Conversation
added 30 commits
September 16, 2026 00:55
…list ROADMAP snapshot moved to 2026-09-15: GPUI default since v1.5.0, split/SSH/ backup remaining items verified done, open items are P4 split and gate loose ends. IME checklist rewritten for the default pebrel entry after the NEBULA_GPUI_SHELL spike removal.
\ce reactions (subscripts, stoichiometry, arrows, charges, states, precipitation/gas arrows, hydration dots) and \unit/\si/\qty/\SI unit macros now translate to standard math TeX before parsing; unsupported syntax keeps the exact source fallback. Corpus fixtures in math-rendering-test.md and the acceptance paper updated to the rendered expectation for the newly supported blocks; \pu stays a fallback negative.
…anes window.create now really creates a GPUI workspace window (monotonic ids, per-window pane namespace, process-level dispatch routing) instead of returning runtime_unavailable, and the new ssh.open opens an SSH pane via the existing connection flow with ssh_not_ready/error semantics. Schema, API docs and the conformance capability table updated; ssh_loop no longer skips.
Mirror ssh.open in the legacy runtime control path (new ssh tab through the existing TabRequest::NewSsh flow), pass &MathLayout at the shared terminal_math call site drifted by the product renderer signature, and make the wallpaper_rect re-export crate-visible for the dual-shell combination. cargo check now passes for gpui-shell, legacy-shell and the combined feature set.
…odel.rs (settings split step 8)
…settings/geometry.rs (settings split step 9)
…ntext/session_persistence.rs
… event handling to window_context/events.rs
126 long user-facing descriptions (settings help, provider/backup/SSH status messages, about page, reset and config errors) move from inline pick() calls to typed settings.help.*/settings.status.* catalog IDs with English and Simplified Chinese entries; other languages keep the English fallback per contract. Restores the startup_directory and bell help arms dropped during migration. Contract and i18n tests green.
…ngsView+helpers into settings/view.rs (settings split step 10)
…d draw helpers into settings/render.rs (settings split step 11)
…ges/appearance.rs (settings split step 12)
tab_insertion now scans the whole window_context module subtree after the P4 split; the markdown math fixture skips pebrel-test fallback negatives like the corpus test; and parse_formula runs mhchem substitution before ASCII arrow normalization so \ce formulas render through the legacy markdown reader too. The legacy suite could not even compile at the base commit; it is green again apart from known parallelism flakes.
…to settings/pages/ (settings split step 13)
…isplay split step 16)
…wing helpers (display split step 17)
…ges/ (settings split step 14)
…sts.rs, delete settings.rs budget line (settings split step 15)
push_quads was missing its match close and draw_text had two stray closers after the page extraction; the math corpus guardrail test moves beside markdown_view.rs via #[path] to keep the shared file under its ratcheted budget (same pattern as gitignore_tests.rs).
-WindowW/-WindowH resize the captured window to a fixed outer frame so both shells compare at the same grid, which the zoom-level stroke-width reconciliation and equal-grid perf runs need.
- powerline_icons: pub(super) items and display-scoped re-export, restore the grid::Dimensions trait import the moved drawing code relies on - settings pages: closure stubs need explicit types once arms live in their own functions without inference call sites; advanced page gets back its s/visible/group_y definitions - guardrails stroke ratchet tightens 32 to 30: two double-coordinate strokes merged onto single lines during page extraction, strokes themselves verified intact against the pre-split source - cli completions snapshot targets the default product surface; gate the test accordingly (legacy surface carries an extra flag by design) Both feature combos compile and their suites are green (legacy 1329/0 single-threaded; product 1484 with only the known watcher flake).
…(display split step 18)
added 21 commits
September 16, 2026 07:47
…corpus capture_acceptance.ps1 posts plain keystrokes to an isolated probe instance and screenshots via PrintWindow; capture_realinput.ps1 adds SendInput chords with AttachThreadInput focus for attended runs. GPUI ignores posted modifier chords, so chord-driven cases need the attended variant - documented in the acceptance protocol.
Documents what is already cross-platform (ai_hook core, managed-file ownership machinery, updater check/download/SHA), what a unix port must add (UDS server, config guard, installer executors, tray/hotkey native adapters), and restates that nothing is claimed usable before native runner verification.
… (display split step 19)
Step 19 moved CHROME_BAR_LOGICAL, toggle_sidebar and apply_scale_factor_change into panel_layout.rs but left their doc comments behind in display/mod.rs, where they silently attached to unrelated neighbors (NebulaUiFont, settings_view, nebula_save_ssh_host). Move each doc onto its item. Also resolves two long-dangling fragments that predate this branch: 'Max remembered commands for the history hint.' now documents HISTORY_MAX in nebula_history.rs (its only referent), and the superseded 'Shortcut sheet' note is dropped from display/settings.rs since keymap.rs already documents EDITABLE_ACTIONS/READONLY_ROWS and the sheet itself.
…ane.rs (display split step 20) Move the settings-pane state cluster out of display/mod.rs into a new display/settings_pane.rs: open/section/scroll plumbing, the settings_view() snapshot, tab activation, theme selection, the dropdown/toggle option families, the fetch/powerline/blur/session toggles, the opacity drag, the background color picker, the sync actions, the background-image and workspace dialogs, and the appearance reset. mod.rs drops 1053 lines (9292 -> 8235). The moved method bodies are byte-identical to their pre-move form; the only differences are the new import header and three private methods (settings_view, apply_nebula_theme, settings_toggle_targets) promoted to pub(super) so sibling modules in the display tree keep calling them. Verified: legacy + gpui cargo check clean; legacy suite 1329 passed / 0 failed (--test-threads=1); gpui suite 1484 passed (only the known side_panel::search watcher flake); file_line_budget and ui::guardrails green; rustfmt --check clean on the new file.
…rs (display split step 21) Move persist_nebula_settings and reload_nebula_settings_if_changed out of display/mod.rs into a new display/settings_persist.rs. These two own the nebula_settings.txt write path and the cross-window change-reload path (system theme, fonts, tray, keymap, ssh hosts, proxy). mod.rs drops 212 lines (8235 -> 8023). Bodies are byte-identical to their pre-move form; the only differences are the import header and reload_nebula_settings_if_changed promoted to pub(super) so update_config / handle_update in mod.rs keep calling it. Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1485 passed / 0 failed; file_line_budget and ui::guardrails green; rustfmt --check clean on the new file.
…lay split step 22) Move the backup-pane state cluster out of display/mod.rs into a new display/backup_pane.rs: item selection, the remote-config protocol option and field editing, the local export/restore file pickers, the passphrase confirm flow, and complete/cancel of a running backup operation. mod.rs drops 384 lines (8023 -> 7639). Bodies are byte-identical to their pre-move form; all methods were already pub, so no visibility change was needed -- only the import header is new. Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1484 passed (only the known side_panel::search watcher flake); file_line_budget and ui::guardrails green; rustfmt --check clean on the new file.
…_pane.rs (display split step 23) Move the WebDAV sync fields/actions and the whole AI-provider pane cluster out of display/mod.rs into a new display/providers_pane.rs: sync field editing and commit, provider select/add/delete, Codex apply, per-field editing and drag, save, and the connection self-test request/outcome plumbing. The inline section headers (设置→高级→同步 / 设置→供应商) move with their code so no orphaned header is left behind. mod.rs drops 474 lines (7639 -> 7165). Bodies are byte-identical to their pre-move form; the only difference beyond the import header is provider_edit_index promoted to pub(super) because settings_pane.rs (a sibling module after step 20) calls it. Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1484 passed with only the known non-deterministic side_panel::search file-watcher flake (the same suite ran 1485/0 at step 21, confirming the watcher tests are timing-flaky on this host, not regressed); file_line_budget and ui::guardrails green; rustfmt --check clean.
… (display split step 24) Move the two proxy segments out of display/mod.rs into a new display/proxy_pane.rs: the global proxy mode selection, pane-state snapshot, system-proxy probe and local-proxy scan, connection self-test request/status plumbing, per-host jump/protocol/override picks (segment A), and the ssh-proxy field editing -- focus, cursor, insert, place, commit, cancel (segment B). The keymap block that sits between them stays put for step 25. mod.rs drops 404 lines (7165 -> 6761). Bodies are byte-identical to their pre-move form; beyond the import header the only differences are invalidate_proxy_test and ssh_proxy_field_text promoted to pub(super) (called from settings_persist.rs and mod.rs respectively). Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1485 passed / 0 failed; file_line_budget and ui::guardrails green; rustfmt --check clean on the new file.
…lay split step 25) Move both keymap segments out of display/mod.rs into a new display/keymap_pane.rs: the 按键映射 search field, clash detection and visible-row projections (segment A), and the 键位自定义 (spec 002) capture flow -- begin/cancel/preview/assign/clear/commit (segment B). Segment B also carries the adjacent global quick-terminal hotkey registration glue (take_quick_hotkey_request / quick_hotkey_registration_done) and the nebula_save_ssh_host auto-save helper that sit alongside the customization block, matching the handover's original 7149-7277 span. mod.rs drops 380 lines (6761 -> 6380). Bodies are byte-identical to their pre-move form; beyond the import header the only differences are keymap_visible_readonly and keymap_clash_info promoted to pub(super) (settings_pane.rs reads them for the pane-state snapshot). Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1484 passed with only the known non-deterministic side_panel::search watcher flake (a one-off ssh_credentials parallel-ordering flake on the first run passed both isolated and on full-suite rerun, and has no code path to these changes); file_line_budget and ui::guardrails green; rustfmt --check clean.
…plit step 26) Move the contiguous pickers block out of display/mod.rs into a new display/pickers.rs: the live terminal-background preview, the shell picker, the startup-directory pick/clear/import flow, the font picker (catalog build, search-query field, popup scrollbar, family apply), the default shell/profile choosers, the shared settings text-drag glue, and restore_hidden_ssh_host. mod.rs drops 630 lines (6380 -> 5750). Bodies are byte-identical to their pre-move form; beyond the import header the only differences are preview_terminal_bg and rebuild_font_catalog promoted to pub(super) (settings_pane.rs reads them for the pane-state snapshot). Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); runtime_exec module 3 passed / 0 failed isolated; gpui full suite has only host parallel-contention flakes -- the independent_child test spawns cmd.exe and got exit code 1 instead of 7 under ~1495 concurrent tests (resource contention, not a logic failure; it passes isolated and passed the step-24 full run), plus the known side_panel::search watcher flake; file_line_budget and ui::guardrails green; rustfmt --check clean.
…step 27) Split the two adjacent glue blocks out of display/mod.rs into new files: - display/palette_glue.rs: command-palette toggle/open, the AI-session and shell menus, the directory picker, and the palette input/scroll/click/ hover/confirm plumbing (314 lines). - display/side_panel_glue.rs: the right-side drawer toggle, tab-rename caret editing, panel routing/layout/sync, and the SFTP panel open/close/hit/ click/upload/download/rename/delete plumbing (385 lines). mod.rs drops 699 lines (5750 -> 5051). Both bodies are byte-identical to their pre-move form; no visibility changes were needed (refresh_directory_picker and sftp_download_entry stay private -- only called within their own file). New imports: command_palette for the palette glue; file_dialog/sftp_panel/ side_panel, NebulaConfirm, chrome_reserve, PhysicalSize and UnicodeWidthChar for the side-panel glue. Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1485 passed / 0 failed; file_line_budget and ui::guardrails green; rustfmt --check clean on both new files.
…window_surface.rs (display split step 28) Move three segments out of display/mod.rs into a new display/window_surface.rs: - background image + window backdrop painting, GL make-current/swap-buffers, transparency and font-size/glyph-cache refresh (draw_background_image .. reset_glyph_cache, 265 lines) - present_frame and the focused-pane pane_view geometry accessor (89 lines) - the impl FrameTimer vsync-timeout block (35 lines), kept as its own top-level impl (struct FrameTimer stays in mod.rs with the other retained types) mod.rs drops 389 lines (5051 -> 4660). Bodies are byte-identical to their pre-move form (verified by a whitespace-insensitive char-stream diff); the only differences are six methods promoted to pub(super) (draw_window_backdrop, update_window_transparency, update_font_size, apply_min_window_size, reset_glyph_cache, present_frame -- called from mod.rs / settings_pane.rs) and the rustfmt trailing comma that wrapping the apply_min_window_size signature produces. Deviation from the handover's literal 10632-10676 span: request_frame stays in mod.rs. The handover's mod.rs-keep list explicitly retains the 'request_frame skeleton', and request_frame is the last method of the main impl Display block; keeping it honors the keep-list and avoids splitting the impl-Display close. compute_cell_size / window_size / tab_drop_index_from_visible_rows (free fns used cross-module) also stay in mod.rs. Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); runtime_exec isolated 1 passed; gpui full suite 1484 passed with only the known host parallel-contention runtime_exec flake (spawns cmd.exe, exit 1 vs 7 under ~1495 concurrent tests; passes isolated); file_line_budget and ui::guardrails green (radius/stroke/glow budgets unchanged -- byte-exact move within src/display/); rustfmt --check clean.
…lay split step 29) Move the two frame-pipeline segments out of display/mod.rs into a new display/frame_pipeline.rs: - segment A: the update/event pump handle_update + process_renderer_update - segment B: the per-frame draw orchestration -- the full-window draw entry, the pane/doc/image/settings frame wrappers, draw_pane_view, split overlays, finish_pane_frame, and the scrollback scrollbar geometry/grab/hit-testing draw_pane (which sits between the two segments) stays in mod.rs for step 30. mod.rs drops 491 lines (4660 -> 4168). Bodies are byte-identical to their pre-move form (verified by a whitespace-insensitive char-stream diff, 14445 chars); the only differences beyond the import header are draw_scrollbar promoted to pub(super) (called by draw_pane in mod.rs) and the rustfmt trailing comma from wrapping its now-wider signature. Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1485 passed / 0 failed; file_line_budget and ui::guardrails green (radius budget unchanged -- the 4 UiQuad::solid calls moved byte-exactly within src/display/); rustfmt --check clean.
…t step 30) Move the draw_pane method -- the 606-line single-terminal paint routine that lays out grid cells, cursor, search/IME/message-bar overlays, inline ghost suggestions, math coverage and the scrollback scrollbar -- out of display/mod.rs into a new display/pane_render.rs. mod.rs drops 614 lines (4168 -> 3554). The method body is byte-identical to its pre-move form (verified by a whitespace-insensitive char-stream diff over 17803 chars); the only signature change is fn -> pub(super) fn because frame_pipeline.rs (draw_pane_view / draw) calls it. The import header is a curated subset: trait imports kept only where their methods are actually called (Dimensions for grid/size accessors, IntoRects for cursor rects); UnicodeWidthChar and super::Error were dropped after confirming they are unused on every platform (all .width() sites are SizeInfo's inherent method; the only Error token is the MessageType::Error variant), including inside the method's cfg(not(windows)) / cfg(macos) blocks. Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1484 passed with only the known side_panel::search watcher flake; file_line_budget and ui::guardrails green; rustfmt --check clean.
…plit step 31) Move the two overlay segments out of display/mod.rs into a new display/overlays.rs: - segment A (797 lines): draw_confirm_modal, draw_ai_fix_bar, draw_ssh_delete_undo, set_focused_pane, the ssh_connect progress-card state + hit-testing + draw_ssh_connect, and draw_resize_hud - segment B (89 lines): draw_ime_preview (with its #[inline(never)]) mod.rs drops 886 lines (3554 -> 2667). Bodies are byte-identical to their pre-move form (verified by a whitespace-insensitive char-stream diff over 22869 chars); the only differences beyond the import header are six private draw methods promoted to pub(super) (called from frame_pipeline / pane_render). Import header is a curated subset: trait imports kept only where their methods are called (UnicodeWidthChar for char.width(), IntoRects for cursor .rects(), Dimensions for grid/size accessors); no cfg-gated code in these segments, so the Windows build fully represents usage. The 8 UiQuad::solid calls moved byte-exactly within src/display/, leaving the guardrails radius budget unchanged. Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1484 passed with only the known side_panel::search watcher flake; file_line_budget and ui::guardrails green; rustfmt --check clean.
…lay split step 32) Split the two adjacent overlay blocks out of display/mod.rs into new files: - display/completion_glue.rs: update_config, update_highlighted_hints, nebula_commit_line, nebula_record_directory, nebula_update_suggestion and draw_completion_popup (327 lines). - display/terminal_overlays.rs: format_search, draw_hyperlink_preview, draw_search, draw_render_timer, draw_line_indicator, highlight_damage and validate_hint_highlights (288 lines). mod.rs drops 615 lines (2667 -> 2052). Bodies are byte-identical to their pre-move form (verified by whitespace-insensitive char-stream diffs: 9603 and 8435 chars); the only differences beyond the curated import headers are nine private methods promoted to pub(super) (called from pane_render / frame_pipeline / window_surface). Trait imports kept only where their methods are called (UnicodeWidthChar for char.width(), Dimensions for grid/size accessors); the cfg(not(windows)) block in completion_glue uses only String methods, so no import is hidden behind it. The 2 '- s(1.0)' stroke lines and the UiQuad::solid calls moved byte-exactly within src/display/, leaving the guardrails stroke(30)/radius(56)/glow(9) budgets unchanged. Verified: legacy + gpui cargo check clean; legacy 1329 passed / 0 failed (--test-threads=1); gpui 1485 passed / 0 failed; file_line_budget and ui::guardrails green; rustfmt --check clean on both files.
…mod.rs budget (display split step 33) Move the #[cfg(test)] nebula_ux_tests module (17 unit tests) out of display/mod.rs into a new display/ux_tests.rs, declared as '#[cfg(test)] mod ux_tests;'. Following the settings/tests.rs convention the file holds the module body directly (de-indented by rustfmt), so 'super::' still resolves to the display module and every test import/call is unchanged. With the test module gone, display/mod.rs is 1781 lines -- under the 2000 default cap -- so this commit also deletes the 'nebula_app/src/display/mod.rs 11150' allowance line from architecture/file-budgets.txt, completing the P4 display split (mod.rs 9309 -> 1781 over steps 16-33). Test bodies are token-identical to their pre-move form (verified by a whitespace-insensitive char-stream diff over 7788 chars; de-indentation and import re-wrapping are whitespace-only). Verified: legacy + gpui cargo check clean (incl. --tests); legacy 1329 passed / 0 failed (--test-threads=1) with display::ux_tests 17/17 green; file_line_budget green after the budget-line removal; ui::guardrails green; rustfmt --check clean. gpui full suite shows only the known host parallel-contention flakes (runtime_exec cmd.exe spawn + side_panel::search watchers) under heavy load; note display/mod.rs compiles only under legacy-shell (gpui maps display to product_ui), so the legacy suite is the authoritative signal for this split.
Steps 16-33 moved the bulk of display/mod.rs's methods into sibling files, each taking their own imports; this left mod.rs's original import header carrying names nothing in the remaining file (Display::new, request_frame, the free helpers, the type/impl blocks) references. On the legacy build -- the only configuration that compiles display/mod.rs, since gpui-shell maps display to product_ui -- these surfaced as 37 unused-import warnings. Remove only the imports whose identifiers are textually absent from the whole file (so unused on every platform, including inside the cfg(not(windows)) and cfg(macos) GL blocks in Display::new): std::cmp, NonZeroU32, Deref, Path, MutexGuard, LogicalSize, ModifiersState, CursorIcon, the nebula_terminal event/index/selection/term/vte names that moved out, RenderableContent/Cursor, IntoRects, damage_y_to_viewport_y, SearchState, Mouse, MessageBuffer/Type, the renderer::rects names, and ShortenDirection/StrShortener. Also drop the unused 'mem'/'term' module self-bindings. Deliberately kept: the glutin imports and the Dimensions/Rasterize trait aliases (their trait methods resolve implicitly and the GL setup lives in non-Windows cfg blocks that cannot be compiled on this host), and the pub use / pub(crate) use re-exports (module API with potential cfg-gated consumers). This trims the warnings 37 -> 16 without risking the unverifiable platforms. Verified: legacy cargo check (incl. --tests) clean, 0 errors.
Steps 16-33 appended 'mod X;' declarations in extraction order rather than alphabetically, so rustfmt's reorder_modules flagged display/mod.rs. Sort the two contiguous mod groups (the settings/ssh group and the split-output group) by module name; this also corrects the pre-existing powerline_icons placement that had drifted after ux_anims. Pure reordering -- mod declaration order has no semantic effect; legacy cargo check (incl. --tests) stays clean. Note: display/mod.rs still carries pre-existing rustfmt reorder_imports diffs in its self:: re-export header (from steps 16-19); these cannot be auto-fixed here because running rustfmt in-place on mod.rs recurses into the CRLF-checked-out submodules and would rewrite them to LF (the ghost-change hazard the project rules forbid). They are cosmetic and affect no gate; every file this split created is rustfmt-clean.
…as done Update the open-items list and the P4 section: the four named oversized files are now split (display/mod.rs 11143 -> 1767 across 16 new facet submodules plus the step 16-19 four; display/settings.rs 8407 -> 1313; event.rs 3485 -> 1164; window_context.rs 3647 -> 910), all four file-budgets.txt allowances removed, and the gate matrix is green (dual-config build, legacy 1329 single-threaded, gpui suite, file_line_budget, ui::guardrails budgets unchanged, i18n contract 25, check_architecture exit 0). Note the gpui product shell maps display to product_ui and does not compile display/mod.rs, so the legacy suite is the authoritative signal for this split. G3 updated: fastfetch is in the parity set with GPUI z12/z16/z24 captures done; the legacy stroke-weight parity remains. G1 (equal-grid perf retest) and G2 (manual IME acceptance) stay open.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概述
按分支前 docs 里点名的 12 项欠账逐项落地（排除第 12 项「服务端强制保护」——维护者明确裁定），多子智能体协作，做完一项测一项。本 PR 为该任务的完整交付（51 commits，base =
main@ 43009fc）。完成情况
✅ 完整完成
\ce（元素/下标/计量数/箭头/电荷/状态/沉淀/气体/水合点）与\unit/\si/\qty/\SI单位宏（math/mhchem.rs+siunitx.rs薄替换桥，解析前翻译为标准 TeX，未知语法保持源码回退），16 个新单测window.create真实创建第二 workspace 窗口（单调 id、进程级分发）；新增ssh.open（destination 校验、ssh_not_ready语义、结构化错误），schema/API 文档/conformance 能力表同步pick()迁到settings.help.*/settings.status.*catalog（en+zh-CN，其余语言回退英文）IME_CHECKLIST.md：改写到当前默认入口（pebrel.exe；已删除不存在的 spike 环境变量引用）🔶 部分完成 / 待实机
ai_hook核心 +managed_files受管写入是纯 std 可共享；named pipe→UDS、守护进程、安装执行器、托盘/热键原生适配层是真正的原生缺口）；原生实现需 Linux/macOS runner——项目规则禁止写未经验证的原生代码capture_acceptance.ps1/capture_realinput.ps1），C8/C9 已由语料单测覆盖；和弦类需 attended 实机会话⛔ 阻塞（如实标注，未伪造为已交付）
P4 大文件拆分（详情）
四个点名超大文件全部按职责/面拆分，行为零变化，每步独立 commit + token 级保真自证（方法体逐字节等价，仅 use 路径与
pub(super)可见性标注差异）：display/mod.rsdisplay/settings.rssettings/九页模块化event.rsevent/input_dispatch+action_contextwindow_context.rswindow_context/{agents,session_persistence,tabs,chrome,events}architecture/file-budgets.txt中这四个文件的超预算津贴已全部删除。验证（全绿）
--no-default-features --features legacy-shell）+ gpui（--features gpui-shell --tests）product_ui提供 display，不编译display/mod.rs）runtime_exec进程派发 +side_panel::search文件监听，单独跑均过，与拆分无因果）file_line_budget✓ ·ui::guardrails✓（stroke 30 / radius 56 / glow 9 预算随字节级搬运不变）· i18n 合同 25 ✓ ·check_architectureexit 0 ✓备注
product_ui，不编译display/mod.rs，故本次拆分只对 legacy-shell 生效，以 legacy 测试套件为权威验证。display/mod.rs仍保留 16 个 legacy 下无害的 unused-import 警告与 re-export 头的 rustfmt reorder diff：前者是 glutin（cfg GL 块）/trait/re-export（公共 API），后者源自 steps 16-19；二者都无法在 CRLF 检出上安全自动修复（in-place rustfmt 会递归改写 CRLF 子模块，项目规则禁止），均不影响任何门禁。