Five crates are copied from GPUI Fast, revision b836dd970b26830f2124b7cf91b0e19018fd12da: gpui, gpui_macos, gpui_windows, gpui_linux, scheduler. The sources track the pinned upstream main revision; normalized manifests use the official 0.1.10 release dependency rules. Core and platform crates retain their Rust library names under the published gpui-fast* package names; the modified scheduler uses gpui-pre-scheduler 0.3.9. Unmodified helpers use the same official release and its 0.3.9 support snapshots. Kit selects its official gpui-fast backend feature. Root registry source patches supply the modified crates; the old gpui-pre Git compatibility facades are removed.
upstream.json records the finite original file inventory and SHA-256 hashes before changes. Original license texts and upstream attribution are retained. New Maka source is not included in this inventory. Workspace dependencies are normalized for the isolated five-crate workspace, with explicit upstream license-file paths.
The patch adds a one-shot platform cleanup receiver. Success requires native destruction acknowledgement and release of all backend-owned renderer/input/callback resources. macOS extends a final state guard across both NSWindow/NSView superclass destructors. Windows revokes OLE drag ownership during WM_DESTROY and waits for WM_NCDESTROY/DestroyWindow completion. X11 uses checked DestroyWindow and drops mapped state/callback owners. Wayland uses a distinct display-sync callback after destroy requests; it survives surface map removal. The test backend waits for actual state destruction. Other unsupported backends return an explicit error. No frame scheduler or editor refresh changes are made.
The receipt does not promise that a GPU driver has reclaimed physical memory. It does not retain a window; the application's closing owner remains alive until this receipt and its own real resource leases settle. Keep this patch bounded and re-evaluate it against upstream before changing the pin.
Upstream example executables/assets are omitted except the JPEG and two regular fonts used by core tests; automatic example targets are disabled. The unmodified IBM Plex Sans and Lilex test fonts retain their adjacent OFL 1.1 license texts and finite original hashes in upstream.json; production does not embed these cfg(test) fixtures. This keeps unrelated demonstration binaries out of the source patch.
macOS teardown also removes the AccessKit adapter from state and releases it in the foreground teardown task before native close. The adapter retains the content view, whose GPUI child owns a state Arc; leaving the adapter until final state destruction forms a cycle and prevents any honest completion receipt.
The embedding can install one quit admission gate, separate from timed shutdown observers. App::quit consults it before stopping any event loop. macOS consults the same gate through applicationShouldTerminate: and returns NSTerminateCancel until actual embedding cleanup completes. Windows checks native WM_QUIT while GetMessage can still process cleanup, instead of ignoring on_quit after the loop has stopped. Forced OS termination or a lost message/display connection is not a clean receipt; applications retain their independent foreground execution owner after a platform return. Linux's normal stop remains protected at App::quit; its callback after a lost client loop is not claimed to restore that loop.
Semantic placement claims live only in prepaint, so layout measurements may build the same component repeatedly. The per-frame ordered trace and derived uniqueness set also replay in ordinary retained reuse, spliced prepaint segments and composited layer/list rows. Prepaint range offsets include claims; Window::transact discards claims when an attempt returns Err. Paint reuse does not register twice. A duplicate successful placement is a fatal trusted native invariant violation, not an isolation/recovery promise.
Native scheduler timers now directly own async-io's timer future, with cancellation propagated by Drop. The test scheduler unregisters an exact reservation id on timer cancellation, with sender destruction outside its queue lock. The browser backend retains its existing scheduling path and is not claimed to support this native cancellation guarantee. The adapted async-io reactor wakes on timer removal; cancellation is a request, and real Waker release follows reactor drain. Kit retains only one owned idle task per scrollbar, using Weak state in its future. No new timer registry or dispatcher authority is added.
Accessibility presentation can mark disabled/read-only on the actual AccessKit node. A facade and its native child may track the same FocusId; TabStopMap retains the full insertion log for replay but removes the previous traversal entry before registering that id again. This preserves one native focus owner and prevents duplicate Tab stops. Candidate admission also reads the existing FocusMap through current handles, so a revoked stop is skipped before the next paint; painted order and live admission remain distinct. The test backend now records the actual platform accessibility callbacks and latest delivered TreeUpdate, and test-context helpers deliver activation/actions through the normal asynchronous channels. These are headless behavioral probes, not OS screen-reader or IME acceptance.
The original ScrollHandle owns live offsets and a last-painted direct-child layout. Tracked Divs may opt into Anchor or FollowEnd retention. An unpainted automatic adjustment keeps a reading origin interpreted against immutable painted geometry; every retry reselects surviving original element IDs. Real wheel, set_offset and focus reveal supersede it with an absolute target. Plain clamp participates in the same retry accounting. An inherited Window prepaint visibility scope suppresses hidden descendants' automatic retention, explicit-request resolution and focus reveal, without blurring or replacing their owners. It isolates outer reveal requests and restores on unwind. DeferredDraw captures the same eligibility for later prepaint; retained context compares it before reuse. Actual Deferred::paint admits its child through the original Frame paint stream, including retained and splice replay. Priority orders currently admitted draws: a nested child first follows its actual ancestor, even with a lower priority. Hover-hidden ancestors cannot paint ghost children; visible-on-hover paint remains admitted. Hidden candidates cannot acknowledge focus geometry; only actual Div content paint publishes the baseline, including retained children. No second tree, global scroll registry or plugin pixel mirror is added.
Bottom and item requests share one tagged pending target. Resolution uses current overflow, bounds and child geometry, but acknowledgement waits for the matching actual paint; hidden, discarded and newly hover-hidden paint cannot consume it. Later requests supersede earlier ones, while real native movement cancels them. ScrollHandle::invalidate() only bumps the original dependency version and does not invent input intent or schedule a frame. Kit VirtualList retains the same mechanical owner.
The original retained splice holding check now includes each rebuilt gap root's location and size. A changed outer box rebuilds its parent; unchanged outer geometry still permits internal content redraw to splice. Native regressions use actual wheel, focus, layout retries, explicit requests and partial child updates, with no replacement scroll owner. These do not establish OS or finished-product acceptance.
The test context can pause automatic test-mode drawing within a scoped callback while real accessibility action channels, effects and observers continue. Explicit drawing still works; an RAII guard restores the original automatic-drawing setting, including nested calls and unwind. This lets regression tests retain and assert the actual old platform tree/listeners before delivering an asynchronous action against changed live native facts. Production drawing is unchanged. The helper neither suppresses action delivery nor establishes OS accessibility acceptance.
App exposes a read-only query of the original current event propagation flag. Native post-dispatch observers can reject already consumed inputs and earlier stopped observations without copying event state or adding a keyboard registry. This supports the existing Kit Root defaults for both focused and unfocused windows; native bindings and raw plugin decisions still run first.
Native focus reveal is derived from the original Window focus generation and committed prepaint geometry. Focused subtrees mark the original autoscroll request with its generation; exact child caret requests take precedence over whole-control fallback, and unrelated sibling requests cannot replace the focus target. Scroll containers plan minimal clamped native offsets and propagate bounds clipped only to their own viewport. A normal subsequent frame rebuilds paint, hitboxes and accessibility together; serving a generation never forces later manual scrolling back. Pointer-driven focus preserves down/up and selection geometry. List retries choose one request after prepainting the full visible pass; failed transactions discard reveal geometry facts while preserving actual offset plans. Pending reveal bypasses retained/layer replay.
The original TestWindow records platform decoration facts, resize requests and client insets. TestAppContext can change those facts and request a redraw, then observe the actual platform calls. This bounded native harness extension verifies Base Root client-frame behavior without a second window/frame owner, and is not Linux OS acceptance.
Native Hitbox accepts optional exact regions relative to its original bounds. One native interaction id and dispatch scope covers disjoint glyph fragments; bounds/mask translation preserves those regions in retained layers. Empty regions never hit, and tooltip prepaint reads the same masked geometry without claiming occlusion. The weak ClickHandle cancels the original element‘s pending press and active styling; it does not create a gesture owner. Actual mouse/key presses retain button/key, focus generation, original Window input sequence and cancellation mark. Every physical down/up advances the sequence before capture/bindings; replay masks its scope and cannot arm. A scoped optional current serial distinguishes outside dispatch from replay and restores nested context, while nested inputs still interrupt an outer clean press. The original Window inactive callback invalidates admission in constant time before observers, then its normal refreshed layout cleans pending visual state; no per-control activation subscription is added. Moves discard stale releases before drag and hover decisions. Dirty layout cannot consume an in-flight release; nested input preserves its outer committed listener frame and lets the existing scheduled redraw handle dirtiness. Native assistive-technology actions enter the same causal input scope, interrupt other targets’ pending or captured presses, and start fresh propagation/default flags, and default Div click activation goes directly through the original click listeners as Accessibility rather than fabricated centre-pointer input; an explicit AX Click listener wins. Kit integrates TextView occurrence identity and original glyph fragments through these native seams. Headless tests do not establish product Markdown or OS accessibility acceptance.
A custom canvas may install the original focused IME handler without tracked reveal geometry. The committed frame now completes that focus generation when the handler exists and its focus has no dispatch-tree geometry, so retained reuse can resume. The original focus/generation and scroll guards remain; an unmounted focus without an input handler stays pending. The dispatcher cancellation test now queues an actual dispatch_after runnable owning a completion sender and retains an executor waiting for that sender's cancellation. Owned async-io timers remain governed by their existing Drop contract.
Window‘s original prepaint transaction checkpoints its active accessibility node builder, focus mappings and bounds, restoring those same facts when the pass fails. This includes open parent builders and their child ids, so an original List autoscroll retry cannot publish duplicate or stale nodes from its discarded pass. Inactive accessibility does not take the snapshot; original paint-stage action listeners and the single published tree remain unchanged. Kit’s actual AX-active retry regression verifies corrected final native bounds and activation; it is not OS accessibility acceptance.
原 Window prepaint transaction 在可访问性 active 时临时保存原 node builder、focus 映射及 bounds，失败时恢复同一事实，包含尚未闭合的父 builder 与 child ids，避免原 List autoscroll retry 发布废弃轮次的重复或过时节点。可访问性 inactive 不建立快照；原 paint 阶段 action listeners 与唯一发布树保持。Kit 的真实 AX-active retry 回归验证最终纠正的原生 bounds 与激活，不替代 OS 可访问性验收。
Entity::query exposes the existing native platform-query classification for derived frame reports: it keeps the original entity lease and read dependency, while observable changes still require the original notification. The original queried-owner scope now restores its outer classification before rethrowing an unwind; this does not introduce entity-lease rollback. A native regression catches a same-owner double-lease failure inside a valid ordinary update, then verifies later source writes remain visible.
Window exposes read-only slices of its original prepainted and completed hitboxes, and the original focus handle's insertion position in the completed dispatch tree. Kit derives retained selection geometry, touch-menu survival and document order from those native frame facts. It does not allocate a second hitbox, focus tree or frame owner.
Entity::query 公开原平台查询的派生报告分类，保留原 entity lease 与读取依赖；可观察变化仍须走原通知。queried-owner scope 在 unwind 复抛前恢复外层分类，不新增 entity lease rollback。原生回归在有效的普通 update 内捕获同 owner 双借用失败，再验证后续 source 写入仍可见。
Window 只读公开原 prepainted/completed hitboxes 及原 focus handle 在完成 dispatch tree 中的插入位置。Kit 据此投影 retained 选区几何、维护触控菜单存活与文档顺序，不新建 hitbox、focus tree 或 frame owner。
The standalone native test workspace selects the same five adapted crates and async-io owner as the application, with line-table debug information and runtime Metal shaders. One upstream property-test entry uses proptest directly because the GPUI macro forwards an unsupported proptest_path option. Its configuration/dispatcher seeds, four cases, shrinking, original context teardown and render-equivalence assertions are preserved; this is a test harness adjustment, not a replacement runtime.
Window exposes a live marked-text predicate through the original focused PlatformInputHandler. The internal direct forwarding seam receives the current Window/App, avoiding a second asynchronous borrow during native key dispatch. The handler is restored after the read; no composition mirror is added.
Window supports one native focus-on-reveal offer per actually painted frame. Inputs offer their original FocusHandle during paint, before registering the same native editor handler; hidden or discarded prepaint cannot take focus. Original Window and completed-frame focus remain aligned. Retained input handler entries retain their original FocusId, and Frame records the exact handler slot published to the platform, including focused custom canvases without tracked geometry. Draw restores that original slot; marked-text queries restore the same handler whether still stashed or moved by retained paint. No second focus authority, input owner or composition mirror is added.
Window provides a revocable, window-bound physical InputScope around an original native focus group. Its nonclone owner controls one opening; retained records and dispatch ancestors observe only weak custody. Lazy immutable origins on original DispatchNodes identify mouse, AX and platform-handler callbacks. The published native tree supplies their current ancestry, including retained reparenting; prepaint rollback restores AX provenance and discards transient origin lookups. AnyElement paint restores its enclosing dispatch node after nested paint, so a later parent listener does not inherit a child's origin. Frame paint records, retained splice and layer carry/shift preserve the original scope declaration. No product open state, second focus tree or domain capability is introduced.
Physical mouse/key/action/AX and platform text operations use completed-frame admission. First-focus offers and input-handler publication use the frame being published, allowing an actual editor below a distinct foreground container to receive its first native input. Native TabStopMap traversal stays inside the live scope. Scope changes interrupt the original press/drag facts, pending chords, pointer capture and touch momentum. Callback loops and chord replay stop on that original interruption while preserving their listener/subscription collections. TestAppContext exposes actual platform text-input lifecycle and original handler custody for native regressions. This prerequisite does not implement the product Dialog.
Window can create a nonclone InputGesture against its original ClickInputState interruption. The gesture owns only immutable mechanical identity and observes the window weakly; WeakInputGesture cannot extend either lifetime. Ending one gesture invalidates its observers even when a new gesture starts in the same interruption epoch. Kit uses these native facts for original selection and automatic scrolling; no selection, timer registry or product state is added to Window.
The original inherited selection context carries document scope and the immutable InputScope focus-group identity through layout, retained/splice/layer reuse and deferred drawing. A group change invalidates reuse; a dead physical opening cannot relabel a retained foreground subtree as background. This context supplies placement provenance only. Native weak opening and gesture admission remain the physical input authority.
Layer eligibility reads the original painted input owners rather than treating every unfocused handler as active input. Handler ranges are read only from their original completed frame; existing native input rebuilding refreshes stale unfocused records. Native regressions preserve the bounded blur-to-composite recovery and compare a hidden/reappeared layer with the existing fresh visible-scene oracle, then query its real restored input handler. Manual notification-frame and held-callback fixtures pause test-only automatic drawing to match the original platform callback-before-frame order.
Fast is pinned to 371769f1ff378bc0bd886440e0f97fc94aaeae5d, with 0.1.7 platform packages and 0.3.9 support snapshots. Upstream removes the old macOS text-system copies in favor of its Apple package. The retained accessibility log, list/layer optimizations, CJK line breaking and platform fixes are imported. Original-byte provenance includes every newly imported source file. The three style tests use ordinary #[test], exactly the disabled-profiling expansion of upstream #[perf]; their bodies and assertions are unchanged. This avoids the unpublished 0.3.9 test helper and its incompatible 0.3.8 dependency graph.
The accessibility log participates in existing prepaint rollback without cloning or duplicating action-listener custody. Retained actions carry their original weak physical input provenance. Upstream's quiet legacy scroll-to-bottom requests coexist with explicit native scroll commands: only fire-and-forget requests may expire without painting; explicit commands keep their original receipt rules. Existing local input scopes, focus/reveal, scroll observations and cleanup remain where upstream has no equivalent.
Programmatic list offsets still bump their original dependency version, including with layers enabled; layers separately classify that version as a scroll. Without this, an unnotified offset assignment can leave a retained ancestor displaying the previous offset (also reproduced with unmodified upstream). Upstream's deferred-view splice guard is retained: an ancestor with deferred draws outside rebuilt gaps rebuilds to avoid replaying stale deferred views. The local causal-paint test now expects that rebuild while continuing to check priority order, cached replay and fresh-frame equivalence.
The five adapted crates now track b836dd970b26830f2124b7cf91b0e19018fd12da (v0.1.10). Their manifests follow upstream script/prepare-release.ts; all nine Fast packages resolve to 0.1.10, support snapshots and the adapted scheduler remain at 0.3.9, and the published WGPU backend uses registry wgpu =30.0.1 with upstream‘s release adaptations. This published WGPU version does not include upstream’s unreleased Vulkan surface-drop fix. Kit now tracks 77ff6f794dca3bcee2e90977cedf12a64aed17e4 (0.8.0), whose Fast requirement is the same exact 0.1.10 release. New rounded-clip, composition and hot-reload sources are included in the original-byte inventory; unrelated examples and iOS sources remain registry dependencies.
Three-way integration preserves Maka's physical input provenance, exact published IME-handler slot, selection context, scheduler cancellation and native cleanup receipts. Upstream field identity and handler restoration notifications use those same existing owners. The native timer patch retains its explicit async-io dependency. The profiler counter uses stable AtomicUsize::try_update in place of its deprecated alias, with the same orderings and checked subtraction.
The test-support Window::painted_quads observation follows the final scene‘s referenced rounded-clip groups, as the renderers do. It preserves each quad’s coordinates and geometry, without treating retained paint operations or unreferenced layer frames as presented output. Kit's table corner assertions remain unchanged.
Maka‘s own change. A wheel or trackpad gesture, or a touch pan, over a scroll container inside another, such as a tool’s output box in a conversation list, moved both, because every Div and List scroll listener under the pointer took every wheel event. Window now keeps a ScrollLatch (crates/gpui/src/gestures.rs). The innermost container under the pointer that moves along the gesture‘s axis (the axis of its larger delta) takes the gesture and keeps it until the gesture ends, at its end too. The containers around it, whose listeners run after its own, leave the gesture’s events to it, and so do containers the scroll brings under the pointer. A container that cannot move lets the event pass outward, so a box at its end hands the next gesture to the page, as browsers chain scrolling; the vendored GPUI Kit‘s ScrollableMask still hands an event to the container around it at its edge. A gesture ends with a TouchPhase::Started event, a wheel event at another position, or 300 ms in which the holder took none of its events. A gesture that began with TouchPhase::Started ends on such a pause only after its TouchPhase::Ended, since a finger can rest on the trackpad. Events still propagate, so other wheel listeners, such as a scrollbar’s, see them. A container that scrolls on one axis with the wheel's other axis takes no part and behaves as before. A Div‘s wheel listener now clamps its offset to the range laid out for its frame, as prepaint already did. The change is in gestures.rs, window.rs, elements/div.rs and elements/list.rs, with nine tests in elements/div.rs and two in elements/list.rs. Review against Kit 0.8.0 at 77ff6f794dca3bcee2e90977cedf12a64aed17e4 confirms that its capture-phase scroll areas (#3500) do not replace this latch for native Div and List scrollers outside those areas. The imported mask test gives its independent trackpad and horizontal-wheel cases separate native windows, so a case cannot inherit the other case’s ongoing gesture. Its original axis and offset assertions remain unchanged; production scroll ownership and propagation are unchanged.