feat: add revision-scoped drop policy resolution

Author: Roy Lin

README.md

@@ -76,9 +76,14 @@ versioned [component matrix](docs/react-aria-component-matrix.json) pins
   `onMove`, same-parent `onReorder`, multi-callback routing, equivalent adjacent
   boundaries, and self/descendant guards now follow the React Aria collection
   policy. Ordinary targets and collection items also share the exact 800ms
-  `onDropActivate` hold lifecycle across pointer and keyboard drags; dynamic
-  acceptance, OS/cross-application transfer, previews, pixels, accessibility,
-  and real hosts still keep every affected family below conformance;
+  `onDropActivate` hold lifecycle across pointer and keyboard drags. Dynamic
+  `shouldAcceptItemDrop` and `getDropOperation` policies now resolve before hit
+  feedback through a synchronous, revision-scoped boundary: high-level item
+  drops are filtered again per transferred item, low-level `onDrop` retains
+  override semantics, and missing, stale, timed-out, malformed, or disallowed
+  answers fail closed to `cancel`. OS/cross-application transfer, previews,
+  pixels, accessibility, and real hosts still keep every affected family below
+  conformance;
 - Checkbox, Radio, and Switch Field/Button parts plus ToastList and
   ToastContent are recorded as eight explicit API gaps;
 - a component reaches `conformant` only with behavior, layout/hit, Graphics
@@ -320,7 +325,12 @@ independently.
   one React Aria-compatible `DropActivate` after 800ms without delaying the
   deadline as the pointer moves inside the same target; all paths share
   event-loop deadlines, stable action bubbling, keyed reconciliation, and
-  reducer rollback in one staged interaction session
+  reducer rollback in one staged interaction session. Generic and collection
+  targets can additionally invoke typed `getDropOperation` policies, while
+  collection `shouldAcceptItemDrop` runs at target resolution and once per item
+  before high-level drop dispatch. Versioned frame/event/query correlation and
+  the protocol-v1 exchange adapter reject stale or failed process answers as
+  `cancel`; Rust never evaluates JavaScript
 - an identical-frame fast path that performs no layout, scene, host, or
   presentation work, plus semantic-only commits that skip pixel presentation
 - a software Graphics presenter and interactive shared
@@ -336,10 +346,10 @@ independently.
 | M1 · GUI integration | Complete | Pinned Graphics boundary, semantic-only dependency gate, renderer inventory, reference/GPU wrappers, first generic adapter |
 | M2 · GPU backend | Implementation landed | Graphics commit `8748fab`; Metal and Vulkan CI parity evidence remains |
 | M3 · Layout and Scene | Current | Generic calculator rectangle slice landed; full flex, stacking, redraw scheduling, cross-platform fingerprints, and thin-host presentation remain |
-| M4 · Text and interaction cutover | In progress | Stable-id raw input, long press, move, typed and collection drag/drop plus timed drop activation landed; shaping, glyphs, editing/IME, accessibility bridges, overlays, and complete calculator scenarios remain |
+| M4 · Text and interaction cutover | In progress | Stable-id raw input, long press, move, typed and collection drag/drop, timed drop activation, and fail-closed dynamic drop policy resolution landed; shaping, glyphs, editing/IME, accessibility bridges, overlays, and complete calculator scenarios remain |
 | M5 · Default cutover | Planned | Make self-drawn content the default, then delete the three legacy widget renderers |
 | H0-H5 · Thin platform hosts | H0 complete; H1 in progress | Atomic frames, lifecycle recovery, stable-id raw input/reducers, long press, captured move, typed drag/drop negotiation and timed target activation, zero-toolkit firewalls, and an interactive calculator landed; the Graphics raw-surface edge remains |
-| T0-T5 · TSX native authoring | Proposed | Automatic JSX runtime, versioned Node-to-host session, state/event runtime, self-drawn native window, packages, and stable SDK |
+| T0-T5 · TSX native authoring | First protocol slice landed | Rust-side revision-scoped drop-policy DTOs and resolver bridge landed; automatic JSX runtime, Node transport/callback registry, state/event runtime, self-drawn native window, packages, and stable SDK remain |
 | M6-M8 · React Aria components | Catalog pinned; conformance planned | 51/51 families mapped; collection DnD authoring/behavior slice landed; eight public parts, full software, accessibility, and three-OS self-drawn evidence remain |
 
 The dependency-ordered plan and acceptance gates are in the

docs/architecture.md

@@ -961,6 +961,17 @@ and events are rejected until delivery is acknowledged. Password values remain
 available to in-process reducers but are removed from commands, accessibility,
 responses, session debug output, and retained diagnostics.
 
+Drop policies that participate in hit testing use a separate synchronous
+protocol-v1 exchange rather than an action invocation. A
+`ProtocolDropPolicyQueryV1` carries the session, committed render revision,
+event sequence, query sequence, policy id, typed generic/collection target,
+drag types, and allowed operations. `ProtocolDropPolicyResolverV1` validates
+the exact response envelope before returning it to the self-drawn runtime; a
+timeout, unavailable transport, handler failure, stale response, wrong
+decision type, or source-disallowed operation becomes `cancel`. This boundary
+supports React Aria `shouldAcceptItemDrop` and `getDropOperation` without
+serializing closures or executing JavaScript in Rust.
+
 `NativeProtocolApp` remains the convenience state/reducer loop for the legacy
 in-process API. Strict-v1 is deliberately a transport-owned
 `NativeProtocolSession` primitive: the transport owns resend/ACK ordering and

docs/platform-hosts.md

@@ -215,6 +215,7 @@ src/platform_runtime/
 |- long_press_input.rs  event-loop deadlines and terminal hold recognition
 |- move_input.rs        captured incremental pointer and keyboard movement
 |- drag_drop.rs         typed transfer data and source/target negotiation
+|- drop_policy.rs       revision-scoped synchronous policy query/response
 |- drag_drop_activation_input.rs
 |                       800ms target hold deadline and activation routing
 |- drag_drop_input.rs   captured pointer drag lifecycle and target routing
@@ -402,11 +403,14 @@ Landed evidence:
   adjacent insertion boundaries. Ordinary targets and collection items emit
   `DropActivate` after an exact 800ms hold through the same host deadline;
   collection roots do not activate, and target exit/change/cancel/drop clears
-  or restarts the timer
+  or restarts the timer. Dynamic item acceptance and operation selection use a
+  synchronous frame/event/query-scoped resolver, re-filter high-level item
+  drops per transferred item, preserve low-level `onDrop` precedence, and map
+  missing, stale, timed-out, malformed, or disallowed answers to `cancel`
 - reducer errors restore the staged interaction state and sequence before the
   event is exposed as successful; successful frame reconciliation preserves
   focused stable ids, while rejected frames do not touch them
-- 63 focused runtime/software tests and four recursive feature/source
+- 67 focused runtime/software tests and four recursive feature/source
   firewall tests pass without any legacy renderer or OS toolkit dependency
 - `self_drawn_calculator` reproduces layout fingerprint
   `16529597026056060935`, scene fingerprint `2100550662756266801`, and

docs/react-aria-native.md

@@ -174,10 +174,22 @@ The first shared interaction milestone is available in the portable runtime:
   combined callbacks retain React Aria order, while low-level `onDrop`
   overrides high-level dispatch.
   Selected descendants are removed when their selected ancestor is dragged,
-  and internal self/descendant targets are rejected. Dynamic item acceptance
-  and operation callbacks, external files/directories and cross-application
-  transfer, drag previews, and conformance evidence remain separate M7 work,
-  so no affected family is marked conformant.
+  and internal self/descendant targets are rejected.
+- Dynamic `shouldAcceptItemDrop` and `getDropOperation` identifiers are not
+  ordinary action ids. The self-drawn runtime issues a synchronous typed query
+  with committed frame, event, and query sequences before exposing a target as
+  valid. Collection item-on targets run aggregate acceptance during feedback
+  and per-item acceptance before high-level dispatch; low-level `onDrop`
+  preserves its override and receives the complete drag-session item list once
+  target-level type negotiation succeeds.
+  A returned operation must be allowed by the source. Missing resolvers,
+  timeout/disconnect/failure, mismatched response metadata, wrong decision
+  types, and disallowed operations all fail closed to `cancel`. Strict protocol
+  v1 DTOs and `ProtocolDropPolicyResolverV1` bridge this contract without Rust
+  evaluating JavaScript. The Node callback registry/transport, external
+  files/directories and cross-application transfer, drag previews, and full
+  conformance evidence remain separate M7 work, so no affected family is
+  marked conformant.
 
 - `NativeInputModality` represents keyboard, mouse, touch, pen, virtual, and
   unknown input.
@@ -611,7 +623,7 @@ props:
 | Priority | Area | Required outcome |
 | --- | --- | --- |
 | P0 | Self-drawn component accounting | Keep all 51 React Aria 1.19.0 families in the executable matrix, implement the eight recorded public-part gaps, and require every upstream catalog delta to update code, matrix, tests, and milestones together. |
-| P0 | Shared self-drawn interaction | Extend the landed stable-id pointer, keyboard, Tab-focus, hover, press, scheduled generic long press, incremental captured move, typed source/target drag negotiation, collection item/between/root delegates plus reorder/move policy, cancellation, wheel, bubbling, and reducer path with dynamic item/operation acceptance, external file/directory transfer, drag previews, collection long-press selection mode, focus-scope restoration, overlay gestures, text editing/IME, and accessibility activation. |
+| P0 | Shared self-drawn interaction | Extend the landed stable-id pointer, keyboard, Tab-focus, hover, press, scheduled generic long press, incremental captured move, typed source/target drag negotiation, collection item/between/root delegates plus reorder/move and dynamic item/operation policy, cancellation, wheel, bubbling, and reducer path with external file/directory transfer, drag previews, collection long-press selection mode, focus-scope restoration, overlay gestures, text editing/IME, and accessibility activation. |
 | P0 | Native input conformance | WinUI's complete 98-case V1 manifest passes real OS automation. Populate the AppKit and GTK4 manifests with platform-run mouse, pen, touch where applicable, keyboard, assistive activation, disabled, cancellation, and keyed-rerender fixtures for every role currently marked native; then close or retain evidence-backed menu/item exceptions. |
 | P1 | Event propagation | Add platform-run conformance fixtures for conditional `Stop`/`Continue` across nested native controls. |
 | P1 | Focus management | Add platform-run conformance fixtures for post-mount `autoFocus`, nested containment, and restoration. |

docs/roadmap.md

@@ -526,10 +526,20 @@ Landed evidence:
   and exposes each collection as one Tab stop with arrow/Home/End navigation.
   ListBox, GridList, Tree, Table, and explicit DropIndicator authoring all lower
   to this shared self-drawn path
+- generic targets and collection targets expose a synchronous
+  `getDropOperation` policy, and collection item-on targets expose
+  `shouldAcceptItemDrop`. Queries carry the committed frame revision, event
+  sequence, query sequence, stable policy id, typed target, drag types, and
+  allowed operations. High-level collection drops filter each item again at
+  drop time, low-level `onDrop` bypasses that high-level filter, and missing,
+  stale, timed-out, malformed, or disallowed responses resolve to `cancel`.
+  Protocol v1 includes strict query/response DTOs and an exchange adapter whose
+  transport must own the bounded wait; the future Node runtime still owns
+  callback execution
 - the shared 410x620 calculator preserves its reviewed layout and scene
   fingerprints, routes eight fake-host events through four reducer actions,
   commits the resulting frames, and reaches display value `10`
-- 63 focused runtime/software tests plus four recursive H1 firewall tests are
+- 67 focused runtime/software tests plus four recursive H1 firewall tests are
   included in `just verify`
 
 Remaining H1 work:
@@ -538,10 +548,10 @@ Remaining H1 work:
   pinned Graphics commit `8748fab` owns only a surface-independent texture and
   readback today, so its safe host-owned surface attachment/recovery contract
   must land before GUI can implement this edge without duplicating `wgpu`
-- dynamic collection item/operation acceptance callbacks, native file/directory
-  and cross-application transfer, drag previews, text editing, IME, overlay
-  gestures, and component-specific pixel/accessibility/real-host conformance
-  remain explicit M4 and M6-M8 work
+- native file/directory and cross-application transfer, drag previews, text
+  editing, IME, overlay gestures, the Node-side policy callback transport, and
+  component-specific pixel/accessibility/real-host conformance remain explicit
+  M4 and M6-M8 work
 
 Gates:
 
@@ -613,7 +623,9 @@ Gates:
 
 ## P0-T TSX Native Authoring Track
 
-Status: architecture proposed; implementation has not started.
+Status: architecture accepted; the first Rust-side revision-scoped drop-policy
+protocol and resolver adapter has landed, while the JSX runtime, Node callback
+registry, process transport, and visible TSX application have not started.
 
 This track is dependency-coupled to the renderer and H0-H5 host programs
 without blocking Rust RSX work. Headless protocol and JSX-runtime work can
@@ -751,9 +763,10 @@ self-drawn conformance.
 - close the executable 1.19.0 behavior deltas: embedded-control keyboard
   navigation for GridList/Tree, Menu action key plus value, arbitrary Popover
   target rectangles, and multi-MIME/wildcard drag type negotiation
-- build on the landed shared collection root/item/insertion delegate and
-  reorder/move policies with dynamic item/operation acceptance, OS transfer,
-  drag previews, and software/accessibility/three-host conformance stories
+- build on the landed shared collection root/item/insertion delegate,
+  reorder/move policies, and dynamic item/operation acceptance with OS
+  transfer, drag previews, the Node policy transport, and
+  software/accessibility/three-host conformance stories
 
 ### M8 - Date, color, tables, and advanced data
 

docs/rsx-framework.md

@@ -370,6 +370,11 @@ Status: initial implementation.
   Link, and text primitives
 - Rust function components stored as `.rsx` source modules and written with
   `ComponentCx` and `rsx!`
+- `UiDroppable` and `UiDropZone` accept a stable `getDropOperation` policy id.
+  `UiListBox`, `UiGridList`, `UiTree`, and `UiTable` additionally accept
+  `shouldAcceptItemDrop`; both lower to dedicated `data-*-policy` metadata and
+  are resolved synchronously by the self-drawn runtime rather than registered
+  as ordinary reducer actions
 - `UiTextarea`
 - class merging for static base classes plus caller `className`
 - focused module split for classes, component source modules, variants, and

docs/tsx-native-runtime.md

@@ -293,11 +293,17 @@ Callbacks that decide hit testing before an event is dispatched are a distinct
 protocol concern. In particular, React Aria's `shouldAcceptItemDrop` and
 `getDropOperation` require a synchronous answer while resolving the current
 collection target. They must not be encoded as ordinary action ids, serialized
-closures, or post-event reducers. Before these APIs are exposed to TSX, the
-session protocol must define a revision-scoped policy decision/query contract
-with bounded execution, stale-revision rejection, and `cancel` as the safe
-timeout/failure result (or an equivalent declarative decision table). Node
-continues to own JavaScript callbacks; the Rust host never executes JS.
+closures, or post-event reducers. The Rust boundary now defines
+`SelfDrawnDropPolicyQuery`/`Response`, strict
+`ProtocolDropPolicyQueryV1`/`ResponseV1` envelopes, and
+`ProtocolDropPolicyResolverV1`. Every query identifies the committed frame,
+event, query sequence, policy id, typed target, drag types, and allowed
+operations; stale or malformed responses and source-disallowed operations fail
+closed. The exchange trait makes timeout, unavailable transport, and handler
+failure explicit and maps all three to `cancel`. Before these APIs are exposed
+to TSX, the Node runtime must bind its revision-scoped callback registry to a
+bounded implementation of that exchange. Node continues to own JavaScript
+callbacks; the Rust host never executes JS.
 
 ### Components and Hooks
 
@@ -516,7 +522,9 @@ minimum M4 text/input slice.
 
 ### T0 - Contract and Architecture
 
-Status: this proposal.
+Status: architecture accepted; the Rust-side drop-policy DTO and resolver
+adapter are implemented. The remaining T0 review fixtures and Node-side
+transport are pending.
 
 - accept process, ownership, identity, protocol, and packaging decisions
 - pin cross-language golden frame and event fixtures
@@ -529,6 +537,8 @@ cannot bypass Native IR, layout, Graphics, interaction, or accessibility.
 ### T1 - Headless Protocol and JSX Core
 
 - add the bounded framed transport and handshake DTOs in Rust
+- connect the landed strict drop-policy query/response DTOs to that transport
+  and the Node callback registry
 - generate TypeScript protocol declarations from Rust DTOs
 - publish local development exports for `jsx-runtime` and `jsx-dev-runtime`
 - implement element/child/prop normalization, keys, and action registration

examples/support/calculator/mod.rs

@@ -32,6 +32,7 @@ pub fn calculator_reduce(
 }
 
 #[cfg(feature = "platform-runtime")]
+#[allow(dead_code)]
 pub fn calculator_reduce_self_drawn(
     component: &CalculatorComponent,
     state: &mut CalculatorState,
@@ -60,6 +61,7 @@ pub fn calculator_reduce_self_drawn(
 }
 
 #[cfg(feature = "platform-runtime")]
+#[allow(dead_code)]
 fn reducer_node_id(stable_id: &str) -> HostNodeId {
     let mut fingerprint = 0xcbf29ce484222325_u64;
     for byte in stable_id.bytes() {

src/lib.rs

@@ -208,11 +208,13 @@ pub use platform_host::{
 pub use platform_runtime::{
     PlatformRenderFrame, PlatformScenePresenter, RecordingPreparedFrame, RecordingScenePresenter,
     SelfDrawnActionInvocation, SelfDrawnActionPropagation, SelfDrawnCollectionDropTarget,
-    SelfDrawnDragContext, SelfDrawnDropItem, SelfDrawnDropOperation, SelfDrawnDropPosition,
-    SelfDrawnElementInteraction, SelfDrawnEventContext, SelfDrawnFrameCommit,
-    SelfDrawnFrameCommitStatus, SelfDrawnFrameSnapshot, SelfDrawnHostEventOutcome,
-    SelfDrawnInputDispatch, SelfDrawnInteractionChange, SelfDrawnRuntimeStats,
-    SelfDrawnWindowRuntime,
+    SelfDrawnDragContext, SelfDrawnDropItem, SelfDrawnDropOperation, SelfDrawnDropPolicyDecision,
+    SelfDrawnDropPolicyQuery, SelfDrawnDropPolicyRequest, SelfDrawnDropPolicyResolution,
+    SelfDrawnDropPolicyResolver, SelfDrawnDropPolicyResponse, SelfDrawnDropPolicyTarget,
+    SelfDrawnDropPosition, SelfDrawnElementInteraction, SelfDrawnEventContext,
+    SelfDrawnFrameCommit, SelfDrawnFrameCommitStatus, SelfDrawnFrameSnapshot,
+    SelfDrawnHostEventOutcome, SelfDrawnInputDispatch, SelfDrawnInteractionChange,
+    SelfDrawnRuntimeStats, SelfDrawnWindowRuntime,
 };
 #[cfg(all(feature = "platform-runtime", feature = "software-reference"))]
 pub use platform_runtime::{