[atiernan]

Note added when this PR was opened (2026-11-13). This is the join of Phase 5's stacks: with it, clazel browse draws real pages on macOS, in a window and headless, through the sandboxed renderer and GPU process, with linked style sheets fetched through the kernel, over http: and https:. Opened as a draft against main: it contains the branches of the 5.15, 5.16, 5.18, 5.19 and GPU/window PRs (and #153, #154), so its diff shrinks to its own commits as those merge. Merge it after them. It was built overnight with no CI run; the test and proof results below are the building session's own local runs. The proof jobs need a full-verification approval.

What is this PR's own (everything not in the PRs below it), in the order built:

1. The renderer pipeline, 5.20 (claude/renderer-pipeline).
2. clazel browse with a window on macOS and browse --headless, 5.23 (claude/browse-window). Its one clazel-sys call (clear_close_on_exec) is audited: row 267abea0, hash 18677bf4…, approved, by a separate audit session.
3. The two joined: one list-socket framing, the renderer binary wired (claude/browse-pipeline).
4. The first parts of 5.25 and 5.26: the HN-shaped fixture, geometry dump and comparison, the reftest runner (claude/reftest-harness).
5. Linked style sheets end to end (claude/sheets-wired).
6. Hostile pages, address bar and GPU-kill tests, 5.26 in part (claude/hostile-pages).
7. The merge of 5 and 6, a process-wide start lock, and the two vendored WPT reference files (claude/phase5-top).
8. An https page-and-sheet test; then, added by hand on 2026-11-13: a release clazel builds its missing helper binaries in release (8739173f), and a back button in the address bar strip (c6887bad).

For the maintainer's eye:

• A sandbox widening decided without the maintainer: the GPU process's Seatbelt profile gained one rule, for Metal's compiler service, measured on one Mac (1a1b1d37).
• A descriptor could leak between sandboxed processes: while one start had cleared close-on-exec on a socket, a concurrently started process could inherit it. Fixed by one process-wide lock around starts (35ea4ea2). Worth a review as a design, not only as a fix.
• One lost frame in 15 runs remains in a_real_page_repaints_for_viewports_and_scrolls_and_follows_a_click, cause unknown; CI may fail on it intermittently.
• Hostile-page findings: 10,000 rules over 100,000 elements paints nothing in 600 s (the rule index PR addresses it), and a million nested elements paints nothing in 600 s (the tree builder is quadratic in depth, known from Phase 4).
• A killed GPU process is not restarted (the kernel's crash policy is a separate PR, and the host does not act on it yet).
• Layout on the real Hacker News: content under <center> is centred too deep, so the story list sits about 200 px too far right. Not fixed: it needs a reading of HTML's "align descendants" and an ERRATA.md entry.
• No WPT reftest has run: the 13 media-query reftests are XHTML (no XML parser), 4 need script.
• Not verified: on-screen pixels, real clicks and typing in a live window (the back button included), Retina scale end to end. macOS on Apple silicon only.

The parts below are the building sessions' own descriptions, newest last. Where an earlier part says something "waits", check the later parts: most of those were done further up this same branch. The descriptions of parts 1, 2 and 4 are in the comments on this PR, for length.

---

Part 3: clazel browse draws pages: the renderer pipeline joined to the GPU process and the window (5.20 + 5.23)

Branch: claude/browse-pipeline, tip 22b19f7b479a59f8fa077ce1fe4499fdd36105c6.

Stacked. It contains, and must merge after:

• claude/browse-window (5.23's host side, 50631b18), including its clazel-sys audit row 267abea0. That branch contains claude/gpu-sandbox (5.21a), claude/mac-window-08480b (5.21), claude/gpu-fallback-cfed1c (5.17c), clazel-gpu: batching, shaders and the Metal backend #153 claude/gpu-drawing-82b82a (5.17b) and claude/ipc-surfaces-cfd15e (5.18, with the docs/phase5-518-decision commit).
• claude/renderer-pipeline (5.20, eb8fa5b6), which contains the same 5.18 and GPU branches, and 5.16's paint and the layout stack below it.

CI has not run. clazel-sys did not change on this branch. Its one change (clear_close_on_exec, 5.23) is audited at 18677bf4…, and cargo xtask check passes in full: STATIC CHECKS PASSED.

What

clazel browse URL (macOS, Apple silicon) shows real pages: the renderer of 5.20 lays a page out and writes display lists; the sandboxed GPU process draws them; the kernel's Paint puts them in the window, or browse --headless OUT URL writes them to a PNG or PPM.

1. Merge of origin/claude/renderer-pipeline. The only conflict was Cargo.lock's clazel-renderer dependency list, resolved as the union of both sides. The auto-merged manifest then named clazel-gpu twice (a dependency from 5.23, a dev-dependency from 5.20); I dropped the dev-dependency. Both are in the merge commit.
2. One list-socket framing. 5.20's renderer wrote a 4-byte big-endian length, while the GPU process's reader read little-endian. page::frame::frame_bytes now writes through clazel_gpu::channel::write_list, the one definition.
   • The renderer's tests split lists with channel::read_list.
   • The new test the_gpu_process_reads_what_the_renderer_writes runs the renderer's bytes through the GPU process's own loop (process::Server: framing, 5.17a's decoder and validator, batching) to the same pixels.
3. The renderer binary runs the graphical pipeline when paired. With --list-fd N it opens /dev/fd/N before its sandbox, reads its --font PATH files then too, and runs run_graphics. Without it, the text path (Display) runs, as 5.18 decided.
   • clazel browse builds that graphics host only for window and headless modes. Renderers there get the system's TrueType faces as --font (Arial, Arial Bold, Times New Roman, Courier New on macOS), plus their GPU process.
   • --text, and every host without a window, is unchanged.
4. The GPU sandbox gains one rule (below).
5. Keys: Space, Page Up/Down and Up/Down are sent as scrolls (7/8 of the content area, or 40 CSS px), since 5.20's renderer ignores key Inputs. Left and Right do nothing.
6. Tests, READMEs. Both crates' "what waits" sections, clazel-sandbox's measurement, and the top README.

The GPU sandbox: one Mach service allowed (a policy change, measured)

The first real pages crashed the sandboxed GPU process.

• What crashed: a second page's glyph uploads made it abort (SIGABRT) inside Apple's driver. The crash report shows AGXMetalG13X, findOrCreateDriverProgramVariant<BlitComputeProgramVariant>, on Metal's compiler queue.
• What the sandbox denied: the system log showed launchd … denied lookup: name = com.apple.MTLCompilerService … Sandbox restriction. The driver compiles blit variants when first needed. 5.21a's measurement drew only the fixed scenes, which never needed one.
• What I tried first, and why it failed:
  • Before entering the sandbox, I drew every scene, then every upload length from 4 to 256 at every 4-byte offset below 64. That did not prevent the crash, so I reverted it.
  • Replaying the identical lists into the sandboxed process from a script never crashed. The trigger is environmental, not one list.
• The change: seatbelt::GPU is now (deny default) plus (allow mach-lookup (global-name "com.apple.MTLCompilerService")). The plan's 5.21a text names "the IOKit and Mach services Metal needs", and Chromium's GPU sandbox allows the same service.
• Measured (Apple M1 Pro, macOS 26.7.2, 2026-11-13):
  • the page flow passes;
  • clazel-gpu's tests/sandbox_macos.rs still sees every escape attempt denied (file, TCP, UDP, Unix socket, WindowServer, fork, exec);
  • the only denial still logged is mach-lookup of com.apple.analyticsd (the driver's telemetry), without effect, and left denied.
• Cost: a compromised GPU process can send requests to Metal's compiler service, an XPC service that Apple sandboxes.
• Where it is recorded: clazel-sandbox/src/seatbelt.rs and its README, and tests/policies.rs's shape test, now gpu_seatbelt_profile_is_deny_default_and_the_metal_compiler. This is a sandbox widening decided without the maintainer; it is flagged here for review.

Evidence (this machine)

End to end, with the real renderer and the real sandboxed GPU process on Metal, against an in-process server (crates/clazel/tests/browse_gpu.rs).

a_real_page_repaints_for_viewports_and_scrolls_and_follows_a_click uses a page with inline styles: a 40 px green link block, a 300 px red block and white text. The renderer lays it out in DejaVu Serif, vendored, so the layout does not depend on the machine.

• First paint at 200×100, under the kernel's URL: green at the top, red at y 60.
• A Viewport change repaints at 240×120.
• A scroll of 60 px repaints with red at the top; scrolling back repaints with green.
• A click on the link: the renderer sends Navigate, the kernel fetches /two, and the next page paints yellow under http://pages.test/two. The server saw / then /two.

headless_writes_a_real_pages_png runs clazel browse --headless page.png --size 200x120 on a blue page with white text.

• The PNG decodes, with every CRC, the zlib header, every stored block and the Adler-32 checked, to 200×120.
• More than 3/4 of its pixels are the page's background, #2050c0.
• There are more than 20 white text pixels in the top 40 rows, and none below.

5.23's hand-built-list tests also pass: the Paint, the PNG, the PPM.

The window, opt-in (CLAZEL_WINDOW_TAKE_FOCUS=1, because clazel browse activates its window). tests/browse_window.rs runs clazel browse http://127.0.0.1:…/ against a served page until it logs clazel: showing http://…; this took 1.7 s. It then ends clazel, whose renderer and GPU process end with their sockets. The default run skips this step and says so; its other, no-focus window step passes (2.5 s).

A manual headless run (clazel browse --headless out.ppm --size 320x200 on a blue page with white and yellow text) gave 63,103 background pixels and white and yellow ink.

Renderer:

• 18 lib tests, including the new agreement test and 5.20's tests on the new framing;
• tests/pipeline.rs 13;
• escape.rs 11.

Checks:

• cargo test -j 4 -p clazel-renderer -p clazel-sandbox -p clazel-gpu -p clazel -p clazel-window: all pass, apart from one intermittent failure (next bullet).
• One intermittent failure: in one of four runs of the multi-crate test command, a_hand_built_list_reaches_a_paint_under_the_kernels_url timed out waiting for its Paint. No crash report was written. Three reruns, one of them the same command, passed. That test's stand-in renderer waits a fixed 1 s before writing its list, which may be the cause; not investigated further.
• cargo fmt --all -- --check: clean.
• cargo clippy --workspace --all-targets --locked -- -D warnings: clean.
• cargo xtask check: STATIC CHECKS PASSED.

Verification status

• CI has not run. Its proof jobs need a reviewer of the full-verification environment.
• cargo xtask verify --changed was not run, by instruction. No Kani, Miri or Verus run was made, and no lock was taken.
• clazel-sys is unchanged here, and its audit row is merged.

Not done, unverified, or macOS only

• The sandbox rule is measured on one Mac (M1 Pro, macOS 26.7.2). Another GPU or macOS version may need another service; then the GPU process dies and 5.17c's crash policy (not yet in the kernel) would act.
• No screen readback. On-screen appearance in the window is unverified; only the GPU's pixels and the files are checked.
• Real input to a live window was never sent: no clicks, wheel, typing or shortcuts. The click and scroll paths are tested through Input events to the host, and the address bar's logic by unit tests.
• Fonts: the window and headless modes use the system's TrueType faces (Arial and others); the in-process tests use DejaVu. Nothing is bundled.
• Linked style sheets wait for 5.19 (FetchStyle). Pages render with style elements, attributes and the user agent sheet.
• Keys: the renderer ignores key Inputs, so the host sends scrolls for the scrolling keys, and Left/Right do nothing. Retina scale 2 through the whole pipeline was not run; the live screen reported scale 1.
• macOS only: Linux needs clear_close_on_exec in its clazel-sys and a GPU backend; Windows has neither. Only aarch64-apple-darwin was compiled.
• 5.17c's host side: the software indicator, the notice, and the kernel acting on GpuReady, GpuRefused or a GPU process's exit.
• The Mach-port surface route (no copy per frame) is not built.
• Miri was not run on the new tests.
• docs/phases/phase-5.md was not edited, including its 5.21a text's measured profile.

---

Part 5: Linked style sheets end to end: renderer FetchStyle, host sub-fetch connections, process tests, reftests through browse --headless (5.19, 5.20, 5.25, 5.26)

Branch claude/sheets-wired, tip db361ae5. CI has not run on this branch or on any branch it contains.

Contains, and should merge after:

• claude/reftest-harness (tip 5158380), which is stacked on:
  • claude/renderer-pipeline (eb8fa5b);
  • claude/paint-display-list (58a9383);
  • claude/table-layout-1d3f0b (aff7a24);
  • layout: block and inline formatting, CSS 2.1 §8.3.1, §9.4, §10 and §16 to a fragment tree #154 claude/flow-layout-050856;
  • claude/ipc-surfaces-cfd15e;
  • claude/gpu-sandbox.
• Merged in here:
  • origin/claude/browse-pipeline (22b19f7b, 5.20 joined with 5.23), in dcbbe273;
  • origin/claude/style-fetches (261a1215, item 5.19), in 65d144bd. Its one conflict was in crates/clazel/src/lib.rs: browse-pipeline's real SpawnGpu/ToGpu arms were kept, next to style-fetches' placeholder arm for the Sub* outputs. The merge commit says so.

What

1. Renderer: linked sheets through FetchStyle, render-blocking (faa76a0f).
   • Page::load starts SheetWait with the document's URL and encoding. run_graphics sends a FetchStyle { request, url } for each pending <link rel=stylesheet> whose media matches.
   • It collects StyleResponse/StyleBody/StyleEnd, or takes StyleFailed.
   • It decodes with 5.2's §3.2, using the response's content type, the document's encoding as the fallback.
   • It parses, cascades, and paints once every sheet is answered.
   • A failed sheet, one over MAX_BODY, or one the kernel timed out is left out.
   • HTML's same-origin quirks-mode content-type exception is implemented. Same-origin is computed in the renderer from the resolved href.
   • The memory table in the renderer's README gains linked sheets: at most MAX_BODY each, 8 in flight, 64 per document, so at most 512 MiB of bodies in flight.
2. Host: carries out SubConnect, SubSend, SubClose and feeds SubNet (20d303a6, 067223ac).
   • Sub-fetch connections run on the same clazel_net::Driver as navigations. clazel_net::SubConns (crates/clazel-net/src/named.rs, 84 lines) maps the kernel's (renderer, serial, hop) names to Driver numbers from 2^63 up. It is a map: which connection, which bytes and which credentials are the kernel's.
   • Host shell: 299 lines (crates/clazel/src/lib.rs; the limit is 300).
   • Fix found by the timeout test: Host::event stepped a leading Tick and dropped its outputs, so the kernel's sweep (SubClose plus StyleFailed for a timed-out sub-fetch) went nowhere. Those outputs are now carried out.
   • pump steps a Tick when nothing arrives, so the kernel's 60 s timeout fires on an idle page.
3. Tests through real processes (5.26's third bullet, on macOS): host, proven kernel, real sandboxed renderer and real GPU process, against the in-process server. They are in crates/clazel/tests/browse_gpu/sheets.rs, a module of browse_gpu.rs so the GPU support is shared without unused items.
   • A page styled only by its sheets is painted with them: green from the same-origin sheet, blue from the cross-origin one, checked by pixel.
   • The same-origin sheet request carries the page's cookie (sid=s3cret). The cross-origin one carries none and goes to its own Host. The server records both.
   • A sheet that never answers blocks painting. The test moves the host's clock past the kernel's 60 s, then the page is painted without the sheet (red background pixel).
   • The HN-shaped fixture is served with its sheet: /site.css?v=7 is requested, and the frame differs from the frame with a 404 sheet.
4. The reftest runner with browse --headless as its renderer (9006b6e9, crates/clazel/tests/browse_gpu/reftests.rs).
   • Each page is served under its WPT path, with WPT's content type by extension. It is rendered by clazel browse --headless OUT --size 800x600 URL, and the RGB PNG is decoded to RGBA.
   • Plumbing check with pages written in the test: a green square matches a border-drawn square and mismatches a red one (pass). A match against the red square fails with exactly 10 000 pixels different.
5. The fixture's screenshot (3ccf7b35): crates/clazel/tests/fixtures/hn/screenshot-macos-metal.png.
   • Stored because three browse --headless runs on this machine (macOS 26.7.2, M1 Pro, Metal, the system Arial/Times/Courier that browse loads) were byte-identical. SHA-256 89d079fc…0e955.
   • Its provenance is in the fixture's README. Nothing compares against it yet.
   • CI's comparison runs on lavapipe, a different driver, and needs its own stored image made by CI.
6. READMEs (db361ae5):
   • the kernel README no longer says the host ignores the Sub* outputs;
   • clazel-net lists SubConns among its choices;
   • the renderer's "What waits" keeps the status gap and <base>.

Reftest counts (WPT reftests vendored here that are in the subset)

The only vendored WPT reftests are the 17 in clazel-style/tests/data/wpt-mediaqueries/ (WPT 4ad507b2). Nothing was tuned.

Outcome	Count	Which
Pass	0
Fail	0
Not run: reference not vendored	13	min-width-001.xht, mq-deprecated-001, mq-invalid-media-type-001 to -004 and -006, mq-invalid-media-type-layer-001, mq-negative-range-001, -002, mq-range-001, negation-001, -002. Each needs css/reference/ref-filled-green-100px-square.xht.
Not run: script	4	relative-units-001 to -004

None reached the renderer. Vendoring the one reference file (plus reference/ref-green-body.xht for the media-queries-00x.xht pages, which the runner did not detect as reftests) would let the 13 run. Those 13 are XHTML, served as application/xhtml+xml, which the renderer may not take. This was not tried.

Decisions

• Sub-fetches share the navigation Driver rather than a second one: it keeps the host shell under 300 lines, and the number ranges cannot meet.
• The renderer computes same-origin itself, from the resolved href, for HTML's quirks content-type exception. The kernel's credentials decision is separate and unchanged.
• StyleResponse has no status, so any final response counts as success. Recorded under "What waits".
• Idle ticking in pump: without it, a page waiting only on a hung sheet would never time out.
• The test modules live under browse_gpu.rs, not as their own test targets, because the shared GPU support has items that only some files use, and lint overrides are not allowed.

Unverified, and known problems

• A frame race that was already there makes the GPU process tests flaky.
  • Now and then a renderer commits and sends its Title, but no Paint follows within the cap (20 s in tests, 30 s in browse --headless).
  • On browse-pipeline's own tip (22b19f7b, 11 tests, none of this branch's): 1 failure in 5 runs, in headless_writes_a_real_pages_png.
  • On this branch (16 tests): about 1 in 2 to 3 runs. Most often reftests::browse_headless_renders_reftests, which starts browse --headless six times; also each of the sheets tests and the older a_real_page_…. Clean runs pass all 16.
  • Not diagnosed tonight. It is between the renderer's list and the GPU process's frame, and needs its own item before CI can rely on these tests.
• No WPT reftest was rendered (see the counts).
• The screenshot is checked only on this machine; nothing compares against it.
• StyleResponse carries no status (as above). <base href> is not used for sheets.
• The geometry comparison against a reference browser: scripts/reference-rects.mjs has still never been run.

Evidence (run here, -j 4)

• cargo xtask check: RESULT: STATIC CHECKS PASSED.
• cargo fmt --all -- --check, and cargo clippy --workspace --all-targets --locked -- -D warnings: clean.
• cargo test -p clazel-net -p clazel-renderer: pass. The renderer has 20 lib tests, including the new linked_sheets_block_rendering_until_answered and the_stylesheet_content_type_quirk.
• cargo test -p clazel: every target passes except browse_gpu, which passes in full on some runs and fails one or two tests on others (the race above).
• No Kani, Miri or Verus: none was needed, and the lock was not taken.

Verification status

• cargo xtask verify was not run locally in any form, as instructed.
• CI has not run. Its proof jobs need a full-verification approval, and the branches below must merge first.
• No tier was raised.
• Untouched: the Status table, the roadmap line, docs/STATUS.md and its SVGs, SPEC-REVIEWS.md, SYS-AUDITS.md, CLAUDE.md and clazel-sys. No clazel-sys change was needed.

---

Part 6: Hostile pages, address bar and GPU process tests through real processes (5.26, part)

Branch: claude/hostile-pages, tip d848741ea1b95efd4d8fc3041c1d12e3ce22d08c.

Stacked on claude/browse-pipeline (22b19f7b), and must merge after it, with everything it contains (5.17b, 5.17c, 5.18, 5.20, 5.21, 5.21a, 5.23 and the clazel-sys audit row).

CI has not run. clazel-sys did not change. cargo xtask check: STATIC CHECKS PASSED.

This covers the parts of item 5.26 that need neither linked style sheets nor TLS. It does not touch crates/clazel/src, clazel-renderer/src/page/sheets.rs or the fixture; every test is in a new file, so it merges cleanly with claude/sheets-wired.

What

1. The intermittent timeout, fixed at its two causes. Measured: a_hand_built_list_reaches_a_paint_under_the_kernels_url now passes 20 of 20.
   • In the GPU process (clazel-gpu, product code). It reads the kernel's channel and the list socket on two threads. When both were already waiting (a process slow to start), a list could be read before the kernel's GpuViewport. That list was drawn on a 1×1 target and its frame lost. A real renderer can hit this. Lists are now held while there is no viewport (at most 16 lists and 256 MiB; more ends the process), then drawn in order, each giving a frame.
   • In the test's stand-in renderer.
     • Its fixed 1 s sleep is replaced by a real condition. It is now a Perl script that reads the kernel's frames and writes its list once BodyEnd has arrived.
     • Its first version closed the list socket at the end of a loop iteration, through a lexical handle. The GPU process, seeing its list socket closed, correctly ended. Traced at 4 runs in 20; the handle now lives for the script.
2. Hostile pages (crates/clazel/tests/hostile_graphics.rs, and tests/support/fonts.rs for the fonts). Each runs through a real sandboxed renderer and GPU process at 800×600, with inline <style> where the item says "sheet". Each records:
   • its outcome and time against a stated limit;
   • the renderer's peak RSS, sampled every 25 ms with ps (the pid recorded by /bin/sh, as in Phase 4), against item 4.13's terms plus 5.20's graphical terms;
   • the GPU process's peak against 1 GiB.
   • The README leaves parsed sheets unbounded, so the harness adds its own stated term of 64 bytes per byte of style text.
   • Every big case was run alone, in its own process group, under an 8 GB and 10-minute cap that kills the group.
3. The address bar (tests/address_bar.rs), with a Perl stand-in GPU process paired with the real renderer, and the real pipeline for the title and margins cases.
4. A killed GPU process (tests/gpu_killed.rs): what happens today is recorded, not required.
5. browse --headless --wait S, a CLI option (default 30 s) the address-bar tests use.

Results (Apple M1 Pro, macOS 26.7.2, debug build, 2026-11-13)

Case	Outcome	Time (limit)	Renderer peak / bound	GPU peak	In the default run
font-size: 1e9px	painted	0.48 s (60)	14 / 97 MiB	22 MiB	yes
width: 1e9px	painted	0.48 s (60)	14 / 97 MiB	24 MiB	yes
margins of -1e9px	painted	0.49 s (60)	14 / 97 MiB	23 MiB	yes
Font: offsets past the end	painted	0.47 s (60)	14 / 97 MiB	22 MiB	yes
Font: overlapping tables	painted	0.45 s (60)	14 / 97 MiB	21 MiB	yes
Font: loca not monotone	painted	0.46 s (60)	14 / 97 MiB	23 MiB	yes
Font: composite glyph containing itself	painted	0.46 s (60)	14 / 97 MiB	22 MiB	yes
Font: 32,767 contours	painted	0.46 s (60)	14 / 97 MiB	22 MiB	yes
Font: overlapping cmap format 4 segments	painted	0.55 s (60)	14 / 97 MiB	22 MiB	yes
Font: numGlyphs disagreeing with loca	painted	0.47 s (60)	14 / 97 MiB	23 MiB	yes
{ nested a million deep	painted	1.18 s (120)	70 / 255 MiB	22 MiB	yes
:is( nested 10,000 deep	painted	0.50 s (120)	14 / 104 MiB	22 MiB	yes
A 100,000-compound selector (100 nested divs)	painted	104.7 s (120)	54 / 160 MiB	24 MiB	ignored (slow)
A million rules	painted	24.7 s (600)	2,149 / 3,720 MiB	24 MiB	ignored (2 GiB)
64 MiB of style	painted	83.0 s (600)	6,751 / 10,720 MiB	20 MiB	ignored
10,000 rules over 100,000 elements	nothing painted	> 600 s (600)	291 / 1,960 MiB	18 MiB	ignored, finding
A million elements, flat	painted	137.1 s (600)	3,591 / 10,629 MiB	22 MiB	ignored
A million elements, nested	nothing painted; killed at the 600 s cap	> 600 s (600)	group 228 MiB	—	ignored, finding
A million-column table	painted	453.6 s (600)	4,496 / 10,337 MiB	22 MiB	ignored
colspan=1000 everywhere (1,000 rows × 100 cells)	painted	48.8 s (600)	480 / 1,253 MiB	24 MiB	ignored

Each ignored case's ignore reason holds these numbers. Run one alone with:

cargo test -p clazel --test hostile_graphics -- --ignored --exact NAME --nocapture

No case exceeded its memory bound, and no process crashed. The GPU process never passed 24 MiB.

What the font cases show, and don't: all seven painted. The test does not tell whether the renderer used the broken face or skipped it as "not a TrueType face" (5.20's rule); either is acceptable here.

Address bar

Case	What happens
A page with margin-top: -1e9px	Painted at most at the viewport (the content area). The window's page layer (layer_frame) has its top edge at the strip's bottom edge, and the strip is the host's own layer, drawn from the kernel's URL.
A GPU process claiming a surface larger than the viewport	Dropped by the kernel, per 5.18's decision 3 (no Paint). Neither process is killed.
A GPU process sending more pixels than it claimed (twice the height)	The kernel paints the claimed size; the host's slot holds 160×240. browse shows nothing (sizes differ). browse --headless exits 1: "no frame … within 5s".
A surface header that is not a buffer (slot 9)	The host's reader refuses it and nothing is shown. Headless exits 1, not by a signal.
A buffer too small (1×1 for 160×120)	Held, never shown. Headless exits 1.
A truncated buffer	The reader refuses it and nothing is shown. Headless exits 1.
A title https://bank.example/login	Only Paint.title. Paint.url is the kernel's http://hostile.test/; the title bar puts it after the URL (title_bar, unit-tested), and the strip draws only the URL.

A GPU process killed (today, without the crash policy)

The tab paints, then its GPU process is killed. On the next scroll the renderer's list write fails with a broken pipe, and the renderer exits with status 70. The kernel drops the tab's renderer, and nothing restarts either process. The host stays up and logs both exits. Killing "repeatedly" therefore stops after the first kill: there is no second GPU process to kill.

Escape attempts from inside the GPU process

These are already committed tests (crates/clazel-gpu/tests/sandbox_macos.rs, 5.21a): open a file, TCP, UDP, a Unix socket, the WindowServer, fork, exec. All were re-run passing after claude/browse-pipeline's profile change (the Metal compiler service). Nothing was added here.

Findings

1. 10,000 rules over 100,000 elements paints nothing within 600 s. The renderer was at 291 MiB (bound 1,960), so this is time, not memory. Each rule is .cN span, over 100,000 divs each holding a span. The likely cause is that every rule is matched against every element, with no rule index, but this was not profiled. Not fixed (not a one-line bug).
2. A million nested elements paints nothing within 600 s; it was killed at the cap with a group peak of 228 MiB. Phase 4 already measured the tree builder as quadratic in depth (hostile_pages.rs runs only 20,000 there). Not fixed.
3. Slow, but within its limit: the 100,000-compound selector takes 105 s of its 120 s limit, for 100 elements. I chose the limit, and nothing else bounds this time (5.5's bound was not checked here). A page can hold its own tab for minutes.
4. Memory, within the harness's own stated term: 64 MiB of style peaks at 6,751 MiB, about 105 bytes per byte of style text. The renderer README states no bound for parsed sheets, so the 64 bytes per byte term is this harness's own, and the case passes only because the other terms add headroom. A bound should be stated in the README.

What of 5.26 waits

• The https demo (browse https://news.ycombinator.com/): Phase 3's TLS in the kernel.
• The HN-shaped fixture through processes (the sheet through FetchStyle with and without the cookie, the stored screenshot, the reftest runner): claude/sheets-wired, in another session.
• Linux and Windows: no GPU process or window there. The X server half of the "not a buffer" case is Linux's.
• The crash policy case ("one tab goes to software, other sites' tabs do not", 5.17c): the policy is not in the kernel yet. Only today's behaviour is recorded.
• Phases 2 to 4's rows kept (the demo, the escape attempts, WPT cookies/, pages.rs as box tree dumps, hostile_pages.rs with the new schema): not addressed here. hostile_pages.rs and the existing escape tests still pass on this branch.
• "Rows with no header or more rows than announced (the renderer is killed)": not built here.
• Strip read-back on screen: no screen capture (it needs the Screen Recording permission, and the display was asleep). The strip and page layers are checked by their layout, not by reading pixels.

Unverified

• Only this Mac, debug build. Times and peaks would differ in a release build and on other machines.
• Peaks are ps samples every 25 ms plus one after the outcome, so a short spike between samples can be missed.
• The memory bound is my reading of the README's terms. The box count is assumed to be at most 3·N, and the sheet term is my own stated choice.
• Miri was not run on the new tests; they start processes.
• cargo xtask verify was not run, by instruction.

---

Part 7: Phase 5 top of stack: hostile-pages merged, one process start at a time, XHTML not run in reftests (5.23, 5.25, 5.26)

Branch claude/phase5-top, tip 4f6df6e3. CI has not run on this branch or on any branch it contains.

Contains, and should merge after:

• claude/sheets-wired (db361ae5), which contains:
  • claude/reftest-harness (5158380);
  • claude/renderer-pipeline (eb8fa5b);
  • claude/paint-display-list (58a9383);
  • claude/table-layout-1d3f0b (aff7a24);
  • layout: block and inline formatting, CSS 2.1 §8.3.1, §9.4, §10 and §16 to a fragment tree #154 claude/flow-layout-050856;
  • claude/ipc-surfaces-cfd15e;
  • claude/gpu-sandbox;
  • claude/browse-pipeline (22b19f7b);
  • claude/style-fetches (261a1215).
• origin/claude/hostile-pages (d848741e, stacked on claude/browse-pipeline), merged in 9ecca749. No conflicts. It brings:
  • the GPU process holding lists that arrive before a viewport (ce60b42d);
  • the stand-in renderer waiting for its commit (9b2c0931);
  • browse --headless --wait;
  • 5.26's hostile-page, address-bar and GPU-kill tests.

What

1. clazel-renderer: one process start at a time while descriptors are passed (35ea4ea2).

   • spawn_gpu and spawn_with_list clear a socket's close-on-exec flag, so every program started before the host closes its copy inherits that socket.
   • The docs put the duty on the caller ("start nothing else"). The host shell meets it with one thread. A process with several hosts on parallel threads, such as browse_gpu.rs's tests, does not.
   • launch now holds one process-wide lock (alone, public) for every start, from clearing the flag to closing the host's copy.
   • The tests' own starts (clazel browse --headless, and the fixture's cargo build) take the same lock through support/gpu.rs's output.

2. Reftest runner: XHTML is not run, by reason (ee0a6945).

   • WPT serves .xht and .xhtml as application/xhtml+xml.
   • The renderer draws a notice for any type but HTML and plain text (page/mod.rs, "Other types"). An XHTML test against an XHTML reference would therefore compare two identical notices and "pass".
   • So a test, or a reference, that is XHTML is "not run: XHTML". This is decided by its path before anything is drawn.

3. The media queries reftests' two WPT references, vendored (4f6df6e3).

   • The files, byte for byte from WPT 4ad507b28db0a636f528def9161d109fe11b93a3, with WPT's licence and each file's SHA-256 in crates/clazel/tests/wpt-references/README.md:
     • css/reference/ref-filled-green-100px-square.xht (568 bytes, b7d98bb3…a4f0);
     • css/mediaqueries/reference/ref-green-body.xht (434 bytes, f100f6bf…b0fa).
   • The maintainer approved fetching them in the other session, which fetched them; they were checked against the hashes here.
   • They are laid out by WPT path beside the runner, not in a crate's tests/data/, which holds only the inputs of xtask's converters.
   • The runner loads them, and the test asserts every reference its 17 tests name is present.

browse_gpu, 15 runs (one run at a time, cargo test -p clazel --test browse_gpu, its 16 tests in parallel)

Test	Merged branch, before 35ea4ea2	With the lock in launch only	With 35ea4ea2 (the tests' starts locked too)
sheets::linked_sheets_apply_with_the_cookie_only_same_origin	2 / 15	0 / 15	0 / 15
a_real_page_repaints_for_viewports_and_scrolls_and_follows_a_click	1 / 15	0 / 15	1 / 15
sheets::the_hn_shaped_fixture_is_served_with_its_sheet	1 / 15	0 / 15	0 / 15
headless_writes_a_ppm	1 / 15	0 / 15	0 / 15
headless_writes_a_real_pages_png	0 / 15	1 / 15	0 / 15
reftests::browse_headless_renders_reftests	1 / 15	1 / 15	0 / 15
The other 10	0 / 15	0 / 15	0 / 15
Runs with any failure	3 / 15	2 / 15	1 / 15

• Control: the merged branch with --test-threads 1 had no failures in 15 runs.
• Before the lock, the symptoms were:
  • renderers SIGKILLed right after commit;
  • a GPU process or renderer whose --list-fd was not its socket (cannot open the list socket N: Permission denied: the child opens its fonts first, so a read-only file sat at that number);
  • gpu 0: cannot start: No such file or directory;
  • frames lost after commit.
• With the lock in launch only, both failures were in tests that start browse --headless from the test process outside the lock. One showed clazel-renderer: cannot open the list socket 3: Permission denied.
• Not fixed: 1 failure in 15 remains. a_real_page_… got commit and Title, no process ended, and no Paint came within 20 s. That is the original "lost frame" symptom, without the descriptor symptoms. The host's log does not record the GPU process's messages (FrameReady, lists read), so it is not known whether the list was written, read, drawn, or its frame dropped by the kernel. Finding it needs that logging. No retries or longer waits were added.
• The first measurement run overlapped a find / I had started by mistake. The two later sets ran with the machine otherwise idle.

Reftests: the WPT reftests vendored here that are in the subset (clazel-style's wpt-mediaqueries, WPT 4ad507b2), with their references vendored (4f6df6e3)

Outcome	Count	Which
Pass	0
Fail	0	none, so there are no pixel counts to list
Not run: XHTML	13	min-width-001.xht (the test itself). Through their reference css/reference/ref-filled-green-100px-square.xht: mq-deprecated-001, mq-invalid-media-type-001 to -004 and -006, mq-invalid-media-type-layer-001, mq-negative-range-001 and -002, mq-range-001, negation-001 and -002.
Not run: script	4	relative-units-001 to -004 (their reference, css/mediaqueries/reference/ref-green-body.xht, is XHTML too)

• No reference is missing. The test asserts every reference the 17 name is present.
• Why XHTML is not attempted.
  • WPT serves .xht as application/xhtml+xml.
  • HTML's navigation sends a response with an XML MIME type to its XML document loading, which parses it as XML. This renderer has no XML parser and draws a notice for the type.
  • So two XHTML pages would compare two identical notices, and an HTML test against an XHTML reference would compare a page with a notice. Neither result would mean anything.
  • Serving the files as text/html would be outside the standard, so it was not done. Nothing was tuned or special-cased.
• media-queries-001 to -003.xht are not reftests: they have no rel=match or rel=mismatch.
• What would let the 13 run: the renderer taking application/xhtml+xml, which needs an XML parser (one of our own, under rule 8).

The six crates' tests, once on the merged branch

cargo test -j 4 --locked -p clazel -p clazel-renderer -p clazel-gpu -p clazel-net -p clazel-kernel -p clazel-ipc: exit 0.

• 45 test targets.
• 320 passed, 0 failed, 10 ignored. The ignored ones are the #[ignore]d hostile cases: 8 in hostile_graphics.rs, 2 in hostile_pages.rs.
• browse_gpu passed 16 of 16 in that run.

Checks

• cargo xtask check: RESULT: STATIC CHECKS PASSED.
• cargo fmt --all -- --check, and cargo clippy --workspace --all-targets --locked -- -D warnings: clean.
• No Kani, Miri or Verus: none was needed, and the lock was not taken.

Unverified

• The remaining lost frame (1 in 15, above). Its cause is not known.
• The lock covers starts through clazel_renderer::launch, and test starts that use support/gpu.rs's output. Other test files that start programs with a plain Command beside in-process hosts are not changed: address_bar.rs, gpu_killed.rs, hostile_graphics.rs and host.rs. They passed in the full run above.
• No WPT reftest was rendered: all 17 are not run, by the reasons above.
• CI has not run. Its proof jobs need a full-verification approval, and the branches below must merge first.
• cargo xtask verify was not run locally in any form, as instructed.
• No tier was raised.
• Untouched: the Status table, the roadmap line, docs/STATUS.md and its SVGs, SPEC-REVIEWS.md, SYS-AUDITS.md, CLAUDE.md and clazel-sys. No clazel-sys change was needed.

---

Part 8: The https demo on Hacker News works; one test pins its path

Branch: claude/https-demo, tip f67c8592ed5965b46d3ae680dd5742a58f097f66, cut from origin/claude/phase5-top (ee0a6945). It contains one commit on top: a test only, no product change.

CI has not run. clazel-sys did not change. cargo xtask check: STATIC CHECKS PASSED; clippy on clazel is clean; the new test passes.

The maintainer is right: TLS is in the kernel, and the https demo works today without any change. The plan's "waits for Phase 3's TLS in the kernel" is out of date.

What I ran (9 requests to the site in all, no loops)

Machine: Apple M1 Pro, macOS 26.7.2, debug build, from ee0a6945.

1. clazel fetch https://news.ycombinator.com/: works.
   • 200 OK from nginx, Transfer-Encoding: chunked, 34,901 bytes, 1.4 s.
   • The TLS 1.3 handshake (ChaCha20-Poly1305, X25519) and certificate validation against Mozilla's roots passed. The chunked body parsed.
   • No content encoding was sent: we send no Accept-Encoding.
2. clazel browse --headless …/hn.png --size 1280x900 https://news.ycombinator.com/: works, 2.46 s end to end.
   • The page arrives over connection 0 … (TLS).
   • The renderer sends FetchStyle for news.css?…, which goes on its own TLS sub-connection (SubConnect { tls: true }), and StyleResponse comes back.
   • Title is "Hacker News", and the PNG is written.
3. An item page, headless: works, 3.0 s.
   • I used item?id=50478515 (IceWM, 36 comments) rather than the 3,000-comment thread.
   • Same path; the title is "IceWM | Hacker News".
4. clazel browse https://news.ycombinator.com/ in a window: works.
   • The log says clazel: showing https://news.ycombinator.com/ (1024 by 732, slot 0).
   • Time from start to first paint in the window: 2.53 s, debug build, including starting the renderer and GPU processes and both TLS connections.
   • Not captured as an image: screencapture failed with "could not create image from display" because the display was asleep, so there is no window screenshot. Its content is the same pipeline as the headless image.

No layer failed:

• the TLS handshake and certificate validation;
• the host's Connect { tls: true } in headless and window mode;
• the sub-fetch's TLS;
• chunked transfer encoding;
• the page's size (34 KiB) against the limits.

So nothing in host wiring needed fixing, and no change touches TLS, X.509 or certificate validation.

Committed

crates/clazel/tests/https_sheet.rs: an https page with an https sheet through the real renderer and GPU process, against the loopback rustls server the host tests use. It checks:

• the sheet comes through FetchStyle on its own TLS connection (two TLS connections in the log);
• the sheet's request carries the cookie the same-origin page set;
• the painted frame has the sheet's colour.

It passes in 1.4 s. Nothing fetched from the real site is committed.

The real front page against a real browser, in words

Screenshot: /private/tmp/claude-503/hn/hn.png (1280×900).

Right:

• the page is 85% wide and centred;
• the orange header bar has a white-bordered logo box, "Hacker News" in bold, and new | past | comments | ask | show | jobs | submit, with "login" at the right;
• the beige #f6f6ef background;
• 30 numbered stories, each with its title in black and its site in small grey after it;
• the subtext line in small grey (points, user, age, hide, comments);
• Verdana falls back to Arial, at sizes close to a browser's;
• row spacing close to a browser's;
• the title is "Hacker News".

Missing, as expected: images (Phase 6). There are no vote arrows and no Y logo; the logo's white border shows as an empty box, which is right without the image.

Wrong: the story list starts about 200 px too far right.

• In a browser the rank numbers sit near the left edge of the beige area.
• Here they start near x = 313 instead of about 110. The rank and vote columns together are about 245 px wide.
• The layer is layout, not wiring: clazel-layout/clazel-style's HTML "align descendants". HN wraps everything in <center> and has no doctype (quirks mode).
  • Read literally, HTML §15.2 (the pinned 4c54fae1 text) has <center> align all its block-level descendants. That includes the story table nested in a cell of #hnmain, so our layout centres it within its cell, as an auto-width table at its max-content width.
  • Browsers implement center by inheriting text-align (-webkit-center), and in quirks mode the HTML table rule table { text-align: initial } stops it at #hnmain, so the inner table is not centred.
• Reproduced without HN's markup, with my own minimal page (/private/tmp/claude-503/hn/www/q-center.html): <center><table width=85%><tr><td><table>…. Ink starts at x = 530 under <center>, and at x = 6 without it, in quirks and standards mode alike.
  • Without news.css the offset is the same, so the sheet is not the cause.
  • It is not table column sizing: §3.9.1's used width is implemented as written.
• Not fixed. The fix is a spec-interpretation decision (CLAUDE.md rule 9: an ERRATA.md entry, saying where align descendants stops) in clazel-layout/clazel-style, not host wiring or a one-line bug.

The item page

Screenshot: /private/tmp/claude-503/hn/item.png.

Right:

• the header;
• the story title, site and subtext;
• comment headers (user, age, parent, next, [–]) in grey;
• comment text in the right font with paragraphs;
• reply links;
• nesting is visible.

Wrong:

• Short comments are pushed right while long ones look right. Each comment is its own auto-width table inside <center>, so the same align-descendants behaviour centres every comment narrower than the page. HN's indent cells (an image s.gif with a width attribute) do reserve their width: long comments show the right indentation steps.
• A large blank area under the subtext, with "help" floating at the right. That is where the comment form is (textarea and "add comment" button). Form controls are not drawn, but their box space is kept. That matches the plan's scope (no forms in Phase 5) but looks broken.

Screenshots and scratch files (none committed)

• /private/tmp/claude-503/hn/hn.png: the front page, headless, 1280×900.
• /private/tmp/claude-503/hn/item.png: an item page, headless, 1280×900.
• No window screenshot: the display was asleep.
• /private/tmp/claude-503/hn/local-nocss.png: the saved front page served locally without news.css (the offset is still there).
• /private/tmp/claude-503/hn/q-plain.png and /private/tmp/claude-503/hn/q-center.png: my minimal reproduction without and with <center>.
• /private/tmp/claude-503/hn/fetch.out and /private/tmp/claude-503/hn/www/front.html: the fetched front page, kept in scratch only.

Unverified

• No window screenshot (display asleep). Window interaction (clicks, scroll, back) on the real site was not exercised, to keep the request count small.
• Times are from one run each on a debug build; a release build would be faster.
• A browser screenshot was not taken for side-by-side comparison. The description above is against HN's known appearance.

🤖 Generated with Claude Code

[atiernan]

Part 1: renderer: the graphical pipeline, documents to display lists with Viewport, Input and Title (5.20, before 5.19)

(The building session's description of this part of the branch, posted as a comment for length. Where it says something waits, see the PR description: most of it was done further up the branch. Its statement that the clazel-sys audit is outstanding, if any, is out of date.)

This branch joins the stacks; merge it after all of these:

• layout: block and inline formatting, CSS 2.1 §8.3.1, §9.4, §10 and §16 to a fragment tree #154 claude/flow-layout-050856 (5.14);
• claude/table-layout-1d3f0b (5.15);
• claude/paint-display-list (5.16, the base this branch was cut from);
• claude/ipc-surfaces-cfd15e (5.18), merged in (92f2dd2), no conflicts;
• claude/gpu-sandbox (5.17b, 5.17c, 5.21, 5.21a), merged in (0d0001a); only Cargo.lock, which merged automatically.

The merged branches are untouched. CI has not run on this branch or any branch below it. Item 5.19 (claude/style-fetches) is not in it yet: see "What waits".

What

Item 5.20 of docs/phases/phase-5.md: crates/clazel-renderer, new module src/page/ beside pipeline.rs, Tier 0. Branch claude/renderer-pipeline, tip eb8fa5b6.

run_graphics(r, w, list, fonts) reads the kernel's messages, sends Title and Navigate to the kernel, and writes display lists to the GPU process's socket. The steps:

1. Item 4.13's content type, encodings, parse and base URL. text/plain becomes one pre block; any other type is a drawn notice.
2. The style sources in tree order (5.8).
3. The wait for linked sheets (page/sheets.rs). This is the one seam for 5.19, with its contract written in page/state.rs. Today every pending link fails at once, so pages render with style elements, style attributes and the UA sheet.
4. The cascade (5.7) for the viewport in CSS pixels.
5. Boxes (5.13).
6. Layout at the viewport's width (5.14, 5.15), in fonts read before the sandbox (--font PATH).
7. Paint (5.16) at the viewport's scale.
8. Per frame, in page/frame.rs:
   • the items that meet the viewport at the scroll offset, offset by it;
   • the glyph masks (5.17) the GPU process does not hold yet, kept within 5.17a's limits across lists;
   • encoded (5.17a) and written as a 4-byte big-endian length and the list.
9. Title when it changes.

Messages: Viewport lays out and paints again; Input scrolls (clamped to the page) and paints again, or hit-tests a click and sends Navigate.

The text path is unchanged. pipeline.rs and Display stay until 5.26, as 5.18 decided; the renderer binary still runs it (see "What waits"). The renderer stays single-threaded, and the sandbox gains no rule.

New dependencies, all our own crates: clazel-style, clazel-font, clazel-layout, clazel-glyph-mask, clazel-displaylist; clazel-gpu for tests only. No unsafe, no lint override, no tier change, nothing in clazel-sys.

Decisions (maintainer away; recorded in the crate README and src/page/mod.rs)

• A sibling module rather than pipeline.rs edited in place. The text path stays whole for Phases 2 to 4's tests, and page/ calls its steps 1 to 4.

• Fonts:

  • --font PATH arguments, read in main.rs before the sandbox is entered; the first face of each file.
  • The bytes are leaked, to live as long as the process.
  • With no face, layout uses em boxes and no text is drawn.

• text/plain and notices are made into HTML (<pre>, <p>, escaped) and drawn by the same pipeline.

• The viewport:

  • at most 8,192 device px a side (the GPU process's limit);
  • scale 2, or 1 for any other value;
  • the CSS viewport is the device one divided by the scale;
  • nothing is painted before a viewport, or for a 0 by 0 one.

• The title is document.title (stripped and collapsed), at most 1,024 characters, sent when it changes.

• Input: scroll is vertical; a click goes to the topmost link region; a key does nothing yet.

• Masks stay live in the GPU process across lists under ids the renderer gives:

  • uploaded once;
  • freed only when a frame's new masks would pass 5.17a's limits (65,536 masks, 64 MiB);
  • a frame's fills, clips and glyphs are capped at half of 5.17a's item limit, with the clip kept balanced.

• The list socket's framing (a 4-byte big-endian length, then one list) is ours: the GPU process's reader does not exist yet.

• The memory bound is stated in the README with measured sizes. On aarch64, per record:

  Record	Bytes
  computed style	432
  box	120
  fragment	96
  line box	56
  glyph	24
  paint item	56
  5.17a item	32

  The computed table at the 4,000,000-node limit is about 1.7 GB. The bound is not measured: 5.26's hostile pages measure it.

Evidence

• Tests (src/page/tests.rs, 7, plus 9 existing). Each runs documents through run_graphics with in-memory sockets and the vendored DejaVu Serif:
  • A style element and a style attribute to pixels: every list passes clazel-displaylist's Validator (kept across lists, as in the GPU process). Drawn by clazel-gpu's software backend: the body's red at (50,5), the div's blue at (5,5), dark text pixels below. The title "A page" is stripped and collapsed.
  • Viewports lay out again: a narrower one wraps a line lower, and fewer masks are uploaded the second time.
  • Scrolling is clamped: to 450 in a 500px page with a 50px viewport, and back to 0. A scroll that changes nothing sends no list.
  • A click on a link sends Navigate with the URL resolved against the base; a click elsewhere sends nothing.
  • text/plain and an image/png notice are drawn as glyphs.
  • Titles are sent only when they change; nothing is painted before a viewport.
  • The sheet wait seam, with and without fetches: media=print does not block; an answer clears its link.
• cargo test -p clazel-renderer -j 4: 16 + 1 + 11 + 13 pass. cargo test -p clazel-layout -j 4 --lib: 158 pass. cargo test -p clazel -p clazel-kernel -j 4 (Phases 2 to 4 through the real sandboxed renderer's text path, and the kernel): all pass (2 ignored, as before).
• cargo fmt --all -- --check, cargo clippy --workspace --all-targets --locked -j 4 -- -D warnings, and cargo xtask check (RESULT: STATIC CHECKS PASSED) pass.
• No Kani or Miri for this item: the renderer is Tier 0, and the brief asked for tests of the pipeline. The kani lock was not taken.

What waits

• Item 5.19 (FetchStyle, Style*) is not pushed yet, so linked sheets do not load.
  • The seam is SheetWait: start(sources, device, fetch = true, encoding), a FetchStyle per index in pending, answer(index, response, encoding) per reply, and render when ready().
  • Page::load calls start with fetch = false today; run_graphics must also hold a page until it is ready.
  • I will merge claude/style-fetches and finish this when it is pushed.
• The list socket is not wired, so the renderer binary still runs the text path.
  • The host must create a socket pair at the GPU spawn and pass the renderer its end.
  • Adopting an inherited descriptor and clearing its close-on-exec flag needs a new audited clazel-sys call (phase-5.md, 5.18's plan), outside this item. The renderer has no unsafe to do it.
  • run_graphics is complete and tested with in-memory sockets.
• The GPU process's list reader (decode, validate, draw per frame from the socket) is not built. The framing it will read is this branch's.
• The memory bound is stated, not measured (5.26).
• WPT or reference-page comparisons wait for 5.25.

Verification status

• cargo xtask verify was not run locally in any form, as instructed.
• CI has not run. Its proof jobs need a full-verification approval, and the branches listed above must merge first.
• The Status table, roadmap line, docs/STATUS.md and its SVGs, SPEC-REVIEWS.md, SYS-AUDITS.md, CLAUDE.md and clazel-sys are untouched.

[atiernan]

Part 2: clazel browse with a window on macOS, and browse --headless (5.23)

(The building session's description of this part of the branch, posted as a comment for length. Where it says something waits, see the PR description: most of it was done further up the branch. Its statement that the clazel-sys audit is outstanding, if any, is out of date.)

Branch: claude/browse-window, tip 50631b181dad12bfd15fc2d31e125ea0f7405f48.

Stacked. It contains, and must merge after:

• claude/gpu-sandbox (5.21a, tip 98c053fe), which itself contains claude/mac-window-08480b (5.21, with its clazel-sys audit row c9a3cb8c), claude/gpu-fallback-cfed1c (5.17c) and clazel-gpu: batching, shaders and the Metal backend #153 claude/gpu-drawing-82b82a (5.17b).
• claude/ipc-surfaces-cfd15e (5.18, tip 301e83fc), which contains the decision commit of docs/phase5-518-decision. The merge had no conflicts, not even in Cargo.lock.

CI has not run. clazel-sys changed (one function); its audit is outstanding (below). The end-to-end test with a real page waits on 5.20 (claude/renderer-pipeline).

What

Item 5.23 of docs/phases/phase-5.md, for macOS on Apple silicon: the host side of clazel browse with a window, complete against the kernel's outputs of 5.18, and browse --headless OUT URL.

• The GPU process exists now (crates/clazel-gpu/src/main.rs, the clazel-gpu binary). The host starts it at SpawnGpu, in its 5.21a sandbox, paired with the tab's renderer. It draws every list it is sent and answers each with FrameReady.
• The host shell routes SpawnGpu, ToGpu, FromGpu and Paint (crates/clazel/src/lib.rs, 281 lines, under the 300 limit). The GPU process's plumbing is clazel_renderer::launch::Gpus. Resize and Input need no routing in the shell: the command line sends them through Host::event, which was already public.
• The window (crates/clazel/cli/window.rs) has two regions:
  • the address bar strip, drawn by the host with clazel-font, clazel-layout's shaping and clazel-glyph-mask (cli/strip.rs), from the Paint's URL or the user's typing, never from a byte the page chose;
  • the content area below it, showing the pixels of the latest Paint, clipped by its layer.
• Title bar: URL — title, URL first.
• The loop applies every queued window event and everything the host has queued before it draws one frame.
• Events and keys, as the item lists them:
  • a resize sends Resize;
  • a click or wheel turn in the content area sends Input, relative to the content area;
  • typing in the address bar and Return navigate (navigate_tab); Escape cancels;
  • Command-L focuses the bar, Command-[ goes back along the committed URLs, Command-R reloads;
  • Space, Page Up/Down and the arrows are sent as Input.
• browse --headless OUT URL [--size WxH] writes the first frame as a PPM, or a PNG with stored deflate blocks (cli/picture.rs, our own code).
• --gpu=hardware ignores the blocklist, with a warning (5.17c).
• browse --text URL is the old text mode. browse URL falls back to it without a window server session or off macOS.

Commits:

1. Merge of origin/claude/ipc-surfaces-cfd15e.
2. clazel-sys: macos::clear_close_on_exec (fcntl(fd, F_SETFD, 0)).
3. clazel-gpu: the GPU process (channel.rs, process.rs, main.rs).
4. clazel-window: Command on Event::Key, keys.rs, show_page_pixels.
5. clazel-renderer launch and the shell's routing.
6. cli/: the window loop, headless, the strip, PNG/PPM; the real-process tests.
7. A log line naming the Paint the window shows.
8. READMEs.

Decisions (each also recorded where it is made)

• How buffers pass on macOS (asked for). 5.17b/5.18's READMEs leave the Mach-port route (IOSurfaceCreateMachPort, posix_spawnattr_setspecialport_np) unbuilt and needing a prototype, and memfd is Linux's.
  • So, until that route exists, the ring is the host's: three slots per GPU process. The GPU process sends each frame's RGBA8 pixels on a surface socket (12-byte header: slot, width, height; checked before allocating, at most 256 MiB), then names the slot in FrameReady.
  • The kernel still decides which slot is shown under which URL. The host shows only a slot a Paint names, and only pixels of the Paint's size. A Paint whose pixels have not arrived yet waits for them; a newer one replaces it.
  • Cost: one copy per frame through a socket into the host. The host composites over white into a CGImage (show_page_pixels), so the IOSurface show_page path of 5.21 is unused for now.
  • Recorded in clazel-gpu/src/channel.rs and its README.
• How the sockets are inherited. The host makes two socket pairs at SpawnGpu: the list pair (renderer to GPU) and the surface pair (GPU to host). It clears close-on-exec on exactly the ends that one child gets, just before that start, then closes its copies. This is the audited call 5.18 planned.
  • The children get the numbers as --list-fd N and --surface-fd M.
  • Each child opens its socket again through /dev/fd/N before its sandbox, which needs no unsafe (measured: /dev/fd reopens a socket on macOS).
• The list socket's framing: 4 bytes of length, little-endian, then clazel_displaylist's encoding, at most 256 MiB. IPC's 1 MiB frame is too small for lists with masks.
• The GPU process draws every list in order, so its masks stay the renderer's.
  • Before the first GpuViewport it draws on a 1 by 1 target and sends no frame.
  • A GpuViewport alone draws nothing: the renderer sends a new list at the new size, since replaying a list would replay its mask uploads.
• Input encoding (for 5.20 to read):
  • click: kind 0 at content-area pixels;
  • wheel: kind 1, the delta in device pixels, positive down, 48 CSS px a notch;
  • Space, Page Up/Down and the arrows: kind 2 with the DOM keyCode (32, 33, 34, 37 to 40), for the renderer to scroll by its own viewport.
• Scale sent with Resize is 2 when the backing scale is 1.5 or more, else 1.
• The strip's font is the first system TrueType face of a fixed list (/System/Library/Fonts/Supplemental/Arial.ttf first). Nothing is bundled. With no font, the strip has no text and the host says so.
• The URL before the first Paint is drawn grey: it was asked for, not yet committed.
• browse activates its window (takes focus) as an ordinary app. No committed test does.
• The shell's line limit. Routing the GPU path pushed src/lib.rs past 300 lines. I moved the GPU process's management into clazel_renderer::launch::Gpus, and moved the log's frame formatter (describe, 22 lines of formatting) there too. This is code moved out of the counted directory to stay under the limit; the shell's decisions did not move.
• clazel-renderer now depends on clazel-gpu, for channel (the host's reader, and the renderer's write_list in 5.20).

For 5.20 (the renderer pipeline)

When paired with a GPU process, the renderer is started with --list-fd N. It should:

1. open /dev/fd/N before entering its sandbox;
2. write each list with clazel_gpu::channel::write_list;
3. lay out at the size the kernel's Viewport gives.

In text mode no --list-fd is passed. Today's clazel-renderer ignores the argument and sends Display, so browse URL opens the window with an empty page area until 5.20.

Evidence (Apple M1 Pro, macOS 26.7.2)

• Real processes, crates/clazel/tests/browse_gpu.rs: 3 tests pass. The setup:

  • a stand-in renderer (a shell script) writes a hand-built list to its inherited list socket. The list has fills, a translucent fill under a clip, and a mask upload and draw;
  • the real clazel-gpu, sandboxed, on Metal, draws it.

  What they check:

  • the kernel's Paint names slot 0 under the kernel's URL;
  • the pixels equal clazel-gpu's software reference within one level per channel;
  • clazel browse --headless against a served page writes a PNG and a PPM;
  • each decodes to the reference (the PNG through a decoder that checks every chunk's CRC, the zlib header, every stored block's LEN/NLEN and the Adler-32);
  • each is byte-for-byte what the writer makes of its own pixels.

• tests/browse_window.rs (harness = false) passes in 1.7 s. It shows that frame in a real 120×100-point window that takes no focus, draws the strip from the Paint's URL, sets the title, sees Closed after closing, and leaves nothing running.

• A live run of the window loop (clazel browse http://127.0.0.1:…/ with the stand-in renderer, killed after 6 s) logged clazel: showing http://127.0.0.1:18523/ (1024 by 732, slot 0). No GPU process, renderer or server was left running.

• Unit tests:

  Where	Tests
  cli/ (cargo test --bin clazel)	17: the address bar's editing (selection, Backspace, surrogate pairs, control characters never typed, Escape), shortcuts, history, title, wheel, the strip (ink only inside the field, caret, long text, Retina size), PNG/PPM (published CRC-32 and Adler-32 check values, multi-block, a flipped byte fails its CRC, refusals, over-white compositing)
  clazel-gpu	66 + 1: channel round trips and refusals; process ring, refusals, and the whole loop on sockets for every scene against the reference
  clazel-window	27, including the key tables
  clazel-sys	17, including that a cleared descriptor stays open and usable

• cargo test -j 4 for clazel-sys, clazel-gpu, clazel-window, clazel-renderer, clazel and xtask: every test binary passes, 0 failed (the clazel host tests' 2 ignored tests as before).

• cargo fmt --all -- --check: clean. cargo clippy --workspace --all-targets --locked -- -D warnings: clean.

• cargo xtask check: fails on the clazel-sys audit only.

Verification status

• The clazel-sys audit is outstanding. This session wrote the change and must not audit it.
  • Source hash for the auditor: 18677bf45199e9f02e139956a81413361f4dea2f6e97ae2fbe12cbaf1e58b518.
  • The change: one foreign function, fcntl, added to the macOS list in xtask/src/sys.rs, in src/macos.rs. One unsafe block, F_SETFD with 0 on a BorrowedFd.
  • The README now claims 228 blocks (470 lines).
• cargo xtask verify --changed was not run, by instruction. No Kani, Miri or Verus run was made, so no lock was taken.
• CI has not run. Its proof jobs need a reviewer of the full-verification environment.

Not done, unverified, or macOS only

• Waits on 5.20:

  • a real page through the renderer to the window and the headless file (the end-to-end test);
  • the renderer reading --list-fd;
  • whether 5.20 reads Input as encoded above.

• No pixel was read back from the screen (Screen Recording permission, and the display was asleep). The strip's and the page's appearance on screen, orientation and clipping are unverified. The live run's screen reported scale 1, so a Retina-scale window was never run; the strip at scale 2 is only unit-tested.

• The window loop's interaction was not exercised with real input: clicks, wheel, typing and shortcuts were never sent to a live window. Only the pure pieces are tested.

• macOS only:

  • Linux has no GPU process or clear_close_on_exec (its clazel-sys needs the same call), and no window (5.22).
  • Windows has no GPU process, no Command/Ctrl state (GetKeyState), and browse falls to text mode.
  • Only aarch64-apple-darwin was compiled.

• 5.17c's host side:

  • the software indicator in the strip;
  • the notice in the content area;
  • --gpu=software, which has no meaning on macOS.

  The kernel does not act on GpuReady, GpuRefused or a GPU process's exit yet; the host logs the exit.

• The Mach-port route, which would remove the copy per frame.

• Known weaknesses:

  • A hostile GPU process can make the host allocate up to 256 MiB per surface frame, and show its own tab stale pixels.
  • Clearing close-on-exec lets any program the host starts during that window inherit the socket. The shell spawns from one thread, but parallel in-process tests could leak a descriptor into another test's child.
  • The stand-in renderer sleeps 1 s so the kernel has committed and sized the tab first.

• Miri was not run on the new tests.

• docs/phases/phase-5.md was not edited: its Status table, and its 5.23 text saying "memfd", stand.

[atiernan]

Part 4: tests: the HN-shaped fixture, geometry dump and comparison, reference script, and the reftest runner's pure parts (5.25, 5.26, partial)

(The building session's description of this part of the branch, posted as a comment for length. Where it says something waits, see the PR description: most of it was done further up the branch. Its statement that the clazel-sys audit is outstanding, if any, is out of date.)

Stacked on claude/renderer-pipeline (5.20, tip eb8fa5b), and so on everything below it: claude/paint-display-list, claude/table-layout-1d3f0b, #154 claude/flow-layout-050856, with claude/ipc-surfaces-cfd15e and claude/gpu-sandbox merged in. Merge after them. Branch claude/reftest-harness, tip 5158380. CI has not run on this branch or any branch below it.

What

The parts of items 5.25 and 5.26 that need neither browse --headless nor real processes, in four commits:

1. The HN-shaped fixture (5.26, second bullet; 5fe300c): crates/clazel/tests/fixtures/hn/index.html and site.css.
   • A page and a sheet written for this project: MIT licensed, invented text (a made-up link aggregator), nothing copied from the real site or its sheet.
   • Its shapes: quirks mode, tables nested four deep with width/bgcolor/border/cellpadding/cellspacing/align/valign/colspan, spacer images (widths 0, 40, 80), font elements, the inline styles (negative margins included), a form, one same-origin linked sheet with a query, and the sheet's selectors, properties, !important and twelve media queries.
   • Its README has a table of what each shape is there for.
   • It lives in tests/fixtures/, not tests/data/, which holds vendored suites that need converters.
2. Our side of the geometry comparison (5.25; 876ecfe): clazel-layout's new rects module.
   • Every element's and text node's client rectangles from the fragment tree: border boxes, inline pieces per line, a table's wrapper, and a text node's glyphs per line over its font's content area.
   • Each is keyed by the node's childNodes path, and written as JSON in one schema, clazel-client-rects/1, stated once in the module's header. Our own reader reads it back.
   • The comparison is a pure function: rectangles matched by node, kind and index; within 2 px in position and 2 % in width (two constants, stated once); reporting the count outside, plus missing and extra rectangles and examples.
   • Page::client_rects in the renderer lays out exactly as run_graphics does.
3. The reference script (5.25; 714b6a4): scripts/reference-rects.mjs.
   • Pinned headless Chrome (Chrome for Testing 131.0.6778.85, puppeteer-core 23.10.4) at 800×600, scale 1, with the repository's font files as the generic families (a fontconfig file listing only them, and Page.setFontFamilies).
   • It records the same JSON from getClientRects, with the browser's name, version and date, and a viewport screenshot.
   • It has never been run. No browser was downloaded or started; its header says so.
4. The reftest runner's pure parts (5.25; 5158380): crates/clazel/tests/reftest/ and crates/clazel/tests/reftests.rs, against WPT at this repository's pinned commit 4ad507b2 (the docs' "Fuzzy Matching" and "Multiple References", tools/manifest/sourcefile.py, wptrunner's executors/base.py):
   • <link rel=match|mismatch> and <meta name=fuzzy> found with our own HTML parser: named or positional ranges, N or N-M, a reference key before the last :, and WPT's error cases.
   • The pixel comparison as wptrunner runs it: RGB only, the difference counted over pixels whose luminance (PIL's convert("L")) is not zero, and check_pass's rule with its two shortcuts. The docs' formula differs (it counts every pixel), and this difference is listed.
   • "Not run, by reason": print, script (including reftest-wait), images and embedded documents (elements and url(), and CSS outside the subset (by clazel-style's own property table and grammars, the "parsed, no effect" properties, and ignored at-rules).
   • A runner that takes the renderer as a parameter (trait Render), with WPT's multiple-references rule.

Decisions

• The fixture's shapes come from phase-5.md's measured "What the exit page needs" (2026-10-31). Item 5.1's inventory script has never been run, so docs/phase5-inventory.md does not exist. The fixture's README says so; rerunning 5.1 may add shapes.
• The JSON schema keys rectangles by childNodes paths (both engines parse with HTML's parser) and uses CSS px in document coordinates. A table element's rectangle is its wrapper's. Heights are not compared, because engines take a line's content area from different font tables.
• wptrunner's comparison is followed over the docs' formula, because wptrunner is what judges reftests. Alpha is dropped; screenshots of different sizes are unequal.
• One level of references: a reference's own references are not followed.
• The "outside the subset" check is conservative. A value the subset's grammar refuses counts as not run, which also catches some error-handling tests that would pass.
• Where things live:
  • the dump is in clazel-layout, which knows the fragment tree;
  • the runner's parts are test support in the clazel crate's tests/ (the plan's reftests.rs), so the host's src/ line count is unchanged;
  • new clazel dev-dependencies (ours): clazel-treebuilder, clazel-style.
• Nothing from WPT is vendored. No listed directory was needed to write or test these parts.

Evidence

• clazel-layout's rects tests (4):
  • a hand-built fragment tree (a real page's boxes and document, its fragments written by hand) gives the expected four rectangles;
  • the JSON round trip, including a browser's floats rounding to 1/64 px;
  • the tolerance at its edges, with zero width;
  • the report's counts.
• The renderer's fixture test: the fixture through the pipeline's layout at 800×600 gives over 100 rectangles and over 50 text rectangles.
  • The outer table is the larger of 85% of 784 px and its min-content width. With no sheet loaded (5.19), that is exactly the 80-column textarea's width, 839.05 px.
  • The JSON reads back unchanged, and compared with itself, every rectangle is within the tolerance.
• reftests.rs (7):
  • references found and resolved;
  • every fuzzy form and error;
  • fuzzy per reference;
  • wptrunner's difference on hand-made pixel buffers (a red difference of 1 alone is not counted; luminances worked out in the comments);
  • the fuzzy rule and its shortcuts;
  • every not-run reason, with an in-subset page that is run;
  • the runner with a fake renderer: one of two matches passes, a matching mismatch fails, a failing match reports its difference, not-run, not a reftest, a missing file.
• Run with -j 4: cargo test -p clazel-layout -p clazel-renderer (all pass); cargo test -p clazel --test reftests (7 pass); cargo fmt --all -- --check; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo xtask check (RESULT: STATIC CHECKS PASSED).
• No Kani or Miri (test support and a Tier 0 dump). The lock was not taken.

What waits

• 5.25's reftests themselves:
  • they need browse --headless to plug in as the Render (5.23, on claude/browse-pipeline);
  • and WPT's css/CSS2/ directories and css-tables vendored (5.1).
  • No WPT test has been run or counted; the README's conformance row waits.
• CI's lavapipe job (one pinned Mesa, failing on any other driver), Windows on WARP, and the macOS smoke test.
• The stored screenshot of the fixture, compared exactly in CI: it needs the GPU path drawing the fixture headless.
• The reference engine's numbers: the script has never been run, so no reference JSON or screenshot exists and no geometry comparison against a browser has been made.
• 5.26's process tests:
  • the fixture served by the in-process server;
  • its sheet through FetchStyle with the cookie, and a cross-origin sheet without it;
  • Paint's buffer against the stored screenshot;
  • the address bar;
  • a click navigating.
• 5.26's hostile pages (CSS bombs, malicious fonts, huge tables and lengths, attempts on the address bar, GPU process kills), the demo, and keeping Phases 2 to 4's tests on the new schema.
• The fixture's sheet is linked, so until 5.19's fetches are wired the pipeline lays the fixture out without it.

Verification status

• cargo xtask verify was not run locally in any form, as instructed.
• CI has not run. Its proof jobs need a full-verification approval, and the branches below must merge first.
• The Status table, roadmap line, docs/STATUS.md and its SVGs, SPEC-REVIEWS.md, SYS-AUDITS.md, CLAUDE.md and clazel-sys are untouched.