Commit graph

2,973 commits

Author SHA1 Message Date
Admin
0fd1ea2e92 route: demo profile — native/demo features, side-panel and provisioning seams, hosted tiles, HTTP nav client
The demo build has no AI panel, no first-run bake and no local files: tiles come from the
hosted .mkmap archive, and search, routing, along-route lookups, weather, radar and wind
go through the site's API with client-side trip state.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:41:14 +02:00
Admin
5d28ed551a map: tile archive review fixes — legacy MBTiles path restored, decode off the UI thread, retry, cancellation, blob dedup, validation
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:34:56 +02:00
Admin
4144dc414c files: the spy test filesystem implements the clock
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:31:46 +02:00
Admin
9ae91aca3c asset-store: static export contract — versioned static index and a sanitized deterministic export-static tool
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:28:31 +02:00
Admin
fe920c8988 files: review fixes — demo scan exclusions, Zipf sizes, trash root guarded, depth bound, tests
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:28:30 +02:00
Admin
47ac158a42 asset-client: portable primitives — completion transport, cache store, static-site config
A completion-based Transport with the native TCP adapter and a platform-HTTP adapter over a
client-owned network runtime, a CacheStore seam with the filesystem cache and a memory
LRU, BlobContent / ClientLocation / Unavailable types, and native/web features so the
client builds for wasm32; static-site connect is a typed Unavailable until the runtime lane.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:26:03 +02:00
Admin
68fb182bf4 Merge work into webdemos: the unified trace switch
The startup trace keeps its topic gate and runs on the platform clock so it stays
wasm-safe.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:25:03 +02:00
Admin
3c7566a565 Merge work into webdemos: the mp prefix rename
apps/files, apps/sheets, libs/wm_api, libs/wm_theme and the renamed env vars and script
namespaces meet the demo seams; added demo files move to the renamed paths; the files app
keeps its own makepad_home so demo builds without the chat feature do not link the AI hub.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:23:11 +02:00
Admin
3389475d33 trace: one switch — MAKEPAD_TRACE=<topics>, trace!(topic, …), and /trace on the bridge
The per-crate *_TRACE / *_DEBUG / *_DUMP environment switches in
platform, widgets and cef become topics of one process-wide set:
startup, frame, present, timer, studio, gpu.*, shader.*, gl.*,
runview.dpi, wayland, tweak, map.*, cef. Hierarchical matching with
negation and all; read once at init; settable on a running instance
through GET /trace?topics=…; an atomic short-circuit keeps the
no-tracing case off the lock in per-frame code; spans are absent on
wasm32 where Instant panics.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 11:23:08 +02:00
Admin
debd8c1075 rename: the mp prefix goes — apps/wm, files, terminal, browser, task, sheets, image, video, pdf; libs/wm_api and wm_theme
Packages are makepad-<name> with the short name as the binary. Env vars
follow (MAKEPAD_WM_*, MAKEPAD_FILES_*, MAKEPAD_TERMINAL_*), config moves
under ~/.makepad/<app>/, the theme namespaces are mod.wm_theme and
mod.browser_theme, the hosted AI envelope key is wm_ai. platform/video
becomes makepad-platform-video so the video app can be makepad-video.
Carries the Score entries that were pending in the WM's curated table.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 11:17:12 +02:00
Admin
a7af3ea99a platform + mpfiles: platform clock instead of std::time on the web, unwind-safe event dispatch
std::time is unsupported on wasm32-unknown-unknown; the demo paths now use Cx::time_now
and the pinned demo clock, and Cx::call_event_handler restores its handler slot on unwind
with an explicit re-entry diagnostic instead of cascading into a second panic.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:11:42 +02:00
Admin
0537687b96 mpfiles: distinct repo-owned pictures for the demo thumbnail pool
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 11:04:28 +02:00
Admin
3203e32f4a finance: review fixes — id remapping on persist, structural determinism tests, one cfg seam
Persisting the generated ledger remaps every id through an explicit map so category
parents and scheduled entries resolve in a fresh native database; determinism is proven
by a structural fingerprint plus reference-integrity and transfer-pair tests; native
persistence and import live behind one cfg-gated module interface with a runtime
pinned day (2026-08-28 in demo builds) used by all shared range code.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:58:42 +02:00
Admin
aa96dbd625 cargo-makepad wasm: package the bin target's wasm and create dirs before minifying
A package whose bin name differs from the package name (apps/finance: finance) no longer
fails at packaging; the bin is resolved from cargo metadata, default-run or --bin, and the
minified JS copies are written after their directories exist.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:53:12 +02:00
Admin
58e1f72d72 mpsheets: review fixes for the demo seam
Visibility wrappers around the picker and disk controls, initial document and demo
loading owned by SheetDocs, a clipboard seam instead of a platform cfg in the view,
loading a demo resets history, selection and scroll, ASCII help text, stronger
bundled-document tests.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:50:51 +02:00
Admin
ad24534b94 map: persistent asynchronous tile archive over a completion-based byte source
libs/mbtile_reader gains pure root/leaf/blob parsing; widgets/map gains archive.rs with
a ByteSource trait, a file backend on the worker pool and an HTTP-Range backend over
cx.http_request, a TileArchive that fetches the root once, caches leaf directories and
dedups in-flight reads, and MapView::set_source_config so local archives and hosted
archives share one request path into the existing tile build and ready-tile delivery.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:50:15 +02:00
Admin
13b4c485e5 mpfiles: demo build — procedural fake filesystem, still-image thumbnails, chat feature
The chat feature (default on) owns the AI hub dependency so a demo graph never names it;
demo builds install a seeded procedural DemoVfs of ~38k files with Zipf sizes and deep
paths, read text through Vfs::read_bytes, take thumbnails from an embedded picture pool
with one still per video, run listing/scan/thumbs inline, and keep prefs in memory.
Process spawning is confined to the native seam.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:48:41 +02:00
Admin
0ccd384a73 platform web: focus dispatch, window-zero geometry and generation-correct ids after the startup deferral
Review fixes: focus/lost-focus events dispatch unconditionally again, only window
zero's creation updates the shared browser geometry, the guarded sites resolve the
generation-correct id of physical slot zero, and four regression tests cover the
deferred-geometry state machine.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:47:35 +02:00
Admin
1e93309385 AGENTS.md: designs stay local; no OS screenshots; focus and hidden-window laws
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 10:36:02 +02:00
Admin
daff390fc6 finance: demo feature — generated ledger, SQLite target-gated, import hidden
seed::generate(years, today) is the pure deterministic generator; native first-run
persists it through the unchanged db path, demo builds keep the ledger in memory with a
pinned day so screenshots are stable. makepad-sqlite is a non-wasm dependency and the db
module only exists outside demo builds; the CSV import screen is absent in demo builds.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:33:55 +02:00
Admin
c17480faf1 render: a non-rigid body may carry its own orientation
A coaster car upside down at the apex of a loop is a body whose
quaternion is not the default; the renderer now honours it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 10:33:30 +02:00
Admin
5b309b311f vj: 32-bit usize constants no longer overflow on wasm32
The 4-16 GiB cache budgets are computed in u64 and saturate to usize::MAX on 32-bit
targets, same as the shared libs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:31:59 +02:00
Admin
83d8eac9cc mpsheets: demo feature and the SheetDocs seam
A demo build carries three bundled formula sheets instead of disk CSV open/save; the
seam is one trait with a native fs impl and a bundled impl chosen at start, the
Save/path chrome hides behind can_save, and the wasm clipboard write is skipped.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:23:47 +02:00
Admin
ed5b2fa509 web: wasm32 portability in libs and web startup geometry deferral
libs/ai/loader, libs/sqlite_query, libs/video_flow: 32-bit const overflows and unix-only
file locking/bulk reads gated so the app crates type-check for wasm32-unknown-unknown.
platform web: ToWasmInit arrived before the app's Window widget allocated window zero and
indexed an empty pool; the browser geometry is now stored and applied once the window
exists, and the other id_zero index sites are guarded.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WV6BzHQiJEvvK9EPc1d4ks
2026-09-02 10:23:47 +02:00
Admin
876e3c4e18 game brief: buildings have insides — ask for a program at the door
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 09:50:47 +02:00
Admin
d7f9813443 game brief: to change a map, edit the plan you were given; vegetation is a layer
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 09:16:57 +02:00
Admin
b94bc58a7f ai-services: the wire, the app port and the panel state — one conversation, many apps
An app exposes an AI service (manifest, tools with a risk class, a port
that receives calls and answers them later); a host aggregates every
connected service into one chat. Hosted by mpwm the port rides the
studio protocol's Custom frames under the mpwm_ai envelope; embedded, it
is a channel pair. The engine behind the feature flag and the panel that
draws EngineState land in the next lanes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 09:15:53 +02:00
ca7bc8439b nigig: carry workspace.dependencies into android wrapper manifest
The generated android wrapper re-creates a standalone workspace and only
forwarded [patch.*] sections from the workspace root manifest, so deps
declared via [workspace.dependencies] + workspace = true failed to inherit
in wrapped crate builds. Extract the [workspace.dependencies] section the
same way patches are handled and inject it into the wrapper manifest.
2026-09-02 10:14:11 +03:00
282845b7e0 nigig: NIGIG test-mode forwarding, custom manifest hook, ortho camera support
- makepad_test/runtime.rs: forward NIGIG_TEST_MODE from host env to the
  Android app via 'am start' intent extra; add wait_timeout (60s) used by
  wait_visible/wait_hidden/wait_count; make query_widgets tolerant of
  snapshot timeouts; grant READ_CONTACTS during adb setup
- makepad-platform android_jni.rs: read makepad.NIGIG_TEST_MODE intent
  extra and surface it as the NIGIG_TEST_MODE env var via apply_studio_env
- cargo_makepad compile.rs: support verbatim custom AndroidManifest.xml in
  addition to the templated variant
- makepad-xr xr_root.rs: add ortho camera controls (ortho, ortho_height,
  min/max), derive Debug on XrCamera
- docs: ANDROID.md and DESKTOP_VISIBLE.md for makepad_test
2026-09-02 10:14:10 +03:00
318b480c0e makepad_test: grant runtime permissions after install to prevent dialog overlay
The GrantPermissionsActivity pops up during navigation and blocks the
app's event loop, preventing hub responses. Pre-grant all runtime
permissions after APK install to avoid this.
2026-09-02 10:14:10 +03:00
1f6e881880 makepad_test: force-stop interfering Robrix app during tests
PID 28203 (rs.robius.robrix) was the actual zombie reclaiming foreground
and killing our test app - not our own package. Force-stop both the
target package and known interfering Makepad apps (Robrix) during test
setup to prevent cross-app foreground competition.

Also remove the pm disable-user approach as it doesn't help against
a different package's zombie process.
2026-09-02 10:14:09 +03:00
26d831c891 makepad_test: use pm disable-user to prevent Samsung zombie resurrection
Samsung devices keep killed app processes alive and bring them back to
the foreground ~15s later, killing our fresh test instance. force-stop
and kill -9 don't prevent this. pm disable-user fully prevents the
zombie from being restarted. Re-enable before launching the new instance.
2026-09-02 10:14:09 +03:00
c17a21830e android: send BeforeStartup/AfterStartup over websocket
The Android platform never sent BeforeStartup or AfterStartup messages
via the studio websocket. Desktop platforms send these through their
stdin event loops, but Android uses websockets instead of stdin.

Without AfterStartup, the hub never broadcasts AppStarted to UI
clients, causing makepad-test to time out waiting for app startup.
2026-09-02 10:14:09 +03:00
debf970c36 feat(test): extend protocol for touch, long-press, paste, IME composition
Add RemoteTouchState, RemoteTouchPoint, RemoteTouchUpdate, RemoteLongPress,
RemoteTextPaste, RemoteIMEComposition wire structs to StudioToApp enum.

Dispatch new events through cx_shared.rs (TouchUpdate→Event::TouchUpdate,
LongPress→MouseUp+MouseDown, TextPaste/IMEComposition→Event::TextInput).

TestApp: touch_down/move/up, long_press, paste_text, ime_composition.
Locator: touch_down/move/up, long_press, paste, ime_composition.
2026-09-02 10:14:09 +03:00
757849940c feat(widgets): reexport optional Makepad sibling crates
Adds feature-gated optional deps and re-exports (makepad-test, makepad-csg,
makepad-gltf, makepad-mbtile-reader, makepad-fast-inflate) so a downstream
workspace can depend on makepad-widgets as its sole Makepad source.
2026-09-02 10:14:09 +03:00
9e7afd661e feat(test): Android makepad_test via adb + in-process hub (legacy Java path)
Adds the Android test runtime to makepad_test: builds the APK with
cargo-makepad's standard Java path, installs and launches via adb with
makepad.STUDIO_* intent extras (incl. STUDIO_BUILD), connects the app to an
in-process hub over adb reverse, and waits for startup + responsiveness.
Adds clean in-process hub shutdown (HttpServerHandle + GatewayHandle Drop)
and the STUDIO_BUILD intent parsing on the app side. No native-activity or
NDK APK compilation code is included.
2026-09-02 10:14:09 +03:00
Admin
adbb078b68 render: a water volume can be physics without a picture
The water shader blends premultiplied, so an alpha-zero sheet meant to
hide the river's buoyancy boxes became additive and painted bright
stepped rectangles over the ribbon and the meadow — every claim-level
invariant green while the screen was wrong. WaterVolume::draw_sheet
splits physical from visual: river volumes keep floating things and
never draw; declared pools still do.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 04:42:34 +02:00
Admin
e18cc694fc chat: a tool call the model wrapped inside its own think block still executes
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 04:42:34 +02:00
Admin
1ef6f59c3e game brief: on a diet and world.plan-first
33.7k bytes to 16.4k: the plan doctrine at the top, the laws, the one-
call list, the build order for a new game, how to read assists and
refusals; per-verb prose left to the verb docs. Back under the context
budget the crate's own test enforces.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 04:11:26 +02:00
Admin
c86a750258 chat: a game session reads its doctrine first and is not the generation assistant
The system prompt chose the generation persona and the <<tool>> JSON
guidance whenever image.generate was among the tools — which a game
session legitimately carries for missing art — and appended the game
doctrine 19k characters later. Against the exact live prompt the model
answered "I can build that for you." and stopped; the same request
with the doctrine first emitted the call. Agentic is now decided by the
presence of world.* tools: doctrine first, an in-game builder persona,
the model's trained tool template, and no duplicate capability text.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 03:37:57 +02:00
Admin
f2b02531b7 drumkit: a sample-based kit for the score preview; the physical model parked as drumkit_phys
The kit that plays drum scores is now a sample player over the Salamander Drumkit (velocity layers with round-robins, derived toms, a synthesised clap), loaded off the audio thread and swapped in atomically. The physically modelled kit stays as makepad-drumkit-phys for a later pass.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 02:52:12 +02:00
Admin
066c78292e piano model: the lower register is hammered, not plucked
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 02:52:12 +02:00
Admin
79882b5fb6 fabric: a photo or a live camera to a fitted sewing pattern
apps/fabric runs SAM 3D Body in-process (install + licence through the hub panel), measures the rest-pose body mesh (libs/fabric/measure: 25 tape measurements from plane slices and landmarks) and drafts parametric patterns (libs/fabric/draft: T-shirt, A-line skirt, easy trousers; nesting, true-scale SVG, tiled A4 PDF). Live mode streams the webcam at a few frames a second, shows the posed body with the measurement rings riding on it, and re-drafts when the numbers settle. Measurements sit in a DataGrid that copies as tab-separated text.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 02:51:45 +02:00
Admin
8ea3684250 widgets: EventOrder reachable from the DSL; DataGrid hit-tests where it was drawn
A View can now say event_order: EventOrder.Down in script. The DataGrid cached its geometry at draw time, before a Fill sibling could shift it, so clicks in a right-hand column landed outside; it re-anchors to its drawn rect on every event.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 02:51:45 +02:00
Admin
cb97fc569f vj: the loop splat — a song sliced into per-stem, beat-quantized loops on the APC40 grid
Eight song sections by drums, bass, vocals, other and mix; launch and swap on the bar, right-click halves and quarters, per-cell waveforms with score blocks, a full-width score popup (drums, bass tab, melody with lyrics) played back through the piano and the sample kit, an NMF drum transcriber, Basic Pitch for pitched stems and Beat This! grid refinement when installed, beat jump and phase-flip buttons, a loading overlay for the grid, and the shared model install panel in INSTALL MODELS.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 02:51:44 +02:00
Admin
120b7e23ae score view: the engraver as a shared library, with drum and pitched score builders
libs/score_view carries the engraving, spacing, font and document code out of the score app so any app can show notation: a ScoreView widget with width/page/content fits, pan and zoom, a playhead, a dark palette, drum-key labels, lyrics under melody notes, and builders for drum, pitched and bass-tab scores. The score app uses it. Vector glyphs no longer write depth for transparent fragments, and the Metal screenshot staging sizes itself from the source texture.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 02:51:44 +02:00
Admin
31e5faaff5 ai-hub: local model runner, licence acknowledgements, a shared install panel; Beat This!, Basic Pitch and the Salamander drum-kit entries
LocalModels runs registry models in-process (install state, resumable downloads, recorded licence acknowledgements at $MAKEPAD_HOME/license_acks.json, weight paths by file role) and libs/ai/hub_ui is the install panel + licence modal every app can embed. New native ports: Beat This! (beats + downbeats) and Basic Pitch (note transcription) with their registry entries; the Salamander Drumkit samples (CC BY-SA 3.0, 37 files pinned by size and sha256) as a sample bank the downloader fetches like a model.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 02:51:44 +02:00
Admin
f4af6df5a0 sim: terrain knows who changed it — a plan layer over player history
Chunks keep the player's bytes apart from the composed density: plan
presses land in an owner-keyed PlanTerrainPatch that is retracted with
its feature and never touches history, so removing a railway takes its
bed with it and a human fill under it survives. Surface queries answer
Surface | Hole | Outside instead of pretending the heightfield continues
over a hole or past the border; landforms issued inside a plan eval are
plan, outside it history. Seven tests pin the layering, including
same-inputs-twice equality.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 02:38:40 +02:00
Admin
c189b035af game brief: agents follow the rules by themselves — you never script a stop
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 02:29:06 +02:00
Kevin Boos
79f938c09d
Splash isolate host: keep inserted subtrees reachable, survive foreign-heap values, contain isolate panics (#1208)
* widget_tree: keep manually inserted children linked across a refresh

A container that owns a child outside its own child vec inserts it with
`insert_child_deep` and never reports it from `children()`, so a refresh
unlinked it from every top-down search and the removal pass then deleted
its subtree. Everything under it went quiet, and invisibly: an empty
`WidgetRef` is a silent no-op.

Mark such children `manual` and keep the live ones linked, clearing the
flag once the parent reports the child itself.

* script: survive a foreign-heap value in the GC mark walk

`GenVec`'s `Index` bounds-checks the raw Vec before the generation check,
and `len` never shrinks, so an index past the end belongs to a different
heap. Aborting the process over one takes the whole app down for a fault
confined to a single script heap.

Add bounds-checked accessors and use them in `mark_value_fields!`, so
marking skips and reports a foreign value; name the table where an index
does still panic.

* splash: contain isolate panics, and report the silent failures

A Splash isolate runs user script on the UI thread, and the VM swap in
`with_isolate_installed` was not panic-safe: a panic could leave the app
VM swapped out, with later script resolving against the wrong heap.
Restore through the unwind, and contain panics at each entry point (pump
arms, timers, host callbacks, isolate GC, body eval, hook calls).

Report what used to fail silently too: callback errors, a script->widget
call whose target is gone, and wrong-VM routing. Adds three headless
regression tests.
2026-09-02 02:26:52 +02:00