Development checks run on Linux x86_64. They establish behavior of the tested builds; they do not establish macOS runtime correctness, hardware GPU performance, production readiness, or minimum possible resource usage.
The current integrated workspace run passes 600 tests, with three tests ignored by the ordinary suite: opt-in independent-device GPU stress, native clipboard shutdown, and native host suspension/recreation (the two native tests run separately on X11). Coverage includes reactive collections, retained component ownership, constrained and absolute layout, fluent styles, editors and controls, ordinary/virtual scrolling, owned modal/popover/menu portals, reentrant focus and disposal, lexical providers/slots, tasks, native accessibility-tree consumers, software differential rendering, surface recovery and GPU pixel/resource tests. All 31 documentation examples, formatting and strict workspace Clippy pass. The workspace also cross-checks for macOS ARM64; that is not native runtime validation. Rerun the complete commands after integration:
cargo test --workspace --all-targets --locked
cargo test --workspace --doc --locked
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo fmt --all -- --checkGPU tests use an actual Vulkan adapter here, implemented by Mesa llvmpipe on the CPU. They check premultiplied color, damage, DPI, shaped text, rounded geometry, images, blur, bounded caches, isolated group opacity, nested invalidation, fractional movement, texture reuse and teardown. They fail if an adapter is unavailable. The 1,000-frame streaming stress test checks bounded caches and reused vertex storage.
The software differential tests compare incremental output against a cleared full redraw across 1,550 deterministic mutation frames, including fractional bounds, alpha, nested clipping, text, layout, moves, node reuse and filter toggles/removal. These caught a fractional damage boundary bug. Unit tests also guard the separate layout preparation path used by input, which must preserve damage for the next renderer frame.
Surface acquisition uses the same bounded recovery policy exercised by injected Lost, Outdated, Timeout, Occluded, recreation-error and validation-error tests. Desktop presentation retains skipped frames, retries timeouts after 16/32/64 ms without rerendering, then sleeps until new damage or exposure. Occlusion waits for visibility. Focus lifecycle tests cover repeated deactivation, removed/disabled targets, consumed restoration state and canceled pointer presses. These deterministic tests do not substitute for native OS suspension or real driver surface-loss testing.
Native examples run under Xvfb with Openbox, using llvmpipe Vulkan:
- The new declarative
componentsexample passes actual native +, =, and done clicks, yielding count3, titlestableand done999; screenshot. No application-side scene parent IDs are needed. - The widget gallery passes pointer activation, Unicode model rendering, typed text, Ctrl+A selection, clipboard copy/paste between fields, Tab focus, native resizing and timed close.
scripts/desktop_smoke.pyverifies final model/semantic values rather than only checking that a window opened. - The multi-window smoke verifies independent child/grandchild lifetime, a rejected first close request, an accepted second request, exactly-once close cleanup, and cancellation of a pending window before its builder executes.
- The workbench passes virtual-row selection, note editing/autosave across selection changes, menu opening/dismissal, modal confirmation and viewport resizing. See workbench and dialog. Its draft storage is session-only memory.
- GPUI, QuickGUI and zgui render the same frozen deterministic workload using their actual pinned frameworks. Geometry/content/colors match; native text rasterization/baseline differences remain. See the comparison protocol and raw results.
To rerun on an existing X11 test display with a window manager:
cargo build -p zgui-desktop --examples --locked
DISPLAY=:96 python3 scripts/desktop_smoke.py target/debug/examples/gallery
DISPLAY=:96 target/debug/examples/windows --smoke-testThe CI configuration builds/checks/tests on Linux and macOS, and includes separate Linux Vulkan/native-smoke and macOS Metal/native-window jobs. The macOS job requires GPU readback tests and two bounded component-window lifecycle runs; it preserves logs even on failure. The portable window harness passes locally on X11 (idle: zero ticks/17 mounted rows; combined: 119 ticks/19 rows over two seconds), which does not validate AppKit or Metal. Its logs and exact harness are retained. Configuring CI is not evidence that its remote jobs have run. This workspace has no remote CI results.
Recorded native runs use scripts/platform_smoke.py, which creates and cleans up its own Xvfb/Openbox and Weston instances. The result inventory and its adjacent screenshots/native Wayland logs are retained in the repository:
| Platform/backend | Evidence | Remaining limits |
|---|---|---|
| Linux X11, forced scale 1.5 | 1350×1140 initial physical surface; pointer activation, text entry, selection, cross-field clipboard, Tab focus, resize to 1500×1200 with logical viewport 1000×800, timed close | Forced initial scale does not test moving between monitors |
| Linux X11, forced scale 2 | 1800×1520 initial physical surface; same input checks; resize to 2000×1600 with logical viewport 1000×800 | Same monitor-transition limit |
| Linux Wayland, headless Weston/pixman | Captured actual gallery surface, semantic snapshot, timed close, multi-window survival/close-policy/exactly-once cleanup | This historical headless run had no input seat; see the newer nested-seat input run below |
| macOS ARM64 target | cargo check --workspace --all-targets --target aarch64-apple-darwin --locked passes from Linux |
Type checking only: no native linking, execution, Metal or AppKit interaction evidence |
All native rendering above uses llvmpipe, not a hardware GPU. Reproduce the isolated runs with:
cargo build -p zgui-desktop --examples --locked
python3 scripts/platform_smoke.py target/debug/examples/gallery \
--windows target/debug/examples/windows --output /tmp/zgui-platform-validationThe script requires Xvfb, Openbox, xdotool, Weston, weston-screenshooter and Python Pillow. It writes screenshots, compositor logs and results.json; the Wayland screenshot check rejects an absent gallery surface. X11 checks assert actual native window dimensions and the model's final logical viewport, so merely issuing a resize command cannot pass validation.
Real macOS windows, Metal presentation, native macOS clipboard/IME/accessibility interaction, Wayland/macOS transparent-window composition and hardware-GPU throughput/energy have not been validated here. Native X11 alpha composition now passes under the owned picom setup recorded below. A private live Linux AT-SPI client now validates text, actions, state changes and accessibility reactivation. Orca end-user usability remains unvalidated; bus-client checks do not establish the complete screen-reader experience. Native IBus/libpinyin composition, cancellation, focus changes and candidate placement now pass on X11; Wayland and macOS IME services remain unvalidated.
Use a real display and equivalent hardware renderer configurations for performance conclusions. In llvmpipe measurements, process CPU includes CPU execution of GPU shaders and driver allocations can dominate RSS. Keep these results distinct from hardware-backed measurements and from core microbenchmarks.
The surface/focus lifecycle changes also pass a fresh full native smoke run: X11 at 1.5× and 2× and Wayland presentation/multiwindow lifecycle. Its separate result inventory and screenshots preserve the earlier platform evidence. That historical Wayland run had no input seat; the newer nested-seat run below covers input separately.
The declarative form example passes native X11 pointer focus, selection replacement, cross-editor clipboard, Tab focus, multiline entry, disabled editing and reactive/native resize via scripts/form_smoke.py. Its model report and screenshot are retained. GPU editor tests compare incremental and full frames after font changes, selection, text replacement and shrink/grow cycles; they also check glyph/caret colors and scroll restoration.
The public component virtual list has bounded-work tests on 100,000 rows, keyed state/index retention, resize and count clamping, constructor failure cleanup, wheel chaining and zero-layout scrolling within the same range. Numeric tests cover extreme counts and finite output geometry; observer tests cover reentrant mounting and removal during size notification. GPU tests verify padded viewport clipping and incremental/full equality across large scroll offsets and allocation changes.
The component workload native debug smoke runs all four modes successfully and visually verifies +, = and done controls. Reports and screenshot are preserved. Debug llvmpipe delivered 179 scroll ticks and 57–59 streaming ticks in three seconds; this is correctness evidence, not release performance evidence. Existing benchmark numbers still describe the earlier direct-scene adapter.
A fresh normalized public-component release comparison completed all 24 runs. Its 3,395 raw samples, 70-file source archive and frozen binary hashes were audited. Active runs delivered 594–599 updates per ten seconds; all zgui active runs delivered 599. The series shows lower sampled active CPU for zgui than both references on llvmpipe, while GPUI has lower RSS. Native screenshots of the same seeded workload were inspected. These are software-GPU measurements, not hardware or macOS performance evidence.
Dynamic native window controls pass title, client resize, minimization/restoration, maximization and visibility checks on X11/Openbox; external state observations supplement the example's viewport assertions. Pending/suspended request-state unit tests do not replace native OS suspension validation. Five allocation-feedback regressions cover oscillation, growth, reentrant preparation, panic cleanup and recovery; fallible native frame/input preparation reports errors rather than hanging.
A same-binary backend-initialization ablation found approximately 22 MiB less idle RSS and 49 fewer threads with Vulkan-only than Vulkan-plus-GL initialization on llvmpipe. The default now enables primary backends and honors wgpu environment overrides. This is separate from the earlier frozen comparison and does not update its active-workload CPU/RSS numbers.
The primary-backend build passes a fresh native X11 1.5×/2× input/resize smoke and Wayland presentation/multiwindow smoke; artifacts preserve those runs. That historical Wayland run used a headless compositor without an input seat.
Rendering now stops before layout preparation/scene flushing for native-confirmed hidden, minimized, occluded or zero-sized surfaces. Unit tests preserve queued damage, cancel retry deadlines and prevent redraw requests from overriding native occlusion. The hidden-update native regression verifies unmapped X11 states, 40 model updates and 42,000 expected latest-state pixels after both show and restore. A 100,000-node-replacement core regression bounds stale dirty generations without any frame flush, preventing hidden virtual-list churn from growing the queue indefinitely. X11 minimized-property roundtrips are skipped for focused and already-hidden windows.
Keyed constructor recovery regressions cover both public components and low-level scopes: a late failure after an earlier new child has mounted releases all staged subscriptions/resources, preserves the original child order/identity/local state and permits successful retry. The complete workspace passes 214 tests, 15 doctests, strict Clippy, formatting and macOS ARM64 all-target cross-check after this change.
Declarative checkboxes share fluent styles and inherited typography with other components, including indicators that expand for large fonts. Four component regressions cover input, model/semantics synchronization, disabled state styles, cleanup and sizing. An AccessKit consumer regression verifies checked-state updates, disabled activation rejection and unmount cleanup. The native checkbox example passes label clicks, Space activation, disabled behavior and external writes under an owned Xvfb window; results and screenshot accompany scripts/checkbox_smoke.py. Linux CI runs this smoke. Reusable Styled::apply, when and when_some transformations preserve sparse patches; dynamic signal styles continue to use reactive_style.
Declarative sliders use allocated content dimensions and padding for thumb/rail drawing and pointer mapping. Four component tests cover resize, capture, keyboard, extreme finite ranges, external normalization, initial/reactive disabled semantics, inherited colors and cleanup. An AccessKit consumer verifies range/value/action updates; GPU readback compares partial/full frames after value, width and color changes. The native slider run validates drag, Home/End/arrows, reactive width, disabled suppression and external values via scripts/slider_smoke.py; Linux CI runs this check. Legacy slider and progress geometry also responds to allocation changes, with two regressions. The integrated run passes 228 tests, 17 doctests, formatting, strict Clippy and macOS ARM64 all-target cross-check.
Declarative progress uses a clipped translated fill: value-only updates and slider value changes perform zero layout work. Core tests cover normalization, idle equality, resize, disposal and semantics. GPU readback verifies exact fill area, padding exclusion, and partial/full repaint equality across endpoints and resizing. An AccessKit consumer checks the read-only numeric role and live values. Native progress evidence covers seven states with exact pixel assertions; slider smoke is rerun after its fill optimization. The workspace passes 233 tests and 18 doctests, strict Clippy, formatting and macOS ARM64 cross-check.
Declarative image and image_signal retain decoded image sources under fluent decorated roots. Tests cover intrinsic growth/shrink, allocated sizing, constraints, padding, source identity, cleanup and invalid children. Same-dimension image replacement invalidates paint without layout; GPU readback verifies exact content pixels and damage reconstruction across source and size changes. An AccessKit consumer checks image descriptions/bounds/removal. The native image run verifies five stages with exact content/padding pixels and is wired into Linux CI. The full workspace passes 240 tests and 19 doctests, strict Clippy, formatting and macOS ARM64 cross-check.
Ordinary scroll(offset) components measure retained child extents, clamp on content/viewport changes, and translate without layout for offset-only changes. Four component regressions cover dynamic extents, nested wheel routing, state retention, disabled state and cleanup. Initial disabled virtual-list semantics now survive styling. Native accessibility exposes page-up/down actions routed through scrolling input, with page/clamp/disabled tests and an AccessKit consumer. GPU differential checks and native scroll pixel evidence validate padded clipping and resize/shrink updates. Linux CI includes the scroll smoke. The integrated suite passes 248 tests and 20 doctests, formatting, strict Clippy and macOS ARM64 cross-check.
Ordinary scroll focus reveal handles Tab/direct/native focus transitions, nested viewports, batched model transactions, oversized targets, redirected focus and cleanup. Manual scrolling does not continuously reveal the current focus. GPU damage comparison verifies actual newly visible control pixels without relayout; AccessKit consumer checks updated descendant bounds/focus. The native focus-scroll smoke checks Tab, Shift-Tab and unchanged focus after manual wheel scrolling. Linux CI includes this smoke. Integrated validation passes 255 tests, 20 doctests, strict Clippy, formatting and macOS ARM64 cross-check.
Horizontal scroll_x shares retained scrolling and focus reveal with the vertical component, but uses row layout and horizontal wheel deltas. Mixed-axis nested tests cover wheel routing, batched focus, extents and resizing. ScrollAxis metadata exposes only applicable native page actions; tests reject wrong-axis requests and respect disabled input. GPU tests compare partial/full repaint and padded clipping. Native horizontal-scroll evidence covers wheel buttons, Tab/Shift-Tab, manual-scroll persistence and resize clamping; Linux CI runs this smoke. Integrated validation passes 262 tests, 21 doctests, strict Clippy, formatting and macOS ARM64 cross-check.
Opt-in overlay scrollbars cover ordinary vertical/horizontal views and virtual lists. Four integration tests verify paging, captured drag/resize/cancel, keyboard/numeric actions, content click-through, hidden lifecycle and virtual extents. GPU readback checks exact thumb pixels, zero-layout offset changes and clearing on shrink. An AccessKit consumer verifies orientation, numeric actions, focus, hide/restore and disabled ancestors. Native scrollbar evidence exercises track clicks, captured drags, Home/End/PageUp/PageDown, horizontal drag and overflow removal; it exposed the now-fixed explicit pointer-focus requirement. Linux CI includes this smoke. Integrated validation passes 268 tests, 21 doctests, strict Clippy, formatting and macOS ARM64 cross-check.
Opt-in virtual-list keyboard navigation mounts and focuses endpoint/page/neighbor rows without scanning intervening keys. Four component regressions cover million-row bounds, batching, keyed focus, removal fallback, child control keys and cleanup. GPU tests verify focused opaque-row pixels and damage; an AccessKit consumer verifies one-based set position, total size and shrink fallback. Native million-row evidence reports 6–7 live rows and 19 total builds over four navigation actions. Linux CI includes the smoke. Final integrated validation passes 275 tests, 22 doctests, formatting, strict Clippy and macOS ARM64 cross-check.
An earlier parallel GPU test process exited with SIGSEGV without a stack. Targeted 24-worker device-lifecycle stress subsequently reproduced a loader fault matching an upstream Vulkan-Loader race. The same binary passed three 240-lifecycle runs with patched loader 1.4.345, retaining debug and validation defaults. Stacks, matched runs, source and build provenance are retained. This strongly supports the loader diagnosis for the reproduced crash; it cannot prove the earlier stackless failure identical. Ordinary fixtures serialize resource lifetimes and retain an explicit four-device concurrency test; the larger stress test is opt-in. Application and benchmark settings are unchanged.
Declarative modal and popover portals now use ordinary children, fluent panel styles, lexical providers/slots and logical-owner disposal. Absolute layout excludes portals from surrounding flow; world-bounds observation tracks anchor translations without relayout. Tests cover nested/sibling focus scopes, non-LIFO removal, reentrant blur unmounting, open-tree replacement, disabled logical ancestors, virtual-row disposal, and constructor failures. GPU partial/full readback agrees through open/close and clipped-anchor movement; native AccessKit consumers verify modal metadata and focus. Eleven native X11 stages cover placement, resize flipping, Tab containment, nested popups and dismissal. The final integrated check logs are retained with that evidence. Closed panels keep their subscriptions; this is not a claim that all hidden-subtree computation is suspended.
Declarative menus now expose accessible menu/item roles, trigger popup/expanded state, retained component/keyed items, disabled-item skipping, bounded Unicode prefix search, arrow/Home/End navigation, Escape and Tab exit. Actions close the menu chain before invoking application callbacks. Automatic overflow preserves intrinsic sizing and shrinking; focus reveal and wheel scrolling translate retained content without layout work. Reactive content spacing, partial/full GPU pixels, AccessKit consumers and ten native X11 stages pass. Dedicated submenu triggers, side placement and Right/Left navigation are now implemented and validated below. Native macOS/hardware GPU validation is still separate.
Cascading submenus now own full-width triggers with decorative chevrons, child panels and focus scopes. Right/Left, Enter, Escape, sibling switching, disabled ancestry, keyed removal and reentrant disposal have regression coverage. Pointer handoff routes a single gesture only to an eligible ancestor menu; outside clicks close the chain without activating background controls. Logical accessibility parentage keeps portal menus in their parent menu's native tree while preserving physical bounds/clipping and rejecting cyclic/stale parent overrides. A GPU partial/full repaint regression and twelve native X11 stages pass; compositor-only anchor movement flips the child without layout work.
Native Wayland input now passes through an owned nested Weston seat. The
protocol/model evidence verifies
pointer focus, keyboard selection, Tab, multiline input, disabled controls,
reactive width, actual output resize and clipboard transfer between editors.
The client has no DISPLAY, and clipboard assertions require standard Wayland
selection/send/receive traffic. Clipboard backend selection follows the actual
native display; the Wayland worker retains the connection for its lifetime.
This is software-compositor evidence, not physical-seat or real IME validation.
Public component .on_event and .focusable hooks pass ordering, disposal,
inherited-disabled and default-cancellation regressions across editing, sliders,
scrollbars, scrolling, menus and virtual navigation. The
native keyboard regression confirms
that prevented printable keys emit no editor text, prevented clipboard shortcuts
do not execute, and ordinary spaces/copy/cut/paste still work. The integrated
workspace passes 349 tests (one opt-in stress test ignored), 25 doctests,
formatting, strict Clippy and the macOS ARM64 cross-check. Native macOS runtime
validation remains outstanding.
Opt-in editor soft wrapping now passes core and actual shaped-text tests for inherited/reactive styles, resize preservation, pointer placement, visual Home/End, preferred-column navigation, scrolling, Unicode/bidi and trailing empty lines. Equal wrapping values and idle preparation produce no layout work or damage. GPU readback verifies multiple painted lines, selection, visible carets through resize, IME preedit/commit, wrap toggling and exact incremental/full-frame agreement. The native wrapped-editor run covers five X11 input/resize stages with preserved model text and selection. The integrated suite passes 362 tests, 25 doctests, formatting, strict workspace Clippy and the macOS ARM64 cross-check. These remain software-GPU and X11 runtime checks; native macOS and live input-method-service validation are separate.
Winit 0.30.13 documents formal application suspension for Android, iOS and Web; it does not emit equivalent callbacks on Linux/macOS. See the upstream lifecycle contract, also verified in the installed dependency source. zgui's callback teardown and recreation path is defensive portability support. It does not constitute a native desktop machine-sleep/wake or real driver-loss test; those remain separate gaps.
Real IBus/libpinyin XIM input passes eight native stages: Chinese preedit, committed text, Escape cancellation, editor focus-switch cancellation and candidate placement beneath each caret. The test drives native keys in an owned X11/D-Bus/IBus session and independently checks model text, displayed preedit and candidate-window geometry. It exposed and fixed X11's baseline-spot convention; other backends keep rectangle geometry. Native IME routing now rejects late events while inactive or after the owning editor changes, with two model-level regressions supplementing native evidence.
Held-key focus transfer verifies that synthetic X11 key presses/releases cannot type or activate controls, while actual subsequent input works. Live Wayland scaling checks 1×→2×→1× with native protocol events, fixed physical surface size, correct logical viewports and caret coordinates, actual pointer edits, and exactly doubled editor pixels at 2×. The application cannot fall back to X11 in that test.
The live X11 DPI regression reproduced stale scale and stationary-pointer routing before the fix. The host now uses the scale-change event as authoritative for viewport, pointer, wheel, accessibility, window-size requests and IME conversions. It waits for the native resize rather than applying a new scale to the old physical size. Only X11's cached pointer is rescaled; Wayland/macOS surface-local logical coordinates stay unchanged. Native normal and maximized-window runs pass, including when the window manager keeps the physical size fixed. Machine sleep, physical monitor hotplug, real driver loss and native macOS remain separate validation gaps.
This integrated platform revision passes 364 tests (one opt-in stress test ignored), 25 doctests, formatting, strict workspace Clippy and the macOS ARM64 all-target cross-check. The native scripts are wired into Linux CI; remote CI execution has not been claimed from these local runs.
Inherited/reactive .line_height(px) and .line_height_normal() now share a
normalized, hashable font metric across layout, GPU/software rendering and editor
geometry. Tests cover sparse style precedence, component ownership, normal reset,
Unicode wrapping, selection/hit testing, trailing empty lines and idle equality.
The measurement-only fallback uses constant auxiliary memory and the same
placement rules as geometry shaping; its normal pitch now matches the existing
editor convention rather than the former independent approximation.
GPU readback confirms line-height changes reuse rasterized glyphs, preserve model and selection, and reconstruct the exact full frame after loose/tight/normal changes. Existing text-box clipping applies to tight outer glyph ink. The native four-stage run validates actual pointer controls and keyboard selection through 24px→42px→12px→normal spacing. The integrated workspace passes 378 tests (one opt-in stress test ignored), 26 doctests, formatting, strict Clippy and the macOS ARM64 all-target cross-check.
The focused editor now shares one bounded layout snapshot across refresh, selection, scrolling and visual navigation. Six public regressions and ownership, cache-weight and native GPU tests cover invalidation and disposal. Replacement shapers refresh caret metrics even when editor bounds remain unchanged. The call-count evidence records redundant shaping removed from unchanged interaction; it is not a CPU-time benchmark. Native X11 evidence covers wrapped resize/editing and inherited line-height changes on an archived 125-input source snapshot, with both binary hashes retained.
Fluent percentage dimensions now pass core and component regressions for padding, min/max constraints, sparse pixel/percentage precedence, image sizing, wrapped editors, indefinite axes and absolute children. Tests cover the definite flex allocation case even when no size redistribution is needed. A GPU differential test checks child resize and old-pixel removal. The native percentage-sizing record verifies real window resize, retained text/selection, input placement and panel pixels from frozen sources.
Letter spacing now shares normalized font attributes across component inheritance, measurement, editor geometry, GPU drawing and software rasterization. Tests cover pixel-to-em conversion, signed tracking, Unicode clusters, selection edges, wrapping and cache invalidation. A GPU differential test verifies exact pixel restoration and no new glyph bitmap uploads for integer tracking changes. The native X11 record verifies expected caret/label changes while preserving model and selection on frozen sources.
A lifecycle audit covers repeated keyed/provider/slot teardown, task completion and destructor reentry, listener capture disposal, timer/background waker cleanup and retained window factories. It fixed stale-node and RefCell panics, lock-held waker destruction and clipboard retention after manager shutdown. The native X11 clipboard regression uses the archived source and binary, while core probes verify resource release and retained live-task ownership without requiring a desktop.
A live Linux AT-SPI run validates ordinary component controls over a private accessibility bus: readable text and status, focus, caret and selection, buttons, numeric values, checkbox state, disabled input and fresh-state reactivation. Static labels now use the AccessKit text value contract; editors publish cached Unicode TextRuns and route selection actions through guarded core input. The evidence records the pinned bridge limitations, source hashes, native trees/events and integrated checks.
Image fitting now supports local fluent Fill/Contain/Cover/None/ScaleDown styles with centered padded clipping. Core checks cover ownership, reactive precedence, intrinsic sizing and idle updates; GPU differential tests verify crop pixels and zero texture uploads for fit-only changes. Eight native resize/mode stages pass 6,608 pixel checks, and the existing image example retains its original behavior.
A retained rendering/IME audit removes layout work for fully allocated image-source replacements and prevents transparent subtrees from uploading textures, rendering layers or applying backdrop blur. Regressions cover hidden oversized resources and reveal/hide damage. Accessibility cancellation of editor preedit now releases native keyboard suppression and guards the queued IME restart interval. Delayed Wayland compositor commits after local reset notifications remain an explicit pinned-backend limitation.
Hidden subtree traversal now prunes zero-opacity branches before retained-layer bounds and child traversal. A hidden 8192×8192 descendant no longer makes a visible 24×24 parent fail the GPU memory budget; its regression uses 2,704 cached layer bytes. Hidden backdrop filters also stop expanding unrelated visible damage, while hide/reveal repair and explicit layer-root opacity remain covered by core/GPU tests.
Effect normalization keeps NaN opacity and infinite filter lengths out of paint metadata. Normalization precedes equality and blur tracking, so repeated invalid reactive values add no scene damage or layout/compositor invalidation. Core/component/GPU checks cover sparse override removal, fallback pixels and idle render counters.
Translation normalization resolves nonfinite coordinates to zero independently before equality, hit testing and damage calculations. Direct and composed tests establish repeated-write idleness and sparse override behavior; GPU tests verify restored pixels and retained isolated-layer reuse without layout or repaint.
Pointer chord validation fixes unrelated mouse-button releases interrupting primary editor/slider/scrollbar drags. Capture now follows its initiating button. Core tests cover cleanup and activation; real X11 pointer sequences verify continued drag after secondary release and stable selection/value after primary release.
Keyboard chord validation preserves pending Space/Enter activation through unrelated releases, consumes matching presses before reentrant callbacks, and aligns active styling with key ownership. Native X11 checks cover counts, held/released colors, focus-loss cancellation and prevented activation.
Disabled interaction lifecycle now publishes disability and detaches interactions before callbacks, tolerates reentrant removal/reenabling/refocus, and prevents stale releases from activating uncaptured controls. Composed sliders explicitly focus on pointer presses. Core regressions and native X11 held-key/button/slider checks cover cleanup and recovery.
Text history limits remain enforced when undo/redo transfers follow a limit reduction. Cached payload totals avoid whole-history scans, and lowering limits trims/shrinks both stacks. Core tests cover accounting and eviction; a native editor shortcut sequence verifies the reduced one-entry limit across redo and undo. Budgets apply independently per stack and exclude entry/container/allocator metadata.
External-model IME cancellation now synchronizes local preedit cancellation with the host, including model replacement and selection/navigation edits. A real X11/IBus probe replaces the model without refocusing or switching engines, rejects the old candidate, edits the replacement normally and commits a fresh Unicode composition. Native empty preedit followed by Commit remains valid; Wayland protocol-serial limitations and the distinction from a complete native session epoch remain explicit.
Initial values and external model updates now follow the same CRLF/CR policy as paste and accessibility replacements; typing and IME commits agree as well. Canonical-equivalent updates preserve selection, preedit and history without layout or damage. Construction batching prevents reentrant model observers from unmounting partially registered editors or declarative trees. Native tests check model/display agreement, retained nodes, continued input and multiline caret placement; both IME suites also pass. Sources, hashes and validation logs record 489 workspace tests, 29 doctests and the platform checks.
Static and reactive read-only policies keep editors focusable/selectable while blocking user mutations. Core tests cover both editor forms, clipboard methods, accessibility actions, history preservation, repeated-write idleness and owned subscription cleanup. AccessKit projection retains selection/focus actions while removing SetValue. Native X11 clipboard/input tests and isolated real IBus composition cancellation pass, along with the existing two IME suites. Archived source, commands and results include 497 tests, 29 doctests, Clippy, formatting and the macOS cross-check. Native macOS behavior and arbitrary delayed Wayland server commits remain outside this evidence.
Failed initial bindings now clean up their public mount even after an outer batch or active effect deferred execution beyond the mount call. Regressions cover exact sibling preservation, conditional/keyed initial children, retained resources, effect counts and retry. Binding registration precedes callback execution, and self-disposed effects cannot acquire orphan subscriptions. Later update failures retain their mounted view; an already replaced document is not restored after a deferred render failure. Archived validation records 509 tests, 29 doctests, strict Clippy, formatting, the macOS cross-check and successful native editor/model/virtual-list regressions.
External text replacements now retain only one changed UTF-8 span in history; canonical model ingress borrows signal text. Unicode/history/selection/IME tests pass, including small-byte-budget streaming and full undo/redo roundtrips. Integrated validation records 516 tests, 29 doctests, strict Clippy, formatting, the macOS cross-check and three native editor suites. The isolated editor benchmark measures median 1,000-update time of 42.65→10.20 ms, live requested allocation bytes of 4,775,648→1,060,788 and retained undo steps of 7→100 across five runs per version. These are headless editor measurements, not whole-framework or GPU performance results.
Selection/read-only refreshes now retain paint text and semantic string storage. Measured allocation regressions prove zero semantic-update allocations for unchanged or same-sized text, and no document-sized allocation for warmed selection/policy refreshes of a cache-eligible 32 KiB Unicode document. AccessKit incremental consumer and live AT-SPI checks preserve full text and selection; model normalization and native IME suites pass. Archived validation records 520 tests, 29 doctests, strict Clippy, formatting and the macOS cross-check. Cold/over-budget shaping and native AccessKit owner-value copies remain separate costs; these checks do not establish whole-framework timing or RSS improvements.
Per-node semantic revisions and cached geometry/children allow unchanged native nodes to skip value construction. Allocation tests verify that unrelated updates and idle projection do not copy a 128 KiB editor document. Invalidation coverage includes ancestry, scaling, logical children, visibility, reconnects, store replacement and partial semantic mutations on unwind. Archived validation records 526 tests, 29 doctests, strict Clippy, formatting, the macOS cross-check and successful live AT-SPI, editor model and native IME suites. Projection still traverses scene metadata; changed nodes still allocate owned AccessKit values.
GPU blur no longer forces every changed frame to reconstruct the whole target. Damage expands through connected filter outputs and their integer physical sampling halos, then replays those regions in paint order. Backdrop copies cover only the required source region, and horizontal filtering covers only the output width and vertical sampling halo. Two full-size scratch textures remain retained; connected filters and conservative scene damage can still cover the full target. The software reference backend retains its full-frame blur policy.
Six new GPU differential tests cover distant updates, sampled backdrop changes outside the output clip, overlapping filters, offscreen clipping, fractional DPI, tiny and capped sigma, and 64 deterministic mutation frames. A cached isolated layer with root blur matches a fresh redraw after both backdrop mutation and fractional translation, with one layer cache hit and no layer repaint; translation also allocates no layer texture. A distant 4×4 update damages 16 pixels in a 240×160 scene containing blur. This is a work-count assertion, not a GPU timing or CPU/RSS measurement. Four helper tests include 4,445 sampling-support checks across seven scales.
The native effects example now uses component children, fluent styles, reactive effect properties and component-owned animation tasks without application scene mutation. The owned X11 smoke drives its actual controls, checks visible changes from blur/fade/opacity, animates with blur enabled, verifies pause stability and waits for timed close. Model-text editing and image-fit/resize smokes also pass. The consolidated run passes 536 ordinary tests, 29 documentation examples, strict Clippy, formatting, and the macOS ARM64 cross-check. Native macOS and hardware GPU execution remain unverified.
Source manifest, run metadata, and native effects results record this build. Archived inputs and their hashes were independently checked against the workspace. The Linux renderer is Mesa llvmpipe using the private patched Vulkan loader; historical framework CPU/RSS comparisons remain unchanged.
Multiline editors now handle Page Up/Down and Shift+Page Up/Down using the padded viewport height with one visual line of overlap. Paging retains the preferred horizontal position shared with Up/Down, moves scrolling by the caret displacement, and clamps at document boundaries. Read-only fields retain this navigation; single-line fields and Control/Alt/Meta-modified page keys leave defaults unhandled. Paging cancels active preedit without changing the committed model or undo/redo history.
Seven integration tests cover viewport resizing, reversed Shift selection, short-line preferred-column recovery, empty/trailing lines, Unicode graphemes and soft-wrap affinity, fractional line heights, read-only behavior, preedit cancellation, event bubbling/default prevention, and existing undo/redo history. Repeated paging through unchanged wrapped text performs no additional shaping in the instrumented layout-cache test.
The native component example and owned X11 smoke exercise actual page keys, Shift-selection, read-only input rejection, resized padded viewports, visible carets, and document endpoints. Fresh wrapped-editor and native IBus IME regressions also pass. The consolidated run passes 543 ordinary tests and 29 documentation examples, strict Clippy, formatting, and the macOS ARM64 cross-check. These Linux runs use llvmpipe and do not validate native macOS or hardware GPU execution.
Source manifest, run metadata, and native paging results record the validated build. All 163 archived input hashes were independently checked against the workspace; full command logs are retained beside them.
Editors now support Shift-click anchor extension, Unicode word-boundary segment selection on double-click, and visual-line selection on triple-click. Dragging extends whole selected units and reverses around the original opposite edge. Single-line triple-click selects all text; line selections exclude hard newline terminators. Selection remains available read-only, cancels preedit, and leaves committed text and undo/redo history intact. Ordinary synthetic dispatch remains unmodified single-click input; native/custom-host modifier dispatch supplies per-event metadata and a target/button-specific 500 ms, four-logical-pixel click chain. Counts cycle 1/2/3/1 and reset with the documented interaction lifecycle. OS-specific multi-click preferences are not queried.
Seven new editor integration tests exercise Shift and unit dragging, grapheme-safe combining/emoji selection, punctuation/whitespace, right-half glyph hits, wrapped-line boundaries, cancellation, read-only mode, composition and history. Dispatcher regressions cover deterministic timing/distance, target/button changes, legacy dispatch, lifecycle resets and nested-event metadata isolation. Native shaping now exposes logical visual-row ranges separately from physical Home/End edges: mixed-direction row edges can omit logical clusters. Shaping regressions and a separate editor-level test cover this distinction, wrapped affinities, line endings, empty rows and trailing whitespace.
The fresh owned X11 selection smoke passes nine stages, including real native Shift-click, double/triple clicks, reversed word dragging, wrapped line selection, fourth-click reset and read-only input rejection. Pointer-button chord/capture and native IBus IME regressions also pass. The final integrated build passes 555 ordinary tests, 29 documentation examples, strict Clippy, formatting, and macOS ARM64 cross-checking. Native macOS and hardware GPU execution remain unverified; Linux rendering uses llvmpipe.
Source manifest, run metadata, and native selection results record this build. All 166 archived inputs and binary hashes were independently verified; full command logs accompany the record.
Captured selection now scrolls while the pointer rests outside an editor. Character, word and visual-line gestures retain their selection rules; single-line fields scroll horizontally and multiline fields vertically and, when unwrapped, horizontally. Edge-clamped hit testing prevents distant pointers from jumping to the document end. Velocity is bounded at 1,200 logical pixels/second and stalled ticks contribute at most 50 ms. One core interaction deadline runs at 16 ms intervals while scrolling can advance; idle calls avoid layout preparation.
Ten deterministic tests cover stationary and reversed unit selection, bounded motion, read-only behavior, unchanged text/history and shaping reuse, capture and focus lifecycle, model replacement, resize rearming, prevented movement and idle work. A dormant boundary gesture cannot overwrite another editor's active deadline after capture transfer. The native host merges interaction and presentation deadlines and cancels captured gestures when inactive or hidden.
The owned X11 smoke holds the pointer still without diagnostic polling timers. Vertical and horizontal movement exceed 100 pixels between reports, beyond the maximum single delayed tick, proving native deadline-driven progress. Returning inside or releasing stops motion. Hiding while the button remains held cancels capture; restoring leaves selection and scroll stable. Fresh selection and hidden-window update regressions also pass.
The consolidated build passes 565 ordinary tests, 29 documentation examples, strict Clippy, formatting and the macOS ARM64 cross-check. All 168 source inputs and binary hashes were independently verified. See the source manifest, run metadata, and native results. Linux native rendering uses llvmpipe; native macOS and hardware GPU evidence remain outstanding.
The transparent-window fixture uses the public component/fluent-style API and
WindowOptions::transparent. An owned Xvfb/Openbox/picom XRender session captures
the final composited desktop, rather than reading the application's framebuffer.
The harness publishes a live root pixmap with a known color; a plain root clear
was insufficient for this compositor and initially yielded a black backdrop.
No renderer correction was needed for the verified setup.
Six stages check 32 sample positions: transparent empty pixels, half-alpha and quarter-alpha panels, their overlap, an opaque control, retained color updates, hiding/restoring a panel, native window movement/resizing and a changed backdrop. Expected colors are computed from source alpha and the known backdrop with a two-channel-value rounding tolerance. Newly exposed resized areas retain alpha zero. Desktop screenshots and exact sample values accompany the results.
The consolidated run passes 565 ordinary tests, 29 documentation examples, strict Clippy, formatting and the macOS ARM64 cross-check. Fresh native transparency, editor autoscroll and hidden-window-update suites pass. All 169 archived source inputs and binary hashes were independently verified. See the source manifest, run metadata, and compositor results. This establishes alpha presentation on this X11/picom setup using llvmpipe; it does not establish Wayland/macOS transparency, compositor backdrop blur, hardware GPU performance, or OS-native blur materials.
An owned Sway session now verifies the transparent-window fixture as a native Wayland client, with Xwayland disabled and the client DISPLAY unset. A private swaybg surface supplies the known background; grim captures the composited output. Six stages cover alpha overlap, retained color changes, hide/restore, movement/resize and a changed background. All 32 client sample colors matched the source-over calculation exactly, within the allowed tolerance of two. The background is also sampled independently at every stage.
Native results, protocol logs and screenshots preserve the evidence. The metadata links the unchanged executable to the earlier transparency build: all 159 compiled inputs match that build, and 164 inputs are preserved in the new source archive. No Rust source changed in this step; the previous 565-test/29-doctest validation remains the Rust baseline. Six new Python sampler regression tests also pass and preserve failed-trial evidence without emitting successful CSV rows.
This covers Sway nested over X11 with pixman and a llvmpipe-rendered client. Native macOS, hardware GPU composition, compositor backdrop blur and OS-native blur materials remain unverified.
An isolated Sway/Fcitx5/Pinyin session exercises actual text-input-v3 preedit and Unicode commits. The basic two-editor test verifies Escape cancellation, focus-switch cancellation and independent models. The client runs with DISPLAY unset; protocol logs show native enable, cursor rectangle requests, preedit and commits. Candidate popup placement is not asserted. Private D-Bus disables service activation to avoid unrelated portal processes and mounts. CI installs the explicit input-method dependencies.
The initial passing run and metadata preserve 162 inputs and a freshly rebuilt native fixture. No Rust code changed. Later functional coverage also checks external model replacement and read-only toggles during preedit; the consolidated evidence below records the final harness.
A failed initial burst is retained: Fcitx sent the full preedit sequence, while the client only received the first update around a cursor-state transaction. A second fresh-composition burst failure is also preserved. Functional smoke tests now await client-visible preedit between characters. Passing them does not resolve these burst failures or prove rapid-input reliability. Transaction backlogs and delayed stale serials remain open compatibility work.
The consolidated native results pass three fresh sessions: two-editor composition (eight stages), external model replacement (six stages), and read-only cancellation/re-enabling (seven stages). Both cancellation tests observe genuine preedit, keep logical/native focus stable, reject the old candidate, resume ordinary Backspace/digit input without switching engines, and accept exactly one fresh Unicode commit. The read-only case changes editability without replacing the model.
All 163 archived inputs, source archive contents and two rebuilt binary hashes were independently checked; see audit. The scripts await actual window mapping/focus and pace composition through observed preedit. CI includes both cancellation modes. No Rust source change was needed for these functional cases; the previous 565 ordinary tests and 29 doctests remain the Rust validation baseline, not a newly rerun test count.
The preserved burst failures above remain unresolved. These tests neither inject delayed server commits nor establish serial-based cancellation guarantees. Native macOS IME and candidate popup placement also remain unverified.
The direct winit diagnostic delivered final preedit and Unicode commit for all 22 tested bursts across fixed, moving and delayed candidate geometry. It narrows the investigation but does not reproduce or resolve the original zgui burst failures.
The first refresh stopped after 17 trials amid disk exhaustion; its failed process had no usable log and the old sampler lost its raw samples. The sampler now preserves failure samples/status, covered by six Python regression tests and CI.
The retry completed all 36 GUI processes and preserved 10,793 samples. Independent recomputation verified all 220 archived inputs and measured binary hashes, but the runner correctly rejected update parity: zgui scrolling repeat 1 delivered 1,099 updates in 20 seconds, below the 1,160 minimum. Unrelated builds restarted on the shared host during sampling. The cause is not isolated, and no new performance ranking is accepted. Fresh seeded captures were reviewed for all three applications. Both attempts remain separate from the earlier accepted historical comparison.
The source-frozen variable-list validation adds heterogeneous allocated heights, logarithmic prefix lookup/updates, incremental append, first-visible anchoring, pixel-based keyboard paging and resizing focus markers. Eleven component tests cover retained keyed ownership, duplicate/constructor rollback, reactive notification suppression, empty/shrunk lists, disposal and explicit scroll requests made by callbacks. Fixed-height lists receive the same callback request preservation fix. GPU damage/full-redraw comparison and 13 native stages pass; at most 14 rows are mounted for 100,000 items. Heights are application-supplied, not automatically measured from text. The recorded core microbenchmark is separate from GUI CPU/RSS comparisons.
Naturally measured virtual rows now share the retained keyed component path. The combined measured-list validation passes 598 tests, 31 documentation examples, GPU wrapped-text damage comparisons, seven measured-list native stages, and the existing explicit/fixed-list native fixtures. Estimates can be severely inaccurate without unbounded discovery; newer focus/scroll requests supersede measurement-time keyboard reveal. Unseen rows retain approximate heights until remounted, and independently sized lists need separate measurement caches. This does not add hardware-GPU or native macOS evidence or convert rejected process benchmarks into valid comparisons.
A standalone winit/softbuffer test with synchronous 80 ms blocking delivered all 12 final preedit/Unicode commit pairs. Four additional unsynchronized bursts in the actual zgui editor also delivered final state. Compositor-side traces in both tests show some intermediate preedits rejected with stale input-method serials; these successes do not invalidate the earlier persistent failure.
A separate zero-delay condition reproduced the persistent final-preedit failure in both zgui and the independent program: two warm failures, two cold successes. In each failure the compositor advanced its input-method serial after the first preedit, then rejected the final preedit carrying the previous serial. Space subsequently committed the correct Unicode text with the current serial in all four observations. This demonstrates the symptom outside zgui and its GPU renderer on the tested Sway/wlroots/Fcitx stack; it does not establish failure rates on other input stacks or lost committed text. No timing workaround or text replay was added to the framework.
Exact sources, binary hashes, client/server/input-method traces and an unsent upstream report are retained in the zero-delay evidence. The blocking matrix and original-rate native matrix remain separate evidence. This platform compatibility issue remains open.
Repeated recoverable Lost/Outdated surface changes now yield to the host retry schedule instead of terminating the application after the second status. Acquisition work remains bounded per call; the rendered target stays retained. Fatal recreation and validation errors still propagate. Fault-injection tests cover every Lost/Outdated pair, persistent changes and later successful frames.
An isolated native X11 test now invokes actual Host suspension/recreation with real windows and GPU renderers. It verifies repeated suspension cleanup, native window release, cleared preedit/capture/retry state, preserved editor node/model, updates during suspension, restored focus and rendering with a replacement renderer. This is integrated lifecycle coverage, not physical machine sleep or real driver fault injection. CI runs it independently and preserves its log. See the source-frozen checks and native log.
A private Fcitx5 5.1.19 frontend patch republishes only the current nonempty preedit after an ordinary input-method serial change, excluding activation and deactivation transitions. All four zero-delay observations delivered final preedit and exactly one Unicode commit. In the zgui warm run, the trace still shows the original final transaction rejected, followed by an accepted refresh at the new serial: this directly demonstrates recovery rather than mere absence of the race. The eight-stage Escape/focus-switch composition smoke also passes.
No installed plugin, global service or zgui production code was changed. This is an upstream patch candidate, not a shipped fix: empty-preedit cancellation, stale commit/deletion transactions and broader surrounding-text/lifecycle cases need upstream testing. Exact patch/source/build provenance, private plugin mapping, raw results and limits are in the private experiment.
Distant streaming damage now uses one batched render pass even when a clean blur panel exists elsewhere. Dependency-expanded damage touching the filter still executes both blur passes. Full-repaint differential tests validate repeated streaming, sampling halos and recursive isolated-layer accounting. The counters measure encoded work, not elapsed GPU time; repainted isolated layers still replay their complete targets.
The integrated snapshot passes all 600 workspace tests, 31 doctests, strict Clippy, formatting and macOS ARM64 all-target checking. Native effects and isolated host recreation also pass. All 175 archived source inputs and the tested native binary hashes are verified.