feat(gpui): gpui render backend and the macos-app target with native text layout - #293

tools/bench-desktop.ts measures the pocket note on the gpui host against
byte-identical web editors shelled by Tauri v2 and Electron: cold start to
each app's own first-painted-frame READY report, hands-off idle and a
120 chars/s typing storm through each stack's real edit path, ps process-
tree medians (WebKit XPC helpers attributed by spawn-delta — Tauri's
WebContent/GPU processes are launchd children), footprint for physical
memory. The gpui renderer gains shaped-line and measured-width caches so a
keystroke repaint reshapes one line, not the document. docs/BACKENDS.md
names the backend split; .github/workflows/macos.yml is the first macOS CI
lane (core tests + clippy + host build).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…nch fixtures

Final measured run (M3 Max, methodology + fairness caveats in the report):
the pocket note on the gpui host takes 1 process / 84 MB idle RSS / 145 ms
cold start / 10 MB disk against Tauri v2 (4 procs, 192 MB, 391 ms) and
Electron (5 procs, 382 MB, 328 ms, 242 MB). Storm completion is now
verified (STORM-DONE), the Tauri window is explicitly focused (an
unfocused WKWebView throttles timers and reads fiction), and the
footprint column is dropped from the table — Electron's hardened helpers
refuse task inspection, so RSS is the uniform metric.

The benchmark fixtures' cargo target/ was packing into the npm tarball
through the wholesale "tools" files entry (the v0.8.0 E415 failure mode —
the tests/npm-package.test.ts tripwire caught it): tools/bench-desktop is
now a governed negation in the files map. Tauri codegen (gen/) untracked;
gpui backend passes clippy -D warnings for the macOS CI lane.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The caret was animate-pulse — a continuous opacity sine that changes the
DrawList every tick, so an idle editor repainted at 60 fps on every host
(88% of ticks; ~3.6% CPU on both the gpui and wgpu hosts). Replace it with
a browser-style square wave (app-local pocket.config.ts theme: 500 ms on /
500 ms off, hard edges via a same-frame twin keyframe) plus the browser
input discipline: the caret is SOLID while typing or moving and resumes
blinking from its ON phase after a 0.6 s rest (a <Show> swap remounts the
animated node, restarting the baked timeline at frame 0).

The square wave's constant segments keep the DrawList byte-stable between
edges, so every demand-rendering host skips them: idle-in-edit repaints
drop from 2115/2400 ticks to 83/2400 (~2 fps, exactly the edge count), CPU
from 3.6% to 0.95% on the gpui host and 3.65% to 0.7% on the wgpu widget
host. Same measurement protocol as docs/bench.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Double click selects the word under the pointer in BOTH modes, browser
semantics throughout: whitespace and punctuation select as runs, a click
just past a word's right half still selects the word (caretFromX rounds to
the nearest boundary), CJK and surrogate pairs ride the non-ASCII word
class, code blocks stay atomic in preview (rowSelSpan granularity), and a
drag after the double click extends from the word start. Detection rides
the virtual clock (0.4 s / 3 px on the svc press stream) so replays stay
deterministic; wordRangeAt is regex-free QuickJS-portable math with unit
coverage.

The sample doc's 'same bytes as the PSP build' line predates the backend
split — it now names the real contract (same core, same DrawList; wgpu
paints baked atlases, gpui paints native text) and the two launch
commands, and the charset-anchor comment drops the stale tofu caveat
(runtime glyph baking and native shaping both exist now).

Verified end-to-end on the gpui host: scripted double click on 'Pocket' +
typing X autosaves '# X Note'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… svc-independent capabilities

Three review blockers on #293, each fixed at the contract level:

1. TEXT_RUN carried a 32-bit content hash while the run string lived in a
   side table — colliding texts could leave identical word streams with
   different pixels, silently defeating demand-render hashes and damage
   word-diffs, and breaking the "DrawList is the complete Vec<u32>"
   contract. The op now packs the run string's UTF-8 bytes INTO the words
   (8 header words + payload; slot/align/lineHeight all in-stream) and the
   side table is gone: snapshots, hashes and diffs are exact by
   construction, not probabilistic. All interpreters skip the variable
   length; the gpui backend decodes from the stream.

2. Measurement and paint could disagree on rotated/scaled text (native-
   sized box, baked glyphs). The provider is now chosen ONCE at layout
   build (native iff a measurer is installed, tracking is 0 and the
   subtree declares no non-translation transform) and RECORDED on the node
   (Node::text_native); paint follows the record unconditionally, and the
   style-dirty restyle path can only flip it for a node-local tracking
   change. Rotated/transformed text takes the baked pair on BOTH sides —
   pinned by tests including a transformed-ancestor case and a
   paint-only-transform consistency case.

3. macos-app capabilities were conflated with the note's svc protocol.
   display.viewport.live is now host-generic: every dynamic app receives
   the framework's __pocketResizeViewport hook inside the tick transaction
   (the hero-resize regression); --editor derives from the app being the
   note companion, never from input.text; and the registry comment states
   the delivery paths plainly — buttons + live viewport host-generic,
   pointer/text/IME/clipboard via the companion adapter today (the
   macos-widget stock-host bar), with the host-generic pointer feed named
   as follow-up (the touch packing's 9-bit axes cannot carry a 4096-px
   window, so it needs new framework surface).

Rot: hosts/macos passes clippy -D warnings and CI now runs it; the macOS
workflow path filter covers contracts/spec, tools/macos.ts and apps/note;
tools/macos.ts is negated out of the npm tarball (its build inputs are
git-only — a published entry point that cannot run).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The Tauri/Electron comparison apps, the runner and the results move to a
stacked PR so the backend/host/contract surface reviews on its own
boundary. The npm files negation stays — it guards the re-add.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…adding

The POCKET NOTE label is widget identity — a real window already titles
itself in the OS titlebar, so the wordmark hides with the rest of the
widget chrome (the eye/pencil toggle and menu stay). The content column's
minimum side padding rises 22 -> 28 px, the floor narrow windows pin to,
so text stops hugging the window edge; wide windows keep the centered
560 px column.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The POCKET NOTE wordmark hides off macos-widget now, and the sim boot is
not a widget — assert the sample document instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… truthful svcOpen

1. The provider divergence check compared unlike predicates: layout gated
   on declared transforms down the path, the draw walk on the composed
   matrix being a translation — a parent scale canceled by a child's
   inverse satisfied one and not the other, oscillating layout.dirty into
   a permanent relayout loop, and every transform transition still painted
   one stale frame. Both sides now accumulate ONE shared predicate
   (Resolved::declares_transform) down identical recursions, so divergence
   can only mean a transform VALUE changed since the last relayout — and
   Ui::draw re-decides and REPAINTS before returning, so every frame that
   leaves draw() is provider-correct. Pinned by
   canceling_transforms_do_not_oscillate_the_provider (draws must not
   schedule spurious relayouts) and the zero-stale-frame rewrite of the
   transform enter/exit test.

2. svcOpen answered true for ANY service (allowlist default None), so the
   note believed its companion was live even when the host was launched
   without --editor — edit/pointer UI over a channel nobody feeds. The
   host now sets the allowlist before mount: exactly "note" with the
   adapter on, empty otherwise. Verified both ways: without --editor the
   scripted pencil-click + typing produces NO autosave (truthfully
   read-only); the --proof acceptance still passes with it.

Minors: the macOS lane's path filter covers framework/compiler, the fonts,
and the test files it executes; font-bake gains mono regression assertions
(slot table stability + the monospace property itself: uniform baked
advances where the proportional face differs); tools/macos.ts ships again
with a git-checkout guard (the note.ts precedent — script and tool now
agree) instead of the contradictory script-without-tool metadata;
BACKENDS.md points at #294 for the benchmark; stale styleHash/bench
comments in the host corrected; the vendored license loses its trailing
whitespace.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>