@qxuken/kui 0.1.0-alpha.41 → 0.1.0-alpha.43

package/CHANGELOG.md

@@ -21,6 +21,455 @@ listed under both (backlog F61, from the alpha.12 field reports: the list
 is what the release knows it broke, and a fix it did not think of as one
 was the first bare bump to break an app in five releases).
 
+## 0.1.0-alpha.43 (2026-10-08)
+
+**What breaks.**
+
+- The drawn menu — a context menu, a select's list, a drawn menu bar's
+  dropdown — is as wide as its widest row needs, where it was always
+  `Metrics::menu_width` (now its floor), and no row's label or
+  accelerator wraps (under Fixed, F127).
+- A menu's accelerator kui can parse is drawn, and read back through
+  `Core::menu` / Node's `menu()` / C's `kui_menu_item`, in the platform's
+  spelling: `"mod+shift+n"` is `⇧⌘N` or `Ctrl+Shift+N`, where it was the
+  string as declared — as the menu bar's already was (under Fixed,
+  F127).
+- Rust: `MenuItem` gains `submenu` (under Added, F128), so a struct
+  literal of one needs the field; `MenuItem::KEYS` is seven keys, with
+  `items`, where it was six.
+- Rust: `WindowEnv` gains `backdrop` (under Added, F126), so a struct
+  literal of one needs the field or `..Default::default()`; so does
+  `kui_devtools::Window`, in the examples' harness.
+- Rust: `QuadKind` gains `Backdrop` (under Added, F129), so a `match` on
+  a quad's kind needs the arm — a renderer of its own draws nothing for
+  it; `InteractSpec` and `NodeInfo` gain `backdrop_blur`, for a struct
+  literal of either. The conformance report's `kinds` line has a tenth
+  column, `backdrop`.
+- C: ABI 26. `KuiSpec` appends `backdrop_blur` (into the tail padding:
+  the 64-bit size stays 704), `KuiMenuItem` appends `submenu` and
+  `submenu_count` (an array element, so its stride moved, to 72), and
+  `KuiRunConfig` appends `backdrop` (44). `KUI_QUAD_BACKDROP` is a new
+  quad kind. `KuiSpan` appends `family`, `size` and `font` (an array
+  element, so its stride moved, to 56), with the `KUI_SPAN_FAMILY` flag
+  (under Added, F130). Recompile; a zeroed tail is what every spec, row,
+  span and config had.
+- Rust: `text::Span` gains `family` and `size` (under Added, F130), for a
+  struct literal of one; `Span::new` and the builders are unchanged.
+- Node: the wire is v22 — a span carries its face and size after its
+  background's radius — so the addon and the package go together, as
+  every wire step has.
+- `Accel::parse` reads a named key's label as that key: `"⌘⌫"` is ⌘
+  Backspace and `"Ctrl+Page Up"` parses, where the first was the
+  character `⌫` and the second nothing (under Fixed, RG146).
+- A host's report of a dead menu row — `Core::activate_menu_bar_item` /
+  `_path`, Node's `activateMenuBarItem`, C's `kui_activate_menu_bar_*`,
+  or a row under a dead submenu row through `activate_menu_path` — is
+  refused and posts nothing, where it was performed (under Fixed,
+  RG147).
+
+`backdropBlur` is a number row like any other, and a row's `items` rides
+in the JSON a row already was.
+
+### Added
+
+- **A window with the desktop behind it** (backlog F126, from Noticon,
+  for a sidebar like an Obsidian theme's on a Mac).
+  `Launcher::backdrop(Backdrop)` — `backdrop` in Node's window options —
+  asks for what shows through the app's windows, named for the effect:
+  `Transparent` (the desktop as it is), `Blur` (a live blur of what is
+  behind the window) or `Tinted` (the desktop's colour, steady). Which
+  regions show it is the app's, by painting them with alpha and the rest
+  opaque. macOS: an `NSVisualEffectView` under the content view, blending
+  behind the window and dimmed with it in the background — the sidebar
+  material for `Blur`, the window-background one for `Tinted`. Windows 11
+  22H2 and later: Acrylic for `Blur`, Mica for `Tinted`
+  (`DWMWA_SYSTEMBACKDROP_TYPE`, the frame extended under the client
+  area), the window without a GDI surface and the device presenting D3D12
+  through DirectComposition (`kui_wgpu::GpuOptions::transparent`,
+  `Renderer::new_with` / `new_in_with`). Linux: `Blur` asked of the
+  compositor — `ext-background-effect-v1` where it is advertised with
+  blur, KWin's `org_kde_kwin_blur`, `_KDE_NET_WM_BLUR_BEHIND_REGION` under
+  X11. Where the OS has no effect to give — GNOME, other Linux, Windows
+  10 — `Blur` and `Tinted` draw the desktop's wallpaper (GNOME's
+  `picture-uri`, Plasma's config, `SPI_GETDESKWALLPAPER`), read on a
+  thread, scaled down and blurred once and cached by path and modification
+  time, as the window's ground under the frame
+  (`Renderer::set_ground` / `set_ground_uv`), aligned to where the window
+  sits on its monitor (centred on Wayland), and report `Tinted`; with no
+  wallpaper, `Opaque`. Where the OS draws the effect the frame is cleared
+  to nothing rather than to the theme's `bg`, and glyphs are grayscale
+  under `TextAa::Auto`. What the window got is `env.window.backdrop`
+  (`window.backdrop` in Node and Lua, `kui_env_set_backdrop` for a C host
+  that makes its own), so a view paints opaque when it says `Opaque`.
+  Every window of the app takes it but a popup and the devtools' own; an
+  app that does not ask opens exactly the window and the swapchain it
+  always did. `KUI_BACKDROP_EMULATE=1` draws the wallpaper for `Blur` and
+  `Tinted` on Windows and Linux, to look at it (macOS reads no wallpaper,
+  so a window there reads `Opaque`). Seen in windows on Windows 11:
+  Acrylic blurring a red window behind the translucent region, Mica, the
+  bare desktop through `Transparent`, the wallpaper drawn by kui under
+  `KUI_BACKDROP_EMULATE`, and an opaque devtools window beside them; on
+  WSLg (Wayland, no blur protocol, no gsettings) a `Blur` reading
+  `Opaque`. On a Mac, built through Noticon, the library column shows the
+  vibrancy. No KDE or GNOME session was at hand: the Linux half compiles
+  and passes clippy there, untried on either desktop. C asks with
+  `KuiRunConfig.backdrop` (a `KUI_BACKDROP_*`) and a view reads what the
+  window got with `kui_ctx_backdrop`, the answer and not the ask; Odin's
+  `Run_Config.backdrop` and `kui.ctx_backdrop`. The `backdrop` example
+  paints a translucent library and an opaque page from the reading.
+  *What you can delete:* nothing — this is new.
+- **A node blurs what is drawn beneath it** (backlog F129, from Noticon,
+  for a frosted toolbar over a scrolling note): CSS's `backdrop-filter:
+  blur()`. `NodeSpec::backdrop_blur(radius)` — `backdropBlur` in JSX,
+  `backdrop_blur` in Lua and Odin, `KuiSpec.backdrop_blur` in C — blurs
+  everything painted before the node, inside its rounded box, by that
+  radius in logical px (the Gaussian's standard deviation, as CSS's):
+  the ancestors' backgrounds, the siblings and the content scrolling
+  under it, and the window's backdrop where it has one. The node's own
+  `bg`, border and children paint over the blur, so a translucent `bg`
+  is frosted glass; it is clipped as the node is and faded by its
+  `opacity`. The core emits a `QuadKind::Backdrop` quad
+  (`KUI_QUAD_BACKDROP`) just before the node's own paint, carrying the
+  shape, the clip, the radius in physical px and the group opacity.
+  kui-wgpu draws a frame that has one into an offscreen copy of the
+  surface, breaks the pass at each, copies out the region under the node
+  plus three radii around it, averages it down by a power of two that
+  leaves a kernel of two to four texels, blurs it along each axis, and
+  writes it back inside the node's rounded rect and its clip, mixing by
+  coverage and opacity with blending off so a transparent window stays
+  premultiplied; then blits the frame to the surface. A frame without
+  one is drawn exactly as before, and the offscreen textures go after
+  120 frames without one. A renderer that cannot read back what it drew
+  draws nothing for the quad, which leaves the node over an unblurred
+  backdrop; a headless core has the quad in its display list and no
+  pixels. `diag::BACKDROP_BLUR_HIDDEN` warns of one under an opaque `bg`
+  of its own, which hides all of it. The devtools inspector and
+  `Core::nodes` (`backdropBlur` in Node) read the radius. Seen on Windows
+  11 in the new `backdrop_blur` example, in an opaque window and over
+  Acrylic: the cards under the toolbar smeared, the edge below it sharp,
+  the badge's blur inside its corners. *What you can delete:* a
+  toolbar's opaque fill over content that scrolls under it.
+- **Submenus** (backlog F128, from Noticon, for "Move to ▸" and "Sort by
+  ▸"). `MenuItem::submenu(label, rows)` — `items` on a row in Node and
+  Lua, read by the one row parser — is a row with a chevron that opens
+  its rows in a menu beside it: when the pointer rests on it, on a click,
+  on Enter or the Right arrow (focus on its first row). Left or Escape
+  closes it, focus back on its row, and Escape again closes the menu.
+  They nest, in the context menu, a select's list and the drawn menu
+  bar's menus alike, and a chosen row inside posts its own `{kind:"menu",
+  role, item}` on the node the menu is about, as any row does; the row
+  that opens one is never chosen. On macOS the context menu and the menu
+  bar build an `NSMenu` submenu, which AppKit opens itself, and report a
+  row inside by its path. A host showing menus itself reports one with
+  `Core::activate_menu_path` / `activate_menu_bar_path` (Node
+  `activateMenuPath` / `activateMenuBarPath`); `menu()` reads a row's
+  `items` back. `Core::menu_submenus` / `menu_bar_submenus` say what is
+  open. The pointer opens and closes on a change of row, with no timer,
+  so a pointer resting on one row does not undo what the keyboard opened.
+  In C a row's `submenu` / `submenu_count` (ABI 26) nest the same
+  `KuiMenuItem`s, in `kui_open_menu`, `kui_select` and `kui_menu_bar`; a
+  row's flags carry `KUI_MENU_ITEM_SUBMENU`, and a host showing its own
+  menus reads and reports a row inside by its path —
+  `kui_menu_submenu_count` / `kui_menu_item_path` /
+  `kui_activate_menu_path`, and the bar's `kui_menu_bar_submenu_count` /
+  `kui_menu_bar_item_path` / `kui_activate_menu_bar_path`; Odin's
+  `Menu_Item.submenu` and the same doors. A C menu nested past 32 levels
+  — a row that is its own submenu — is refused, as an unknown role is.
+  *What you can delete:* a list cut short because a menu could not
+  nest — Noticon's `MOVE_TARGETS` cap on the folders a note can move to.
+
+- **A span in a face and a size of its own** (backlog F130, from
+  Noticon, whose inline `code` was drawn in the body face with a wash).
+  `Span::family(FontFamily)` / `Span::mono()` and `Span::size(px)` —
+  `family`, `font` and `size` on a JSX `<span>` and in a Lua span table,
+  `KuiSpan.family` (with `KUI_SPAN_FAMILY`), `.font` and `.size` in C,
+  the same fields on Odin's `Span`. The paragraph still shapes as one
+  flow; each span's glyphs are shaped in its face, at that family's
+  weights, so a caret, a hit, a selection and the measurement read the
+  glyphs that are drawn and byte positions stay exact across a change of
+  face mid-line. A sized span's line height scales at the paragraph's
+  ratio, a line is as tall as its tallest span (every span then carries
+  its metrics, so a line of only smaller ones never comes out shorter),
+  measurement sums the lines' own heights, a selection and a caret are
+  their line's height, and a span's background is its own height around
+  its glyphs rather than the line's. A paragraph with a sized span is
+  shaped whole, never chunked as a long line. Pinned by
+  `tests/span_face.rs` (the mono width, carets and hits across the
+  change, line heights, the caret, the wash), Node's `a span takes a face
+  and a size of its own`, and the corpus's first scene, which gained a
+  mono span and a sized one in all five adapters; the `text` example
+  shows inline code and a larger word. *What you can delete:* inline code
+  drawn in the body face, or as a box beside the text.
+
+### Fixed
+
+- **A menu's accelerator reads as the platform writes it** (backlog
+  F127, from Noticon). `MenuItem::accel` drew its string verbatim in a
+  context menu, so a row declared with the portable `"mod+shift+n"` —
+  the spelling the docs give for a menu bar, where it was already
+  rewritten — showed those eleven characters. `open_menu` now rewrites
+  an accelerator it can parse into `Accel::display`'s spelling, as
+  `declare_menu_bar` does, and the drawn rows read every accelerator
+  through `Accel::label`, so a menu an app draws itself with
+  `widgets::context_menu` gets the same. A spelling kui cannot parse
+  (`"gd"`) is still drawn exactly as written. `MenuItem::accel_label`
+  is the drawn string; `accel_text` stays the declared one. *What you
+  can delete:* the `Accel::parse(..).display()` an app ran over its own
+  accelerators before handing them to a menu.
+- **A menu is as wide as its rows** (backlog F127). The panel was the
+  metric's 200 px whatever it held, so a long label beside a long
+  accelerator wrapped one of them onto a second line. It is now as wide
+  as its widest label plus its widest accelerator, with at least
+  `widgets::MENU_ACCEL_GAP` between them, and never narrower than
+  `Metrics::menu_width`; labels and accelerators are one line each.
+- **`scripts/npm-approve.nu` takes the version as npm spells it.**
+  Approving alpha.42 as `nu scripts/npm-approve.nu
+  @qxuken/kui@0.1.0-alpha.42` looked for a stage whose version was the
+  whole spec, found none, and said "nothing staged for
+  @qxuken/kui@@qxuken/kui@0.1.0-alpha.42" while the stage sat there. The
+  package prefix is cut off now, and a spec naming another package is
+  refused by name. A release script, so nothing an app sees.
+- **A macOS menu shortcut on a named key works** (backlog RG146). The
+  bar (since alpha.11) and now the context menu build each item's key
+  equivalent from the accelerator in the platform's spelling, and
+  `Accel::parse` read `⌘⌫`'s `⌫` as a character: AppKit drew ⌘⌫ beside
+  the row and the chord did nothing, as with ⌘↩, ⌘← and every named
+  key. `parse` now reads a key as `Accel::display` writes it, in either
+  platform's spelling.
+- **A dead menu row cannot be chosen by reporting it** (backlog RG147).
+  The bar's activate doors performed a disabled row, or one in a
+  disabled menu — kui.h said they refused it — and `activate_menu_path`
+  a row under a disabled submenu row. Every row on the path must be
+  enabled now, as the drawn menus need.
+
+**What you can delete.**
+
+- The `Accel::parse(..).display()` an app ran over its accelerators
+  before handing them to a context menu (F127).
+- A menu cut short, or flattened, because menus could not nest: "Move to
+  …" rows one per folder up to a cap (F128).
+- A toolbar's opaque fill over content that scrolls under it (F129).
+- Inline code drawn in the body face, or as a box beside the text (F130).
+- A toolbar's opaque fill over content that scrolls under it (F129).
+- Inline code drawn in the body face, or as a box beside the text (F130).
+
+### Native verification
+
+The by-hand round alpha.6 introduced (backlog R4), on 2026-10-08, over
+F126–F130 from the Noticon wish list, with alpha.43's pre-tag pass over
+them on the Mac: the mechanical round, then three read-only reviews of
+the diff since alpha.42 (the window backdrop and the blur; the menus and
+the span's face; the docs), each claim probed. They filed RG146–RG149,
+built before the tag (a macOS menu shortcut on a named key binding no
+key, a host's report of a dead menu row performed, an Escape spent on a
+submenu an app-drawn menu had noted, a Node span's family losing to an
+inherited font handle), and RG150, open.
+
+**macOS**, the pre-tag pass. fmt and clippy are clean; `nu
+scripts/test.nu`: **1911 tests over 142 suites**, 0 failed. The C round
+passes, and so do the **57 scenes**; Node's tests under
+`KUI_CONFORMANCE_REQUIRED=1` (**218 of 218**), `npm run gen` with no
+diff, the examples' typecheck, the headless round (with `backdrop_blur`'s
+drive, which the roster had left out) and the book. The windowed round
+with Node's: **128 windows** (one `transition` window hung at the
+timeout on a first run four at a time and drew on eight runs alone and a
+whole second round). The AX audit: **106/106**. The bench guard against the alpha.42 tag:
+**green**, the guarded rows −0.4 to +3.1% (`deep_nesting_64_levels`,
+−2.1% on a second run); the stream, long-line and cell grid rows flat.
+The Odin
+binding's four steps did not run here — the machine's `odin` links an
+`llvm@22` no longer installed — so CI's check on the tag is their run.
+F126's macOS half and F128's macOS menus were compiled and run on a Mac
+the day they were built, through Noticon; F126 has not met KDE or GNOME.
+
+## 0.1.0-alpha.42 (2026-10-07)
+
+**What breaks.**
+
+- A press after a dead key it does not combine with carries what the
+  platform typed in its `text`: German's `^ space` is a Space whose
+  `text` is `^`, and `^ z` a `z` whose `text` is `^z`, where they said `" "`
+  and `z` — in a key sink's payload and in what an editor inserts (under
+  Fixed, RG127). A keymap that binds Space by its `text` rather than its
+  `code` sees the accent there.
+- Node: a whole number past 2^53 in a message comes back a `number`,
+  where it came back a `BigInt` (RG138).
+- C: `kui_take_menu_action` with a NULL or too-small `out` leaves the
+  action queued, where it dropped it; `kui_take_warnings` keeps what does
+  not fit `cap` for the next call, where it dropped it; `kui_draw_data`'s
+  `fragments` and `textures` are NULL on a frame that draws none, where
+  they were a non-NULL pointer to nothing (RG133, RG134, RG131).
+- A text style whose size or line height is under a pixel — 0, negative,
+  NaN — shapes at a pixel, where Node and Lua aborted or hung and Rust
+  panicked (RG136); a cell grid's rows are a pixel apart at an infinite
+  one, where they went to the layout's limit (RG144).
+- Rust: `schema::Door`, `schema::CustomProp` and `schema::ElementDef` gain
+  `odin` (under Added, the Odin binding), so a struct literal of one needs
+  the field.
+
+C stays at ABI 25 (kui.h gains no function and no field; four doors now
+keep what it always promised) and the Node wire at v21 (no frame version).
+
+### Added
+
+- **An Odin binding, experimental** (`packages/odin`). `kui/c` mirrors
+  kui.h declaration by declaration, pinned to the C compiler's layout by
+  848 generated `#assert`s. `kui` is the typed layer, generated from
+  kui.h and the prop schema:
+  - `Spec` and `Text_Style`, one field per schema row;
+  - an enum or bit set per family of constants;
+  - a door per C function: out-params as results, arrays as slices,
+    messages as plain Odin values with `#[derive(Message)]`'s `kind`
+    rule.
+
+  The elements are written by hand: containers close at the end of their
+  `if` through `@(deferred_in)`. A C function the hand-written files do
+  not call gets a generated door, so the binding covers kui.h whole: 219
+  generated, 51 by hand, 2 skipped with their reason.
+  `examples/odin/tools/surface.odin` is `surface.c` through it, and calls
+  every door, and `examples/odin/tools/conformance.odin` rebuilds the
+  scene corpus through `Spec` and the doors, matching the reference report
+  byte for byte, as the Rust, Lua, C and Node adapters do.
+  `polyline` and `polygon` take points (`[][2]f32`), the count kui.h
+  means; a dash or a pivot is a fixed array in a `Maybe` (`[5]f32`,
+  `[2]f32`), so a short one cannot be written; and pixels are checked
+  against the size beside them.
+
+  It covers extensions both ways. An Odin host loads a plugin with
+  `ctx_add_extension` and `slot`. An Odin plugin is a shared library whose
+  seven `kui_ext_*` exports are one line each over `extension.odin`.
+  Built with `KUI_PLUGIN` on macOS and Linux, it links no kui and loads
+  into any host (on Windows it imports `kui_ffi.dll`, as a C plugin does):
+  `nu scripts/odin.nu slots` drives the Odin panel in the C and Rust
+  hosts and the C panel in the Odin host.
+
+  Run it with `nu scripts/odin.nu gen | test | slots | run counter`. It is
+  not published. CI's `check` installs a pinned Odin release (`ODIN_VERSION`)
+  and runs `gen --check`, `check`, `test` and `slots`, so a header or schema
+  change that was not regenerated goes red there. All four also run green
+  by hand on Windows x64 and Linux x64. On Windows the binding links
+  `kui_ffi.dll.lib`, odin.nu puts `kui_ffi.dll` beside the programs, and
+  `gen --check` reads a CRLF checkout as current.
+- `scripts/pack-ffi.nu`: libkui_ffi for every platform kui ships, dynamic
+  and static, with `kui.h`, rustc's `native-static-libs` as `link.txt`, a
+  tarball each and `SHA256SUMS`. It is for a C or Odin host that links a
+  library instead of building the workspace. The machine's own platform
+  is built natively. Linux x64 and arm64 (glibc 2.28) and Windows x64 are
+  built in a pinned Docker image, with cargo-zigbuild at the release
+  workflow's pins and with cargo-xwin. Windows also asks for
+  `--accept-msvc-license`, for the CRT and SDK xwin downloads. macOS is
+  built on a Mac only. A Windows pack carries windows-targets' import
+  libraries (`windows.0.53.0.lib`, `windows.0.52.0.lib`), which its
+  `link.txt` names and no SDK has, so a static link finds them. Every
+  leg has been run, and a C host linked against each x64 pack alone,
+  dynamically and statically, and run; the arm64 pack was read, with no
+  arm64 machine to run it on. `kui.h` ships with LF line ends from any
+  checkout.
+- `examples/rust/tools/schema-dump.rs`: the prop schema (props,
+  composites, elements, events, the verb table, the name lists) as JSON,
+  for a binding generated outside Rust.
+- The verb table (`schema::DOORS`) and `docs/props.md` have an Odin
+  column beside C's, each spelling held by the Odin generator both ways;
+  Node's `protocol()` carries it (`Door.odin`).
+
+### Fixed
+
+- **A dead key types its accent before a key it does not combine with**
+  (backlog RG127, from the Windows and Linux round after alpha.41). With
+  German, `^ space` typed a space where it types `^`, `´ space` a space
+  where it types `´`, and `^ z` a `z` where it types `^z` — on Windows
+  always, and under X11 with `imeOff` on; on US-International, where `'`
+  and `"` are dead, a quote could not be typed at all. winit composed it
+  right: the runner read a press's text off the logical key, which is
+  the key the accent fell back to, and Space's insert was a space
+  whatever the press carried. A press's text is now what the platform
+  composed, the layout's character where it composed nothing, and Space
+  inserts its own. `^ e` was right and is unchanged; with the input
+  method on, X11 composes through XIM as before.
+- The docs of F103 (alpha.41) said an animating Windows window behind
+  other windows skips its frames. It does not: DWM composes a covered
+  window, and it draws at the display's rate, 241 frames a second here,
+  as an uncovered one does; minimized, it asks for none (RG45). F103's
+  wait holds there only for an acquire that times out. `retry.rs` says so
+  now (backlog RG128).
+- **Text is read aloud on Windows and Linux** (backlog RG129, from the
+  regression and smoke round after RG127). Every static text — a line of
+  text, a list row's content, a drawn title — reached UI Automation with
+  an empty Name and AT-SPI with an empty name: AccessKit names a label by
+  its value, and kui set only its label. macOS read it all along.
+- **A disclosure or a select opens from Narrator** (RG130). UI
+  Automation gives a node with `expanded` its ExpandCollapse pattern in
+  place of Invoke, and its Expand and Collapse reached nothing. They are
+  the node's click.
+- **A text size or line height of 0 no longer ends the process** (RG136).
+  `lineHeight: 0`, `size: 0`, or a size under 0.4 (whose line height
+  rounds to 0) aborted a Node or Lua process — cosmic-text asserts a line
+  height is not 0 — and a negative one spun its layout; on an `edit`, a
+  `cells` and in `measureText` too. Every buffer is shaped at a pixel at
+  least. C's door had always read them as unset.
+- C: what kui.h says a door hands out lives as long as it says (RG131–
+  RG134). A second `kui_draw_data` in a frame freed the arrays the first
+  handed out; `kui_access_runs` freed the strings `kui_access_tree`
+  handed out; reading a menu row or asking for a copy freed a taken menu
+  action's text; and `kui_take_warnings` dropped what did not fit `cap`,
+  where kui.h says the rest wait.
+- A custom editor whose `caret` or `selection_anchor` falls inside a
+  character has an access tree (RG135): the run was sliced there and
+  panicked, which under C emptied the tree every frame; the position is
+  the character's start.
+- Node: `measureText` inside a `<devtoolsTab>` function child no longer
+  breaks the frame being encoded (RG137); a message, a `<select>` option
+  or a `menuBar` row holding a string cut through an emoji draws its lone
+  surrogate as U+FFFD rather than failing the frame, and `dir: null` is
+  absent like every other null prop (RG138, RG140).
+
+### Native verification
+
+The by-hand round alpha.6 introduced (backlog R4), on 2026-10-07, over
+the rounds after the alpha.41 tag — the Odin binding and `pack-ffi.nu`,
+RG127 and RG128 from the Windows and Linux round after alpha.41, and the
+regression and smoke round after RG127 (RG129–RG138) — with alpha.42's
+pre-tag pass over them on the Mac: the mechanical round, then four
+read-only reviews of the diff since alpha.41 (the Odin binding; the C
+doors and `pack-ffi.nu`; the runner's keys, the access bridge, the text
+floor and Node; the docs), each claim probed. They filed RG140–RG144,
+built before the tag (a `<select>` option or menu bar row cut through an
+emoji failing the Node frame, `kui_draw_data` while a frame built losing
+the finished frame's fragment draws, the Odin drains freeing the strings
+they returned, Odin's popups, unchecked slices and acronym kinds, a cell
+grid's infinite line height), and RG145, open.
+
+**macOS**, the pre-tag pass. fmt and clippy are clean; `cargo test
+--workspace --features kui-core/conformance`: **1856 tests over 139
+suites**. The C round passes, and so do the **57 scenes**, the Odin
+binding's `gen --check`, `check`, `test` and `slots`, Node's tests under
+`KUI_CONFORMANCE_REQUIRED=1` (**215 of 215**), `npm run gen` with no
+diff, the headless round and the book. The windowed round with Node's:
+**124 windows**. The AX audit: **106/106**. RG127's dead keys, which the
+Windows and Linux round could not reach on a Mac: twelve sequences typed
+into the `edit` example through `CGEventPostToPid` and read back through
+AX, each as AppKit composes it (`⌥e e` is `é`, `⌥e space` `´`, `⌥e z`
+`´z`). The bench guard against the alpha.41 tag: **green**, the guarded
+rows −1.2 to −0.3%, RG126's warm cell grid −0.4%.
+
+**Windows 11 x64 (MSVC) and Linux x64 (WSL Ubuntu 24.04), rustc
+1.99.0**, on the tree with the pre-tag fixes and `pack-ffi.nu`'s. fmt
+and `cargo clippy --workspace --all-targets --features
+kui-core/conformance -- -D warnings` are clean on both. `cargo test
+--workspace --features kui-core/conformance`: **1857 tests over 140
+suites** on Windows (5 ignored), **1853 over 139** on Linux (4
+ignored), **0 failed**. `cargo audit --deny warnings` is clean over
+`Cargo.lock`'s 444 crates. `pack-ffi.nu` ran every leg but macOS's: native
+on both, and linux-x64, linux-arm64 and win32-x64 (cargo-xwin) in its
+container. A C host linked against each x64 pack alone, dynamically and
+statically, ran; the arm64 pack was read, not run. It found three things,
+fixed before the tag (RG145): a CRLF `kui.h` from a CRLF checkout, the
+closing table lost off a terminal, and a `docker` that could not be
+spawned stopping the script. Earlier the same day, before the pre-tag
+fixes, the Odin binding's four steps passed on both, and the regression
+and smoke round after RG127 ran the windowed smoke and walked the
+accessibility tree through UI Automation and AT-SPI.
+
 ## 0.1.0-alpha.41 (2026-10-07)
 
 **What breaks.**

package/docs/adr/0007-composite-keyboard-patterns.md

@@ -331,7 +331,14 @@ derived orientation are the whole surface.
   decision 5's warning is where an app feels the missing semantic half.
 - **Submenus.** Left / Right in a `menu` should close and open them. kui
   has no submenu relation (a `menu` inside a `menuItem`), so today those
-  arrows step like any other menu's.
+  arrows step like any other menu's. *Built 2026-10-08 for the core's own
+  menus (backlog F128):* Right on a row with a submenu opens it with focus
+  on its first row, Left inside one closes it with focus back on its row,
+  and Escape closes the innermost before the menu. The relation is the
+  core's state rather than a derived one — a submenu's panel is a `menu`
+  beside its row, not inside the `menuItem` (which is named from its
+  content), and the item walk already stops at a nested `menu` — so an
+  app's own `menu` composites step on Left / Right as before.
 - **`radio-without-group`.** A lone `radio` is invalid ARIA and now also
   means "no arrows here". A warning in the shape of `control-without-name`
   once something in the repo declares radios — the fixture will, so this

package/docs/adr/0018-a-menu-bar-the-app-declares.md

@@ -189,6 +189,16 @@ does. An app that has to write the menu twice has not been given a menu.
   something wants one, it wants it in the context menu too, and that is one
   change to `MenuItem` rather than two features.
 
+  *Amended 2026-10-08 (backlog F128).* Something wanted one — Noticon's
+  "Move to ▸" and "Sort by ▸", in the context menu first — and it was that
+  one change: `MenuItem::submenu` (`items` in plain data, so every
+  binding's one parser reads it), drawn by the same `menu_panel` beside
+  its row, in the context menu and the drawn bar alike, and an `NSMenu`
+  submenu where the platform draws them. `BarMenu` is still one level;
+  its rows nest. There is no hover timer: the core opens or closes on a
+  *change* of hovered row, which is what keeps a pointer resting on one
+  row from undoing what the keyboard just opened.
+
 - **Standard application-menu roles** (`about`, `quit`, `services`, and
   macOS's `NSApplication` responders). They change what an item *is* — one
   the platform performs rather than one the app hears — so they need their

package/encoder.js

@@ -402,7 +402,8 @@ export function createEncoder(P) {
     const np = fi++;
     let n = 0;
     // dir and size first: the decoder constructs spec/style from them.
-    if (p.dir !== undefined && p.dir !== 'column') {
+    // `!= null`: a null dir is absent, as every other null prop is.
+    if (p.dir != null && p.dir !== 'column') {
       // `table` is a column whose rows' cells line up (ADR 0033).
       const dir = p.dir === 'row' ? 1 : p.dir === 'table' ? 2 : undefined;
       if (dir === undefined) throw new Error(`bad dir ${JSON.stringify(p.dir)} (row | column | table)`);
@@ -734,6 +735,8 @@ export function createEncoder(P) {
   // dotted (v13, backlog K4). A span's own underline colour and style
   // beat the enclosing span's; either implies the underline. Then the
   // background's radius (v17, backlog F101), 0 for a square one; a span's
+  // own beats the enclosing span's. Then the span's own face — `family`
+  // by name, `font` by handle, which wins — and `size` (v22); a span's
   // own beats the enclosing span's.
   function collectSpans(node, st, out) {
     if (node == null || typeof node === 'boolean') return;
@@ -751,7 +754,7 @@ export function createEncoder(P) {
         (st.ul?.ref ? 512 : 0) |
         (st.ulStyle === 'wavy' ? 1024 : 0) |
         (st.ulStyle === 'dotted' ? 2048 : 0);
-      out.push([String(node), flags, st.color?.v ?? 0, st.bg?.v ?? 0, st.ul?.v ?? 0, st.bgRadius ?? 0]);
+      out.push([String(node), flags, st.color?.v ?? 0, st.bg?.v ?? 0, st.ul?.v ?? 0, st.bgRadius ?? 0, st.family ?? null, st.font ?? null, st.size ?? 0]);
       return;
     }
     if (Array.isArray(node)) {
@@ -766,6 +769,12 @@ export function createEncoder(P) {
     if (p.bgRadius != null && !(typeof p.bgRadius === 'number' && p.bgRadius >= 0)) {
       throw new Error(`bad bgRadius ${JSON.stringify(p.bgRadius)} on <span> (a number of logical px, 0 or more)`);
     }
+    if (p.family != null && typeof p.family !== 'string') {
+      throw new Error(`bad family ${JSON.stringify(p.family)} on <span> (sans, serif, mono or an installed family's name)`);
+    }
+    if (p.size != null && !(typeof p.size === 'number' && p.size > 0)) {
+      throw new Error(`bad size ${JSON.stringify(p.size)} on <span> (a number of logical px, above 0)`);
+    }
     collectSpans(
       node.children,
       {
@@ -778,6 +787,11 @@ export function createEncoder(P) {
         ul: spanColor(p.underlineColor, st.ul),
         ulStyle: p.underlineStyle ?? st.ulStyle,
         bgRadius: p.bgRadius ?? st.bgRadius,
+        family: p.family ?? st.family,
+        // A span naming a family drops the handle it inherited, which
+        // would otherwise win over it.
+        font: p.font != null ? String(p.font) : p.family != null ? null : st.font,
+        size: p.size ?? st.size,
       },
       out,
     );
@@ -828,15 +842,18 @@ export function createEncoder(P) {
           collectSpans(el.children, {}, spans);
           f[fi++] = OP.richText;
           props(p, null, false);
-          reserve(8 + spans.length * 8);
+          reserve(8 + spans.length * 14);
           f[fi++] = spans.length;
-          for (const [text, flags, c, bg, ul, radius] of spans) {
+          for (const [text, flags, c, bg, ul, radius, family, font, size] of spans) {
             strRef(text);
             f[fi++] = flags;
             f[fi++] = c;
             f[fi++] = bg;
             f[fi++] = ul;
             f[fi++] = radius;
+            strRef(family);
+            strRef(font);
+            f[fi++] = size;
           }
         } else {
           f[fi++] = OP.text;