow trust for ANY nested-function assignment in the enclosing function, including callbacks textually after the switch that cannot have executed before it — demoting flow-exhaustive switches to their declared unions and leaving guarded fall-through reads on raw optionals.
- Arrows and function expressions do not exist as values before their definition evaluates: they now count only when the definition precedes the switch, or a loop encloses both so the back edge re-enters the switch after the definition ran.
- Function declarations hoist and class-member bodies exist from their container's creation, so both still count regardless of position; the judgment sits on the OUTERMOST nested function.
* Stop break/continue-binding walks at function boundaries
- Labels are function-scoped in JS: a nested helper's `break outer` binds the helper's own `outer` label, never the enclosing function's loop — but bindsBreak walked into nested function bodies, reading an enclosing constant-true loop as fallible and merging branch kills tsc keeps, and labelReferenced kept emitting a Zig loop label nothing in the function consumes (an unused-label error).
- bindsBreak, bindsContinue, labelReferenced, and the early-break gate now stop at function boundaries — the same rule breaksToLabel, escapingEdgesOf, and the route analysis already applied, so every binding walk is uniform.
* Give tsc-excluded arms no routes and extend the exclusion to for(;false;)
- The route walks (allRoutesLeaveFunction, escapingEdgesOf) and the terminality binders (bindsBreak, breaksToLabel) now consult tscExcludedArm: a break/continue under an arm tsc's CFA cannot reach is not an edge, so it no longer stages kills at loop exits the surviving flow never carries. labelReferenced and bindsContinue deliberately keep counting — the arm's text still emits, so the label must stay referenced and the do-while flag form must host the emitted continue; the split is documented at the helper.
- tscExcludedArm gains the literal-false-condition ForStatement case (body and incrementor), mirroring while(false); wired through every consumer: the finally entry scan, the loop-dispatch join sites, and emitClassicFor's body scope. An omitted for condition stays the opposite judgment (infinite loop) — literal false never collides with for(;;).
- Conformance, emitter-pin, and runfidelity coverage for both directions: dead break/continue keep the post-loop narrow, real break/for kills still stage and re-guard.
* Close a claimed-terminal plain switch's chain with an unreachable else
- An inferred literal union (const k = x > 0 ? 1 : 2) passes the sound coverage judgment, so alwaysExits claims the switch terminal, but the emitter-level type is plain number and the lowering is emitPlainSwitch's if/else chain — left open, a callback value block or returning function falls off the chain's end into invalid Zig.
- emitPlainSwitch now reads the same memoized judgment through alwaysExits and closes the claimed-terminal defaultless chain with an unreachable else the claim has already proven no execution reaches; a non-exhaustive inferred union still declines and completes normally.
- The agreement invariant gains its third leg: no switch lowering may leave a completable fallthrough under a terminality claim — emitValueSwitch and emitPlainSwitch assert it, the kind switch closes by construction, and a test pins all three lowerings.
|
||
|
Chris Tate
|
4be334fd40 |
Dynamic images: load at runtime, journal the bytes, replay offline (#146)
* Add fx.loadImage: the runtime image-load effect with the audio source cascade
- New .image effect kind in effects.zig: local-path-then-url resolution with a content-addressed url cache (imageCachePath mirrors audioCachePath under images/), decode + registration through the registered-image seam at drain time, and one terminal Msg carrying loaded dimensions or the same error classes the runtime API raises
- Journal format v6: the .image effect-result record kind with outcome/dimensions and the blob-store content-address fields; replay feeds recorded terminals verbatim and re-registers journaled bytes best-effort
- Fake-executor seams (pendingImageLoad*, feedImageBytes, feedImageResult) plus effects_image_tests.zig covering the request shape, the full decode-register path, every failure class, cancel, and the real executor's local/network/cache-hit cascade against a loopback fixture
* Journal image results through a content-addressed session blob store
- session_blobs.zig: blobs/ beside the journal, one file per distinct payload named by SHA-256 prefix (the audio-cache hashing convention) — dedup by construction, verified on read; DirBlobStore for the app runner, MemoryBlobStore for tests
- The recorder moves an image record's encoded source bytes into the blob store at effect-result time and journals hash + length; replay resolves the blob, verifies address and length, and feeds the recorded bytes — byte-identical, offline, refusing loudly (ReplayMissingBlob) when the store is absent or damaged
- Session tests: record-replay equality with fingerprint checkpoints over two loads sharing one blob, a journaled decode failure, and a regenerating rejection; plus the no-blob-store recording refusal and the journal codec round-trip
* Markup <image>: the runtime-image leaf with a dynamic ImageId binding
- New element code 67 (image, widget_kind image, pictorial a11y class) reusing attr 38's binding grammar broadened to avatar+image; the binding is required on the leaf (an unbound image is dead markup, the icon-without-name policy)
- Both engines mirror the avatar guard: binding-only, integer-only, and negative model values fail the build with the teaching message instead of trapping in the u64 cast; teaching messages renamed to the shared image_binding_* vocabulary
- Pin test updated for the new element fingerprint (print-pins: elements 67, element_names 55); validator/interpreter/compiled/contract tests cover resolve, the 0 sentinel, every misuse, and hand-view parity; LSP docs, SKILL.md tables, and the docs vocab JSON carry the new entry
* Cmd.imageLoad: the TS tier's runtime image vocabulary end to end
- SDK: ImageState/ImageEventArm/ImageEventKind, ImageSource/ImageRoute, the image_load Cmd member and factory keyed by the app's numeric ImageId (any number expression — ids are model data)
- Transpiler: emitImageLoadCmd with the audio source-object grammar, the four-field arm shape check (state matched by member name, width/height/status numbers), and compile-time id/bounds gates; rt.zig gains opcode 0x10 additive within cmd_format_version 2 (the 0x0D-0x0F precedent) and the cmdImageLoad builder
- Host bridge: an id-keyed image table routing the ONE terminal by field name, the spawn discipline for duplicate live ids (bridge-side "rejected" at the post-cycle boundary), and image_cache_dir wiring deriving the content-addressed cache path from the URL like audio; covered by wire-layout, conformance, run-fidelity, and host e2e suites plus the SKILL.md vocabulary
* Document dynamic images: the load-show-replay story
- New docs page (/dynamic-images) covering Cmd.imageLoad TS-first with the Zig toggle, the source cascade and content-addressed cache, the honest result vocabulary and fixed limits, and the byte-identical offline replay guarantee via the session blob store
- Native UI's Images section now leads with the first-class load path and shows the <image> markup leaf; the TypeScript Cmd table gains the imageLoad row
- Changelog fragment states the journal v6 format break plainly (v5 journals refused at the preamble; re-record)
* Regenerate the docs component-preview wasm module
- The live-preview host embeds the runtime and markup engines, which now carry the image effect kind and the <image> element (schema code 67)
* Keep the dynamic-images doc sample inside the transpiled subset
- The core declares the ImageState alias itself (the named-alias rule the arm check enforces) and tracks the last state as a plain enum field
* Export the image effect surface through both roots
- src/root.zig and src/runtime/root.zig now carry EffectImageResult, EffectImageOutcome, imageCachePath, max_effect_image_path_bytes, max_effect_image_bytes, and effect_image_blob_hash_len beside the audio exports they mirror, so an external Zig app can write an Effects.imageMsg Msg arm and reason about the image bounds without module-internal paths.
- A compile-shaped export pin in effects_image_tests.zig (the media-surface pin's convention) holds both roots to the effects module's types, builds the Msg arm through the public constructor, and derives a cache path through the public root.
* Serve session replay decode through the host platform's image codec
- runSessionReplay built its null platform with the image decoder OFF, so production replay dropped every journaled load's pixels (and replayed screenshots lost images) while the branch's tests enabled the decoder by hand; the runner now installs the recording host's own context-free codec (CGImageSource / gdk-pixbuf / WIC) into the headless services via platform.installHeadlessImageCodec, decoding JOURNALED blob-store bytes only — the network stays absent.
- A codec-less null-platform build falls back to the null platform's strict test-PNG decoder, stated honestly in the installer's doc; the comptime platform dispatch keeps the desktop arms out of test-tier analysis so the unit suite links without host shims.
- The offline blob-store replay test now installs its decode seam through the SAME call the runner makes instead of flipping image_decode manually (the exact gap that let this slip), and a file-contains step pins the runner wiring plus all three per-platform installers.
* Reject the seventeenth in-flight image load instead of panicking
- A gallery screen (or one Cmd.batch) with 16 loads already in flight reached the bridge table's freeImageIndex panic, contradicting the documented exactly-one-result contract; a full table now routes pushImageReject like the sibling refusals — the engine's own slot-exhaustion vocabulary, and consistent with audio, whose single channel replaces in place and never crashes.
- The e2e suite fills all 16 entries with dynamic model-owned ids, proves the 17th dispatch answers state "rejected" through the event arm, and feeds one of the 16 live loads to its loaded terminal to show the refusal touched nothing else.
* Make the ImageId bound exclusive at 2^53 in both tiers
- The contract is a positive integer BELOW 2^53, but the emitter allowed literals <= 2 ** 53 and the host allowed dynamic ids <= 9007199254740992.0; 2^53 is the first f64 that aliases a neighbor (2^53 + 1), so both tiers now reject it — the emitter via Number.isSafeInteger with the NS1030 message naming the bound, the host via a strict < with the aliasing rationale in place.
- Boundary tests on both sides: conformance pins 2^53 - 1 building and 2^53 stopping at compile time (NS1030), and the e2e suite drives model-owned dynamic ids through the bridge — 2^53 - 1 parks a live load with the id intact, 2^53 answers state "rejected" without touching it.
* Echo the requested id through the image result arm
- The image event arm is now five fields matched by name (id/state/width/height/status): the engine's EffectImageResult always carried the id, but the arm dropped it, leaving two concurrent loads sharing one arm uncorrelatable in update.
- Bridge rejections echo the refused id too (0 for an id the wire cannot carry exactly — there is no honest integer to echo for one), staged as tag+id pairs at the same post-cycle boundary.
- Every tier that pins the arm shape learns the fifth field: SDK types, emitter conformance, the host's comptime shape check, the wire docs, the e2e fixtures (including a new concurrent-loads test distinguishing completions by the echoed id), and the docs page whose sample now adopts cover: msg.id.
* Stage image-load rejections without a user-reachable cap
- The reject staging buffer was fixed at the 16-entry table size with a panic past it, but the count is the app's to choose: a Cmd.batch of 17 loads against a full table crashed on the seventeenth instead of yielding 17 rejected results.
- Staging still exists because the walk cannot dispatch mid-command (the wire bytes are frame-arena resident and a nested cycle's frame reset would free them), so the stage now spills lazily: the table-sized inline buffer covers everyday cycles allocation-free, and the first overflow takes one engine-allocator block sized by the wire's own arithmetic bound (an image_load record is at least 30 bytes, so cmd.len / 30 caps the count without a second record parser to keep in sync).
- Delivery is unchanged — every reject still dispatches after the issuing cycle's frame reset, nows first, spawn rejects next, image rejects last, in record order — and the new e2e drives a 17-load batch against a full table to 17 boundary rejections with the 16 live loads untouched.
* Cmd.imageCancel: the TS tier's numeric-id image cancel
- The documented "cancelled" outcome was unreachable from TS: Cmd.cancel is string-keyed and never inspects the numeric image table, so a stale load pinned its id against same-id retries until it terminated. Cmd.imageCancel(id) routes to the fx.cancel(id) path the engine already covers — loud like spawn's cancel (the load's own event arm delivers state "cancelled" and the entry retires, freeing the id), a no-op for an id with no live load, mirroring how audioStop is audio's close rather than an overload of the silent string-keyed cancel.
- Wire record image_cancel [op 0x11][id f64 LE], additive within cmd_format_version 2; full tier coverage — SDK factory, emitter with imageLoad's NS1030 id-literal gates, conformance, wire-layout pin, host decode, and an e2e proving cancelled delivery plus a same-id retry parking a fresh load.
- The 0x11 opcode overlap with feat/menu-bar-lifecycle is known cross-branch and handled by the merge-order reconcile.
* Verify blob-store dedup hits instead of trusting the name
- Recording's dedup probe treated ANY existing hash-named file as the bytes, so a damaged blob let future recordings seal successfully while replay refused them. The probe now reads the existing file back chunk-wise against the incoming bytes (equality against the caller's bytes IS the hash check — their address is the file's name, and no blob-sized buffer is staged) and skips the write only on an exact match.
- A mismatch — damage, truncation, an unreadable file — is a repairable state while the true bytes are in hand: the write falls through to the same atomic partial+rename a fresh install uses, with a debug-scoped log line, never a hard failure. Cost: a dedup hit is one bounded read (<= the 1.25 MiB blob budget) instead of one existence probe.
- MemoryBlobStore had the same blind-dedup shape and repairs in place identically; tests pin corrupt-then-rewrite repair on both stores (dir store covering flipped bytes and truncation through the atomic path) alongside the existing one-blob-for-same-bytes dedup pins.
* Feed worker-origin image rejections under session replay
- A rejected image terminal journals from both sides of the executor seam, but replay skipped every one as regenerable loop-side validation - a worker-refused load (a host-less URL that passes the loop's scheme check, an executor that could not start) parked forever in the fake executor and diverged the replay.
- Loop-side validation refusals now mark themselves with the record's exit reason (the .host records' convention) and keep regenerating; unmarked rejections are executor truth and feed like every other worker terminal.
- Covered by a record/replay test that drives a host-less URL through the real executor's worker and asserts the rejected Msg delivers fingerprint-identical offline.
* Give each image cache install its own temp file
- Every install wrote <cache_path>.partial, so two concurrent loads of one URL truncated each other's temp and a rename could publish a half-written file into the cache name; the temp now carries the slot generation (operation-unique), keeping the rename atomic with last-whole-file-wins.
- A failed install deletes its own temp, so the cache directory never accumulates this process's debris; only a hard crash mid-install can leave one, in the OS-purgeable caches directory.
- Pinned by a temp-name uniqueness test on the extracted imageCachePartialPath seam plus a two-loads-one-url executor test asserting both terminals, an intact cache entry, and no .partial debris.
* Stage loop-side image terminals outside the lossy pending ring
- The shared pending ring evicts its oldest entry on overflow and folds the loss into a drop counter, but EffectImageResult carries none and loop-side validation rejections are unbounded per dispatch: 33 refused loadImage calls before a drain silently evicted one terminal, breaking the exactly-one-terminal-per-load contract and stranding the issuing model forever.
- Image terminals now stage in a dedicated non-lossy FIFO: the ring-sized inline buffer covers everyday bursts allocation-free, and a burst past it grows a heap ring geometrically (each staged entry answers exactly one loadImage call, so storage is bounded by the caller's own call count between drains; the spill frees when the stage drains empty). A shared enqueue stamp merges the stage with the ring at drain, so delivery order across both structures is unchanged.
- The new burst test drives 33 sourceless loads plus one rejected spawn through a single dispatch to 34 terminals in enqueue order, exactly one per load - restoring ring routing for image terminals fails it at 32.
* Make image cache install temps writer-unique, not generation-unique
- imageCachePartialPath named temps `<cache_path>.<generation>.partial`, but the slot generation is channel-local: two Effects channels in one process, or two app processes sharing the platform cache directory, can install toward one cache path at the same generation and recreate the truncate/rename race the temp exists to prevent.
- Each install now appends a random 64-bit token drawn from the operation's own executor io (the CSPRNG seam every worker already carries), unique across channels and processes; the generation stays in the name as debris provenance, and the formatter stays pure on every compile target - the wasm32-freestanding docs preview never runs an install (no executor io exists there), verified by a green docs-wasm-preview build.
- The temp-name test now pins the cross-channel case directly: colliding generations with distinct tokens produce distinct names, so reverting the token fails it; the failed-write/rename self-cleanup path is unchanged and the concurrent-load no-debris assertions still hold.
* Refuse fractional expectedBytes at both tiers instead of truncating
- The emitter accepted any finite nonnegative expectedBytes literal, and the host's representability check lacked the whole-number clause its id sibling has: a fractional 1.5 truncated through @intFromFloat to 1, so cache installs verified every download against a size the app never declared and re-fetched on every launch.
- The emitter literal gate is now the id gate's Number.isSafeInteger (>= 0), teaching "not a whole-number byte count below 2^53" in the NS1030 voice; the host adds the floor clause, so fractional and unrepresentable DYNAMIC counts map to 0 = "unknown size" - the honest degrade the comment already promised (verification skipped, never wrong).
- Conformance pins the literal pair (1.5 stops the build, 4096 builds) and the e2e drives model-owned 1.5 and 4096 through the wire to expected_bytes 0 and 4096 with both loads completing; reverting either tier's gate fails its test.
* Propagate a cancel that lands inside the image cache probe
- readImageCache swallowed every error into a cache miss, including error.Canceled; Zig Io cancel delivery is one-shot, so a cancel interrupting the probe was consumed and the load fell through into the network fetch with nothing left to interrupt it - explicit cancel, the timeout, and teardown all degraded to waiting out the fetch, and a timed-out load could deliver late as .loaded.
- The probe now returns error{Canceled}!bool: Canceled propagates and the cascade terminates .cancelled like its sibling probe arms, while every other failure stays an honest miss that refreshes from the network.
- Covered at both tiers: a unit test drives the probe with an Io whose open/read return Canceled (and pins the honest-miss half against std.Io.failing), and an e2e parks a real load inside the probe on a reader-less FIFO, cancels it, and asserts one .cancelled terminal with zero requests reaching the loopback fixture.
* Cmd.imageUnregister: the TS tier's registry release
- A TS gallery had no recourse past the 16-slot registry: Zig cores call fx.unregisterImage(id), but Cmd.imageCancel only ends in-flight loads, so every successfully loaded distinct id occupied its slot permanently and the 17th image answered registry_full forever. Cmd.imageUnregister(id) routes to fx.unregisterImage — the image-family verb naming (imageLoad/imageCancel precedent), synchronous registry surgery like registration itself: no result Msg (releasing a slot cannot fail the way I/O and decode can), a miss is the silent idle no-op imageCancel and audio_ctl keep (the engine's own bool answer treats a miss as an answer, not an error, and the wire has no channel to carry it). It frees only the CURRENT registration: a load in flight is untouched and its terminal still registers the pixels — pinned by e2e as the engine behaves today — so eviction under a live load is imageCancel first, then unregister.
- Wire record image_unregister [op 0x12][id f64 LE], additive within cmd_format_version 2; full tier coverage — SDK factory, emitter with the imageLoad/imageCancel NS1030 id-literal gate, conformance, wire-layout pin, host decode, and e2e proving the gallery eviction verbatim: sixteen loaded images, the next id refused registry_full, one unregister, and the freed slot accepting a 17th distinct image.
- The 0x10-0x12 image block's opcode overlap with feat/menu-bar-lifecycle's 0x10-0x11 window verbs is known cross-branch and handled by the merge-order reconcile; this commit extends this branch's contiguous image block by one.
* Survive two recorders writing the same session blob into one store
- DirBlobStore.write staged every blob through <hash>.partial — one shared file whenever two recorders write the same blob into one blobs/ directory (the designed shared layout), so the writers truncated each other mid-write and the loser's rename failed the whole write, refusing a correct recording. Each write now stages through a writer-unique temp, <hash>.<token>.partial with the token drawn from the store's io CSPRNG (the same entropy seam the effect executor's cache installs use) — unique across stores and processes, with the hash kept in the name as debris provenance.
- A rename that still fails gets the content-addressed grace: re-running the verifying probe against the addressed name decides the outcome — an exact byte match means a concurrent writer won the install with THIS content, so the write succeeded and returns cleanly; a verified mismatch or absence stays BlobIoFailed. The loser's temp is deleted on every failure path. MemoryBlobStore is untouched: its medium is its own entries array, never a shared directory, so the race has no analogue there (documented on the type).
- Tests pin both halves where each is deterministic: the two-writer window cannot be paused mid-call through write(), so the loser's exact rename-failure state is staged at the installPartial seam (reverting the grace fails it with BlobIoFailed), the writer-unique temp name is pinned at the blobPartialPath formatter (a name without the token collides), two DirBlobStore instances over one directory both succeed with one intact blob and zero temp debris, and the existing corruption-repair and dedup coverage still holds.
* Back-pressure replay image feeds instead of dropping bytes and order
- A fed image terminal that found the completion queue full took the pending-ring fallback: releaseFetchSlot freed the journaled bytes and the loop-side delivery jumped ahead of every queued result, so a recording whose drain pass carried more than 64 results replayed with the image pixels gone and the terminal reordered around the recorded lines.
- Under replay the feed now reports EffectQueueFull with the request still parked and its bytes intact, and the replay pump drains through the same .wake dispatch the platform delivers live before feeding once more - everything rides the queue, mirroring the real worker's blocking postImage retry; the byte-free fallback (with its derived .loaded-to-.rejected honesty rewrite) remains for non-replay test feeds, the only other traffic that can reach it.
- The saturation regression test records 64 line results plus a loaded image terminal as one unbroken journal run and asserts replay delivers them in recorded order, re-registers the recorded pixels, and matches every fingerprint checkpoint.
* Retire the image slot before its terminal reaches update
- imageWorkerMain posts the terminal entry first and stores .draining on the next line, so a drain racing ahead of that store could dispatch the result while the slot still read .running - a reload of the same id from inside the handling update (the gallery-refresh idiom) then rejected as a duplicate active key
- the drain's .image arm now stores .draining right after taking the buffer, so the slot is reclaimable by the time any update code reacts to the terminal; the worker-side store stays as the pre-drain transition (cancel targeting and early thread reclaim key off it)
- the new test reconstructs the preemption window (terminal queued, slot rewound to .running - the exact state a preempted worker leaves) and proves the in-handler reload parks and completes instead of rejecting
* Reject children on the image leaf instead of dropping them
- <image ...><text>Caption</text></image> validated through and both engines built the children, but widget layout gives an image no child slots - the caption silently vanished
- all three surfaces now refuse with icon's leaf policy exactly: the validator (native check), the interpreter's build failure, and the compiled engine's compile error, sharing one image_children_message ("image is a leaf - it takes no children")
- negative cases land in the validator table and the interpreter's image-misuse suite with the message asserted symbolically; the compiled engine's rejection is a comptime fail, covered by the documented compile-error strategy (the interpreter enumerates what it rejects)
* Mirror the image leaf's required binding and raw-child checks into both engines
- the validator refused <image /> without its image={binding} (dead markup), but unvalidated or hot-reloaded markup reaching the interpreter or the compiled engine still built the leaf with the default id and silently rendered nothing - both engines now refuse with the validator's image_missing_image_message (icon's missing-name precedent)
- the engines checked image children AFTER context-menu extraction while the validator checks the raw node, so <image on-press="..."><context-menu/></image> built in both engines yet failed validation - the engine checks now read the ORIGINAL node's children, so all three surfaces agree the leaf takes no children at all
- negative cases land in the interpreter's image-misuse suite and the validator table with messages asserted symbolically; the compiled engine's rejections are comptime fails, covered by the documented compile-error strategy (the interpreter enumerates what it rejects)
* Count undelivered draining image slots as occupied in loadImage
- A reload landing between an image worker's terminal post (slot already .draining) and the drain was accepted live but rejected under replay, where the first request is still a parked .running fake until its recorded terminal feeds - the second terminal then had no pending request to match.
- Delivery ends the occupied window: the drain takes the slot's buffer before the terminal Msg reaches update, so a non-null fetch_buffer under .draining is exactly "undelivered" and the reload-from-own-terminal handler idiom still parks as a fresh load.
- Tests: an unrelated dispatch reloading inside the window rejects (and parks again after delivery), plus a record-to-replay session proving both sides reject identically.
* Make the dynamic expectedBytes bound exclusive at 2^53
- The bridge accepted a dynamic expectedBytes of 2^53 while the emitter's literal gate (Number.isSafeInteger) rejects it: 2^53 + 1 aliases 2^53 on the f64 wire, so no one honest count exists - an installed 2^53 becomes a verification size every real download misses, silently re-fetching on launch.
- 2^53 now maps to "unknown size" (0) with the fractionals; 2^53 - 1, the last exactly-carried count, still installs verbatim. The image id checks were already exclusive.
- Boundary e2e: model-owned 2^53 - 1 parks with the count intact, 2^53 (and its 2^53 + 1 alias) parks with expected_bytes 0.
* Teach the eval harness cmdview decoder the image records
- image_load 0x12, image_cancel 0x13, image_unregister 0x14 decode in the harness-lib Cmd iterator, matching ts_core_host.zig's decoder as renumbered past main's window verbs
- Pinned-bytes tests cover the load record's full layout and the two one-field records advancing exactly their own length in a batch
* Regenerate the docs component-preview wasm module after the reconcile rebase
- The wasm build now carries main's window-verb wire records alongside the renumbered image records, so the checked-in artifact drifts and is refreshed per the branch convention
* Refuse replay of .loaded image records that claim a zero-length blob
- A journaled .loaded image record always carries source bytes (the drain journals .loaded only after those exact bytes decoded and registered, and empty bytes cannot decode), so a zero-length blob is journal damage; replay now refuses it with the new ReplayDamagedRecord class instead of skipping blob resolution and delivering a pixel-less loaded.
- State the record-time invariant at the drain's journal site and the replay gate, and add a session test that hand-zeros a recorded journal's image_blob_len (blob store present and intact) and asserts the exact refusal.
* Document image status 0 as the no-exchange signal for cache hits and local paths
- A cache hit delivers .loaded with status 0 on purpose: status is the HTTP status only for url loads that performed an exchange, and fabricating the origin's 200 for a non-network event would claim an exchange that never happened - 0 lets apps tell a cached load from a network one.
- Say so everywhere the field is described: EffectImageResult.status and the journal record in effects.zig, the cache-hit site itself, core.ts's ImageEventArm, rt.zig's wire prose, the ts-core SKILL, and the dynamic-images docs page.
- Extend the offline-cache-hit test: the network load reports the loopback fixture's real 200, the offline re-load of the same id/url reports .loaded with status 0.
* Bump the session-journal format to v7 for the image record layout
- main already ships v6 (the hidden window-frame flag), and this branch appends the .image effect-result kind plus blob-address fields to every effect record - a layout change, so the version gate moves to v7 and a main-written v6 journal refuses as version skew at the preamble instead of misreading as corruption
- the doc-comment history splits v6 (hidden state) from v7 (image records); the changelog fragment and the dynamic-images docs page state the v7 break the same way
- the version-skew test now pins a concrete v6-preamble journal to JournalUnsupportedVersion and its re-record teaching, before any record layout is consulted
* Hold same-pass effect completions to the next wake so journal event boundaries stay causal
- one drain pass now consumes only completions that existed when it began (Effects.DrainBoundary; UiApp.drainEffects and the ts-core host drain use the bounded takeMsgWithin): a load an update handler starts mid-pass that finishes before the pass ends delivers - and journals - under the NEXT wake's event record, so replay's file-order feed always finds the parked request instead of turning the chained fast load into a false ReplayEffectDivergence
- the journal header now states the causal premise its feed-then-dispatch ordering invariant rests on; this is the recorder-side guarantee, chosen over a replay-side retry because the documented contract promises file order IS a valid feed order for every effect family, not just images
- the fake executor gains the instant-load convention (fake_instant_image_bytes) that reproduces the race deterministically, and the chained same-wake session test records, replays fingerprint-identical, and pins the effect/wake interleaving in the journal
* Report registry allocation failure as alloc_failed, never decode_failed
- EffectImageOutcome gains alloc_failed and classifyImageRegisterError maps error.OutOfMemory (the registry slot's lazy pixel-buffer allocation) to it: resource exhaustion at registration is its own honest class, named for the failing stage like io_failed/decode_failed - valid bytes are never reported corrupt
- the fifteen-member contract ripples everywhere it lives: the SDK ImageState alias and ImageEventArm docs, the emitter's IMAGE_STATES build gate, rt.zig's wire docs, the conformance/effects/runfidelity and e2e fixtures, ts-core SKILL.md, the docs outcome table, and the changelog fragment
- a FailingAllocator at the registry seam delivers alloc_failed and the SAME bytes load once memory heals; the fed-classes coverage carries the new member and the TS e2e sees the fifteenth state by name through the host's name-matched mapping
* Make undelivered-terminal occupancy key-wide across effect families
- The effect families share one key space, but only loadImage counted the posted-but-undelivered .draining window as occupied, and only for image slots: a key whose fetch/spawn/file/clipboard terminal was queued but not yet drained was accepted live by any other family (and by its own), while under session replay the same request is still a parked .running fake until its journaled terminal feeds - the accepted duplicate then diverges the Msg stream.
- keyOccupiedUntilDelivery gates every keyed admission (spawn, fetch, file read/write, clipboard, loadImage, and hostRequest's cross-kind collision arm) on findUndeliveredTerminalSlot, whose per-family "terminal still pending" marker is derived from how each drain retires the slot: the fetch_buffer handoff (fetch/file/clipboard/host/image), the collect_buffer handoff (collect spawns), and a new exit_undelivered flag for .lines spawns, whose slots previously retired to idle before their exit drained; the drain clears the flag before the exit Msg reaches update, so the respawn-from-own-exit idiom still parks fresh.
- Tests: live duplicate admissions inside the window reject and delivery frees the key for fetch->fetch, spawn->spawn (plus the respawn idiom), fetch->loadImage, and image->spawn; two record-to-replay sessions prove the cross-family rejections regenerate identically on both sides.
* Hold an image id through its staged start-failure rejection until it drains
- loadImage's executor-start failures (the staged source buffer's allocation, ensureIo, Thread.spawn) stage NON-regenerating rejections - executor truth that journals and FEEDS under session replay, where the same request allocates its own buffer and stays parked until the recorded delivery position. Live, the id was free the moment the rejection was staged, so a reload inside that window was accepted live and rejected under replay.
- Admission (keyOccupiedUntilDelivery, plus hostRequest's collision arm) now also consults the staged pending-image FIFO for non-regenerating entries: those hold their id until the drain delivers them, which covers both start-failure paths and the fake cancel's staged terminal with one rule - occupancy mirrors exactly the records replay feeds. Regenerating validation refusals deliberately do NOT occupy: replay re-runs the same loop-side checks at the same dispatch, so both sides refuse identically with the key never held.
- Tests: a surgical one-shot allocator fails exactly the staged source buffer, then a same-id reload inside the window rejects and delivery frees the id (live), and a record-to-replay session proves the start-failure terminal feeds while the in-window reload's refusal regenerates - model and fingerprint identical on both sides.
* Feed replayed image terminals verbatim past a stale cancel mark
- A fed image terminal is executor truth: check entry.image_fed before the cancelled rewrite so replay's differently-timed fake-slot mark cannot rewrite the journaled outcome
- Repro: a cancel that loses to a slotless staged start-failure rejection live (no-op, .rejected journals) used to resurface as .cancelled at replay, diverging model and fingerprint
- Session test records that window and asserts the fed terminal stays .rejected with identical model and fingerprint
* Publish spawn exit occupancy before the exit is consumable
- Set the lines-mode undelivered-exit marker before postExit: the queue mutex orders the mark before any consume, so the drain-side clear can never be overtaken by a late worker-side set that would strand the slot in .draining and hold the key forever
- Keep the .draining release store after the post: reclaimSlots joins draining workers, and a worker parked in postExit's full-queue retry must stay unjoinable until the loop can drain
- Cover the drain-side clear directly and prove slot handback with more delivered exits than the pool has slots
* Accept exact-fit blob reads in DirBlobStore
- A read that filled the buffer conflated "blob is exactly buffer-sized" with "blob is larger", rejecting valid exact-fit reads as BlobOverBudget before the hash check - callers size the buffer from the journal record's byte length, so the exact fit is the designed case
- Disambiguate with a one-byte probe past the buffer's end: a byte there is genuinely over budget, EOF falls through to the hash check, and a probe failure maps to BlobIoFailed like the main read
- Pin under/exact/over parity between DirBlobStore and MemoryBlobStore, and that an exact-fit read of damaged bytes still reports BlobCorrupt
* Refuse journaled image dimensions the recorder can never produce
- Replay's damage gate now checks decoded dims: .loaded must carry nonzero width/height whose RGBA8 bytes fit max_registered_canvas_image_pixel_bytes (overflow-checked product), every other outcome must carry 0x0
- A hand-edited maxInt width previously fed verbatim into the app's Msg and, on the TS core host, into an @intCast to i64-classed arm fields - a safety panic
- status needs no twin gate (u16 at the journal codec, completion entry, and EffectImageResult, so every downstream cast holds by type); four new session tests hand-damage journals and assert error.ReplayDamagedRecord
* Hold EventKind state unions to their exact members in stock tsc
- ImageEventKind and AudioEventKind now check state BOTH directions: the & constraint held the arm's states to the SDK union, and a tuple-wrapped [ImageState] extends [M["state"]] refuses a narrower union as never instead of letting it type-check
- The docs promise exactly the fifteen ImageState / six AudioState members; a narrower arm silently dropped states the host emits until the transpiler's own shape check caught it
- Four conformance tests pin the rule in tsc itself: narrower unions fail, the exact-member arms keep passing and transpiling
* Journal fire-and-forget image start failures so replay retires the parked fake
- Stage non-regenerating image terminals even with no on_result: only the Msg is handler-gated, so the staged entry still occupies the id (stagedImageOccupiesKey) and journals at drain, and replay's parked fake request retires when the record feeds instead of holding the key and a slot forever.
- Journal before the handler gate in the pending-image, clipboard, and host drain arms: executor-truth terminals record regardless of the route; regenerating validation refusals stay handler-gated because replay re-runs the same refusal at the same dispatch.
- Pin both sides deterministically: a handlerless start failure holds the id until its terminal drains, and a recorded session feeds the handlerless terminal on replay with an identical Msg stream and fingerprint.
* Retire spawn, fetch, and file slots before their terminal handlers run
- Store .draining consumer-side in the exit, response, and file drain arms, mirroring the image arm: workers store it only after posting the terminal, so a drain riding another wake could dispatch the Msg while the slot still read .running and a same-key retry from the handler (the poll/reload/restart idiom) would reject as a duplicate - nondeterministically, and unlike replay, whose fed fakes retire before feeding.
- Keep the exit arm's retire generation-gated beside the undelivered-marker clear, with the happens-before argument documented at the site; the worker-side store stays after the post (cancel targeting, joinability, full-queue retry) and the re-store is idempotent. Clipboard and host need no consumer store: their terminals stage on the loop thread with the store sequenced before the enqueue, and host replaces rather than rejects.
- Pin the idiom per family: fetch and file handler retries park fresh (unit and record/replay session coverage), and the spawn respawn-from-own-exit test runs a second full cycle.
|
||
|
Chris Tate
|
6f526a9c1e |
Menu-bar app lifecycle: close-to-hide windows and app show/quit verbs (#155)
* Track alive-but-hidden window state through frame events and the journal - WindowState/WindowInfo gain a hidden flag: the window is alive and open but off the glass (the close_policy .hide shape), distinct from minimized and from closed - window_frame_changed events carry it into the runtime window table, and the session journal round-trips it (format v6) Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Add the close_policy window declaration: .quit stays the default, .hide is the menu-bar shape - Per-window close_policy threads app.zon (top-level and shell windows) through WindowOptions to the hosts, .quit by default so every existing app is unchanged - macOS: windowShouldClose orders a .hide window out instead of closing (both hosts), the Dock reopen re-shows policy-hidden windows, runtime closes bypass the policy; Windows: WM_CLOSE hides via SW_HIDE and the tray stays the re-show affordance - Linux GTK has no status item to bring a hidden window back, so .hide refuses loudly: a comptime teaching for manifest windows and error.UnsupportedWindowClosePolicy at runtime create, gated by the new window_hide_on_close platform feature Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Add the showWindow and quitApp effects verbs on the window-action seam - fx.showWindow(label) un-hides and activates a window (deminiaturize + order front on macOS, SW_RESTORE + foreground on Windows, present on GTK) and fx.quitApp() terminates through the same shutdown event path a last-window close takes - Both follow the existing verbs' shape exactly: mirror counts in windowActionState, fire-and-forget with no journaling of their own, honest no-ops for unknown labels, mirror-only under the fake executor - Null platform models both with pinned seams (show counts, quit requests); a recorded hide/reopen/quit session replays its window states through the journal Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Mirror the window verbs into the TypeScript Cmd vocabulary - Cmd.showWindow(label) and Cmd.quitApp() ride new additive wire records (window_show 0x10, quit_app 0x11; cmd_format_version 3) and decode onto the same fx.showWindow/fx.quitApp verbs the Zig tier calls - The emitter lowers both with the string-literal label discipline effect keys use (window labels are declarations; a dynamic label is taught) - Conformance pins the emitted shapes and the dynamic-label teaching; the effects gate asserts the exact wire bytes; the host-bridge suite pins the mirror counts Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Add the menu-bar example: the tray-player lifecycle in one small app - Zero-config canvas app whose main window declares close_policy "hide"; the status item's Open/Quit rows map to fx.showWindow/fx.quitApp through the ordinary on_command path, with a model-driven title showing transport state while hidden - Tests drive the real tray-selection-to-verb loop and pin the declaration, the mirror counts, and the exactly-once stop hook - A purpose-built example keeps the pattern reference minimal instead of repurposing soundboard's close behavior Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Document the menu-bar lifecycle and make the tray quit example real - The tray page's "app.quit" example now handles the command (runtime.quitApp) and a lifecycle recipe walks the whole pattern: close hides, tray Open/Quit drive showWindow/quitApp, the Dock reopen re-shows - close_policy documented on the windows and app.zon pages, the new verbs on the runtime and TypeScript pages, and the platform matrix states the per-platform truth including Linux's loud refusal - Changelog fragment for the feature (defaults unchanged, no breaks) Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Thread close_policy through the generated runner template - The scaffolded runner's manifestWindow now mirrors the SDK runner: an app.zon window close_policy rides WindowOptions (.quit stays the default), instead of being silently dropped so a "hide" declaration kept quit-on-close - The "hide" declaration is refused at comptime on linux with the same teaching as the SDK runner - nothing could bring the hidden window back - The template test pins the field and the linux refusal, so dropping either fails the writeDefaultApp test again Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Expose alive-but-hidden in the JS bridge's window JSON - writeWindowJsonToWriter emits "hidden" beside open/focused: a close_policy = "hide" window read open:true/focused:false over the bridge, indistinguishable from a visible unfocused one - NativeSdkWindowInfo carries the field, the window bridge test drives a policy-hidden window through window.list, and the windows doc names the bridge JSON among the surfaces where hidden shows up - The webview JSON twin stays untouched: policy-hidden is window state, webviews have none Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Stop listing hidden as persisted WindowState in the windows doc - The type table said hidden persists while the close-policy prose and the implementation say the opposite; the row now marks it deliberately session-transient (never persisted, every launch starts shown) so nobody re-adds it to the store Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Thread shell-startup window state through the generated runner template - The scaffold runner ignored every `.shell.windows` startup declaration that is host state fixed at create time: mirror the SDK runner's manifestShellStartupTitlebar/Resizable/ShowMode/MinSize/ClosePolicy threading (including the Linux comptime refusal of close_policy "hide") into the windows.len == 0 branch, so a scene-first app.zon no longer silently keeps quit-on-close, standard chrome, immediate show, and no min-size floor. - Thread titlebar and min_width/min_height through the top-level manifestWindow too — the same silent-drop class close_policy shipped with once. - Pin the shell-startup threading and the new window fields in the template test, so dropping any of them fails the scaffold contract loudly. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Route focus of a policy-hidden window through the show verb - focusWindow on a window hidden by close_policy .hide left state inconsistent: the hosts' focus paths order a window forward without touching their policy-hidden bookkeeping (macOS reported hidden=true on a visible window; Windows never shows an SW_HIDE'd window at all), so the runtime now drives showWindow first — the seam that clears the hosts' policy-hidden sets, emits consistent state, and rolls back on platform failure — before focusing. - One rule at the runtime seam covers every focus ingress: the app verb and the JS bridge's native-sdk.window.focus both resolve hidden-then-focus the same way. - Tests pin the routing through the null platform's show count on both paths: the runtime seam (hidden clears, focus lands, no second show for a visible window) and the bridge twin (the focus response never reports a focused window that is still hidden). Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Queue the quit verb's stop so app_shutdown emits after the requesting dispatch - fx.quitApp() lands mid dispatch (the tray/menu command's update returned it), and the macOS and GTK hosts emitted SHUTDOWN synchronously from the stop call: the shutdown dispatch nested inside the command's, the session recorder's nested commit + finish() sealed the journal, the outer commit no-oped, and the journal lost the very command (and model mutation) that quit the app — replay diverged. Both hosts (AppKit, macOS CEF, GTK) now queue the identical emitShutdown + stop onto their loop's next turn (dispatch_async onto the main queue / g_idle_add, the same seams the wake paths ride); Windows already posted. The pre-run-loop inline emit stays on macOS so a failed START handler's synchronous shutdown request keeps working, and stop's posted wake event still unwinds a loop whose quit was the last thing that ever happened. - The null platform's quit seam models the queued shape: quitApp records the request and takeQueuedQuit() hands the test the deferred app_shutdown to dispatch as its own loop turn, exactly once — the userCloseWindow pattern. - A recorded-session test drives the whole verb chain (menu command -> update -> fx.quitApp -> queued host echo) with a recorder attached and pins the contract: the journal is not sealed by the quit dispatch alone, contains BOTH the command and app_shutdown in order, and replays fingerprint-identical; a build check step pins the queued stop in all four host sources so reverting to the synchronous emit fails the suite. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Occlude policy-hidden windows in the Windows pacing and spectrum gates - Both occlusion answers in the WebView2 host were IsIconic-keyed only, so a window hidden by close_policy .hide (the menu-bar shape — hidden for days behind its tray icon) kept its full-rate canvas frame loop and its 25 Hz spectrum emissions running for glass nobody can see: pure background CPU burn. gpuSurfaceOccludedPacingActive now answers occluded for a policy-hidden window's surfaces (the ~1 Hz heartbeat, same first-present and input exemptions), and audioAnyWindowReachesGlass stops counting policy-hidden windows as visible, so an app with every window minimized or hidden goes honestly quiet. - Re-show restores full cadence without dropping a beat: SW_SHOW on a same-size window dispatches no WM_SIZE (the minimize path's restore re-arm), so the show verb itself supersedes a parked heartbeat emission at the frame-grid delay after clearing policy_hidden. - This is C++ host logic the Zig suite cannot execute: the contract is pinned by the test-gpu-occluded-frame-heartbeat file-contains step (both policy_hidden gates plus the re-show re-arm), verified by cross-target -fsyntax-only compiles of both WebView2 configurations, and written into the windows and capabilities docs; the pacing comments now name both occlusion facts honestly. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Refuse a .hide main window at Linux platform init instead of silently quitting on close - LinuxPlatform.initWithOptions creates the MAIN window before any runtime exists, so the runtime's create-time .hide gate (window_storage's error.UnsupportedWindowClosePolicy) and the generated runner's comptime refusal never covered a direct-SDK or custom-runner caller: a .hide declaration was silently dropped and the user got quit-on-close. The init now refuses with the same error and the same teaching text the comptime check prints — one message, all seams — through an extern-free gate that is unit-tested on every host, with a file-contains step pinning both its wiring into initWithOptions and the cross-seam message lockstep. - Three-platform pre-created-window audit: macOS threads the declared policy into the host right after create (applyWindowClosePolicy -> windowShouldClose) and Windows does the same (applyWindowClosePolicy -> the WM_CLOSE hide hook), so neither drops it; Linux was the only silent seam and now refuses. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Park a pre-run quit verb and drain it after the boot dispatch returns - A quit requested before [NSApp run] exists (App.start's update, a boot command during the synchronous first canvas frame) rode the failed-START inline emit on the macOS hosts, nesting app_shutdown inside the very dispatch that requested it — the session recorder sealed the journal before the boot turn committed and replay refused the recording. - The seams are now split: native_sdk_appkit_request_stop (the quit verb, AppKit and CEF alike) parks pre-run quits in pendingPreRunStop and runWithCallback drains them at top level after the START dispatch and again after the remaining pre-run emits, while native_sdk_appkit_stop keeps the byte-for-byte inline pre-run emit for the host-side failed-START request. - The recorded-quit session tier gains the quit-from-boot case (the journal carries the start event and app_shutdown in order, and replays fingerprint-identical through the modeled park-then-drain seam), and test-quit-pre-run-pending pins the host wiring so an inline pre-run revert fails the build. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Track, coalesce, and destroy-remove the GTK quit-stop idle source - Every native_sdk_gtk_stop queued a bare untracked g_idle_add: a second stop requested while the first executed (the shutdown handler's error path can make one) left an idle source holding a freed host after the loop quit. - The pending source id now lives on the host: stop coalesces while a turn is queued and skips entirely once did_shutdown is set, the idle clears the id as its first act, and native_sdk_gtk_destroy removes a still-pending turn before the host is freed. - test-gtk-stop-idle-tracked pins the tracking, coalescing, and removal textually — this suite cannot run the GTK loop on macOS; the linux-dev-smoke CI job exercises the real path at runtime. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Clear hidden with open when the app closes a policy-hidden window - closeWindow flipped open and focused optimistically but left hidden alone, so an app-driven close of a policy-hidden window parked {open=false, hidden=true} in the runtime table — visible through the JS bridge, which exposes hidden; a closed window is not hidden, it is gone. - hidden now clears beside open/focused and restores on platform failure through the same rollback; the null platform gains a fail_next_close_window injection seam (error.CloseFailed, consumed on use) so rollback paths are drivable. - The new ui_app_window test walks the whole arc: .hide close hides, a refused platform close rolls every flag back (still open, still hidden), and the successful close reads open=false and hidden=false — dropping the hidden clear fails it. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Clear policy-hidden membership on the CEF app-close exit that skips windowWillClose - The CEF host's app-driven close of a browser-bearing window exits through orderOut + an open=false emit without ever reaching windowWillClose, so the window stayed in policyHiddenWindows: the frame encoder derives hidden from set membership, so app-closing a policy-hidden window emitted {open=false, hidden=true} (overwriting the runtime's optimistic hidden clear), and a later Dock reopen — which re-shows every set member — could resurrect the closed window. - The branch now leaves the set before its emit; after this every close exit removes and only hideWindowWithId (the user close of a live window) adds, so set membership implies a live, policy-hidden window and the reopen handler cannot resurrect. The AppKit host needs no change: all of its close paths run windowWillClose, whose cleanup already precedes the emit. - A file-contains gate pins both hosts' cleanup-before-emit ordering, including the CEF orderOut branch's own cleanup. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Mirror the close's hidden clear in the null platform and gate its reopen on liveness - NullPlatform.closeWindow cleared open/focused but left hidden standing, and userReopenApp re-showed on the hidden flag alone — so the modeled host resurrected an app-closed policy-hidden window (hidden=false, focused=true, a frame event), the same hole the real macOS hosts' set hygiene closes. - The close mirror now clears hidden with open (matching the runtime table's own close flip), and userReopenApp skips windows that are not open — a closed window keeps its slot in the mirror, so hidden alone is not liveness. - The new test drives the whole arc through the runtime: close a policy-hidden window, reopen emits NO event and the runtime table is untouched, then force a stale hidden flag onto the closed slot to prove the liveness gate holds on its own — reverting either fix fails it, and the existing reopen re-shows test still passes for genuinely hidden-open windows. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Move runtime focus with a successful showWindow: the show verb activates - The service contract is show AND activate — every host's show path makes the window key — but the runtime's showWindow flipped only hidden, so listWindows and the JS bridge reported the shown window unfocused while it stood frontmost on the glass. - After the platform accepts the show, focus now moves through the same setFocusedIndex seam focusWindow uses (the dethroned window's key-loss consequence fires); a refused show still rolls hidden back and moves no focus, drivable through the null platform's new fail_next_show_window injection (error.ShowFailed, consumed on use). - Tests pin both halves: show a hidden window and the runtime table reads it focused with every other window unfocused (the bridge's window.list JSON carries the same truth), the failure injection leaves hidden and focus untouched, and dropping the focus update fails both tests. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Teach the evals Cmd decoder the v3 window_show and quit_app records - cmdview.zig self-identified as cmd_format_version 2 and panicked on op bytes past 0x0F, so any graded core returning Cmd.showWindow or Cmd.quitApp (alone or in a batch) crashed the ts-track behavioral harness mid-eval, reading as the graded app's failure. - It now decodes window_show 0x10 ([op][label_len][label]) and quit_app 0x11 (bare op), mirroring the runtime decoder in src/runtime/ts_core_host.zig; a repo sweep found no other Cmd opcode table outside packages/core and src/runtime, both already v3. - The decoder gains its first tests (round-trip of both records against the encoders' pinned bytes, plus batch adjacency), wired into `zig build test` as test-evals-cmdview since eval-time is too late to learn the decoder lags the format. The 0x10/0x11 overlap with feat/dynamic-images remains merge-order-reconciled. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Execute the CEF show and minimize verbs synchronously on the main thread - native_sdk_appkit_show_window queued its work with dispatch_async and returned 1 immediately, while the close verb runs synchronously (direct on main, dispatch_sync hop otherwise): the runtime's post-success focus flip ran while the window was still in policyHiddenWindows, so frame emits in the gap carried {focused:true, hidden:true}, and a show-then-close in one dispatch re-ordered — the queued show landed AFTER the synchronous close and put a retained (ordered-out) closed window back on the glass. showWindowWithId: now owns closeWindowWithId:'s exact on-main/off-main split, with the window lookup inside the block so a window closed before an off-main hop lands is a no-op. - The minimize sibling had the same queued shape and the same close race (a queued miniaturize captured past a synchronous close genies an app-closed window into the Dock); it moves into a miniaturizeWindowWithId: with the same discipline. Minimize mirrors no runtime window state, so it emits no frame event — the ordering race was its only exposure. - The AppKit host's show and minimize were already synchronous direct calls; a file-contains gate pins the CEF block shapes, the shims' call-then-return-1 ordering, and the AppKit symmetry, so reverting any verb to a queued dispatch fails the suite. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Gate the runtime window verbs on slot liveness before the platform call - Runtime.showWindow resolved the id and called the platform: a closed window keeps its table slot (ids and labels release lazily, at the next create), so a retained dead slot was accepted — the null platform reported {open:false, focused:true} and the CEF host, which retains browser-bearing windows past their close, would visibly re-order one onto the glass. Dead slots now answer error.WindowNotFound (the runtime's one answer for not-open slots) before any platform call, gating the resurrection race independent of host timing. - focusWindow had the same hole (close clears hidden with open, so a dead slot skipped the hidden-routing and reached the platform's focus verb directly) and minimizeWindow too (the CEF host would genie the retained closed window into the Dock); both get the identical gate. - The new test closes a window and drives all three verbs: each answers WindowNotFound, the null recorder counts stay 0, and the runtime table and platform mirror stay closed/unfocused/un-hidden — dropping the showWindow gate fails it (verified). Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Expose the full PlatformFeature cohort to the JS bridge and typings - Backfill camelCase aliases in platformFeatureFromString for the seven members past gpuSurfaces: gpuSurfaceScrollDrivers, contextMenus, viewSurfaceAdoption, audioPlayback, audioStreaming, audioSpectrum, windowHideOnClose - Extend NativeSdkPlatformFeature with both spellings of each and sync the builtin-commands feature enumeration - Pin both window_hide_on_close spellings to the null platform seam (true by default, false when flipped) plus the audioSpectrum alias in the bridge test Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Teach check-runtime-types the PlatformFeature union and alias table - Derive every expected union member (snake plus camel form) from the PlatformFeature enum in src/platform/types.zig and fail naming any missing or extra name in NativeSdkPlatformFeature - Parse platformFeatureFromString's manual alias entries and fail on missing, extra, or mistargeted camelCase aliases - Accept a newline after = when locating exported type unions, matching the multiline union layout Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Correct the quit_app_fn contract to the queued shutdown emit - The doc comment mandated a synchronous app_shutdown emit — the exact shape that nests the shutdown inside the requesting dispatch and seals the recorder's journal before the triggering command commits; every shipped host defers, so the written contract now does too. - States the queued shape (emit on the NEXT loop turn, after the requesting dispatch returns), the pre-run park-and-drain case, the exactly-once app.stop guarantee, and names the null platform's quit_pending/takeQueuedQuit seam as the reference model. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Bring every narrative command-set surface to v3 with the window verbs - Four surfaces still said v2 after the window verbs landed: the rt.zig format heading, sdk/core.ts's command-set header, ts_core_host's command-walk doc, and the ts-core skill's command-set line — each now says v3 (the opcode tables and version-history prose beneath them were already v3-complete and unchanged). - sdk/core.ts's header enumeration and the ts-core skill gain the window-verb pair in the set's voice: Cmd.showWindow(label) (un-hide + activate the declared label, the tray Open consequence) and Cmd.quitApp() (the graceful terminate through the last-window-close shutdown path). - The typescript docs page already carried both verbs; version-cohort test names and the v1/v2-additivity history in rt.zig name past versions correctly and stay as they are. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Serialize the JS window-close response from the post-close table - closeWindowFromJson answered from a pre-close snapshot with open and focused hand-cleared, so a policy-hidden window's close told JS {open:false, hidden:true}; the response now reads the table slot after closeWindow, which owns the full set of flags a close clears - The slot index stays valid across the close: closed windows keep their table slot, and slots only compact inside window create when a dead id or label is re-used - The bridge test now closes a policy-hidden palette window and pins "hidden":false in the response Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Gate secondary startup windows on the window_hide_on_close feature - loadStartupWindows creates index > 0 windows through the platform services directly, bypassing the runtime create path's close-policy support check: a .hide declaration on a secondary startup window was silently accepted on hosts that cannot re-show a closed window, so the user's close really closed it - The same loud error.UnsupportedWindowClosePolicy gate now rides that direct create; the host-created main window keeps its own init-time refusal - New test drives the GTK-shaped null platform (window_hide_on_close=false) through a .quit main plus .hide secondary startup pair and pins the refusal at load; the supported host loads both windows Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Require the tray capability for .hide on Windows and downgrade tray-less hides - close_policy "hide" on windows now requires the "tray" capability at every validation seam: the SDK runner and generated-template comptime checks refuse the declaration (SW_HIDE removes the taskbar entry and windows has no dock-reopen path, so the status item is the only re-show affordance; macos stays exempt via the Dock), and the runtime create gates inherit the refusal because the Windows host answers window_hide_on_close only when the manifest declares a tray (new AppInfo.declares_tray, threaded like has_web_content), with a Linux-style init refusal for the host-created main window - Runtime backstop for a tray that validation accepted but creation lost: the WM_CLOSE hide hook consults the host's live tray_active state and downgrades a tray-less .hide close to a real close with a loud stderr line - a visible close beats a running, invisible, unreachable app - Tests: pure-fn coverage for the conditional supports answer and the init refusal, generated-template text pins for the windows teaching and the declares_tray threading, and a textual pin holding the WM_CLOSE tray consult ahead of the SW_HIDE with the downgrade line present (the C++ branch itself is beyond the suite; both WebView2 configurations cross-compile clean to x86_64-windows-gnu) Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Count UTF-8 bytes in the emitter's literal length gates - Cmd.showWindow's label gate (and every sibling string-literal gate: host/request names, cancel/delay/request/spawn/audioPlay/audio-verb/Sub.timer keys, and the asciiBytes literal bound) counted UTF-16 code units while teaching bytes, so a 200-character CJK label passed the gate and arrived as 600 UTF-8 bytes against the wire's 255-byte length prefix; every user-text gate now measures Buffer.byteLength (Cmd.fetch header names/values stay on .length - they are ASCII-enforced right above, where the counts agree) - rt.cmdWindowShow's std.debug.assert compiles out of ReleaseFast, where the length-byte @intCast would then truncate and corrupt the wire record silently - it is now an explicit panic in every build mode, the loud backstop behind the emitter's build-time teaching - Conformance pins both sides of the byte bound (100 CJK chars = 300 bytes teaches; an 84-char/250-byte multibyte label emits and compiles) and the effects harness pins the wire record for a CJK label carrying its 9-BYTE length prefix Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Document the Windows tray prerequisite for close_policy hide - The windows, app.zon, and tray pages now state the tray-capability requirement and the runtime downgrade the round-10 guard introduced. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> --------- Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> |
||
|
Chris Tate
|
c09a12669e |
Document registered fonts and prove the CJK path on Windows CI (#144)
* Document registering fonts for scripts beyond bundled coverage
- New Fonts page: the Options.fonts / registerCanvasFont path with a CJK anchor example, every registration error and its teaching, ownership until Runtime.deinit, how typography tokens resolve a registered face, and the honest platform + TypeScript-tier status
- Cross-link the tofu guard's teaching in Native UI and the theming typography group to the new page
* Teach the register-a-font path where the tofu guard fires
- font_coverage_message, the ui builder's Debug diagnostic, the markup CLI usage text, and the native-ui skill now name registering a covering font (UiApp Options.fonts) alongside vector icons and plain words
- Platform Support gains a text-and-registered-fonts matrix row: first-class on the three desktops per the code and suite, stated unverified on mobile where no test registers a font and host measurement has no registered-font seam
* Prove registered CJK faces render Chinese text on Windows in CI
- Commit a 2.2 KB OFL-licensed fixture (Noto Sans SC instanced at wght=400, subsetted to 你好世界 plus notdef, license beside the file) and a receipt test: a scaffold-shaped UiApp registers it through Options.fonts, every ideograph resolves to its own glyph with nonzero rasterized ink, and the reference screenshot differs from the bundled-face tofu twin
- Add zig build test-canvas-fonts (the font-registry suite filtered from the desktop tests) and run it natively on the Windows CI lane; the same tests keep running in zig build test via the canvas-frame shard
- Note the Windows-native receipt in the platform matrix footnote
* Scope the fonts page's claims to what each tier delivers
- The example now teaches the mono_font_id slot instead of claiming whole-app coverage, and the lockstep guarantee names the desktop paths and defers mobile to the platform notes.
* Pin the Chinese receipt against the registered face's own tofu
- The end-to-end receipt now renders a third screenshot: the same registered face showing four ideographs the fixture deliberately does not map (each pinned with glyphIndex() == 0 first), and asserts the real-CJK shot differs from that self-calibrating control.
- A renderer that wrongly resolved every ideograph to the registered face's notdef glyph and inked its outline would differ from the bundled-face shot and pass nonblank, yet match this control byte-for-byte; sabotage-verified by forcing the uncovered string into both slots and watching the new assertion fail.
- The scaffold model gains a show_uncovered_cjk toggle so the control renders through the identical dispatch-rebuild-screenshot pipeline as the receipt itself.
* Name the one render-time refusal and add the release fragment
- The fonts page's registration-time claim now carries its one honest exception: point-matched composite placement is the per-glyph refusal maxp cannot gate, surfacing at first raster as the deterministic block fallback — never a crash, never a silent skip — and no measured production face uses it.
- New changelog.d fragment covers the branch's user-visible changes: the tofu-guard teachings now name font registration first, the fonts docs page, and the Windows-native CJK receipt lane.
- src/runtime/testdata/fonts/OFL.txt drops one trailing space (line 21) so git diff --check runs clean; the license wording stays verbatim.
* Evict a re-registered font id's cached NSFonts in the AppKit host
- The per-(id, size) NSFont cache is per-process while font-id permanence is per-runtime, so an embedder destroying a runtime and registering a different face under the same id measured and drew the first face from stale cache entries.
- native_sdk_appkit_register_font now purges the id's "id/"-prefixed cache entries under the descriptor table's @synchronized guard before installing the new descriptor, and the comment claiming cached NSFonts never go stale states the real lifetime instead.
- No SDK test tier links appkit_host.m (only managed app builds compile it), so the eviction wiring is pinned by a file-contains check step like the other AppKit host contracts; the CEF host's register_font is a stateless accept with no cache, so nothing to evict there.
* Rebuild every installed surface when a font registers late
- noteCanvasFontsChanged forced a repaint but installed UiApps never rebuilt (the frame handler rebuilds only on install, scale change, or size change), so the repaint re-inked widget frames and baked text layouts measured before the face joined — breaking the fonts page's every-open-surface-re-measures promise.
- The registered-font count is the runtime's fonts generation (registration is permanent, no unregister): UiApp adopts it at install and both frame handlers compare it per presented frame, rebuilding ALL installed surfaces — main canvas and declared windows — through rebuildAllViews when a face joined late; rebuildEmitsTokens also treats a text-measure provider change as an emit reason so static-token apps push the font-aware provider into the stored tokens.
- Test: an app with no declared fonts installs a main canvas plus a declared window, registers the CJK fixture through the runtime seam, and one arriving frame must move BOTH surfaces' text frame widths (mixed CJK+Latin text — the Latin tail measures at Geist's sub-em advances before and the face's 1.0 em notdef after); sabotage-verified: with the rebuild call removed, exactly this test fails.
* Split the matrix's text row so mobile text is not denied
- The single "Text & registered fonts" row rendered "Not available today" for iOS/Android, false for bundled text: mobile hosts present the same reference-renderer pixels the desktop software hosts ink.
- Now two rows: "Text" is full on all five platforms, and "Registered fonts" keeps full desktop with the honest none-unverified mobile note; footnote 3 already narrates both halves, so fn={3} stays on every cell and nothing renumbers.
* Invalidate the AppKit measured-width cache when a font id re-registers
- The width NSCache in native_sdk_appkit_measure_text survived re-registration: the round-3 eviction covered only the NSFont size cache, so a new runtime reusing an id kept measuring the previous face's widths while drawing the new one.
- NSCache cannot enumerate keys, so prefix eviction is impossible there; instead registration bumps a per-id generation (stored beside the descriptor table, under the same @synchronized) and the width-cache key includes it, so the old generation's entries become unreachable and age out under the cache's own count limit — keeping NSCache's bounding and memory-pressure purging, which a dictionary conversion would forfeit for a 16384-entry text-keyed cache.
- The test-appkit-registered-font-cache-eviction pin step now covers the width-cache half (generation table, bump inside register_font, generation-carrying key), same textual tier as round 3 since no SDK test tier compiles the ObjC host.
* Scope the fonts page's late-registration and no-cascade promises to the truth
- Late registration: automatic re-measure and rebuild is UiApp wiring, so the sentence now says UiApp surfaces rebuild automatically while callers driving the runtime directly re-emit their display lists after registering.
- No-cascade: true for the engine paths (reference renderer, glyph atlas, SDK-rasterized packet text), but macOS host-drawn text follows platform shaping including system-font fallback, so uncovered codepoints there may render from a substituted family instead of notdef — the paragraph now states both halves.
* Return the host-side font registration at Runtime.deinit
- New optional platform service unregisterGpuSurfaceFont(id): Runtime.deinit calls it per registered id before freeing the bytes, so the macOS host's per-process font state (CoreText descriptor, size cache, width-cache generation) no longer outlives the runtime that registered it; the CEF host accepts statelessly and platforms without the register seam keep answering UnsupportedService.
- The null platform records the teardown call, the embed cycle/idempotence tests assert deinit makes it exactly once, and the AppKit eviction pin step now holds the ObjC removal and the deinit call site.
- Fonts page: deinit returns the host-side registration too, and host font state is one face per id per process (concurrent runtimes sharing an id see the last registration - a deliberate current constraint).
* Adopt the late-font rebuild count only after the rebuild succeeds
- rebuildForRegisteredFonts assigned fonts_built_count before rebuildAllViews, so under production's degrade policy a failed rebuild (widget budget, allocator pressure, a secondary window's emit) marked stale layouts as font-current and never retried.
- New test drives a late registration into a budget-failing rebuild, asserts the count stays unadopted, and proves the next healthy frame retries, re-measures with the registered face, and only then adopts.
* Scope the matrix footnote's text-parity claim to the reference path
- Footnote 3 opened with "identical code on every platform" while its own next sentence described macOS resolving packet text through CoreText; the opening now names the SDK's TrueType pipeline as the shared reference path (goldens, screenshots, software presents), matching the distinction the fonts page draws.
- Every other fact in the footnote is unchanged.
* Key AppKit width-cache invalidation on a process-global font token
- Replace the per-id registration generations with one monotonic process-global token counter: registration stamps the id with a fresh never-repeated token and the measured-width NSCache key carries it, so no registration can ever reach a previous life's cached widths.
- Because tokens never repeat, unregister now deletes the id's token record outright instead of retaining a bumped entry per retired id — descriptor, size-cache entries, and token record all drop, leaving zero host state per retired id, which is what the fonts page's runtime-cycle sentence promises.
- Align the file-contains pins with the token names and additionally pin the token-record removal inside native_sdk_appkit_unregister_font so the zero-retained-state property cannot silently regress.
* Return host font registrations through the owner captured at registration
- Each CanvasFontEntry now captures the platform's unregister fn and context when the registration is pushed to the host, and Runtime.deinit returns the registration through that captured pair — never live options.platform, which is publicly mutable and may name a different host (or a null seam) by teardown time, the owned_allocator identity-freeze doctrine applied to the host seam.
- Pin the capture and the deinit call site in the file-contains step, and add an embed test that registers through platform A, swaps options.platform to platform B, and asserts the deinit unregister lands on A (count 1) and never on B (count 0); reverting to the live-options read fails both the test and the pin.
- One services read in registerCanvasFont now serves both the host sync and the captured return path, so the host that hears the registration is exactly the owner the entry names.
* Guard host font unregistration with a per-registration ownership token
- registerGpuSurfaceFont now returns the host's ownership token for the registration (0 from stateless hosts); the runtime stores it in the font entry beside the captured owner and Runtime.deinit presents it at unregister, so the AppKit host removes an id's descriptor and caches only while the id's current registration still carries that token — an older runtime's deinit can no longer tear down a newer runtime's live face under a shared id, and a stale token is a no-op accept.
- The null platform gains an opt-in host-font mirror (id-keyed, last-wins, monotonic tokens — the AppKit table shape without CoreText) plus a token field on its unregister recorder; a new embed test registers one id through two runtimes and proves the newer registration survives the older runtime's deinit.
- The AppKit pin step now pins the two-argument unregister signature, the token-match guard line, the reported out-token, and the three-argument deinit call, so reverting the host to id-keyed removal fails the pins.
* Snapshot font token and face in one AppKit critical section
- native_sdk_appkit_measure_text read the registration token and resolved the font under separate lock acquisitions, so a registration landing between them paired token 0 with the new registered face and cached registered widths under the reusable token-0 key — served as stale registered widths after teardown, when token 0 means built-in resolution.
- NativeSdkRegisteredFontSnapshot now reads the id's token and resolves its registered face inside one @synchronized section (shaping stays outside the lock: a stale-but-consistent pair keys a retired token no lookup reaches); built-in resolution is split into NativeSdkBuiltInFontForFontId so token 0 only ever pairs with built-in widths.
- measure_text_advances audited: it memoizes nothing host-side (the engine caches the batch under its own measure generation), so it has no (token, face) pairing to tear; the pin step now pins the snapshot signature and its measure_text call site.
* Clear the AppKit measured-width cache when a font registration is torn down
- unregister_font purged the descriptor, token, and size cache but the measured-width NSCache was a function-local static inside measure_text, unreachable from teardown: retired-token entries could never be served again (tokens never repeat) yet stayed resident — up to 16,384 keys carrying full text strings — until memory pressure, contradicting the zero-retained-state contract.
- The cache is hoisted to a shared accessor (the same shape as the NSFont size cache) and the token-matched unregister path clears it wholesale — NSCache cannot enumerate keys, so per-id eviction is impossible; the trade is stated at the site (teardown-frequency event, live ids re-warm in one measure each), and a stale-token no-op never clears.
- The cache-eviction pin step holds the accessor, the clear, and the measure_text call site; sabotage-verified (pin fails with the clear removed). No behavioral tier can observe the ObjC cache, so textual pins are the honest coverage.
* Cover the PR's user-visible fixes and API break in a changelog fragment
- Seven review rounds accumulated user-visible surface beyond the original docs/diagnostics/CI fragment: the late-registration rebuild, the macOS host font teardown, and the registerGpuSurfaceFont token break with the new unregisterGpuSurfaceFont service.
- A new fix-tagged fragment covers them, per the one-tag-per-fragment convention; the Breaking bullet states the break deliberately with a matter-of-fact migration note for custom-platform embedders.
- Internal-only work (pins, test machinery) stays out, matching the fragments' user-facing voice.
* Recheck the registration token before caching a measured width
- measure_text shapes outside the descriptor guard, so an unregister landing mid-shape cleared the width cache and then had it repopulated by the in-flight write: a retired-token entry no lookup can serve but resident until memory pressure
- Registered-token writes now re-enter the guard and cache only while the id still carries the snapshotted token; token 0 (built-in resolution, never unregistered) keeps the unconditional write
- Pin the recheck shape in test-appkit-registered-font-cache-eviction; advances batch and packet drawing re-audited as memoizing nothing host-side that the window could touch
|
||
|
Chris Tate
|
4a947ef2d5 |
Stop embedding the 16 MiB registered-image pixel pool in every Runtime (#143)
* Allocate registered-image slot buffers on demand instead of embedding 16 MiB - canvas_image_pixels becomes per-slot heap slices: one slot-budget allocation from the init-frozen owned_allocator at a slot's first registration, reused across re-registrations and unregister/register churn, freed only by Runtime.deinit — a runtime that never registers an image allocates nothing. - registerCanvasImage (and the fx bindings) now surface error.OutOfMemory when a slot buffer cannot be allocated; the allocation runs before any registry mutation, so a refusal leaves the registry unchanged and the registration retryable. - unregisterCanvasImage compacts by swapping slot buffer pointers instead of memcpying pixels; the vacated slot keeps its buffer for reuse, matching the media-surface pool's deinit-only ownership story. * Pin the lazy image slot-buffer lifecycle with an allocation-discipline test battery - Zero-allocations-until-first-registration, frozen-allocator ownership (a mutated options.allocator sees neither the allocs nor the frees), pointer-swap compaction with pixel verification across cycles, and the OOM refusal/retry path through a FailingAllocator. - Changelog fragment states the on-demand footprint and the new error.OutOfMemory surface on register. |
||
|
Chris Tate
|
4f22071c82 |
Keep the WebView stub compile silent and support GLib 2.72 (#152)
* Remove the informational pragma from both WebView stub paths - zig renders every clang diagnostic of a failing C compile as error:, so the note masqueraded as the build-killer whenever a real error joined it - the stub branches keep their explanatory comments; the misconfigured web-build #error stays - build graphs (build/app.zig and the ejected template) document why the expected state is silent: runtime WebViewNotFound is the teaching channel Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> * Compile the GTK host against GLib 2.72 - G_APPLICATION_DEFAULT_FLAGS is GLib 2.74+; the host's GTK floor is 4.10, whose own GLib floor is 2.72 - distros backporting GTK 4.10 onto a 2.72 base (Ubuntu 22.04 derivatives) now compile canvas apps out of the box Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> * Pin diagnostic-free stub compiles in both canvas-smoke CI lanes - zig cc passthrough is the one channel where C warnings reach stderr, so each lane compiles its stub host and asserts zero diagnostics - fails on the old pragma, passes after its removal; the webkit-less build + ELF audit receipts already live in these lanes - changelog fragment for the user-visible fix Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> * Run the stub diagnostic receipts against a cold zig cache - on a cache hit zig cc replays nothing, stderr included, so a restored cache would hide the exact diagnostics the steps pin against - throwaway ZIG_GLOBAL/LOCAL_CACHE_DIR per step keeps every run cold Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> * Print the captured compiler output when a stub receipt compile fails - Actions runs steps under bash -e, so a nonzero command substitution killed the step at the assignment and swallowed the forensics the step captured; the || arm keeps errexit out of the capture. Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> * Pin the GLib 2.72 fallback with an error-set receipt on stock 22.04 - No stock image pairs old glib with GTK 4.10, so the receipt asserts the error set: GTK-age failures only, never a glib symbol - a future 2.74+ symbol without a fallback trips it. Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> * Whitelist GTK-age diagnostic shapes in the GLib 2.72 receipt - The prefix blacklist missed non-undeclared shapes (unknown glib type names); the whitelist rejects everything that is not a GTK-age root or its cascades, with the cascade rationale in the script. Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> * Demand positive evidence from the GLib 2.72 receipt - Unlocated error shapes (driver/invocation failures) reject instead of sailing past the located-diagnostic parser, and fewer than five GTK-age roots means the compile proved nothing. - Renamed to the allowlist vocabulary. Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> * Narrow the conversion cascade to its signature and document the lattice - Int-to-pointer lines only pass when converting from 'int' (the undeclared-function-returns-int shape); the docstring now records why cascade allowances are sound: full-GTK lanes compile the same file, so only the old-glib delta reaches this filter, and glib regressions always reject at their root. Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> --------- Co-authored-by: nextpointer <110530249+nextpointer@users.noreply.github.com> |
||
|
Chris Tate
|
e59091060f |
Fix the Linux Debug startup crash at the GTK create-view seam (#153)
* Fix the Linux Debug startup crash at the GTK create-view seam - Force the LLVM backend for the app executable on x86_64 (and in the ejected template's build): zig 0.16.0's self-hosted backend shifts native_sdk_gtk_create_view's stack-passed arguments, so Debug `native dev` runs crashed reading a garbage role pointer. - Cap the GTK host's view string lengths at the platform limits with a teaching refusal, so a corrupted C-ABI boundary fails loudly instead of faulting in strndup. Co-authored-by: codehz <13158903+codehz@users.noreply.github.com> * Add a Linux Debug-scaffold runtime smoke to CI - linux-dev-smoke scaffolds the default ts-core template with the CLI, builds it -Doptimize=Debug with automation, and drives it under Xvfb to ready + first presented pixels. - Pins the Debug half of the Linux runtime story: release-shaped lanes always use the LLVM backend and can never see a Debug-only x86_64 codegen fault. Co-authored-by: codehz <13158903+codehz@users.noreply.github.com> * Apply the x86_64 LLVM-backend workaround to the checked-in example builds - The web-frontend examples own expanded build.zigs that created their exe without use_llvm, leaving Debug x86_64 runs exposed to the same self-hosted-backend C-ABI miscompile the app graph now guards against. Co-authored-by: codehz <13158903+codehz@users.noreply.github.com> * Restore the windows-canvas-smoke job key the dev-smoke insertion ate - Duplicate name/runs-on/steps keys collapsed both jobs into one: the Wine smoke ran mislabeled and the new Debug scaffold smoke never executed. Co-authored-by: codehz <13158903+codehz@users.noreply.github.com> --------- Co-authored-by: codehz <13158903+codehz@users.noreply.github.com> |
||
|
Chris Tate
|
b566850b46 |
Scale the comptime canonicalize quota by stamped source size, not a tree walk (#154)
* Scale the comptime canonicalize quota by stamped source size, not a tree walk - canonicalizeComptime sized its @setEvalBranchQuota by recursively measuring the document inside the quota argument, which evaluates under the caller's default 1000-branch budget - so CompiledMarkupView failed on .native documents past ~10KB while the runtime interpreter handled them fine. - MarkupDocument now carries source_bytes, stamped by both parsers, both import resolvers (the runtime resolver sums every visited file; the comptime resolver uses the embedded set's total, a superset of the merged tree), and the NSUI decoder; the quota reads it in O(1). - The per-byte constant (400) keeps its headroom: source length includes every byte the old measured tree size counted (node text, names, attr names/values) plus all markup syntax, so the new scale is always >= the old one. resolveImportsComptime's own size-summing loop now gets a set-length-scaled quota first, hardening the same invariant. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> * Guard the compiled engine against the comptime document-size cliff - New compile-cost fixture: a ~20KB comptime-generated .native document (36 realistically nested sections) built and rendered through CompiledMarkupView, plus a tiny root importing a 16KB+ template file through CompiledMarkupImports so the resolver's source_bytes accounting covers imported trees. - Both tests reproduce the old "evaluation exceeded 1000 backwards branches" failure when the fix is reverted, and neither raises @setEvalBranchQuota itself - the engine must get by on its own derived quotas. Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> --------- Co-authored-by: perminder-klair <3984412+perminder-klair@users.noreply.github.com> |
||
|
Chris Tate
|
57bf56bc58 |
Prepare v0.5.3 release (#145)
- Bump Native SDK package versions and platform pins to 0.5.3 - Merge pending changelog fragments into the marked 0.5.3 release notes - Fold contributor credits for the v0.5.2..HEAD release rangev0.5.3 |
||
|
Chris Tate
|
4a19caa338 |
The media surface: a dynamic texture channel composited like any widget (#142)
* Add the media-surface element and its dynamic texture channel
- media-surface (element 66, widget kind 61) composites producer-pushed RGBA8 textures like any widget; surface (attr 81) binds the model-owned u64 surface id in the runtime-image-id grammar, wired through both engines, the validator, the model contract, LSP docs, and docs previews
- Runtime.acquireMediaSurfaceProducer hands out an any-thread handle over a process-lived mailbox (latest-wins staging, generation/owner-tag fencing, no runtime pointers), adopted on the compositor's presented-frame clock with fingerprint damage gates at both the push and adoption boundaries
- texture contents stay presentation chrome: adopted textures ride the image pipeline as presentation_only resources the deterministic reference renderer skips (goldens, screenshots, replay marks render the id-derived placeholder), and bit 63 of the ImageId space is reserved for the texture namespace
* Pin the media-surface channel with the synthetic producer battery
- pins latest-wins burst adoption on the frame clock, damage short-circuits at both the push and adoption boundaries, viewport clipping plus the surface's own radius mask, and reference-placeholder byte-identity with a producer pushing real frames
- pins fingerprint exclusion (a11y line is producer-independent) and record/replay: a session recorded with a live producer replays fingerprint-identical with NO producer attached
- pins the thread contract: cross-thread pushes, and a producer outliving its runtime landing in inert process-lived slots with no cross-talk into a successor runtime's claim
* Prove the media surface through markup, contract, wire, and TS tiers
- validator teachings pinned: surface is one binding, required, media-surface-scoped; the contract checker requires an integer-producing model binding with the same message
- NSUI round-trips the element and attribute under codes 66/81
- the TS markup fixture declares a media-surface bound to a transpiled-core integer field, adopted into the retained tree through the full e2e (record/replay suites included)
* Document the media surface and its producer recipe
- components/media-surface reference page (markup-first, placeholder-policy honest) plus the Media Producers recipe under Mobile & Embedding — the external-renderer/mpv answer's home, explicit about the Zig-tier producer API
- native-ui guide and the native-ui skill gain the element row; changelog fragment states the feature, the determinism policy, and the reserved bit-63 id namespace
* State the software-fallback placeholder honestly in the producer recipe
- textures composite through the GPU packet pipeline; hosts on the software pixel fallback render the reference path's placeholder in this release
* Let media-surface uploads through at the frame budget the producer enforces
- The upload side-channel capped every image at the registered-image slot bound (1 MiB), so a 1920x1080 RGBA8 frame the producer accepted (8 MiB budget) was staged, adopted, and then refused at presentation with InvalidGpuSurfaceImage.
- Bounds are now keyed by the id namespace: ordinary registered images keep the avatar-scale registry bound (anything larger is an engine bug the registry already refused), while the reserved media-surface namespace is bounded by the producer's own frame budget, pinned in lockstep with canvas_limits.
- New coverage: a real 1080p frame end to end through push, adoption, packet present, and host upload; the exact-budget/one-over boundary refusing at the producer and never downstream; the per-namespace bounds at the PlatformServices seam every host (AppKit included) sits behind.
* Remove the host-side texture when a media-surface entry is reclaimed
- The reclaim path overwrote the retained entry without removeGpuSurfaceImage, so hosts that retain copied side-channel textures (AppKit's NSImage store) grew unboundedly as surface ids rotated, and a widget still drawing the reclaimed id could resolve the stale host image instead of its placeholder.
- Reclaim now mirrors unregisterCanvasImage's best-effort teardown, issued after the slot lock drops so guarded sections stay bounded memcpys; hosts without the seam and hosts that never uploaded the id are both safe no-ops.
- The reclaim-on-exhaustion path also self-deadlocked the moment the entry table first filled: the active-slot scan relocked the non-reentrant spin mutex the adoption loop already held. The scan now reads the held slot lock-free; the other paths (explicit release retains the paused frame deliberately, and a runtime never outlives its platform) need no removal.
- New coverage: reclaim removes the host image and the widget serves the placeholder in both engines' resolution paths; a surface-id rotation loop keeps the host store bounded by the channel budget; reclaim is safe on hosts without the upload seam.
* Export MediaSurfaceProducer from the public roots
- The producer handle type was public only inside media_surface.zig, so the docs' typed mpv callback (producer: media.MediaSurfaceProducer) could not be written as shown; it now rides the runtime root and the SDK root beside Runtime.acquireMediaSurfaceProducer, with the channel budgets exported like the image registry's.
- A compile-shaped test drives the docs example's exact signature against the public exports, and a docs-contract step pins the signature in the page and its test mirror in lockstep.
* Wake the idle compositor when a media producer stages new bytes
- pushFrame requests ONE coalesced frame through the platform's thread-safe request_frame_fn (the automation watcher's wake path) when it stages new bytes, so an idle demand-driven host adopts a 24/30fps producer instead of stalling and a late-starting producer is adopted promptly; damage-skipped and stale-generation pushes wake nothing, and a per-slot pending flag makes a burst of pushes cost at most one platform call
- The binding lives in the slot's process-lived wake half behind its OWN spin mutex with the platform call made UNDER it (the effects executor's abandon-fence doctrine): disarmMediaSurfaceWakes — run-loop exit defer, TestHarness.destroy, embed host destroy — takes the same mutex, so after disarm returns no producer thread is inside the host call and none can start one, preserving the orphan-producer UAF-safety story
- frame_requested dispatch now adopts staged frames (adoption's invalidation then arms the prompt gpu-surface frame via the existing noteCanvasImagesChanged path); tests pin the idle wake-adopt round trip, burst coalescing across threads, no-wake on damage-skip/released/invalid pushes, the disarm fence, and teardown with a wake pending
* Close the nested-slot-lock class behind the cross-runtime reclaim deadlock
- The retained-entry reclaim scan locked OTHER mailbox slots while the adoption loop held the drained one: two runtimes with full texture tables adopting concurrently could each hold a different slot and spin on the other's forever (ABBA) — the same class as the shipped self-deadlock fix, one runtime wider
- mediaSurfaceHasActiveSlot now snapshots ownership LOCK-FREE: the claim/release sites store the owner-tag/surface-id/active triple with atomic stores (active last, .release) and the scan reads them with atomic loads (active first, .acquire), which is what the memory model honestly supports — per-field tear-free, triple possibly stale, acceptable because it feeds only the reclaim heuristic and self-corrects on the next adoption (documented at the fn)
- SpinMutex.lock asserts in Debug/ReleaseSafe that a thread never holds two media-surface mutexes (data or wake) — no nesting means no lock order to violate, so any reintroduction fails loudly in every debug test run instead of hanging a stress run; a bounded two-runtime full-table concurrent-adoption stress test pins the racing shape itself
* Clip cover-fit media surfaces to their frame like the image widget
- emitMediaSurfaceWidget emitted the fit-expanded texture draw with no rectangular clip: cover expands past the widget frame on one axis, the draw-level radius mask is nothing at radius zero, and packet hosts that only mask radii painted the overflow over siblings — the exact overflow emitImageWidget already crops with a push_clip, now mirrored (part id 3, rect = frame) around the media draw
- Reference renders are unchanged by construction (the planner crops draws to their requested dst), so goldens stay byte-identical; the rounded case keeps its draw-level mask and gains the same bounds crop
- Tests pin the emitted command sequence (placeholder fill, rect clip, cover draw, pop before the sibling paints; no clip for non-cover; radius preserved under the clip) and the reference render's byte containment of the fit-expanded draw
* Allocate adopted media-surface texture buffers on demand instead of embedding 32 MiB
- Runtime.media_surface_pixels (4 x 8 MiB inline) becomes one lazy frame-budget allocation per texture entry from the new Options.allocator at first adoption, freed by the new Runtime.deinit (wired through the app runner's five run paths, TestHarness with the leak-checked test allocator, the embed host's destroy, and the docs wasm preview host); zero media use = zero bytes, OOM at adoption drops that frame loudly and retries — measured on the docs wasm preview host as 169.5 MB -> 137.5 MB per component tile (the -32 MiB pool exactly; 12-tile cap: -384 MB), the registered-font-pool regression's twin
- Repairs the branch's broken wasm32-freestanding build so the measurement (and the docs preview) compile again: the adoption path's std.debug.print gets the session recorder's freestanding guard (analyzing it dragged std.Io.Threaded in), and the reclaim scan's ownership atomics route through single-threaded-aware accessors (wasm32 lacks 64-bit atomics; with no second thread the plain access is exact)
- A FailingAllocator test pins that construction, startup, a live claim, and staged pushes allocate nothing, that a refused allocation degrades without a torn entry, and that the first adoption allocates exactly one frame-budget block reused across frames
* Freeze the runtime's owning allocator at init so media buffer frees never chase a mutated options.allocator
- Runtime.options is public and mutable, so the lazy media-texture buffer allocating through a live read of options.allocator at adoption and freeing through another at deinit could split the pair across two allocators (silent UB); initAt now captures Options.allocator into a private Runtime.owned_allocator and the adoption alloc, deinit frees, and all ownership docs go through that frozen identity
- The zero-allocations-until-adoption test now injects its counting allocator through the real capture site (re-initAt) and flips the frozen allocator's fail_index for the OOM-refusal phase; a new test adopts a frame through a tracked allocator, swaps options.allocator to a poisoned one, and pins deinit's free to the frozen identity with zero activity on the swap-in
- Audited the branch's other allocator wiring (app runner run paths, TestHarness, embed host, docs wasm preview host): all pass the allocator at init and only deinit reads it back, so the adoption-vs-deinit pair was the only differing-time read
* Reset the push-boundary fingerprint when adoption drops a staged frame
- Both adoption failure paths (registry full, lazy texture-buffer OOM) cleared slot.staged but kept last_push_fingerprint, so a producer re-pushing byte-identical pixels (a paused video's frame, album art) hit the push dedup gate — no stage, no wake, the frame was lost until the pixels changed; both paths now reset the fingerprint to 0, the same "no previous push" state claim and release use (frameFingerprint maps real hashes away from 0), so an identical retry stages and wakes again
- Push-side dedup is untouched: identical pushes between presents still short-circuit at the hash, and the OOM path's comment now states the honest retry contract (the producer's next push retries, not "the next adoption")
- Tests drive both drops with a synthetic producer — the OOM path through the frozen owned_allocator's FailingAllocator seam, the registry-full path by manufacturing the raced-release shape the branch guards — then re-push the same bytes and pin that the retry stages, wakes one coalesced frame, and adopts
* Range-check markup's signed-to-u64 id casts instead of trapping
- The surface and avatar image bindings cast the expression's i64 straight to u64 in both engines, so a signed model field (surface: i64 = -1) trapped safe builds at the @intCast; both seams now refuse negatives with the existing teaching messages (failVoid in the interpreter, the runtimeFail latch in the compiled engine), mirroring the tooltip-delay range guard
- Message-payload coercion gets the same guard against its payload's own integer bounds (minInt/maxInt, so signed payloads keep their negative range), and key conversion maps negative integer ids bijectively via @bitCast — keys are identity, so a -1 sentinel is a distinct key, never a trap and never a spurious failure
- Negative-binding tests cover surface and avatar through both engines, plus a positive control pinning the u64 id's ride into the widget's image_id
* Regenerate the docs wasm preview over the rebased base
- The committed artifact now bakes in main's CJK font, paste, and pinch work alongside the media surface.
* Refuse reserved media-surface ids before the image decode
- registerCanvasImageBytes now rejects ids with the reserved media-surface bit before invoking the platform codec, so callers get error.InvalidImageId instead of a codec error and never pay a decode for an unusable id
- Test registers PNG bytes under a bit-63 id and asserts the null platform's decode counter stays at zero
* State the honest surface-id range everywhere docs describe it
- A surface id is any nonzero value below the reserved media-surface texture bit (bit 63, refused at acquire): the producer recipe, the component page, the markup attribute docs plus regenerated vocab JSON, the native-ui skill, and the widget/schema comments now all say so instead of implying any nonzero u64
- Fix the producer recipe's binding example to {player_surface} — markup binding resolution is exact-name, and the model field is player_surface
|
||
|
Chris Tate
|
2c028094bb |
Registered CJK fonts render dense glyphs (#139)
* Size glyph outline budgets from real CJK faces and gate maxp at parse - Raise the outline budgets to 1024 points / 128 contours, sized from measured maxp maxima of production TrueType builds (Noto Sans JP/SC/TC/KR, Noto Serif JP, brush-style Yuji Mai; worst measured 738 points / 87 contours), so dense kanji ink as outlines instead of block fallbacks - Face.parse now refuses any face whose maxp declares maxima beyond the budgets (loud, registration-time), leaving the per-glyph checks as backstops for under-declaring fonts; declaredGlyphMaxima exposes a refused face's numbers for teaching callers - Derive the reference renderer's glyph path capacity from the parser budgets and prove both gate sides with in-test synthetic TrueType fixtures (dense rings, budget-edge composites, over- and under-declaring maxp) Co-authored-by: WhiteHades <44260523+WhiteHades@users.noreply.github.com> Co-authored-by: IFTC-XLKJ <151902522+IFTC-XLKJ@users.noreply.github.com> * Refuse over-budget faces at registration and admit full CJK font files - registerCanvasFont maps the parser's glyph-budget refusal to error.FontExceedsGlyphBudgets, and UiApp's fonts teaching names the face's declared maxima against the budgets, restoring "a registered id always resolves at render time" - Raise the per-font registration bound to 24 MiB (matched by the gpu-surface side-channel bound): measured Google Fonts TrueType builds run 9.6 MB (Noto Sans JP) to 17.8 MB (Noto Sans SC); memory stays fixed address space with pages touched only as fonts register - Cover the gate at the registry and UiApp seams with a maxp-patched fixture, plus a /tmp-guarded end-to-end test registering the real Noto Sans JP and outlining dense kanji (skips where the download is absent) Co-authored-by: WhiteHades <44260523+WhiteHades@users.noreply.github.com> Co-authored-by: IFTC-XLKJ <151902522+IFTC-XLKJ@users.noreply.github.com> * Allocate registered font bytes on demand instead of embedding a 192 MiB pool - Runtime.canvas_font_bytes (8 x 24 MiB inline after the CJK bound raise) becomes an exact-size heap copy from the new Options.allocator at registration; zero fonts = zero bytes, freed only by the new Runtime.deinit (registration is permanent, so ownership is one alloc and one free) - Measured on the docs wasm preview host (one Runtime per component tile, linear memory never overcommits): per-instance bytes 313.5 MB -> 121.5 MB (pre-branch base: 137.5 MB), linear memory with one active tile 528.9 MB -> 144.9 MB (base: 272.9 MB) - TestHarness routes font bytes through the leak-checked test allocator and deinits on destroy; a FailingAllocator test pins that a fresh runtime performs zero font-byte allocations until a registration happens, and that the first allocation is exactly the file's size * Gate flattened-composite maxima at parse so composite-heavy faces refuse at registration - Face.parse and GlyphMaxima/declaredGlyphMaxima/withinBudgets now read maxp.maxCompositePoints/maxCompositeContours (offsets 10/12): a face whose composites flatten past the path capacity was passing the simple-only gate and silently blocking at render, the exact failure the gate exists to prevent - Composite budgets equal the simple budgets (1024 points / 128 contours): a composite flattens through the same path sink and per-glyph capacity, so densest-renderable-glyph is one answer; measured ground truth (Geist 89/5, Geist Mono 104/10, Yuji Mai 198/5, Noto CJK 0/0) sits 5-12x below, and the reference glyph path capacity derives from max(simple, composite) maxima - Registration teachings (parseFailureReason and the UiApp fonts warn) name the composite numbers; tests cover over-budget composite declarations refused at parse and at the registry, an at-budget composite flattening denser than any simple glyph rendering within the derived capacity, and the bundled faces' pinned composite maxima * Deinit the embedded runtime when the UI host is destroyed - UiAppHost.destroy freed the host without returning the runtime's heap-owned font copies, leaking every registered font per host recreation cycle; MobileHostApp.destroy already deinits — the UI-host sibling now matches. * Give EmbeddedApp a public deinit so direct embedders can end the lifecycle - EmbeddedApp.deinit (idempotent) returns the embedded runtime's heap-owned registered-font bytes; the documented lifecycle now ends at deinit, not stop, and the docs show the defer embedded.deinit() idiom - MobileHostApp.destroy and UiAppHost.destroy route teardown through embedded.deinit — one lifecycle owner — so native_sdk_app_destroy reaches the same deinit through its host - Leak-checked create-register-destroy cycle tests through the Options.allocator seam cover the direct embedder, idempotence, and the C ABI destroy path * Derive the glyph raster budgets from the outline budgets the gate admits - vector.zig grows a GlyphRasterizer whose edge/crossing capacities are derived from the font gate's outline budgets (quads <= 1024+128, edges <= quads*16+128 = 18,560, crossings <= edges), lockstep-pinned against font_ttf's constants, so a truthfully-declared budget-maximal glyph never trips VectorPathTooComplex - Tolerance-exact flattening has no finite bound (nothing bounds text size), and even the generic 48-segment cap costs 1.06 MiB of edges, so glyph fills clamp at 16 segments per curve: binds only above ~128-px ems, error stays under em/512 (0.2%), goldens byte-identical - The reference renderer inks glyphs through a per-thread heap GlyphRasterizer (lazy_tls, ~508 KiB, only on threads that ink glyphs); zigzag adversarial tests prove a gate-admitted 1024-point contour rasterizes at the max raster size on both text paths instead of degrading to the block fallback * Freeze the ownership allocator at init so font bytes free through the identity that made them - Runtime captures Options.allocator into owned_allocator at initAt: options is public and mutable, so an embedder swapping options.allocator between registration and deinit split the alloc/free identity (silent wrong-allocator free); registration allocs, refusal-path errdefer frees, and the deinit frees now all resolve through the frozen field - The field is general (every runtime-lifetime heap ownership, not font-specific) so future on-demand owners share the same frozen identity - New test registers through a counting allocator, mutates options.allocator to a poisoned one, and deinits: counts balance on the original and the mutated allocator sees zero activity; existing tests that retargeted options.allocator post-init now re-freeze owned_allocator before anything is owned --------- Co-authored-by: WhiteHades <44260523+WhiteHades@users.noreply.github.com> Co-authored-by: IFTC-XLKJ <151902522+IFTC-XLKJ@users.noreply.github.com> |
||
|
Chris Tate
|
2027ff03b8 |
First-class trackpad pinch input for GPU-surface apps (#141)
* Add trackpad pinch input vocabulary, macOS host emission, and journal v5 - GpuSurfaceInputKind gains phase-explicit pinch_begin/pinch_change/pinch_end and GpuSurfaceInputEvent a scale field carrying the per-event magnification delta (NSEvent.magnification semantics: cumulative scale is the product of 1 + delta); Windows/GTK sources are staged follow-ups noted at the vocabulary. - The AppKit host implements magnifyWithEvent: with begin/changed mapping directly, cancelled folding into pinch_end (deltas are applied as they arrive, so there is no transient to roll back), and change deltas emitted uncoalesced because summing coalesced deltas would drift from the product. - Bump the session journal to v5: gpu-surface input records gain the scale field (a layout change a v4 reader would misparse) plus the pinch kind codes 12-14, with the round-trip test pinning both. Co-authored-by: jhodges10 <18431344+jhodges10@users.noreply.github.com> * Deliver pinch to app cores through the on_pinch/pinchMsg channel - Zig cores gain Options.on_pinch (the on_key shape): pinch is view-global, so the raw journaled gpu_surface_input pinch kinds surface as a phase-explicit PinchEvent with the change delta and view-local centroid, and the Msg dispatch replays from the same journaled event. - TS cores gain the pinchMsg(pinch) export: the wiring adapter maps the named begin/change/end phase alias by member name and widens the numbers, with the record shape validated at transpile time (NS1033) and mirrored in @native-sdk/core/events as PinchPhase/PinchEvent. Co-authored-by: jhodges10 <18431344+jhodges10@users.noreply.github.com> * Add the widget-pinch automation verb driving real pinch platform events - widget-pinch <view-label> <scale> [x y] synthesizes pinch_begin, one pinch_change carrying scale - 1 (the product of 1 + delta lands exactly on the commanded cumulative scale), and pinch_end at the given or view-center centroid. - Plain input synthesis per the widget-key discipline: every event journals as itself and replays through the same dispatch - pinch is not a widget verb, so no accessibility-action record. - Bump the automation protocol to v7 for the new verb string. Co-authored-by: jhodges10 <18431344+jhodges10@users.noreply.github.com> * Class the pinch record's fields as boundary floats in the transpiler - Magnification deltas are ~0.01..0.3 per event and the centroid is sub-point, so pinchMsg's parameter record fields are host values, never provable integers: without boundary marking, a core's pinch.scale === 0 comparison int-claimed the slot and every zoom product rounded to whole numbers. - frameMsg/keyMsg records keep their historical by-usage classing; the emitter test pins the f64 emission and the NS1033 shape refusal. Co-authored-by: jhodges10 <18431344+jhodges10@users.noreply.github.com> * Test pinch delivery end to end: both core tiers, the verb, and replay - ui_app_tests drives begin/change/change/end plus the widget-pinch verb into a Zig core, pinning product-of-deltas cumulative scale (two +25% steps land on 1.5625, never a sum's 1.45), centroid delivery, default view-center aim, non-pinch isolation, and the non-positive-scale refusal. - The ts-core markup fixture exports pinchMsg (phase-gated on change) and the e2e drives raw events plus the automation verb through the transpiled core. - The record/replay reference session pinches once raw and once through the verb; replay re-derives the identical binary-exact zoom and fingerprints from the journaled scale fields alone. Co-authored-by: jhodges10 <18431344+jhodges10@users.noreply.github.com> * Document the pinch channel, the widget-pinch verb, and the journal bump - native-ui gains a Trackpad pinch section (both tiers' channel shapes, product-of-deltas semantics, centroid, staged platforms); the automation/cli pages and the automation skill list widget-pinch. - Changelog fragment covers the channel, the verb (protocol v7), and journal v5. Co-authored-by: jhodges10 <18431344+jhodges10@users.noreply.github.com> * Pin the macOS pinch ABI conversion - The kind codes 12-14 map to the pinch phases and the ABI event's scale field carries the magnification delta with the converted centroid on x/y — the headless half of the magnifyWithEvent: path. Co-authored-by: jhodges10 <18431344+jhodges10@users.noreply.github.com> * Forward the terminal pinch magnification instead of discarding it - AppKit documents every magnifyWithEvent: as carrying the delta since the previous event, the Ended/Cancelled one included; the terminal branch now emits a nonzero delta as one last PINCH_CHANGE before PINCH_END so the cumulative product of (1 + delta) matches what the OS delivered - Cancelled deliberately shares the path: pinch applies deltas incrementally with no rollback, so the honest stream reports every measured delta, then ends - Pin the ordering in build.zig's host-source checks and fold a terminal-delta Ended plus a zero-delta Ended into the on_pinch product test * Name the pinch x/y for what it is: the pointer anchor - AppKit reports gesture events at locationInWindow — the pointer location, never a midpoint between the fingers (raw touch positions are trackpad-normalized and have no view-space meaning) — so the API was right and the word "centroid" was wrong - Redocument x/y as the pointer anchor (zoom-at-cursor anchoring) across the platform vocabulary, the app-channel docs in both tiers, the automation verb's usage, the docs pages, the changelog fragment, and test names; the word has zero survivors * Carry the source identity on the pinch channel - PinchEvent gains window_id/label in Zig and windowId/label in TypeScript (the on_frame GpuFrame identity shape): x/y are view-local, so a coordinate without its view is not a position, and multi-window apps could not tell pinches apart - handlePinch forwards the identity the journaled platform event already carries; the TS adapter, NS1033 shape validation, and the emitted-record pins extend to the six-field contract, with the wholesale boundary classing covering the new numeric field - Pin distinguishable pinches in a two-window/two-view Zig fixture and mirror windowId plus a label match through the transpiled markup core end to end * Normalize AppKit's additive magnification into multiplicative pinch deltas - NSEvent.magnification is additive (Apple: gesture total = 1 + sum), so forwarding raw chunks made the product of (1 + delta) depend on event chunking; the macOS host now tracks the gesture's additive sum in f64 and emits per-event ratios, so the product equals Apple's total no matter how the driver sliced the gesture — the app rule is unchanged (zoom *= 1 + scale, memoryless). - A sum crossing -1 (a pinch cannot invert through zero scale) clamps at a floor of 2^-10, keeping every emitted factor positive; the arithmetic lives in tiny pure functions pinned by a file-contains step and mirrored runnably in a Zig test (chunking invariance, terminal-delta participation, round-trip to unity, clamp). - Product pins across ui_app/markup-e2e/session tests update to the normalized truths (1.5/1.75 instead of 1.5625/1.953125), and the widget-pinch docs now say plainly that <scale> is the gesture's final multiplicative zoom — the verb synthesizes events downstream of AppKit, untouched by the normalization. * Forward raw AppKit magnification as the multiplicative pinch delta - Revert the running-sum additive normalization of NSEvent.magnification: WebKit (ViewGestureControllerMac.mm: m_magnification += m_magnification * scaleWithResistance) and Chromium (pinch_update.scale = magnification + 1.0) both compound raw magnification multiplicatively, and Apple's own Event Handling Guide example multiplies — only the API reference's loose prose says "add". Raw magnification IS the multiplicative per-event delta; the doctrine comment at magnifyWithEvent: carries the receipts, and the test-appkit-pinch-magnification-doctrine step pins the comment, the raw forwarding, and the floor so a sum-based transformation cannot come back quietly. - The one guard that stays is per-event: a single magnification at or below -1 (a factor <= 0 on the wire — a zoom inverted through zero scale, physically impossible) clamps to -1 + 2^-10, keeping every emitted factor positive; the terminal-delta forwarding and synthesized-begin structure are unchanged. - Product pins return to the raw-forwarding truths (ui_app 1.5625/1.953125 and "Zoom 1.95", markup-e2e exact 1.5625/3.125, session 1.40625), the Zig normalization mirror test is deleted with the machinery it mirrored, and every contract/doc surface now states the engine convention instead of host-side normalization. * Refuse widget-pinch scales whose f32 delta rounds to a zero factor - The parser's finite-and-positive guard is not enough on the f32 wire: any scale at or below 2^-25 (e.g. 1e-20) rounds `scale - 1` to exactly -1, dispatching a pinch_change with factor 1 + delta = 0 — a zoom through zero scale no gesture can perform and no downstream product can recover from. - The dispatch now validates the computed wire delta and refuses with error.PinchScaleBelowWireMinimum before anything dispatches (no partial gesture reaches the journal); the minimum accepted scale — the smallest f32 above 2^-25, ~2.9802326e-8 — is named at the guard. - Tests pin both sides: `widget-pinch <view> 1e-20` is refused with the named error and moves no model state, and the smallest accepted scale round-trips a positive factor (delta -1 + 2^-24, model product exactly 0x1.8p-25). * Class export-list wiring entries at the host boundary like the modifier - Integer inference keyed its host-ABI marking (number params of the entry's exported functions, and pinchMsg's wholesale record classing) on the inline export modifier only, so the first-class list spelling — `function pinchMsg(...) {...}` plus `export { pinchMsg };` — passed validation and wired the channel but skipped the marking: `pinch.scale === 0` int-claimed the slot to i64, every real magnification delta rounded to 0, and the adapter's zero gate silently dropped the events. The seam now reuses exportListBindings (the same export-list truth the checker, emitter, and model-helper surfaces already resolve by): an un-renamed entry-module list binding marks exactly like the modifier, and renamed bindings stay out on purpose — renamed wiring names never reach inference (NS1014/NS1047 fence them first) and a renamed ordinary function keeps its historical classing. - Family audit: pinchMsg was the only wiring entry observably broken (it force-classes its record's fields; frameMsg/keyMsg/commandMsg carry no number param slots and keep by-usage field classing, appearanceMsg/chromeMsg/envMsgs are consts the emitter already reads list-aware, and model helpers were already list-aware in types.ts) — but the same hole covered every export-list function's number params, where a `=== 0` comparison int-claimed an i64 signature that would truncate host f64 arguments; the one seam fixes both. - Tests pin the list spelling end to end: emitter mirrors of the pinch boundary-float classing and the frameMsg channel, an f64 host-boundary signature pin, an NS1014 pin that a renamed list entry still cannot bind a wiring name, a run-fidelity case whose 0.25 probe an i64 signature cannot even accept, and the markup e2e fixture's pinchMsg now exports by list so the native battery proves 0.25 deltas survive to the 1.5625 zoom product. --------- Co-authored-by: jhodges10 <18431344+jhodges10@users.noreply.github.com> |