Slice 3: THE SPIKE — RMLUi→wlr_scene bridge lands, GO

Plan A verified on hardware (HD 4400/crocus): RMLUi renders into a GLES
3.2 sibling-context FBO backed by a dmabuf wlr_buffer (wlr_allocator +
EGLImage import), composited as a wlr_scene_buffer with per-frame damage.
Plan B (glReadPixels→shm) implemented and verified as runtime fallback;
auto-engages when any Plan-A precondition fails. Plan C not needed.

- Hello-world RML doc: text, data-bound frame counter, pointer input
  proof (hover/:active) — verified upright on screen via screenshot after
  fixing the classic FBO Y-flip (buffer-level V-flip keeps display ==
  document coords for input); position-aware orientation guard added.
- Temporary spike surface: Options::ui_spike + frame-count/orientation
  probes, host-bin --ui-spike flag; replaced by the real ui substrate
  contract in slice 4+.
- kernel suite 6 cases / 416 assertions green; ASan/UBSan clean in our
  code (Mesa leak noise + 2 benign UBSan downcast reports inside vendored
  RMLUi are known); idle RSS ≈83 MiB.
- Deferred (notes/plan.md §7): glFinish→EGL fence + swapchain; dmabuf
  render-format negotiation (private API in wlroots 0.20).

1 files changed, 29 insertions, 0 deletions

diff --git a/packages/kernel/src/input.cpp b/packages/kernel/src/input.cpp
index 93bee74..7095154 100644
--- a/packages/kernel/src/input.cpp
+++ b/packages/kernel/src/input.cpp
@@ -190,6 +190,20 @@ void Server::Impl::process_cursor_motion(std::uint32_t time_msec) {
         return;
     }
 
+    // Slice-3 spike input proof (NOT the slice-5 routing contract): if the
+    // cursor is over the spike node, forward surface-local coords to RmlUi so
+    // the document's button reacts to hover. Crude and private.
+    if (ui_spike != nullptr) {
+        if (wlr_scene_node* spike = ui_spike->node()) {
+            int nx = 0;
+            int ny = 0;
+            wlr_scene_node_coords(spike, &nx, &ny);
+            const double sx = cursor->x - nx;
+            const double sy = cursor->y - ny;
+            ui_spike->on_pointer_motion(sx, sy);
+        }
+    }
+
     double sx = 0;
     double sy = 0;
     wlr_surface* surface = nullptr;
@@ -221,6 +235,21 @@ void Server::Impl::attach_cursor_handlers() {
     cursor_button.connect(cursor->events.button, [this](void* data) {
         const auto* event = static_cast<wlr_pointer_button_event*>(data);
         wlr_seat_pointer_notify_button(seat, event->time_msec, event->button, event->state);
+
+        // Slice-3 spike input proof: forward clicks over the spike node to
+        // RmlUi so its button reacts to press/release. Crude and private.
+        if (ui_spike != nullptr) {
+            if (wlr_scene_node* spike = ui_spike->node()) {
+                int nx = 0;
+                int ny = 0;
+                wlr_scene_node_coords(spike, &nx, &ny);
+                if (wlr_scene_node_at(spike, cursor->x, cursor->y, nullptr, nullptr) != nullptr) {
+                    ui_spike->on_pointer_button(event->state ==
+                                                WL_POINTER_BUTTON_STATE_PRESSED);
+                }
+            }
+        }
+
         if (event->state == WL_POINTER_BUTTON_STATE_RELEASED) {
             reset_cursor_mode();
         } else {