Slice 3: THE SPIKE — RMLUi→wlr_scene bridge lands, GO

Plan A verified on hardware (HD 4400/crocus): RMLUi renders into a GLES
3.2 sibling-context FBO backed by a dmabuf wlr_buffer (wlr_allocator +
EGLImage import), composited as a wlr_scene_buffer with per-frame damage.
Plan B (glReadPixels→shm) implemented and verified as runtime fallback;
auto-engages when any Plan-A precondition fails. Plan C not needed.

- Hello-world RML doc: text, data-bound frame counter, pointer input
  proof (hover/:active) — verified upright on screen via screenshot after
  fixing the classic FBO Y-flip (buffer-level V-flip keeps display ==
  document coords for input); position-aware orientation guard added.
- Temporary spike surface: Options::ui_spike + frame-count/orientation
  probes, host-bin --ui-spike flag; replaced by the real ui substrate
  contract in slice 4+.
- kernel suite 6 cases / 416 assertions green; ASan/UBSan clean in our
  code (Mesa leak noise + 2 benign UBSan downcast reports inside vendored
  RMLUi are known); idle RSS ≈83 MiB.
- Deferred (notes/plan.md §7): glFinish→EGL fence + swapchain; dmabuf
  render-format negotiation (private API in wlroots 0.20).

1 files changed, 8 insertions, 0 deletions

diff --git a/packages/kernel/src/server_impl.hpp b/packages/kernel/src/server_impl.hpp
index 3abf739..2975537 100644
--- a/packages/kernel/src/server_impl.hpp
+++ b/packages/kernel/src/server_impl.hpp
@@ -4,6 +4,7 @@
 #include <unbox/kernel/wlr.hpp>
 
 #include "listener.hpp"
+#include "ui_spike.hpp"
 
 #include <cstdint>
 #include <list>
@@ -80,6 +81,12 @@ struct Server::Impl {
     wlr_seat* seat = nullptr;
     std::string socket;
 
+    // Slice-3 spike: RMLUi -> wlr_scene bridge. Null unless options.ui_spike
+    // and the bridge started; a started-but-disabled bridge is non-null but
+    // reports Plan::Disabled. Owned here; torn down in shutdown() BEFORE the
+    // scene/renderer/allocator die.
+    std::unique_ptr<UiSpike> ui_spike;
+
     // Ownership (RAII teardown); drained naturally during shutdown by the
     // destroy events wl_display_destroy_clients / backend destroy fire.
     std::list<std::unique_ptr<Output>> outputs;
@@ -135,6 +142,7 @@ struct Server::Impl {
     void init(); // throws std::runtime_error on any component failure
     void shutdown();
     void handle_new_output(wlr_output* output);
+    void start_ui_spike(); // slice-3 spike; never throws, may no-op
 
     // toplevel.cpp
     void handle_new_toplevel(wlr_xdg_toplevel* toplevel);