✨ Slice D of #848: draw and own a REPL terminal

[taras]

Why

Issue #848 asks for a REPL that can run one XMD entry and reconstruct it from a
URL. It is delivered as five slices; this is Slice D, the terminal platform —
the layer that decides where things go, draws them, and gives the terminal back.
It references #848 and does not close it: only Slice E makes xmd repl exist.

What changes

Before: a described screen reconciles into a mounted tree, but nothing places it,
nothing draws it, and nothing turns terminal bytes into the events it understands.

After: a committed tree is laid out at four sizes, rendered through one layout
engine, and answered back with the exact live node a pointer landed on;
presentation time has one owner; and every way out of the terminal restores it.

The runtime adapters exist as construction boundaries and are not registered:
no entrypoint imports one, and xmd repl does not appear in help.

How it works

committed frame → placement → engine ops → bytes → the terminal
                       ↓
              element id + geometry → the live node it came from
                       ↑
   bytes → normalized key or position → target → the same ancestry walk

Placement is presentation and nothing else: it reads the committed frame and
tells the tree nothing, so resizing moves things and changes no selection, no
model object and no action's meaning. Four profiles are decided — 160x36 wide,
120x30 medium, 72x20 narrow, and a refusal below the narrow minimum that
recovers when the window grows.

Only mounted nodes are drawn. Each frame carries an immutable map from the element
the engine measured to the live node that asked for it, valid for exactly the tree
revision that produced it — so a pointer from a frame the tree has moved past, one
naming a node that has gone, and one landing behind an open modal all reach
nothing. A pointer that does resolve becomes the same normalized event a key
produces and walks the same ancestry.

Presentation time has one owner: a single acknowledged frame stream. Holding a
subscription is what asks for frames, an advance waits until every subscriber has
applied the previous timestamp, and a settled tree schedules no timer at all.

Review guide

Start with: packages/cli/src/repl/layout.ts

Then review:

1. packages/cli/src/repl/renderer.ts — the frame map and capacity recovery
2. packages/cli/src/repl/frame.ts — the acknowledged stream and its ownership rule
3. packages/cli/src/repl/screen.ts — modes, the reader, and the single reset
4. packages/cli/src/repl/input.ts — normalization, and the two decoder repairs

Look carefully at:

• renderer.ts copies the engine's output immediately: render() returns a view
  into WASM memory that the next render overwrites and a resize detaches
• screen.ts registers each release before taking the thing it releases
• input.ts drains the scanner, which returns at most 128 events per call

What must stay true

• A frame map names only mounted nodes, for one tree revision — enforced by the
  renderer filtering against tree.mounted() and carrying the frame id, checked
  by the stale-frame, removed-node and behind-a-drawer rows.
• Output bytes are the caller's — enforced by copying out of WASM memory, checked
  by two renderers driven through one sequence where one caller scribbles over
  every result.
• Every exit restores the terminal exactly once — checked for success, refusal,
  failure, cancellation, end of input, and a cancellation during registration.

How to verify it

• F1 asserts semantic frames at all four profiles, five History rows, marker
  grouping that keeps every marker's identity, an explicit empty Sessions and a
  refusal that exposes no target.
• H1 proves one acknowledged stream, copied bytes, real capacity recovery and
  nearest-common-ancestor ownership; a settled tree schedules zero frames.
• H2 proves the restoration contract on every exit path, including halts during
  registration and during a pending read.

Scope

Included

• deterministic responsive placement, the renderer and its frame map
• the one acknowledged frame stream
• the terminal Api, its portable half, and the one owner of its modes
• byte and pointer normalization
• four unregistered runtime-named adapter factories

Intentionally unchanged

• no screens, no command, no retained user data: Slice E
• nothing registers the adapters, so no other command acquires a terminal

New dependencies

• Package: @bomb.sh/tty 0.9.0, exact, private to packages/cli
• Used for: terminal layout, rendering and input decoding
• Why existing dependencies are insufficient: the repository has no terminal UI
  layer at all. It is used only behind renderer.ts and input.ts.

Two things this version does that the host has to work around, both documented at
the call site:

• scan() returns at most 128 events per call and buffers the rest, so a paste
  longer than that was silently truncated; the decoder drains until the buffer stops
  producing.
• scan() never resolves a lone Escape — the documented flush returns the same
  pending report and no event, however many times it is called. That decision is
  made at the normalization boundary, and the scanner is replaced afterwards so the
  spent ESC cannot join the next keystroke.

Generated or mechanical changes

• deno.lock and pnpm-lock.yaml are the intentional result of
  deno install --frozen=false then deno task setup, not hand-edited.
• test-weights.json comes from the Measure test weights workflow, run
  36319908505 at the accepted implementation head, committed unchanged. Floors
  12 deno / 7 node / 4 bun against installed 15/10/5, so no shard count moves.

Risks and limitations

• No frame this REPL produces comes close to the engine's capacity limits, so the
  recovery path is exercised with a deliberately oversized frame. Measured: text
  measurement capacity scales with the dimensions the engine was built for.
• Cells are word-wrapped rather than clipped, so text longer than a cell reflows.
  Every row the application emits is a single line that fits its region, so this
  is not reachable from the product; clip was tried and reverted because it made
  the engine report INTERNAL_ERROR at frame sizes that previously worked.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.