experiment(#441): migrate floating painter to winit 0.31-beta (objc2 0.6 unification) [DO NOT MERGE]

[IvanWng97]

⚠️ DRAFT — do not merge. This depends on winit = "0.31.0-beta.2", a
pre-release windowing lib. Kept open as WIP for #441 so CI exercises the
Windows gates (check-windows / windows-test) my local macOS build
can't cover. Land it only once winit 0.31 ships stable.

What this does

Migrates the floating-window painter from winit 0.30 to winit 0.31.0-beta.2,
which completes winit's own move to the objc2 0.6 stack. That collapses all
of #441's duplicate objc2 families in one shot:

• objc2 0.5.2 — gone (only 0.6.x remains)
• objc2-app-kit / objc2-foundation 0.2.2 — gone (0.3.x / winit's)
• objc2-core-graphics 0.23 — gone
• bitflags 1.3.2 — orphaned/dropped

On main we pin objc2-app-kit to winit-0.30's 0.2.2 and tell dependabot to
ignore its bumps precisely because a lone bump ahead of winit builds a second
full objc2 stack and breaks the AppKit activate API. This branch is the other
half: once winit moves, our direct objc2-app-kit pin moves with it and the
dependabot ignore is dropped.

API migration map (winit 0.30 → 0.31)

• ApplicationHandler is non-generic; window creation resumed → can_create_surfaces
• typed user-event → payload-free proxy.wake_up() (EventLoop::builder() replaces with_user_event())
• Window / ActiveEventLoop are traits — Rc<dyn Window>, &dyn ActiveEventLoop, create_window → Box<dyn Window> (wrapped via Rc::from)
• WindowEvent renames: Resized→SurfaceResized, CursorMoved→PointerMoved{source}, MouseInput→PointerButton{button: ButtonSource::Mouse(..)}
• inner_size() → surface_size()
• MonitorHandle::position() now returns Option; size via current_video_mode()?.size()
• per-platform attrs are structs (WindowAttributesMacOS / WindowAttributesWindows) attached via with_platform_attributes(Box<dyn PlatformWindowAttributes>)
• run_app(app) takes the app by value
• objc2 0.6: NSApplicationActivateIgnoringOtherApps → ActivateIgnoringOtherApps; the runningApplicationWithProcessIdentifier / activateWithOptions msg-sends became safe (dropped unsafe)

softbuffer 0.4.8 still works unchanged (winit keeps impl HasWindowHandle for dyn Window).

Verified (macOS)

• builds clean; just clippy clean
• full suite green (756 + 14 + 22 tests)
• render intact (floating window opens, positions on monitor, resizes, click-to-focus)

Not yet verified

• Windows — this draft exists so CI runs check-windows + windows-test.

Refs #441.

🤖 Generated with Claude Code

[claude]

Claude finished @IvanWng97's task in 1m 13s —— View job

---

Security review — PR #629 (winit 0.30 → 0.31 migration)

• Gather context (CLAUDE.md, PR diff 291f75d..8595f25)
• Check whether the diff touches a trust boundary
• Review process/permission-handling changes (focus/macos.rs)
• Sanity-check Cargo.lock for suspicious/typosquatted additions

Scope check: the diff touches crates/pixtuoid/src/focus/macos.rs (process
activation by pid — the "process/permission handling" boundary), so this got a
full pass rather than a scope-exempt one-liner.

Findings: none.

• focus/macos.rs: the activate_os/focusable logic is byte-for-byte
  unchanged — only the unsafe {} wrapper is dropped (objc2 0.6 itself
  reclassifies runningApplicationWithProcessIdentifier /
  activateWithOptions as safe class-method calls) and the activation-options
  enum variant is renamed (NSApplicationActivateIgnoringOtherApps →
  ActivateIgnoringOtherApps). No new pid handling, no new attack surface.
• floating/mod.rs / floating/window.rs: mechanical winit 0.31 API-rename
  migration (resumed→can_create_surfaces, typed user-event→wake_up(),
  Window/ActiveEventLoop as traits, event renames, inner_size→
  surface_size). No new untrusted-input parsing, no config/socket/hook code
  touched.
• Cargo.toml / Cargo.lock: version bumps only (winit 0.31.0-beta.2,
  objc2-app-kit 0.3.2 + winit's own per-platform split crates:
  winit-appkit/-win32/-x11/-wayland/etc., plus objc2-core-text,
  objc2-core-video, borsh, keyboard-types). All are legitimate
  upstream winit/objc2 crates pulled in by the version bump — no
  unrecognized or typosquat-looking additions.
• .github/dependabot.yml: drops the objc2-app-kit/typescript ignore
  rules that were pinning around the old objc2 stack — consistent with the PR
  description (this branch is the "unpin" half once winit tracks 0.6
  itself). No security implication.

No hook shim, socket/pipe transport, settings.json/config writes, install
targets, path/home resolution, or untrusted-input decoding paths are touched
by this diff. As the PR itself notes, this is a draft kept open only to
exercise the Windows CI gates — no action needed from a security standpoint
before it ships as WIP.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.13%. Comparing base (4cfab03) to head (8595f25).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #629      +/-   ##
==========================================
- Coverage   97.14%   97.13%   -0.01%     
==========================================
  Files         159      159              
  Lines       42268    42268              
==========================================
- Hits        41062    41058       -4     
- Misses       1206     1210       +4     

Components	Coverage Δ
pixtuoid-core	97.42% <ø> (-0.04%)	⬇️
pixtuoid-scene	98.58% <ø> (ø)
pixtuoid	95.48% <ø> (ø)
pixtuoid-hook	98.11% <ø> (ø)
pixtuoid-web	99.04% <ø> (ø)
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[IvanWng97]

Closed under the open-PR cap (at most 4 open PRs; the runners take 20 jobs at once, docs.github.com/en/actions/reference/limits). The branch stays; this reopens when it is next to merge. Do not force-push the branch, or it cannot be reopened.

[IvanWng97]

Dropped for good in the waitlist triage against AGENTS.md's "Every mechanism earns its upkeep": it names no failure that nothing else prevents, or the need it served is met elsewhere. The branch is kept for reference.