feat: add transactional TSX render messages

Author: Roy Lin

README.md

@@ -6,7 +6,7 @@
   <a href="https://github.com/A3S-Lab/GUI/actions/workflows/ci.yml"><img alt="CI status" src="https://github.com/A3S-Lab/GUI/actions/workflows/ci.yml/badge.svg"></a>
   <img alt="Rust 1.95.0" src="https://img.shields.io/badge/Rust-1.95.0-2F3945?style=flat-square&logo=rust&logoColor=white">
   <img alt="Roadmap milestone M3 current" src="https://img.shields.io/badge/roadmap-M3%20current-0067C0?style=flat-square">
-  <img alt="TSX architecture milestone T0 proposed" src="https://img.shields.io/badge/TSX-T0%20proposed-1687D9?style=flat-square">
+  <img alt="TSX milestone T1 Rust foundation" src="https://img.shields.io/badge/TSX-T1%20Rust%20foundation-1687D9?style=flat-square">
   <a href="LICENSE"><img alt="MIT license" src="https://img.shields.io/badge/license-MIT-2F3945?style=flat-square"></a>
 </p>
 
@@ -20,10 +20,9 @@ path uses a DOM, CSSOM, WebView, or framework-owned content renderer.
 > AppKit/GTK4/WinUI control hosts are established dogfood baselines. The first
 > generic self-drawn layout-to-Scene slice has landed; self-drawn text shaping,
 > editing/IME, accessibility bridges, and real thin-host presentation remain
-> roadmap
-> work. The TSX runtime, local host session, and npm packages are architecture
-> only and have not been implemented yet. React Aria component parity is not
-> claimed yet.
+> roadmap work. The TypeScript runtime, executable process host, and npm
+> packages have not been implemented yet; the landed Rust TSX protocol is not
+> a runnable TSX application. React Aria component parity is not claimed yet.
 
 The target is unambiguous: A3S draws all application content. The existing
 `appkit-native`, `gtk4-native`, and `winui-native` modules create controls only
@@ -137,15 +136,22 @@ await createApp(Counter).run();
 ```
 
 This sample documents the target API; it is not runnable yet. The Rust-side
-session entrance is now executable: strict `hello`/`welcome` DTOs negotiate the
-renderer, capabilities, debug channels, one in-flight render, and a JSON
-payload limit no larger than 16 MiB; incremental and blocking codecs enforce a
-little-endian `u32` length prefix and reject empty, oversized, truncated,
-invalid UTF-8, duplicate-field, unknown-kind, and unsupported-protocol input
-before a session is bound. The remaining design keeps component state and callbacks in Node,
-keeps platform/GPU handles inside a separate Rust process, reuses resolved
-`ProtocolUiFrameV1` records, and sends complete frames so Rust remains the only
-native reconciler. Read the
+session boundary is now executable in Rust: strict `hello`/`welcome` DTOs
+negotiate the renderer, capabilities, debug channels, one in-flight render,
+and a JSON payload limit no larger than 16 MiB. Strict `render`, `committed`,
+and ordered multi-invocation `event` messages reuse resolved
+`ProtocolUiFrameV1` input while keeping legacy planned-widget responses out of
+the TSX wire contract. `TsxHostApplicationSessionV1` validates message,
+render, host-frame, and event sequences before mutation, preserves the active
+revision after a rejected frame, and maps self-drawn snapshots and dispatches
+directly. Incremental and blocking codecs enforce a little-endian `u32` length
+prefix and reject empty, oversized, truncated, invalid UTF-8, duplicate-field,
+unknown-kind, and unsupported-protocol input. Canonical hello, counter render,
+commit, and event fixtures plus a Rust RSX/TSX Native IR and accessibility
+parity test pin this slice. Actual process I/O, TypeScript declarations, JSX
+runtime, callback registry, and packages remain. The design keeps component
+state and callbacks in Node, platform/GPU handles inside a separate Rust
+process, and Rust as the only native reconciler. Read the
 [TSX native runtime architecture](docs/tsx-native-runtime.md) for protocol,
 identity, failure recovery, packaging, and T0-T5 delivery gates.
 
@@ -355,7 +361,7 @@ independently.
 | M4 · Text and interaction cutover | In progress | Stable-id raw input, long press, move, typed and collection drag/drop, timed drop activation, and fail-closed dynamic drop policy resolution landed; shaping, glyphs, editing/IME, accessibility bridges, overlays, and complete calculator scenarios remain |
 | M5 · Default cutover | Planned | Make self-drawn content the default, then delete the three legacy widget renderers |
 | H0-H5 · Thin platform hosts | H0 complete; H1 in progress | Atomic frames, lifecycle recovery, stable-id raw input/reducers, long press, captured move, typed drag/drop negotiation and timed target activation, zero-toolkit firewalls, and an interactive calculator landed; the Graphics raw-surface edge remains |
-| T0-T5 · TSX native authoring | T1 Rust foundation in progress | Strict handshake, bounded length-prefixed framing, message sequencing, and revision-scoped drop-policy DTO/resolver bridge landed; render/event messages, TypeScript declarations, JSX runtime, Node callback transport, state runtime, self-drawn native window, packages, and stable SDK remain |
+| T0-T5 · TSX native authoring | T1 Rust foundation in progress | Strict handshake/framing, transactional render/commit/event messages, self-drawn snapshot/dispatch adapters, counter golden/parity fixtures, and revision-scoped drop-policy bridge landed; process I/O, TypeScript declarations, JSX runtime, Node callback registry/state, packages, and stable SDK remain |
 | M6-M8 · React Aria components | Catalog pinned; conformance planned | 51/51 families mapped; collection DnD authoring/behavior slice landed; eight public parts, full software, accessibility, and three-OS self-drawn evidence remain |
 
 The dependency-ordered plan and acceptance gates are in the
@@ -499,7 +505,7 @@ src/
 |- rsx_app/              ComponentCx, hooks, components, and binding scope
 |- rsx_ui/               built-in semantic design-system registry
 |- protocol.rs           versioned frame, event, action, ACK, and recovery boundary
-|- tsx_protocol/         strict handshake, message sequencing, and bounded framing
+|- tsx_protocol/         strict handshake/framing plus transactional render, commit, and event sessions
 |- native.rs             portable NativeElement UI IR
 |- layout/               deterministic records, style projection, diffs, and tests
 |- drawing.rs            Graphics boundary and reference/GPU renderer wrappers

docs/architecture.md

@@ -970,9 +970,16 @@ limits. `TsxHostHandshakeV1` mutates from unbound to negotiated only after the
 complete response fits the negotiated limit. Both stream and incremental JSON
 codecs validate a little-endian `u32` length before allocation, enforce the
 16 MiB protocol-v1 JSON-payload ceiling, and poison an incremental decoder
-after any framing or strict-JSON violation. This Rust transport foundation has
-no Node, Nub, N-API, Graphics, legacy renderer, or OS-toolkit dependency;
-render/event session messages and the Node implementation remain T1 work.
+after any framing or strict-JSON violation. Strict full-frame `render`, atomic
+`committed`, and ordered multi-invocation `event` messages now feed a
+`TsxHostApplicationSessionV1` that permits one render in flight and advances no
+committed state on validation or response-encoding failure. It tracks the TSX
+callback-scope revision separately from the self-drawn host snapshot revision,
+so callback-only rerenders can reuse identical Native IR safely. Feature-gated
+adapters consume `SelfDrawnFrameSnapshot` and `SelfDrawnInputDispatch`
+directly. The feature-independent foundation has no Node, Nub, N-API,
+Graphics, legacy renderer, or OS-toolkit dependency; commands, process I/O,
+generated TypeScript, and the Node implementation remain T1 work.
 
 Drop policies that participate in hit testing use a separate synchronous
 protocol-v1 exchange rather than an action invocation. A

docs/react-aria-native.md

@@ -187,11 +187,11 @@ The first shared interaction milestone is available in the portable runtime:
   types, and disallowed operations all fail closed to `cancel`. Strict protocol
   v1 DTOs and `ProtocolDropPolicyResolverV1` bridge this contract without Rust
   evaluating JavaScript. The separate TSX boundary now also has strict atomic
-  handshake negotiation and bounded length-prefixed JSON framing, but its
-  render/event messages and Node callback registry/transport, external
-  files/directories and cross-application transfer, drag previews, and full
-  conformance evidence remain separate M7 work, so no affected family is
-  marked conformant.
+  handshake negotiation, bounded length-prefixed JSON framing, transactional
+  render/commit/event messages, and a direct self-drawn dispatch adapter. Its
+  Node callback registry/transport, external files/directories and
+  cross-application transfer, drag previews, and full conformance evidence
+  remain separate work, so no affected family is marked conformant.
 
 - `NativeInputModality` represents keyboard, mouse, touch, pen, virtual, and
   unknown input.

docs/roadmap.md

@@ -623,10 +623,11 @@ Gates:
 
 ## P0-T TSX Native Authoring Track
 
-Status: architecture accepted; the Rust-side strict handshake, bounded framing,
-message sequencing, and revision-scoped drop-policy protocol/resolver adapter
-have landed. Render/event transport messages, generated TypeScript, the JSX
-runtime, Node callback registry, and visible TSX application remain.
+Status: architecture accepted; the Rust-side strict handshake/framing,
+transactional render/commit/event session, self-drawn snapshot/event adapters,
+counter golden/parity fixtures, and revision-scoped drop-policy
+protocol/resolver adapter have landed. Process I/O, generated TypeScript, the
+JSX runtime, Node callback registry, and visible TSX application remain.
 
 This track is dependency-coupled to the renderer and H0-H5 host programs
 without blocking Rust RSX work. Headless protocol and JSX-runtime work can
@@ -651,25 +652,29 @@ decisions are recorded in
   identity, and no-install-script packaging decisions
 - reuse the resolved `ProtocolUiFrameV1` input vocabulary behind a new TSX
   session envelope
-- pin Rust RSX and TSX counter/calculator parity fixtures
+- extend the landed Rust RSX/static-TSX counter parity fixture to the
+  calculator and generated TypeScript CI
 
 Gate: TSX is a peer authoring frontend and cannot bypass Native IR, layout,
 Graphics, interaction, accessibility, or capability checks.
 
 ### T1 - Headless JSX and protocol slice
 
-Status: Rust transport foundation in progress. Strict `hello`/`welcome` DTOs,
-atomic negotiation, the fixed protocol/session/message/revision envelope,
-16 MiB-capped little-endian length framing, incremental decoding, and the first
-canonical JSON fixture have landed without Node or Graphics dependencies.
+Status: Rust transport foundation in progress. Strict `hello`/`welcome` plus
+`render`/`committed`/`event` DTOs, atomic negotiation and commit ordering, the
+fixed protocol/session/message/revision envelope, independent TSX and
+self-drawn host revisions, 16 MiB-capped little-endian framing, incremental
+decoding, four canonical JSON fixtures, and static counter Native
+IR/accessibility parity have landed. The core remains free of Node and Graphics
+dependencies; self-drawn conversions compile only with `platform-runtime`.
 
 - generated TypeScript declarations from versioned Rust DTOs
 - automatic `jsx-runtime` and `jsx-dev-runtime` exports
 - deterministic child, prop, key, and event normalization
-- extend the landed bounded length-prefixed framing, handshake, and message-id
-  sequencing with render revisions, event sequencing, process I/O, and
-  structured diagnostics
-- static TSX counter rendered through the current headless semantic path
+- add command messages, local process I/O, and generated structured diagnostic
+  declarations to the landed application session
+- extend the landed static counter semantic parity to TypeScript CI and the
+  calculator fixture
 
 Gates:
 

docs/tsx-native-runtime.md

@@ -1,6 +1,7 @@
 # TSX to Native Runtime Architecture
 
-Status: proposed. No TypeScript package or TSX host is implemented yet.
+Status: proposed API; the Rust T1 protocol foundation is in progress. No
+TypeScript package or executable TSX host is implemented yet.
 
 This document defines an optional TypeScript authoring path for A3S GUI. The
 developer experience is a directly executable `.tsx` application:
@@ -385,9 +386,16 @@ control messages with the fixed `a3s.gui.tsx` identifier, atomic
 `TsxHostHandshakeV1` negotiation, exact per-sender `TsxMessageSequenceV1`, and
 blocking plus incremental framed JSON codecs. The decoder validates a declared
 length before allocating, becomes unusable after a framing/JSON violation, and
-has a checked end-of-stream path for partial headers and payloads. A canonical
-`hello-v1.json` fixture pins the current wire spelling. Render/event/command
-messages, actual local process I/O, and the TypeScript peer are still pending.
+has a checked end-of-stream path for partial headers and payloads.
+`TsxHostApplicationSessionV1` now accepts strict full-frame `render` messages,
+promotes them only through a bounded `committed` response, emits complete
+ordered `event` batches, permits exactly one render in flight, and leaves the
+active revision unchanged on validation, host, or response-encoding failure.
+Its feature-gated adapters project `SelfDrawnFrameSnapshot` and
+`SelfDrawnInputDispatch` directly; no planned-widget response is involved.
+Canonical hello, counter render, committed, and event fixtures pin the wire
+spelling. Command messages, actual local process I/O, generated TypeScript,
+and the TypeScript peer remain pending.
 
 ### Messages
 
@@ -414,6 +422,14 @@ ordered invocation vector, applies batched state updates, and then schedules at
 most one new frame. Stale, skipped, or duplicated sequences are explicit
 session errors.
 
+Protocol `renderRevision` identifies the TSX tree and callback scope.
+`hostRevision` identifies the committed self-drawn snapshot used for layout,
+hit testing, scene, and accessibility. They deliberately are not aliases: a
+TSX rerender may replace callbacks while producing identical Native IR, so the
+self-drawn host can retain its snapshot revision while the TSX render revision
+advances. An event must match the active host revision and is then delivered
+against the active TSX render revision.
+
 ### Commit and Recovery
 
 The host performs each render as prepare, validate, commit, and present:
@@ -449,9 +465,11 @@ packages/typescript/
 `- tests/
 
 src/tsx_protocol/
-|- message.rs      strict control DTOs and common envelope metadata
+|- application.rs  strict render, commit, event, context, and diagnostic DTOs
+|- message.rs      direction-specific messages and common envelope metadata
 |- handshake.rs    atomic capability, renderer, and limit negotiation
 |- framing.rs      limits plus blocking and incremental JSON framing
+|- session.rs      one-in-flight transactional revision/event ordering
 `- tests.rs
 
 src/platform_host/       shared zero-widget host contract and OS shells
@@ -530,12 +548,13 @@ minimum M4 text/input slice.
 
 ### T0 - Contract and Architecture
 
-Status: architecture accepted; the Rust-side strict handshake/framing boundary
-and drop-policy DTO/resolver adapter are implemented. The remaining parity
-fixtures, application message set, and Node-side transport are pending.
+Status: architecture accepted; the Rust-side strict handshake/framing,
+render/commit/event session, counter parity fixtures, self-drawn adapters, and
+drop-policy DTO/resolver adapter are implemented. Calculator and
+cross-language fixtures, commands, and Node-side transport are pending.
 
 - accept process, ownership, identity, protocol, and packaging decisions
-- pin cross-language golden frame and event fixtures
+- extend the landed Rust golden frame/event fixtures into cross-language CI
 - define the first counter and calculator parity scenarios
 - record unsupported React and browser behaviors explicitly
 
@@ -546,16 +565,19 @@ cannot bypass Native IR, layout, Graphics, interaction, or accessibility.
 
 Status: Rust transport foundation in progress. `hello`/`welcome`, atomic limit
 and renderer negotiation, exact message-id sequencing, 16 MiB-capped framing,
-incremental decoding, and the first canonical JSON fixture have landed.
+incremental decoding, strict `render`/`committed`/`event` DTOs, transactional
+session ordering, self-drawn adapters, four canonical JSON fixtures, and the
+static counter Native IR/accessibility parity test have landed.
 
-- extend the landed bounded framing and handshake DTOs with render/event/
-  command messages and actual local process I/O
+- extend the landed application messages with command messages and actual
+  local process I/O
 - connect the landed strict drop-policy query/response DTOs to that transport
   and the Node callback registry
 - generate TypeScript protocol declarations from Rust DTOs
 - publish local development exports for `jsx-runtime` and `jsx-dev-runtime`
 - implement element/child/prop normalization, keys, and action registration
-- run a static TSX frame through the existing semantic and headless pipelines
+- extend the landed static counter parity fixture to generated TypeScript CI
+  and the calculator scenario
 
 Gates: