docs(gpuix): P2.1 stay vendored until park publishes

AGENTS.md

@@ -10,8 +10,10 @@ chat.
 
 The native face is React authored and rendered through Zed GPUI using
 `@gpuix/react`, pinned to `file:vendor/gpuix-react-0.6.1.tgz` (spring lease
-parking). Automaton consumes that package; it does not publish the `@gpuix`
-npm scope. Domain logic in `src/domain.ts` and `src/session.ts` is pure.
+parking). Stay vendored until remorses merges gpuix#34 **and** publishes a
+park-bearing `@gpuix/react` — see `docs/gpuix.md`. Automaton consumes that
+package; it does not publish the `@gpuix` npm scope. Never ask for NPM_TOKEN
+to publish `@gpuix`. Domain logic in `src/domain.ts` and `src/session.ts` is pure.
 Jobs live in `src/runtime/pm.ts` and `src/runtime/jobs.ts`. Implement workers
 use a sandbox cwd and never this checkout. Visual tokens live in
 `src/tokens.ts`.
@@ -75,6 +77,7 @@ Invariants:
 - Skills library (`docs/skills.md`) — Settings list/author local skills; imported read-only body; pin via agent skillIds; offer-once widget on composer match; mouths stay Send; package 0.3.0.
 - Idle CPU (`docs/idle-cpu.md`) — park inventory + Mac idle proof; doctor notes checklist (optional `AUTOMATON_IDLE_CPU=1` live sample); package 0.3.0.
 - Living marks (`docs/marks.md`) — selected glance / soft melt / lid springs; sister-freeze parks idle rail; honesty on stubby life; package 0.3.0.
+- `@gpuix/react` vendor (`docs/gpuix.md`) — stay on vendored 0.6.1 park until remorses/gpuix#34 merges **and** a park-bearing npm publish; never switch to registry 0.7.0 (no motion-spring); never ask NPM_TOKEN for `@gpuix`; package 0.3.0.
 
 ## Safety
 

README.md

@@ -54,7 +54,9 @@ Layout:
 
 - `@gpuix/react` on Zed GPUI (`src/main.tsx`), pinned to
   `file:vendor/gpuix-react-0.6.1.tgz` (parked spring MotionDiv leases).
-  Automaton consumes `@gpuix`; it does not publish that npm scope.
+  Stay vendored until park publishes — `docs/gpuix.md` /
+  [remorses/gpuix#34](https://github.com/remorses/gpuix/pull/34). Automaton
+  consumes `@gpuix`; it does not publish that npm scope.
 - Idle parks: `src/resting-motion.ts` (blob springs),
   `src/runtime/feed-pin.ts` / `feed-row.ts` (tail pin + row fingerprints);
   proof checklist `docs/idle-cpu.md` / `bun run sample:idle-cpu`

docs/gpuix.md

@@ -0,0 +1,39 @@
+# `@gpuix/react` vendor pin (P2.1 honesty)
+
+Automaton stays on **vendored** `@gpuix/react` **0.6.1**
+(`file:vendor/gpuix-react-0.6.1.tgz`). Package / Info.plist remain **0.3.0**
+(this pass does not bump the band).
+
+## Decision: stay vendored
+
+| Fact | Detail |
+| --- | --- |
+| Pin today | `package.json` → `"@gpuix/react": "file:vendor/gpuix-react-0.6.1.tgz"` |
+| Why vendor | Dist includes spring lease parking (`motion-spring`, `onFrame` park) that P1.6 idle parks need |
+| npm latest | `@gpuix/react@0.7.0` on the registry **does not** ship `motion-spring` / lease-park in dist |
+| Upstream | [remorses/gpuix#34](https://github.com/remorses/gpuix/pull/34) (`feat/motion-springs`, park commit) is still **OPEN** (mergeable / unstable) |
+| Publish | Cary does **not** own the `@gpuix` npm scope. Never ask for `NPM_TOKEN` to publish `@gpuix` |
+
+**Do not** switch the dependency to npm `0.7.0`. Dropping `file:vendor` onto
+registry 0.7.0 would lose P1.6 idle parks (`spring-lease` / `frame-pace` in
+[`docs/idle-cpu.md`](./idle-cpu.md)).
+
+## When to drop the vendor tarball
+
+Only after **both**:
+
+1. remorses merges [gpuix#34](https://github.com/remorses/gpuix/pull/34) (or equivalent park-bearing work), **and**
+2. a park-bearing `@gpuix/react` is **published** to npm
+
+Then: drop `file:vendor/gpuix-react-0.6.1.tgz`, pin the real npm version that
+contains lease-park, re-verify idle CPU (`bun run sample:idle-cpu` /
+[`docs/idle-cpu.md`](./idle-cpu.md)), and remove this honesty hold.
+
+Until then: keep the vendored tarball; prefer Automaton-side or vendored park
+paths; do not publish `@gpuix`.
+
+## Related
+
+- Park inventory: [`docs/idle-cpu.md`](./idle-cpu.md)
+- Living marks / spring leases: [`docs/marks.md`](./marks.md)
+- Agent invariant: `AGENTS.md` (vendored pin + idle GPUI sleeps)

docs/idle-cpu.md

@@ -45,6 +45,14 @@ Code mirror: `idleParkInventory()` in `src/runtime/idle-health.ts`.
 
 `bun test` covers park/coalesce invariants. GUI CPU sampling **soft-skips** when no live process or under `CI=true` / `AUTOMATON_SKIP_IDLE_CPU=1`. Never fail the suite for missing Mac GUI metrics.
 
+## Vendor pin
+
+Idle parks that depend on MotionDiv lease-park stay on vendored
+`@gpuix/react` 0.6.1. Do **not** drop onto npm `@gpuix/react@0.7.0` (no
+`motion-spring` in dist). Hold until [remorses/gpuix#34](https://github.com/remorses/gpuix/pull/34)
+merges **and** a park-bearing release publishes — see [`docs/gpuix.md`](./gpuix.md).
+
 ## Out of scope
 
-Rust rewrite, Loro, Xvfb scroll myths, private Anysphere kits, Discord OS, bumping 0.2.0.
+Rust rewrite, Loro, Xvfb scroll myths, private Anysphere kits, Discord OS,
+bumping the 0.3.0 band, publishing `@gpuix`, asking for `NPM_TOKEN` for that scope.

docs/marks.md

@@ -31,7 +31,7 @@ is for selected rest life — not a second layout physics on the feed.
 - Add another animation library.
 - Put Motion `layout` / `layoutScroll` / `popLayout` on virtual feed rows or the live tail.
 - Rip Grok shapes/colors or invent two-lobe / scrotum silhouettes.
-- Publish `@gpuix`; park primitives stay Automaton-side or vendored `file:vendor`.
+- Publish `@gpuix`; park primitives stay Automaton-side or vendored `file:vendor` ([`docs/gpuix.md`](./gpuix.md) — stay vendored until park publishes).
 
 ## Parks