Tao: NativeView/TextureView headful monkeys and the embed bugs they caught

[kdroidFilter]

Summary

New stage-2 headful cases (decorated-window-tao), run on X11 (Xvfb + openbox, AWT Robot) and on a native Wayland session:

• NativeView monkey: a BasicTextField, a Compose button, a real native text widget embedded through NativeView (GtkEntry / NSTextField / EDIT, handed out by new nativeDiag* bridge entry points) and a Compose button drawn over the embed. Alternating click storms, a right click on the embed, a resize storm (discrete, burst, animated, interactive corner drag) and a 150-action random walk, each with an in-process driver and a real-pointer Robot driver. Asserts Compose keeps counting clicks, a single keyboard owner, letters and caret keys landing where the focus says, a stable I-beam over the field, the embed on its Compose slot, no leaked probe, a live main dispatcher.
• TextureView monkey: four TextureViews fed by the platform test producers from their own threads plus an in-process renderer on the scene's Skia context (rememberTaoGpuRenderContext); mount/unmount/swap/close-under-view/hide-show/minimize/DPI/frame bursts.
• Shared MonkeySupport (dispatcher watchdog, journal echoed to stderr, seed), PointerDrivers, NativeProbe; -Dnucleus.tao.headful.monkeyScript replays a journal; the suite filter accepts a|b.

Bugs the monkeys found, all fixed in this PR:

• NativeView disposed the platform view before detaching it (SIGSEGV in nativeDetach); nativeViewHost() returned a new object per call (detach/attach churn on every recomposition of the window root); a late setFrame after detach touched the widget.

• Linux: a right click forwarded to an embed lost its release to the widget's context-menu grab and every later Compose click was dead. The host records buttons forwarded to an embed, heals from GDK's live button mask on the next motion and releases phantoms before a new press.

• Linux: printable keys never reached a focused GTK embed (toplevel IME + Stop), and arrows moved GTK focus into the embed (move-focus binding). Tao propagates keys to a foreign focus widget and stops the event once Compose consumed it.

• Linux: GTK's map-time default focus landed on the embed (two carets). Focus sink, keyboard reclaim on a Compose-kept press, clearFocus on a forwarded press.

• Linux: the embed trailed its slot through a resize; nativeSetFrame now relayouts the overlay synchronously (0 px behind measured, was 12–40 px).

• Linux: SIGSEGV in Skia after a Wayland hide/show for rememberTaoGpuRenderContext consumers — the old GL host bound the new EGL context for a closed DirectContext.

• All platforms: native popup layer windows leaked when an owner window closed during a Dialog's disappearance animation, leaving an invisible click-eating window. Hosts now close surviving layers on detach.

• Linux/Wayland: the embed peeled off the Compose hole by a frame through a resize (a sub-surface position is parent state, applied on GTK's commit, one paint after Compose swapped its desync buffer). During a resize burst with an embed the content sub-surface runs in set_sync mode and a toplevel draw is queued after each swap, so hole and embed land in the same commit.

• Linux/Wayland: nativeSetContentOffset committed GTK's toplevel surface out of band; that races GDK's end_paint/after_paint buffer bookkeeping and aborts the process in cairo (reproduced by the texture monkey after minimize/restore cycles). It now queues a GTK draw instead.

Windows, once the monkeys were run there (the native probe hands out a plain EDIT control):

• A press forwarded to an embedded child HWND is replayed to the owner HWND a moment later — forwarding moves Win32 focus and the queue hands the message to the window that owns the pixels. Dispatched twice, Compose held a press with no release and every later click was dead. The host recognises the replay of the overlay event it just handled and drops it, matched on button, position and recency.
• The child captures the mouse on that press and keeps every later message, so neither the scene nor its blending overlay sees the pointer again. The capture is handed straight back, and a release the child swallowed is healed from Win32's own button state.
• Keys kept going to an embed clicked into earlier while Compose showed a focused text field. A press Compose keeps takes Win32 focus back (the macOS makeFirstResponder equivalent), and a press handed to the embed clears the Compose focus.
• A child's handler may run a modal loop — an EDIT opens its context menu from WM_RBUTTONUP and does not return until dismissed. Everything but the press is now posted rather than sent, and the Tao loop drains the main dispatcher on a wake: Windows derives MainEventsCleared from a WM_PAINT that a modal loop never generates, so the app's coroutines used to stop for as long as the menu was up.
• The overlay input replay repeated whatever message it saw last regardless of what the caller was forwarding; it only replays the matching one now.
• The scene placed a click where the last move it saw left the pointer. Tao reports a button without a position and drops a WM_MOUSEMOVE whose coordinate equals the last one it saw, while every move over an embed goes to the blending overlay, which Tao knows nothing about — a pointer that left the embed and came back to a point Tao had seen before got no move at all, so the click landed on the embed the user had just left, and every click after it was dead. When the position came from the overlay the host asks Win32 where the pointer is and walks the scene there first.
• A native modal loop on the loop thread stops Tao producing MainEventsCleared, which is where the Windows redraws asked for during a batch were served: the window froze for as long as an embedded EDIT's context menu was up, with no frames, no recomposition, and anything queued behind a frame never running. The wake that drains the dispatcher inside such a loop now serves those redraws too.
• A press handed to an embed cleared the Compose focus through the frame queue, so when that press was the one opening the embed's menu the clear waited for a frame that could not come and the field kept its caret beside the embed's. It goes through the main dispatcher instead.
• Handing an event to a child HWND runs its handler on this thread, and anything it pumps swallows the redraw the window had pending; the coalescing latch then suppressed every later request. Reset after a forwarded dispatch, like the other nested-pump callers.
• Closing a native popup layer is idempotent now: the detach sweep above closes surviving layers itself and Compose then disposes the same layer as the composition unwinds, which released the native panel twice and took the process down.

macOS (real desktop, both drivers):

• NSTextField.mouseDown: / NSTextView.mouseDown: run trackMouse:untilMouseUp: (and a right click may pop an NSMenu) on the Tao thread. A synthetic press never returned, and the suite watchdog halted after 900s on the first NativeView case. Tracking and menu selectors are skipped; a press only makeFirstResponders. Compose focus is cleared on a forwarded press, a Compose-kept press takes first-responder back, synthetic keys go to the embed when it holds the keyboard, and a late setFrame after detach is refused.
• nucleusIOSurfaceTextureSource now retains the IOSurface. Closing the producer under a live TextureView used to free the surface; remounting then SIGSEGV'd in IOSurfaceGetPixelFormat.

Test plan

• native view and texture view monkey filters green on X11 (Robot included) and on Wayland
• full X11 headful suite: 235 run / 53 skipped; remaining failures are the #582 clipboard cases (wl-copy on the box) and two known WM-placement flakes that pass 3/3 in isolation
• ktlintCheck, detekt, apiCheck, unit tests green
• Windows (real desktop, both drivers): the native view and texture view monkey filters green, 13 run / 0 failed, and both monkeys green over four seeds (7, 999, 12345, 20260903)
• full Windows headful suite: 234 run / 54 skipped / 3 failed — one tab-drag WM flake that passes in isolation, and the two dialog appearance disappearance cases, which fail the same way on this branch before these fixes (hide gone: in-scene=null native=null, pre-existing on Windows)
• ktlintCheck, detekt, apiCheck, unit tests green on Windows
• macOS (real desktop, both drivers): 12 native view cases green (synthetic + robot storms, right click, resize, both 150-action monkeys) and the 200-action texture view monkey