[m-mdy-m]

Summary

Add the first reusable production GUI-SDL adapter layer, separately from the SDL smoke preview.

• Export an installable CMake library target cdin::frontend_ui_gui_sdl when CDIN_FRONTEND_BUILD_UI_SDL=ON; keep the preview application as a separate target.
• Keep SDL types and includes out of Core/public Protocol headers. The Composition Root owns the transport and Core Session, and supplies an already attached Driver Session to the adapter.
• Add SDL window/renderer lifecycle with rollback on partial startup and ownership-aware video-subsystem teardown.
• Forward physical non-text keys (press/repeat/release), committed UTF-8 text, Ctrl+Shift+V paste, focus and pixel resize through the public Core Session API. Printable keys are not sent twice as both key and text.
• Add an independent bounded GUI model with view/version checks, staged view.lines responses, response-flush commit/ACK, and version-pinned line requests.
• Add platform-independent model regression coverage that runs in the normal native CI even when SDL is disabled.
• Update the GUI-SDL architecture and README to separate implemented behavior from remaining release gates.

Deliberately incomplete

This is a production adapter foundation, not a claim of a completed desktop editor. The renderer is currently an ASCII/debug-text baseline and renders one attached view. Full pane-tree rendering, style roles, selections/cursor visualization, scrolling, font fallback, shaping, grapheme mapping, bidi/Persian rendering, IME composition, mouse capabilities, panels/widgets, device-loss recovery and the full SDL native matrix remain open.

The optional FreeType/HarfBuzz/FriBidi proposal is not introduced as a dependency.

Verification

• Native Ubuntu, macOS and Windows Core/TUI jobs plus Pipeline quality passed in CI run 42295241142.
• SDL3 3.4.16 production adapter, preview and GUI model tests passed under AddressSanitizer in CI run 42295241142.
• Clean-prefix install/export consumer linked cdin::frontend_ui_gui_sdl and resolved the SDL3 dependency in CI run 42295241142.
• CDIN-owned live Backend/Runtime + GUI session smoke (tracked by CDIN PR #110); this is outside the independent Frontend package job.

Snapshot commit semantics

The GUI semantic model now stages snapshot fields independently of the renderable state and commits them only on a valid snapshot-scoped ui.flush. It validates the flush revision, rejects stale snapshot groups without mutating the committed version/cursor/selection/style state, and acknowledges stale flush sequences so Backend queue capacity is released. Response-scoped line data remains staged until its own response flush. Regression coverage verifies pre-flush invisibility, atomic commit, version-pinned line response commit and stale revision rejection.

Latest status — 2026-11-07

The current PR head 1dd2fc0826d302883fa0e6bab0cbead3ec84a6d4 passed the full Frontend CI run 42304001468. The SDL3 job includes AddressSanitizer execution of the GUI model and adapter tests, package installation and a clean-prefix downstream CMake consumer. This head also corrects the model test's NUL terminator literal so it checks the actual empty view-id state. The earlier adapter smoke crash at cdin_frontend_session_resize was caused by a test constructing an attached Session without the attach-established pixel/cell units; Core Session now rejects missing/invalid units, and the test sets the same state that a negotiated attach establishes.

The GUI-SDL model now binds its first semantic Runtime view ID from the first view-scoped snapshot message; it no longer assumes the Frontend ATTACH viewport ID equals Runtime's document view ID. The adapter smoke also pushes SDL text input and Ctrl+S key-down events through the same SDL queue/pump and verifies that the Core Session emits distinct input.text and input.key frames. Both native and AddressSanitizer GUI-specific suites passed in CI run 42304001468.

This PR is ready for independent review as an installable adapter foundation. It does not claim a complete desktop editor: the renderer remains an ASCII/debug-text baseline and text shaping, bidi/Persian, IME, multi-pane rendering and recovery remain open. The live CDIN Backend/Runtime composition smoke is tracked separately in CDIN PR #110 and is not part of this repository's component-only CI.

CDIN integration pin — 2026-11-07

CDIN currently consumes this PR candidate at immutable revision 1dd2fc0826d302883fa0e6bab0cbead3ec84a6d4. The adapter's semantic model binds the first view-scoped snapshot to the Runtime-generated view ID instead of assuming the Frontend's attach view ID and Runtime's document view ID are identical. Frontend CI run 42304001468 passed all native jobs, SDL3 AddressSanitizer/package-consumer verification and Pipeline quality. CDIN's end-to-end GUI smoke remains a separate product-level check in PR #110; no full editor/release readiness is claimed here.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T21:57:23.742501Z	0623543	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[m-mdy-m]

Status update — 2026-11-07

Frontend CI run 42295241142 passed the Linux/macOS/Windows and Pipeline matrix. The SDL3 job passed AddressSanitizer model/adapter tests, installed the public cdin::frontend_ui_gui_sdl target, and linked a clean-prefix consumer.

The earlier SDL smoke crash was traced to the test constructing an ATTACHED Session without the units value normally established by cdin_frontend_session_attach(). The Core resize API now fails closed when that metadata is absent/invalid, and the smoke uses a pixel-attached Session state.

This PR is marked Ready for Review as an installable adapter foundation only. The renderer is still ASCII/debug text and the live CDIN Backend/Runtime integration smoke remains a separate gate in CDIN PR #110. No desktop release-readiness claim is made.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 06235437dc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[m-mdy-m]

Integration verification update — 2026-11-07

Current PR head 1dd2fc0826d302883fa0e6bab0cbead3ec84a6d4 passed Frontend CI 42304001468: Linux, macOS, Windows, SDL3 AddressSanitizer model/adapter tests, install/export clean-prefix consumer and Pipeline quality. The model now binds the actual Runtime view ID on first view-scoped snapshot; it does not assume that the Frontend attach view ID and Runtime-created document view ID are the same.

CDIN pins this exact immutable commit in its current deps.lock. The live Backend/Runtime/SDL input/save test belongs to CDIN PR #110 and must pass independently before CDIN calls its GUI flow verified. This PR remains an adapter foundation, not a complete desktop editor.