Expose Dawn's exact Vulkan instance for Linux presentation #649

Active implementation checkpoint — 19 September 2026

Exact upstream heads are WebScene 4df8c197d46610a9234a920db5da3b602376d308 and AppScene bbc59ae4e2e57e54088cce979bb50af4dac94f2e; unchanged Code OSS is 645f29cc3176500b4b5762ba887cf2a7f0ffdf2c. Local vscode-demo is 8ffbb5de and remains intentionally unpushed with Actions disabled.

Merged Linux stack: WebScene exact factory/query #645/#647, #646/#648 and VkInstance/resolver v2 #649/#650; AppScene allocator #260/#261; AppScene presenter ownership #262/#263. WebScene #650 also replaces the exception-dependent live-device registry that failed Dawn's -fno-exceptions build.

Only one subagent is active on AppScene #264, a native sub-issue of #184. From AppScene bbc59ae4 and WebScene 4df8c197, it owns the concrete same-instance Xlib Vulkan/Skia Graphite host: exact tuple validation, surface support, external memory/sync import, layout transitions, texture-backed images, retained-scene recording, swapchain acquire/present/completion, resize, teardown, and device loss. CPU/raster fallback and a second Vulkan instance/device remain forbidden. Clipboard is interrupted and untouched.

Consolidations remain open and unmerged: WebScene #76 at a414deed1cf00ab76d3a0bcc185eeb1c310ce328, AppScene #65 at 0170ea479b81cf0c210cf902b8921b123eb42e4d, and vscode-demo #1. WebScene current-main runs 35435909460, 35435909464, and 35435909467 are retained; superseded and consolidation jobs were cancellation-requested. AppScene current-main Linux SDK passed for #263. #264 also owns the two deterministic AppScene policy-document corrections from the #263 PR.

Ordered next work: merge #264, resume clipboard as the sole lane, then complete real Linux pixels, synchronization/device-loss, resize, FD/GPU-residency, zero-CPU-transfer, performance, VM/computer-use and unchanged Code OSS package acceptance. The recorded desktop-service, workspace/file/webview/terminal/worker/accessibility/CSS/Windows/SDK backlog remains open.

Parent: #28. Overall Code OSS integration: #227. AppScene dependents: SceneTech/AppScene#184, SceneTech/AppScene#262, and SceneTech/AppScene#130.

Problem

The merged exact-device query from #646/#648 returns Dawn's live VkPhysicalDevice, VkDevice, VkQueue, queue family, and UUIDs. AppScene can therefore allocate/import exact-device images, but it cannot construct the concrete X11 Vulkan/Graphite presenter safely: vkCreateXlibSurfaceKHR and Skia's Vulkan backend need the owning VkInstance and an exact instance procedure resolver. Creating a second VkInstance would break the same-instance/device invariant and must fail closed.

Scope

• Add a versioned successor to websceneDawnQueryVulkanDeviceV1 that returns the exact borrowed VkInstance alongside the existing live Vulkan tuple.
• Return an exact vkGetInstanceProcAddr-compatible resolver or an equivalent public function-query contract so AppScene does not assume a different Vulkan loader/dispatch domain.
• Preserve the live-device registry check before any Dawn object dereference; reject foreign, stale, lost, non-Vulkan, incomplete, or version-mismatched requests atomically.
• Keep all Dawn private headers and casts inside the pinned WebScene/Dawn bridge. Publish only opaque C ABI values plus the public C++ lifetime wrapper.
• Retain the same wgpu::Device lifetime anchor; AppScene borrows and never destroys the instance, device, queue, or resolver.
• Record whether the required X11 surface extensions are enabled for the returned instance and fail closed when Xlib presentation cannot be constructed.
• Extend installed SDK headers, symbol/export policy, cache/hash inputs, native-source contracts, and focused validation documentation.
• Preserve v1 ABI behavior for existing consumers.

Acceptance

• Foreign/stale/lost-device and ABI-size/version negative cases execute before private Dawn dereference.
• Returned instance/device/queue/proc resolver are proven to belong to one live Dawn Vulkan backend.
• A Linux X11 consumer can create and destroy an Xlib surface with the borrowed instance without creating another VkInstance or VkDevice.
• AppScene can construct its qualified Skia Vulkan/Graphite context from the same tuple.
• No CPU transfer, raster fallback, browser, WebView, Electron, CEF, or Dawn-private-header exposure.
• Installed-SDK symbol/header/source-contract checks and real Linux Vulkan qualification are documented.