android: one window per host, GL fallback, backend pinning and IME fixes

[tuyc]

Fixes and features found while embedding gpui-mobile in a production Android app (an AI chat page hosted in a regular Activity, stacked any number of times: page → AI → page → AI). Four commits, one per problem; each builds on its own.

1. One GPUI window per host, not one per process (b9faada)

Platform::open_window always answered with the primary window, so every host after the first rendered into the first host's surface. Hosts are now keyed by a HostId: each gets its own AndroidWindow, kept across that host's surface teardowns so a returning Activity finds its own window. The window is named via a pending slot before GPUI's open_window runs; on_open_window receives the HostId; Resumed/Paused act on their own host only (stacking Activities interleaves A.onPause → B.onResume → A.onStop, so a global resume woke A back up).

2. Load on API < 29 (d1d67bd)

ndk_sys::android_get_device_api_level() only exists in libc from API 29, and Rust has no __INTRODUCED_IN guard, so the .so failed to dlopen on Android 8.x (reproduced on an OPPO R11s). Read ro.build.version.sdk instead. Verified by diffing the .so's strong undefined symbols against the NDK API 26 stubs: all 231 now resolve.

3. Fall back to GL when Vulkan cannot build our pipelines (e870c46)

wgpu picks an adapter by creating a device and configuring a surface, which says nothing about shader compilation. An Adreno 512 (Android 8.1) passes that probe, then loses the device while WgpuRenderer::new builds its pipelines — every frame after that was black, and re-attaching after Home panicked. A GL without unaligned buffer bindings rejects path_rasterization, which reached wgpu's default error handler and panicked the render thread.

• Fresh contexts are built on an explicit backend set and the first renderer is created inside Validation/OutOfMemory/Internal error scopes; any error or device loss drops the context and tries GL next, and if GL fails too open_window fails cleanly.
• host::set_gpu_backend(GpuBackend::Gl) lets a host skip Vulkan once it knows the device needs GL (R11s: 689 ms → 68 ms); host::on_gpu_outcome reports Vulkan / Gl / GlAfterVulkanFailed, and Failed once per host whose window cannot be opened or re-attached (re-attach failures used to only log, leaving a black page).
• Failed hosts are remembered until destroyed and their later surfaces ignored (surfaceChanged follows surfaceCreated, so every failure ran twice).
• Stop forcing Mailbox when replacing a surface: replace_surface doesn't check the caps (unlike WgpuRenderer::new) and GL only offers Fifo.

4. Hide only the keyboard on back (91ca188)

Back used to send IME event 4, which drain() turns into Escape — hiding the keyboard over a search overlay also closed it and dropped the query. Back now sends a new event 5: composition finished, keyboard remembered, no Escape. GPUI only requests the keyboard on focus gain and the platform cannot blur, so a tap on the focused field's row (judged by its caret) brings the keyboard back, as on a native EditText. Event 4 (IME "done") is unchanged; GpuiInputActivity sends 5 on back.

Compatibility

• Android-only code paths; iOS and desktop are untouched.
• on_open_window now takes Fn(HostId, &mut App), and surface_created / surface_destroyed / resumed / paused take a HostId — hosts using android::host need a one-line change.
• Hosts with their own IME proxy keep working: event 5 is new and optional.

Testing

• Rebased on main (gpui-pre 0.3.7). Locally: cargo check --all-targets, cargo test --lib (46 passed), cargo fmt --all -- --check, cargo check --target aarch64-apple-ios / aarch64-apple-ios-sim, and Android aarch64 checks of the crate and the example. Each of the four commits builds for Android and passes cargo fmt --check on its own.
• On devices, through the host app: OPPO R11s (Android 8.1, Adreno 512) — Vulkan fails, GL is used, the chat renders, Home/return cycles and new pages render; second launch goes straight to GL. Emulator (API 35/36): multi-window isolation, back/keyboard sequence on the history search, forced GL failure reported once.

About the iOS CI failures

Not from this branch. Cargo.lock is not tracked, so CI resolves libc 0.2.190 (released 2026-10-02), whose _dyld_* functions no longer resolve for aarch64-apple-ios with backtrace 0.3.76. A clean main fails the same way with libc 0.2.190 and passes with 0.2.189; main's last green run was 2026-09-29, before that release.

🤖 Generated with Claude Code