diff --git a/cli/src/index.ts b/cli/src/index.ts
index 89c71ab..c574fe6 100644
--- a/cli/src/index.ts
+++ b/cli/src/index.ts
@@ -1526,7 +1526,9 @@ function validateMediaTransportCapability(project: SourceProject, errors: string
 
 function validateSource(project: SourceProject): string[] {
   const errors: string[] = [];
-  const usedProviders = new Set<"time" | "cpu" | "memory" | "audio" | "media">();
+  const providerNames = ["time", "cpu", "memory", "audio", "media"] as const;
+  type ProviderName = (typeof providerNames)[number];
+  const usedProviders = new Map<ProviderName, Set<"useProvider" | "useProviderSignal">>();
   const stateVariantAncestry = (node: ts.JsxOpeningElement | ts.JsxSelfClosingElement): "pressable" | "component-boundary" | "none" => {
     let current: ts.Node | undefined = node.parent;
     while (current) {
@@ -1648,9 +1650,21 @@ function validateSource(project: SourceProject): string[] {
         }
       }
     }
-    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === "useProvider") {
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) &&
+        (node.expression.text === "useProvider" || node.expression.text === "useProviderSignal")) {
       const argument = node.arguments[0];
-      if (argument && ts.isStringLiteral(argument) && ["time", "cpu", "memory", "audio", "media"].includes(argument.text)) usedProviders.add(argument.text as "time" | "cpu" | "memory" | "audio" | "media");
+      if (argument && ts.isStringLiteral(argument) && (providerNames as readonly string[]).includes(argument.text)) {
+        const provider = argument.text as ProviderName;
+        const hooks = usedProviders.get(provider) ?? new Set<"useProvider" | "useProviderSignal">();
+        hooks.add(node.expression.text);
+        usedProviders.set(provider, hooks);
+      } else if (argument && ts.isStringLiteral(argument)) {
+        errors.push(locationMessage(
+          node.getSourceFile(),
+          argument,
+          `${node.expression.text}("${argument.text}") names no known provider; available providers: ${providerNames.join(", ")}`,
+        ));
+      }
     }
     if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === "wfetch") {
       const argument = node.arguments[0];
@@ -1663,8 +1677,10 @@ function validateSource(project: SourceProject): string[] {
     ts.forEachChild(node, visit);
   };
   for (const sourceFile of project.sourceFiles) visit(sourceFile);
-  for (const provider of usedProviders) {
-    if (!project.config.subscribe?.includes(provider)) errors.push(`useProvider("${provider}") requires subscribe: ["${provider}"] in the widget config`);
+  for (const [provider, hooks] of usedProviders) {
+    if (!project.config.subscribe?.includes(provider)) {
+      for (const hook of hooks) errors.push(`${hook}("${provider}") requires subscribe: ["${provider}"] in the widget config`);
+    }
   }
   validateMediaTransportCapability(project, errors);
   validateLoweredTreeBudgets(project, errors);
diff --git a/cli/test/cli.test.mjs b/cli/test/cli.test.mjs
index 0090a67..d815389 100644
--- a/cli/test/cli.test.mjs
+++ b/cli/test/cli.test.mjs
@@ -162,11 +162,13 @@ test("bundle manifest is the subscription origin of truth", () => {
   try {
     assert.equal(spawnSync(process.execPath, [cli, "init", "system-card"], { cwd: root, encoding: "utf8" }).status, 0);
     const sourcePath = join(widget, "widget.tsx");
-    const source = `import { useProvider, widget } from "@weaver/sdk";
+    const source = `import { useProvider, useProviderSignal, widget } from "@weaver/sdk";
 export default widget({ name: "System Card", size: [200, 100], subscribe: ["cpu", "memory", "audio", "media"] }, () => {
   const cpu = useProvider("cpu");
   const audio = useProvider("audio");
-  return <text>{cpu.percent + audio.rms}</text>;
+  const memorySnapshot = useProvider("memory");
+  const memory = useProviderSignal("memory");
+  return <row><text>{cpu.percent + audio.rms + memorySnapshot.percent}</text><text>{memory.map((value) => value.percent)}</text></row>;
 });
 `;
     writeFileSync(sourcePath, source, "utf8");
@@ -182,6 +184,17 @@ export default widget({ name: "System Card", size: [200, 100], subscribe: ["cpu"
     assert.equal(readFileSync(join(widget, "dist", "data", "widget.json"), "utf8"), "nested manifest asset");
     assert.equal(readFileSync(join(widget, "dist", "assets", "dist", "pixel.bin"), "utf8"), "nested dist asset");
     assert.equal(existsSync(join(widget, "dist", "widget.tsx")), false);
+
+    writeFileSync(sourcePath, source.replace('subscribe: ["cpu", "memory", "audio", "media"]', 'subscribe: ["cpu", "audio", "media"]'), "utf8");
+    const missingSignalSubscription = spawnSync(process.execPath, [cli, "check", widget], { encoding: "utf8" });
+    assert.equal(missingSignalSubscription.status, 1);
+    assert.match(missingSignalSubscription.stderr, /useProvider\("memory"\) requires subscribe: \["memory"\]/);
+    assert.match(missingSignalSubscription.stderr, /useProviderSignal\("memory"\) requires subscribe: \["memory"\]/);
+
+    writeFileSync(sourcePath, source.replace('useProviderSignal("memory")', 'useProviderSignal("memmory")'), "utf8");
+    const unknownProvider = spawnSync(process.execPath, [cli, "check", widget], { encoding: "utf8" });
+    assert.equal(unknownProvider.status, 1);
+    assert.match(unknownProvider.stderr, /useProviderSignal\("memmory"\) names no known provider; available providers: time, cpu, memory, audio, media/);
   } finally {
     rmSync(root, { recursive: true, force: true });
   }
diff --git a/docs/error-propagation-brief.md b/docs/error-propagation-brief.md
new file mode 100644
index 0000000..e8e5bf1
--- /dev/null
+++ b/docs/error-propagation-brief.md
@@ -0,0 +1,148 @@
+# Error-propagation pass — the seams
+
+Brief for a detailed pass over every place an error can be born, swallowed, or
+presented. The governing rule is the one this repo already committed to
+(#39, "Name every silent failure where the developer looks"): a failure must
+surface **where the developer is looking** — `weaver check` output, the dev CLI
+stream, the per-widget log, or the widget window itself — and it must name the
+budget/cause, not just exist as a bare error name.
+
+Everything below was reproduced live on 2026-07-29 against noro-shell unless
+marked speculative. The single worst end-to-end demo: add ~6 retained nodes to
+`examples/noro-shell/widget.tsx` and the widget window renders a flat field of
+**uninitialized GPU memory** (a different random color every launch), with
+`weaver check` passing and zero error lines in any log.
+
+## Seam 1 — the SDK render path has no error boundary (highest leverage)
+
+- `sdk/src/reconciler.ts:835` `scheduleRender()` runs `renderRoot()` inside
+  `void Promise.resolve().then(...)`. Any throw inside a re-render (including
+  every budget error the Zig bridge deliberately throws) becomes an unhandled
+  promise rejection.
+- No `JS_SetHostPromiseRejectionTracker` is installed anywhere
+  (`rg PromiseRejection runtime/` is empty), so QuickJS drops the rejection on
+  the floor. Confirmed: over-budget fresh start logs *nothing*, hot swap logs
+  only a bare `error: CallbackFailed`.
+- `renderRoot()` (`sdk/src/reconciler.ts:403`) has `try/finally` around the
+  batch but no catch: a throw mid-reconcile leaves a **half-built tree already
+  committed** via `native.endBatch()`. There is no rollback and no "don't
+  present a tree whose build threw."
+
+Wanted: a render error boundary that (a) catches, (b) logs the message + stack
+through a bridge call so it lands in the per-widget log, (c) puts the widget
+into a visible error state (even a solid color + name is fine), and (d) never
+commits a partially-built generation. Same treatment for effect callbacks,
+`useInterval` callbacks, and `onFrame` canvas callbacks.
+
+## Seam 2 — platform callback failures lose their name
+
+- `runtime/native-sdk/src/platform/macos/root.zig:763` intends to log
+  `platform callback failed: <name> (event <tag>)`, but what actually reaches
+  the widget log is a bare `error: CallbackFailed` (observed three times
+  today). Find where that line is emitted (likely the runtime's top-level exit
+  path in `runtime/src/main.zig`) and make the *named* line the one that lands
+  in the per-widget log before the process dies.
+- After the runtime process dies, the host keeps the widget window alive
+  showing whatever memory the surface had. That's both a UX bug and arguably an
+  info leak (stale GPU memory). The host should clear the surface and/or show a
+  tombstone when the runtime for a window is gone.
+
+## Seam 3 — budget errors: born loud, dying silent
+
+The bridge does the right thing at the throw site — `failFmt`
+(`runtime/src/bridge.zig:142`) even documents that budget errors must name the
+budget, the limit, and the ask. But:
+
+- `runtime/src/bridge.zig:166` `createNode` → "node capacity exhausted" names
+  neither `max_nodes` nor 128 nor the node count. Same for the generic
+  "appendChild failed" / "insertBefore failed" (`bridge.zig:185,195`) which is
+  how `max_children = 24` surfaces. Bring these up to the `failFmt` standard.
+- All of them then die in Seam 1 anyway. Both halves need fixing.
+- `runtime/src/tree.zig` budgets (`max_nodes 1024`, `max_children 64`,
+  `max_text_bytes 1024`, `max_canvases 8`) are statically checked for the
+  initial tree. `weaver check` validates the lowered representation—not just
+  authored JSX—so generated layout/text nodes and canvases count. Every
+  `max_nodes`, `max_children`, `max_text_bytes`, and `max_canvases` failure
+  reports the configured limit, requested amount, and remaining headroom.
+
+## Seam 4 — image failures are log-only, screen-silent
+
+- `runtime/src/main.zig:119` and `:1012` log `ImageTooLarge` etc. to the
+  per-widget log, then render proceeds with a black hole where the image was.
+  Nothing on screen, nothing in the dev CLI stream, `weaver check` passes.
+- The pinned Native widget profile permits 1 MiB of decoded RGBA. A 256×256
+  image is 256 × 256 × 4 = 262,144 bytes (256 KiB), so it passes. `weaver check`
+  reads local image dimensions and reports the decoded-byte calculation without
+  decoding pixels. Runtime failures report dimensions plus requested bytes.
+  Images over 1 MiB need downscaling or an on-widget placeholder that says why.
+
+## Seam 5 — dev loop failure modes
+
+- `cli/src/index.ts:431-460`: rebuild failures print once via `printFailure`,
+  but the runtime keeps hot-swapping/serving the **stale bundle** with no
+  banner that what's on screen no longer matches the file. Persist an "out of
+  date since <time>: <first error>" state in the dev stream (and ideally on the
+  widget).
+- The watcher (`cli/src/index.ts:458`) watches only `widget.tsx` — asset and
+  font edits silently do nothing until an unrelated source change.
+- Hot swap of a bundle that then throws mid-render: observed
+  `dev hot swap applied (preserved root hook state)` immediately followed by
+  process death (`CallbackFailed`) and an auto-restart that comes back blank.
+  The hot-swap path already knows how to reject a bad candidate
+  (`runtime/src/main.zig:362` evaluateCandidate) — extend that rejection to
+  candidates whose *first render* throws, and keep the old bundle running.
+
+## Seam 6 — dynamic canvas denial remains screen-silent
+
+- `weaver check` already reports statically knowable clipping and opacity
+  violations as `CanvasNeedsUnclippedAncestors` and
+  `CanvasNeedsOpaqueAncestors`; the relevant validators live in
+  `cli/src/index.ts:1527-1681`. The remaining gap is a runtime diagnostic when
+  the host denies a canvas surface dynamically, so the widget cannot blank
+  without a named reason.
+
+## Seam 7 — empty-catch inventory
+
+Each of these should either handle-and-log, narrow to the specific expected
+error, or grow a comment proving silence is correct (some already have one —
+those are fine and are the model):
+
+- `sdk/src/reconciler.ts:873, 910` — hot-swap seed parse/capture: silence is
+  probably right, but a swap that falls back to fresh state should say so in
+  the log (today "preserved root hook state" prints even when seeding failed).
+- `sdk/src/class-compiler.ts:610, 642`
+- `cli/src/host-tools.ts:195, 200, 206, 224`, `cli/src/origin.ts:5, 15`,
+  `cli/src/index.ts:733, 812, 913, 1127`, `cli/src/weave.ts:344`
+- Zig: 18 hits of `catch {}` in `runtime/src` (`rg 'catch \{\}' runtime/src`),
+  plus `catch return null` / `catch return` sites in `geometry.zig:38,65`
+  (corrupt geometry file → silently repositioned widget),
+  `dev_reload.zig:61` (accept failure → dev reload just stops working),
+  `js_engine.zig:100,110` (hot-swap capture failure → silent fresh state).
+- `runtime/src/main.zig` msg-handler catches (lines 140-240) all log — good —
+  but several then continue with stale state where a degrade should be marked
+  once (e.g. repeated `provider dispatch failed` every 33 ms would flood; needs
+  latch-and-summarize).
+
+## Seam 8 — status surfaces that lie by omission
+
+- `weaver dev` stream prints provider/present milestones but not their
+  absence: a widget that never logs `presenter path=` never presented a frame —
+  after N seconds that should be an explicit error line (it was the only
+  signal, and today it's an *absence*).
+- `~/Library/Application Support/Weaver/status.json.backend-*` orphan files
+  accumulate silently; `weaver status` doesn't reconcile them.
+- Uninstall/registry restore paths (`cli/src/index.ts:414, 486, 616, 694`)
+  swallow the second-order failure by design (comments present) but nothing
+  ever reports the widget/registry divergence at the *next* `weaver status`.
+
+## Suggested acceptance test for the whole pass
+
+One integration test per seam that used to be silent, each asserting a named
+error is visible at the correct surface. The canonical one: a widget whose
+tree exceeds `max_nodes` must (a) fail `weaver check` naming the budget and
+count, and if forced through anyway (b) log
+`node capacity exhausted: max_nodes=1024, asked for 1025` and (c) render an
+error surface — never uninitialized memory, never a silent flat fill. A failed
+first render must commit only the error surface with no partially built nodes;
+a failed hot-swap first render must keep the previously active tree and bundle
+unchanged.
diff --git a/docs/gpu-ledger-session-2026-07-30.md b/docs/gpu-ledger-session-2026-07-30.md
new file mode 100644
index 0000000..3d48afb
--- /dev/null
+++ b/docs/gpu-ledger-session-2026-07-30.md
@@ -0,0 +1,103 @@
+# Session teachings — naming the GPU ledger wall (2026-07-30)
+
+Scoped record of one working session on Dara's `Mac15,6` (M3 Pro, 18 GB,
+macOS 26.5.2). The durable state lives in `docs/macos-memory-handoff.md`
+and `docs/gpu-ledger-wall-brief.md`; this file is the distilled lessons of
+how the 85 MB got its name, for anyone (human or agent) doing memory
+forensics on this platform again. Branch state: weaver `78f8cdf` →
+`0db488a`, native `6a8e6178`.
+
+## The finding, in one paragraph
+
+The ~85–96 MB of dirty "owned physical footprint (unmapped) (graphics)"
+that every measured continuously presenting Weaver widget carried on this
+machine is the Apple GPU driver's
+**per-process command-submission working set**: a ~95 MB arena the driver
+commits to any process that submits Metal command buffers in a sustained
+cadence (≥ ~1 Hz), plus ~2.4 MB per additional presenting layer, reclaimed
+after submission silence. The samples bound that release only indirectly: the
+arena was held by 1-second submissions, did not establish across 5-second gaps,
+and was gone by the 10-second idle checkpoint. It is not window setup, not
+device creation, not presentation (offscreen renders trigger it), not
+drawable size (240×110 and 960×440 pay the same), and not anything Weaver
+allocates. Weaver pinned it forever because `renderFrame` presents
+unconditionally from a 60 Hz timer — on the software backend too, since
+both paths drive the same CAMetalLayer.
+
+## The mental model that survived
+
+**The driver charges every continuously active GPU client a flat
+subscription fee, billed to the submitting process.** Everything follows:
+
+- Who submits, pays. A process that submits no Metal and shows frames via
+  IOSurface contents on a plain CALayer pays ~0 — the compositing charge
+  lands in WindowServer, which is composing every window on the system
+  anyway. Measured: 0–16 KB graphics ledger at 60 Hz content updates.
+- One bill per process, not per renderer/layer/window. 8 presenting
+  layers in one process: 95.6 → 112.7 MB, not 8 × 95 MB.
+- The fee's size is driver policy per hardware class. Same binary, same
+  commit: ~95 MB on the M3 Pro (18 GB), near zero on the M2 Air (8 GB).
+  We measured THAT it differs, not why — separating GPU generation from
+  RAM size needs a third machine. Don't write a "why" without one.
+- Lazy commit, idle release: it is not eagerly reserved at device
+  creation (one present ≈ 1 MB), and it releases within seconds of
+  silence. Held at 1 s submission intervals; never establishes at 5 s
+  intervals. The measured 1 Hz workload stays pinned; the measured 0.2 Hz
+  workload does not establish the arena. Cadences between them were not
+  measured.
+
+## Method teachings (how the name was found)
+
+1. **Turn it on and off, or it has no name.** The receipt is a ~100-line
+   probe with zero Weaver code that reproduces the exact vmmap signature
+   and releases it on idle. Every hypothesis got a probe variant: rate
+   (60/1/0.2 Hz), size, layer count, offscreen-vs-present,
+   IOSurface-vs-Metal. Probe sources + raw logs:
+   `.zig-cache/macos-memory/gpu-ledger-wall/` (throwaway; never in a PR).
+2. **One-shot probes lie about steady-state costs.** Two prior threads
+   measured floors with a single present and concluded "no wall" — the
+   trigger was sustained cadence. When chasing a steady-state number,
+   the probe must run the steady-state loop.
+3. **Match the suspect's exact configuration.** The probe copied weaver's
+   layer setup verbatim (framebufferOnly, allowsNextDrawableTimeout=NO,
+   BGRA8, contentsScale, drawable size) so a null result would have been
+   meaningful. It wasn't needed — but a config-mismatched probe proves
+   nothing either way.
+4. **Ledger self-report + external attach, cross-checked.**
+   `task_info(TASK_VM_INFO).ledger_tag_graphics_footprint` from inside
+   the probe, `footprint`/`vmmap --summary` from outside (attach works on
+   this harness, unlike the Air's T3 harness). The graphics *category*,
+   not the total, is what identifies the wall — totals were ±10 MB noisy
+   across the whole investigation.
+5. **PID-vs-build-time discipline is not optional.** This machine had
+   seven stale weaver-widget processes from prior sessions at
+   investigation start, two of them running the same fixture path.
+   Stale-PID mixups had already burned two threads; `ps -o lstart` vs
+   build finish time before every measurement.
+6. **Read the incumbent platform before theorizing.** The Windows source
+   answered two architecture questions for free: presents are packet-
+   driven ("frames exist only on demand" — webview2_host.cpp), and "the
+   widget never creates or loads a D3D device" (d3d_presenter.h). The
+   macOS 60 Hz pump is the outlier, not the norm.
+
+## What this settles (decisions recorded in the handoff doc)
+
+- Shared renderer re-approved by Dara on this receipt: one render host
+  pays the arena once; device-less widget processes (IOSurface on plain
+  CALayer) pay ~0. Next work is Phase 1 of the handoff plan.
+- Event-driven presenting (kill the unconditional 60 Hz pump) is correct
+  and Windows-proven, good for CPU/battery, and makes the shared host
+  cheap — but it is NOT the memory fix: 1 Hz still holds the arena.
+- The Phase 1 "20s–30s MB" gate was calibrated on Air content costs; on
+  M3-class machines verify by vmmap category ("footprint minus the
+  ~95 MB arena"), not by a single total.
+
+## Corrections to prior session records
+
+- The 2026-07-30 correction's fear that "whatever allocates the 85 MB
+  would move with the rendering" resolved favorably: it moves with the
+  *submitting process*, and is paid once there.
+- The Phase 0 falsification stands as honest — its "Metal baseline"
+  theory was genuinely wrong. The gate asked "is the wall in device/window
+  setup?" and the true answer was no; the wall was in sustained
+  submission, a question the gate never posed.
diff --git a/docs/gpu-ledger-wall-brief.md b/docs/gpu-ledger-wall-brief.md
new file mode 100644
index 0000000..9e0d4b5
--- /dev/null
+++ b/docs/gpu-ledger-wall-brief.md
@@ -0,0 +1,171 @@
+# The GPU ledger wall — name the 85 MB
+
+Brief for an agent on Dara's MacBook Pro (`Mac15,6`, Apple M3 Pro, 18 GB,
+macOS 26.5.2). This is the successor to the shared-renderer experiment in
+`docs/macos-memory-handoff.md`, whose Phase 0 gate stopped that plan; read
+its "2026-07-30 correction" section for the full evidence trail. Vocabulary
+(receipt, tripwire, landmine) is CLAUDE.md.
+
+## The finding you are chasing
+
+This brief was opened on branch `feat/macos-memory-work` at weaver `c099db6`.
+The recorded measurements below were taken at weaver `78f8cdf` with native
+`6a8e6178`; `0db488a` is the subsequent documentation state, not a measurement
+commit.
+
+- Bare NSWindow + CAMetalLayer + Metal device + one presented frame:
+  9.705 MiB mean physical footprint (~1.1 MB graphics ledger).
+- Weaver running trivial Myclock: **125.3 MB footprint, of which 85 MB is
+  dirty "Owned physical footprint (unmapped) (graphics)" across 33
+  regions** (peak 128.3 MB).
+- The identical branch state measures 34.265 MiB on a `Mac14,2` M2 Air.
+
+So the wall is not the Metal entry fee (bare probe ~1 MB graphics), not
+measurement error (same tools, floors match the Air within ~1.5 MiB), and
+not machine-generic (absent on the Air). Something Weaver's renderer does
+makes THIS GPU driver retain ~85 MB for a clock. Your job: give that 85 MB
+a name — which allocation, which API pattern, which driver behavior. No
+architecture decisions until it has one.
+
+## End state
+
+A written receipt in this doc that names what the 85 MB is, demonstrated
+by turning it on and off: a change (or workload variation) that moves the
+owned-unmapped-graphics ledger by tens of MB, measured live, plus the
+recommendation that follows (fix in-process vs shared renderer vs report
+as driver behavior). Rendering stays visually correct and tests stay
+green throughout; a low number with broken rendering is a failed end
+state.
+
+## Evidence-led order
+
+1. **Reproduce first.** From `runtime/`:
+   `mise exec zig@0.16.0 -- zig build -Doptimize=ReleaseFast`, then run
+   `runtime/zig-out/bin/weaver-widget examples/myclock/dist`, verify the PID started
+   after the build finished, and sample `footprint -p <pid>` after a 5 s
+   warmup. Expect ~120-125 MB with ~85 MB owned-unmapped-graphics. Record
+   the number before touching anything.
+2. **Software-candidate discriminator.** Run:
+
+   ```sh
+   python3 scripts/macos-renderer-bakeoff.py \
+     --runtime runtime/zig-out/bin/weaver-widget \
+     --candidate software \
+     --bundles examples/myclock/dist \
+     --count 1 \
+     --output .zig-cache/myclock-software.json
+   ```
+
+   The harness sets `WEAVER_FORCE_SOFTWARE=1` for this candidate. The old thread
+   saw software at 128.6 MB — if software is still wall-height, the trigger is
+   in the CAMetalLayer present loop shared by both paths, not in canvas GPU
+   rendering.
+3. **Redraw-rate variation.** Myclock ticks at 1 Hz (`timer` +
+   `gpu_surface_frame` every second). Compare a static widget (no timer,
+   one present) against Myclock: does the ledger hit 85 MB at first present
+   or accumulate to a high-water mark? Immediate points at layer/surface
+   allocation; accumulating points at drawable/command-buffer pool
+   retention.
+4. **Machine A/B.** Same widget, same commit, `vmmap --summary` +
+   `footprint` on both this machine and the Air; diff the graphics
+   categories (here: 85 MB owned-unmapped dirty, IOAccelerator 3.5 MB,
+   IOSurface 432 KB). The Air's continuation receipts in the handoff doc
+   have its numbers.
+5. **Bisect Weaver's Metal usage** until the ledger moves: canvas GPU
+   surface allocation, drawable pool configuration, texture/heap allocation
+   pattern, `WEAVER_MEMORY_RECEIPT=1` internals. Metal debug/environment
+   instrumentation is fair game for diagnosis; nothing diagnostic ships.
+
+## Rules
+
+- Every claimed number: live measurement, multiple samples, recorded here.
+- Always verify PID start time > build finish time (stale-PID mixups have
+  burned two threads already), and use weaver's status API for the active
+  PID when running under weaverd.
+- The measurement method that works everywhere: the process's own
+  `task_info(TASK_VM_INFO).phys_footprint`, or `footprint`/`vmmap` where
+  attach is permitted. On the Air's T3 harness, attach hangs; self-report
+  instead.
+- Do not start shared-renderer work from this brief. If the name you find
+  argues for it, record the receipt and stop; that decision gets made with
+  Dara.
+
+## Recorded results (append as you go)
+
+### 2026-07-30 — named. The wall is the AGX driver's per-process Metal submission working set
+
+All measurements on this machine (`Mac15,6`, macOS 26.5.2 `25F84`), branch
+state weaver `78f8cdf` / native `6a8e6178`, fresh ReleaseFast build
+(finished 11:09:06; measured PID 63629 started 11:09:13). Probe sources and
+raw logs: `.zig-cache/macos-memory/gpu-ledger-wall/` (throwaway; never in a
+PR). Ledger numbers are the process's own
+`task_info(TASK_VM_INFO).ledger_tag_graphics_footprint`; footprints
+cross-checked with `footprint`/`vmmap --summary` attach, which works on this
+harness.
+
+**Reproduction (step 1):** fresh Myclock (240x110, dist manifest says
+`renderBackend: software`): 133.1 MB phys_footprint, flat over 5 samples.
+Prior morning session's vmmap of the same workload: 121 MB with **85 MB
+dirty "Owned physical footprint (unmapped) (graphics)" across 33 regions**
+(saved in the cache dir). A 960x440 software-backend variant: 159 MB with
+96.2 MB owned-unmapped-graphics — the wall barely scales with window size
+and hits the software path too, because both paths drive the same
+CAMetalLayer present loop.
+
+**The turn-it-on-and-off receipt.** A ~100-line bare probe (weaver's exact
+layer config: BGRA8, framebufferOnly=YES, opaque=YES,
+allowsNextDrawableTimeout=NO, 480x220 drawable) presenting clears in a
+sustained loop:
+
+| Probe workload | Graphics-ledger observation | phys_footprint observation | Sampling / aggregation |
+|---|---:|---:|---|
+| Before loop starts | 82 KB | 9.0 MB | Single pre-loop sample |
+| 60 Hz present loop, 240x110 window | **95.6 MB** (established within the first ~5 frames) | 110.5 MB | Reported steady-state sample; count/window not recorded |
+| 1 Hz present loop | **95.5 MB** (held between presents) | 109.2 MB | Reported between-present sample; count/window not recorded |
+| 0.2 Hz present loop (5 s gaps) | 0.2-3.3 MB (never establishes) | 12-14 MB | Observed range; count/window not recorded |
+| 10 s after any loop stops | ≤1 MB | 13-14 MB | Final sample at the 10-second idle checkpoint |
+| Offscreen clears at 60 Hz — no window, no CAMetalLayer, no present | **96.1 MB** | 103.2 MB | Reported steady-state sample; count/window not recorded |
+| 60 Hz IOSurface content updates via plain CALayer, no Metal device | **0-16 KB** | 10.0 MB | Observed range plus reported footprint; count/window not recorded |
+| One process, N presenting CAMetalLayers (n=1/4/8, 60 Hz) | 95.6 / 103.3 / 112.7 MB | 109.5 / 122.5 / 136.9 MB | One reported value per layer count; window not recorded |
+
+**The name:** the ~85-96 MB "owned physical footprint (unmapped)
+(graphics)" is the Apple GPU driver's **per-process command-submission
+working set** on this hardware/OS. It is committed as soon as a process
+submits Metal command buffers in a sustained cadence — presentation is not
+required (offscreen row), a window is not required, and the render target
+size barely matters. It is one arena per process (~95 MB) plus ~2.4 MB per
+additional presenting layer. The receipt bounds idle reclamation without
+pinning an unsupported interval: held at 1-second submissions, never
+established across 5-second gaps, and gone within 10 seconds of idle. Weaver
+never goes silent because
+`renderFrame` presents unconditionally from a 60 Hz display timer
+(`appkit_host.m` layer setup / renderFrame), so every widget process pins
+the arena forever. The M2 Air's driver sizes this working set near zero for
+the same workload (34.3 MiB total footprint there); this is driver policy
+per hardware class, not anything Weaver allocates.
+
+**Why the earlier probes missed it:** the Phase 0 probes and this brief's
+bare-window floor presented exactly one frame — under the cadence
+threshold. The wall was never in window or device *setup*; it is in
+sustained *submission*.
+
+**Recommendation (decision stays with Dara):** the numbers point at the
+device-less widget process, two independent ways:
+
+1. In-process tuning cannot reach the target on this hardware. Damage-driven
+   presenting (stop the unconditional 60 Hz loop) only releases the arena
+   for the measured 0.2 Hz workload; the measured 1 Hz seconds clock holds it.
+   Intermediate cadences were not measured. Worth doing anyway for
+   battery/honesty, but it is not the memory fix for 1 Hz-or-faster widgets.
+2. A widget process that submits **no Metal at all** and shows frames via
+   IOSurface contents on a plain CALayer measures ~10 MB footprint even at
+   60 Hz content updates (probe row above). Whatever process renders pays
+   the ~95 MB arena once — that is the shared-renderer shape, now with the
+   receipt the 2026-07-30 correction demanded. Marginal cost signals in the
+   host look benign (~2.4 MB per extra presenting layer in one process; and
+   the host renders to IOSurfaces, not per-widget layers), but per-widget
+   host cost and the 30-minute drift check remain to be measured by that
+   plan's own gates.
+
+No weaver code was changed in this investigation; rendering and tests are
+untouched.
diff --git a/docs/macos-memory-handoff.md b/docs/macos-memory-handoff.md
new file mode 100644
index 0000000..48524b2
--- /dev/null
+++ b/docs/macos-memory-handoff.md
@@ -0,0 +1,547 @@
+# Handoff — Weaver widget memory reduction (Noro focus)
+
+Continuation brief for a fresh agent. The prior thread ran in T3 Code (codex
+harness) on Dara's other laptop, session id
+`019fafbc-4c73-7ef3-a1e6-cd3ffd497f8f`, 2026-07-29. This doc is the recovered
+state of that thread plus everything needed to continue. It lives on branch
+`feat/macos-memory-work`, which is the complete working set: this doc, the
+audit briefs, the `examples/myclock/` bakeoff fixture, and the pinned native-sdk
+memory work.
+
+## Goal
+
+Get a Weaver widget's Activity Monitor "Memory" number (phys_footprint) as low
+as possible. Dara's target: **~20 MB per widget** (numbers in the 20s in
+Activity Monitor). Current reality: Noro sits at ~155-166 MB, and even the
+trivial Myclock widget is ~130 MB. Dara considers 100+ MB per desk widget
+insane, and it is. Push back on the 20 MB target only with measurements, not
+vibes — see "The remaining wall" below for why the honest near-term floor may
+be higher, and what would have to change to actually reach the 20s.
+
+Verify end-to-end: live process measurements (footprint, vmmap) AND visual
+correctness of the rendered widget. A lower number with broken rendering is a
+failure.
+
+## Setup (2026-07-30)
+
+You are already on the right branch if you can read this file. It is
+rebased onto master with PRs #43-45 merged (error-propagation seams,
+Noro art-shadow scrim, visualizer spectrum meter), so all current
+widgets are available as test subjects.
+
+- Native SDK memory work: branch `macos-memory-shared-renderer-prep`
+  (head `6a8e6178`; memory implementation `600d6cf6`, on top of
+  `45336f24`) in SunkenInTime/native — the autorelease pools,
+  framebufferOnly, analytic rounded clips, the Metal tiled-image primitive,
+  and diagnostics-only screenshot/cache/task-ledger receipts. Setup:
+  `git submodule update --init`, then in `runtime/native-sdk`:
+  `git fetch origin macos-memory-shared-renderer-prep && git checkout --detach
+  6a8e6178`.
+- `examples/myclock/` is the clean isolated-benchmark fixture
+  (`examples/myclock/dist` is the bundle the bakeoff harness takes).
+- The audit briefs (`docs/receipt-sweep-brief.md`,
+  `docs/error-propagation-brief.md`) are separate passes; do not mix
+  them into this work.
+
+Everything that was once loose on the old machine (the Noro scrim, the
+briefs, the fixture) is now merged or on this branch; nothing else needs
+recovering.
+
+## What was diagnosed (in order)
+
+Starting point: Noro at ~161 MB phys_footprint, of which ~105 MB graphics
+(~87 MB "owned unmapped graphics" + ~18 MB IOAccelerator). Widget files are
+220 KB; the album art (256x256) and ArtShadow.png (174 bytes) were ruled out.
+Not a leak: 30-second sampling flat, near-zero CPU. It is high steady state.
+
+Ruled out: the old "Dock-icon snapshot for accessory processes" postmortem
+(~70 MB class) — current runtime passes no_activate, guards present. That old
+28.5 MB validated baseline is stale for today's renderer/OS.
+
+Found, fixed, verified:
+
+1. **Missing Objective-C autorelease pools** around the Zig->AppKit packet
+   presentation ABI (pixel, JSON-packet, binary-packet) and the parallel
+   raster fill workers. Temporary NSMutableData / NSBitmapGraphicsContext per
+   raster fill were never released. Fix verified live on Noro:
+   raster backing 16.4 MB -> 23 KB, stale bitmap contexts 102 -> 0,
+   heap 33.1 MB -> 19.2 MB, counts flat afterward.
+2. **`CAMetalLayer.framebufferOnly = NO`** (inherited from old commit
+   `b4711106`, not a current requirement). Changed to YES in production, NO
+   kept for automation builds (automation does a 1x1 blit from the drawable
+   for first-pixel verification). Semantically correct but **measured no
+   footprint win** (Myclock 131.9 -> 132.0 MB). Keep the change, claim
+   nothing for it.
+3. **Per-command raster cache blowup from rounded ancestor clips.** Noro's
+   command cache held 99 textures / 12.93 MB: 31 rounded fills (2.53 MB) +
+   31 rounded strokes (2.53 MB) + 28 shadows (2.45 MB) + 6 images (5.37 MB)
+   + 3 text. Rounded fills/strokes fell off the analytic Metal path solely
+   because an ancestor clip had rounded corners (the progress strip generated
+   most of them). Fix: analytic path extended — rounded fills honor rounded
+   ancestor clips, analytic rounded strokes added, shader multiplies shape
+   coverage by clip coverage. Verified live: cache 99 -> 37 entries, payload
+   12.93 -> 7.87 MB, IOAccelerator resident 20.5 -> 14.2 MB, regions 76 -> 63,
+   owned-unmapped-graphics virtual 92 -> 52 MB.
+4. **Tiled-image expansion** (~4 MB): tiny source tiles were expanded into
+   destination-sized retained rasters. Fix implemented: direct Metal
+   tiled-image primitive, one lazily created source texture per image ID,
+   repeat samplers. Restricted to untransformed, uncropped, full-source tiles
+   with no image-local radius; everything else stays on the raster path.
+   Shader compiles, full ReleaseFast build passes. **This fix's live memory
+   win and visual correctness were NEVER verified** — the thread died during
+   visual inspection. This is where you pick up.
+
+## Where the thread died
+
+Repeated failed attempts to visually inspect the live Noro window via
+Computer Use (Sky cannot address Noro by name — it's an unbundled accessory
+process with no LaunchServices identity; full-screen captures kept getting
+blocked by T3 Code's own window and Mission Control wouldn't hold open).
+Meanwhile a stale/current PID mixup happened once already (measured the wrong
+binary's cache: 99 entries "still there" was a pre-rebuild PID — always check
+process start time vs. build finish time, and use weaver's status API to find
+the ACTIVE Noro PID; there were two at one point).
+
+Better inspection route than Computer Use, discovered late in the thread:
+weaver has a production GPU screenshot hook that reads the composited Metal
+texture directly. The env var is inherited by the CLI watcher but NOT by an
+already-running host — the instrumented instance must be launched fresh (or
+use the window-capture approach in the weaver memory note
+"verify-widgets-by-window-capture" if working with the Claude harness).
+
+## Remaining work, in order
+
+1. Tiled-image validation is complete: the cache payload fell by the expected
+   ~4 MB, the composited screenshot passed visual comparison, and
+   `test-canvas` passed 841/841 after the patch (checkpoint below).
+2. Shadows: 28 entries / 2.45 MB still rasterized. Analytic shadow parity is
+   harder; measure before attempting.
+3. **The remaining wall:** see "The shared-renderer experiment" below. This
+   is the real fight for the 20 MB target and has its own phased plan.
+4. Keep the per-widget heap wins honest: re-sample after each change,
+   multiple samples (footprint numbers were noisy run to run, ±10 MB).
+
+## The shared-renderer experiment (the ~90 MB wall)
+
+### Background
+
+On the measured M3 Pro-class machine, sustained Metal submission at roughly
+1 Hz or faster establishes an ~89-96 MB per-process "owned unmapped graphics"
+working set. Both the Metal-composite and software-pixel paths paid it because
+both presented through CAMetalLayer. The same workload's graphics ledger was
+near zero on the M2 Air, so ~130 MB is not a universal per-widget floor; it is
+a hardware- and workload-scoped result.
+
+**Key discovery: weaver's Windows runtime already solved this.** Widget
+processes on Windows are device-less — display-list packets go over a pipe
+to a shared renderer owned by weaverd, and the rendered surface is imported
+into the widget's window by DirectComposition. See
+`runtime/native-sdk/src/platform/windows/shared_renderer_client.h` and
+`d3d_presenter.h` ("the widget never creates or loads a D3D device";
+lazy connect, reconnect after renderer crash). That is why Windows widgets
+sit at 20-40 MB. macOS is the outlier: every widget owns a CAMetalLayer and
+pays the full Metal entry fee. The plan is to port the shared-renderer
+contract to macOS: pipe -> unix socket/XPC, DirectComposition shared
+surface -> IOSurface into the widget window's CALayer, d3d_presenter -> a
+Metal presenter owned by the render host.
+
+### The decision is made — gates are falsification checks, not a debate
+
+Dara has approved the shared-renderer architecture (2026-07-29). Do not
+re-litigate whether to build it; build it. The gates below exist to
+FALSIFY the decision, and only these findings overturn it:
+
+1. The probe delta shows the ~90 MB is not device-scoped (Phase 0 gate).
+2. Per-widget overhead of the new design comes in an order of magnitude
+   worse than expected — ~20 MB+ per widget over the current design's
+   content cost, not a couple MB of IPC/surface overhead.
+3. The design scales badly: per-widget marginal cost in the host grows
+   super-linearly with widget count, or memory drifts upward over time
+   (a leak-shaped curve) rather than holding a flat steady state.
+
+Any of those three is a stop-and-report finding. Anything smaller is a
+note in the results, not a reason to deviate.
+
+### End state (this is what done means)
+
+Every weaver widget on macOS shows in the 20s-30s MB in Activity Monitor
+(phys_footprint), with one shared render host paying the Metal baseline
+once. Rendering is visually identical to today (rounded clips, tiles,
+strokes, shadows verified by screenshot), test-canvas and the runtime suite
+pass, and every claimed number is recorded in this doc with multiple
+samples. Work the problem however long it takes — but done is defined by
+those recorded numbers, not by code existing.
+
+Phases below are the strategy, in order. Each phase's numbers get recorded
+in this doc BEFORE its conclusions are acted on — the numbers are what make
+the next step trustworthy, including to you.
+
+**Non-goals (read twice — these bound the tenacity):**
+- Do NOT implement both architectures. The comparison happens in Phase 0
+  with throwaway probes; after the gate, exactly one architecture is built.
+- A failed gate is a FINDING, not an obstacle. If the gate number says the
+  hypothesis is dead, the problem you are grinding on changes from "build
+  the shared renderer" to "explain where the memory actually lives and
+  report." Do not make a dead architecture work through sheer persistence.
+- Do NOT weaken visual correctness or tests to hit the memory number. A
+  low number with broken rendering is a failed end state.
+- The deeper consolidation — host owns the windows, widget processes
+  become pure JS runners with no AppKit — is OUT OF SCOPE for this pass,
+  even if probe 3 makes it look attractive. Measure it (probe 3 stays),
+  record the numbers as evidence for a future decision, but Phase 2 builds
+  the device-less-widget-process design and stops there. Dara has
+  explicitly deferred this call.
+
+### Phase 0 — floor probes (throwaway code, no weaver changes)
+
+Three standalone probe apps (~100 lines each), each measured with
+`footprint` (multiple samples, note the spread):
+
+1. Process + NSWindow + CAMetalLayer + Metal device, drawing one quad.
+   = floor of the CURRENT architecture.
+2. Process + NSWindow + plain CALayer with IOSurface contents, no Metal
+   device anywhere in-process. = floor of a device-less widget process.
+3. Process, no AppKit at all, allocate + fill an IOSurface.
+   = floor of a pure JS-runner widget (host owns the window).
+
+Record all three numbers here.
+
+**GATE:** the bet rests on (probe 1 - probe 2) being large (expected
+~70-90 MB). If it is small, the ~90 MB is not device-scoped, the shared
+renderer will not reclaim it, and the plan must stop here and be rethought
+— record the numbers and end the phase either way.
+
+### Phase 1 — one-widget spike (ugly, hardcoded, throwaway)
+
+Route ONE widget (`examples/myclock/dist`, the clean fixture) through a minimal Metal
+presenter running in a second process, frames delivered via IOSurface into
+the widget window's CALayer. Ignore crash-reconnect, multi-client, and
+protocol cleanliness. Deliverable: the widget process's footprint with real
+weaver content (QuickJS + packet ABI) and a screenshot proving it renders.
+Record the number here.
+
+**SUPERSEDED GATE:** the original target was for the widget process to land in
+the 20s-30s, but the Phase 1 kickoff calibration below replaced that fixed
+total-footprint target. The active gate is categorical: the widget process's
+`ledger_tag_graphics_footprint` must stay near zero. Report the remaining
+hardware-specific content cost separately before any Phase 2 work.
+
+**Scaling check (falsification condition 3):** extend the spike to N
+clients — run 1, 2, 4, 8 myclock instances through the one host and record
+host footprint at each N plus one widget-process footprint. Expected: host
+grows linearly with a modest per-widget slope (surfaces + retained state,
+single-digit MB per widget); widget processes stay flat. Then hold the
+8-widget configuration for 30+ minutes and sample: steady state must be
+flat, not drifting. Super-linear host growth or upward drift is a
+stop-and-report finding per the falsification list above.
+
+#### Phase 1 kickoff calibration (2026-07-30, after the wall was named)
+
+Approved to run on `Mac15,6` (the M3 Pro) — the machine where the
+submission arena exists, so the gates have teeth; the M2 Air is the
+post-pass cross-check, not the spike machine. Read
+`docs/gpu-ledger-wall-brief.md` (recorded results) and
+`docs/gpu-ledger-session-2026-07-30.md` before starting; the wall's name
+changes how this phase is judged:
+
+- **Recalibrated gate:** the original "widget lands in the 20s-30s" was
+  written against Air content costs. The success criterion here is
+  categorical, not a bare total: the widget process's graphics ledger
+  (`vmmap` "owned unmapped graphics" / `ledger_tag_graphics_footprint`)
+  stays at ~0 — the ~95 MB arena must not appear in any widget process —
+  and the widget total is judged as myclock content cost without the
+  arena. The host pays the arena once; that is by design, not a failure.
+- **The widget side must submit no Metal at all.** The blueprint is the
+  probe's IOSurface-contents-on-plain-CALayer row (~10 MB at 60 Hz content
+  updates). Probe sources: `.zig-cache/macos-memory/gpu-ledger-wall/`.
+  Any Metal submission from the widget process at >=1 Hz cadence recommits
+  the arena and fails the phase, whatever the total reads.
+- **Do not mix in event-driven presenting.** Killing the unconditional
+  60 Hz pump is separately approved, Windows-proven work — but it is not
+  the memory fix (1 Hz still holds the arena) and bundling it into the
+  spike muddies the receipt. The host may keep the dumb 60 Hz loop for
+  this phase.
+- **Expected host shape, from the N-layer probe:** ~95 MB arena plus
+  ~2.4 MB per additional presenting layer — and the host can render
+  widget frames to IOSurfaces offscreen, so N widgets need not mean N
+  presenting layers. The scaling check validates per-widget host cost and
+  the 30-minute drift, which the probes did not cover.
+- Stale-PID discipline applies (this machine had seven stale
+  weaver-widget processes at the last session's start): PID start time >
+  build finish time, every measurement.
+
+### Phase 2 — build the winning implementation as reviewed slices
+
+Only if Phase 1's gate confirms an obviously winning design (if it does
+not, stop at the finding and report — no build-out for a coin flip).
+
+This phase IS the real, ship-bound implementation, and it is built as a
+sequence of PRs against master — one coherent slice per PR. The reason for
+slicing: the code review bots review one focused slice of production code
+far better than a monolithic port. The throwaway probe/spike code from
+Phases 0-1 never appears in a PR.
+
+Spec: mirror the Windows contract
+(`runtime/native-sdk/src/platform/windows/shared_renderer_client.h` is the
+interface to follow; keep the lazy connect + reconnect-after-crash
+semantics). A plausible slice sequence — adjust to what the spike taught:
+
+1. IOSurface presentation path (widget window presents from an IOSurface).
+2. Render host process + socket protocol (host side of the contract).
+3. Device-less widget client (widget side; no Metal device in-process).
+4. Cutover + per-client frame budgets — one host serving N widgets means a
+   pathological widget can starve its neighbors; that is a new tripwire
+   surface and it must name the budget when it fires (see CLAUDE.md).
+
+For each PR:
+- The description carries the receipts: relevant probe/spike numbers,
+  before/after footprint where the slice moves it, and visual-verification
+  screenshots. Every number states its measurement.
+- Babysit it until the code review bots are fully green and the review
+  score is 5/5 BEFORE starting the next slice. Address findings properly —
+  fix real issues, push back with evidence on false positives; never
+  satisfy a bot by weakening tests, suppressing warnings, or shrinking the
+  change's honesty.
+- Re-run live memory measurements after any review-driven change to the
+  render path, and update the PR's numbers if they move.
+
+### Recorded results (append below as phases complete)
+
+- Phase 0 (probes): **FALSIFIED on 2026-07-30; stop-and-report gate
+  fired.** Metal-window minus device-less IOSurface-window physical
+  footprint was 2.781 MiB at the same five-second checkpoint and 2.861 MiB
+  across the ten-sample means, not the expected 70-90 MB.
+  **Partially rescinded later the same day — see "2026-07-30 correction"
+  below. The probe result stands, but it answered the wrong question: the
+  wall is workload-scoped, not window-scoped, and it reproduces on other
+  hardware.**
+- Phase 1 (spike): **not started.** Un-blocked 2026-07-30: the wall was
+  named (per-process Metal submission working set — see the "wall is
+  named" section below and `docs/gpu-ledger-wall-brief.md`) and Dara
+  re-approved the shared-renderer plan on that receipt. This is the next
+  work.
+- Phase 2 (slices — one line per merged PR): **not started; gated on
+  Phase 1.**
+
+### 2026-07-30 continuation receipts
+
+Hardware was a MacBook Air `Mac14,2`, Apple M2, 8 GB, macOS 26.5.1
+(`25F80`). The T3 Code harness could not attach Apple's `footprint` or
+`vmmap` processes to another process: each command hung until explicitly
+terminated. The replacement measurement path was not RSS or an estimate:
+each throwaway probe called `task_info(mach_task_self(), TASK_VM_INFO, ...)`
+and recorded the kernel's `phys_footprint` plus graphics ledgers itself.
+Ten one-second `proc_pid_rusage(RUSAGE_INFO_V6).ri_phys_footprint` samples
+then matched that self-reported checkpoint byte-for-byte on the first sample
+and stayed within the spreads below. Probe source and raw JSON live only in
+`.zig-cache/macos-memory/phase0/`; they are throwaway and must not enter a
+PR.
+
+#### Tiled-image checkpoint — verified
+
+The rebuilt runtime binary completed at `00:35:21`; the measured Noro PID
+`16114` started at `00:35:27`, so this was not the stale-PID failure from
+the prior thread. The GPU screenshot hook produced both the composited PNG
+and a cache receipt:
+
+- raster cache: 33 entries / 3,917,992 bytes (3.737 MiB), down from the
+  prior 37 / 7.87 MB;
+- direct source-image textures: 4 entries / 133,840 bytes;
+- scratch textures: 3 entries / 49,152 bytes;
+- first present: 102 commands = 33 cache fills + 69 direct commands.
+
+The retained cache therefore fell by approximately the expected 4 MB. The
+fresh screenshot at
+`.zig-cache/macos-memory/noro-self-ledger/widget-canvas-p1.png` was opened
+and compared with `docs/mac-styling-2026-07-24/noro-shell.png`: the outer
+51 px rounded clip, tile orientation/seams/opacity, progress-strip bottom
+corners, button borders, and asymmetric corner radii remained intact.
+`zig build test-canvas --summary all` passed 841/841.
+
+The screenshot diagnostic deliberately makes the composite target
+CPU-readable, so its self-ledger is not used as the production footprint:
+57,901,872 bytes physical, including 13,352,960 bytes graphics. The clean
+non-diagnostic metal run below is the production number.
+
+#### Phase 0 floor probes — falsification finding
+
+Each row is ten one-second samples after a five-second warmup. Values are
+the XNU physical-footprint ledger, in MiB; the parenthesized bytes are the
+self-reported five-second checkpoint.
+
+| Probe | Min | Mean | Max | Self checkpoint | Graphics at checkpoint |
+|---|---:|---:|---:|---:|---:|
+| NSWindow + CAMetalLayer + Metal device + one quad | 11.204 | 11.233 | 11.313 | 11.313 (11,862,712) | 1,163,264 footprint + 2,424,832 no-footprint bytes |
+| NSWindow + plain CALayer + IOSurface contents | 8.329 | 8.373 | 8.532 | 8.532 (8,946,336) | 16,384 footprint + 0 no-footprint bytes |
+| no AppKit + allocated/filled IOSurface | 2.516 | 2.518 | 2.532 | 2.532 (2,654,616) | 0 bytes |
+
+The decisive delta is only 2,916,376 bytes (2.781 MiB) at the same
+checkpoint, or 2,999,935 bytes (2.861 MiB) between the sample means. The
+probe does **not** reproduce a device-scoped ~90 MB wall. This is
+falsification condition 1 from the approved plan, so the shared-renderer
+spike and production slices stop here.
+
+#### Where the current footprint actually lives
+
+Full Weaver measurements used the same ten one-second
+`ri_phys_footprint` samples. Each run was flat or had the spread shown in
+`.zig-cache/macos-memory/phase0/runtime-results.json`.
+
+| Workload | Mean physical footprint |
+|---|---:|
+| Myclock, metal | 35,929,314 bytes / 34.265 MiB |
+| Myclock, software | 32,824,570 bytes / 31.304 MiB |
+| Noro, metal production path | 52,429,664 bytes / 50.001 MiB |
+| Noro, forced software | 44,876,640 bytes / 42.798 MiB |
+
+The current Noro metal total decomposes without inventing categories:
+
+- 31.304 MiB: full Weaver + Myclock software floor;
+- 2.961 MiB: Myclock's metal-over-software delta;
+- 11.494 MiB: Noro's software content over Myclock software;
+- 4.242 MiB: Noro-specific GPU content above Myclock's metal delta.
+
+Those measured parts total 50.001 MiB. Moving rendering out of process
+cannot turn this widget into a 20s-MB process: even the forced-software Noro
+is 42.798 MiB, and the isolated device delta is under 3 MiB.
+
+The diagnostics-only `WEAVER_MEMORY_RECEIPT=1` line also rules out QuickJS
+as the wall. Noro's QuickJS allocator held 398,176 bytes (Myclock: 332,224
+bytes). The fixed Weaver `WidgetApp` value is 5,845,424 bytes and its
+retained `Tree` is 2,512,320 bytes. A `CanvasState` is 294,960 bytes, so the
+eight inline canvas slots account for 2,359,680 bytes of every `Tree` before
+a widget uses a canvas; the transaction path can retain another whole
+`Tree` as `snapshot_storage`. Lazy canvas capacity and the transaction
+representation are therefore evidence-led next investigation targets. They
+require a new plan; this handoff's shared-renderer plan is stopped by its
+own gate.
+
+### 2026-07-30 correction — the wall is real, workload-scoped, and machine-dependent
+
+Measured the same day on Dara's other machine, `Mac15,6` (MacBook Pro,
+Apple M3 Pro, 18 GB, macOS 26.5.2, build `25F84`), on a fresh ReleaseFast
+build of this exact branch state (weaver `73789e3`, native `6a8e6178`;
+widget PID start verified after build finish):
+
+| Measurement (Mac15,6) | Result |
+|---|---|
+| Bare NSWindow + CAMetalLayer + device + one cleared/presented frame | 9.705 MiB mean (10x1s samples; ~1.1 MB graphics footprint + 2.4 MB no-footprint) |
+| Bare NSWindow + plain CALayer + IOSurface contents, no Metal | 8.541 MiB mean |
+| Myclock, metal production path, live | **125.3 MB footprint (peak 128.3), of which 85 MB dirty "Owned physical footprint (unmapped) (graphics)", 33 regions** |
+
+The same branch state measures Myclock at 34.265 MiB on the `Mac14,2` Air.
+Conclusions, in order of importance:
+
+1. **The ~85-90 MB wall is real and current — on this hardware class.** It
+   is not stale-measurement error, not the `footprint` tool (the bare-probe
+   floors match the Air's within ~1.5 MiB using the same tool), and not
+   Dara's corporate security software (which would appear as mapped library
+   regions, not driver graphics ledger).
+2. **It is workload-scoped, not window-scoped.** A bare Metal window on the
+   same machine carries ~1 MB of graphics ledger; Weaver's trivial clock
+   carries 85 MB. Something Weaver's renderer does — canvas GPU surface
+   allocation, the per-second `gpu_surface_frame` redraw, texture/heap
+   allocation pattern — makes this GPU driver retain ~85 MB that the M2
+   driver does not.
+3. **The Phase 0 gate design was flawed, not the probes.** The probes
+   honestly measured window floors and found no device-scoped wall; but the
+   wall was never in the device setup. The falsification verdict stops the
+   original "move the Metal *baseline* into a shared host" plan — that
+   baseline genuinely does not exist. It does NOT settle whether an
+   out-of-process renderer is needed, because whatever allocates the 85 MB
+   would move with the rendering. Architecture stays on hold until the
+   allocation is named.
+
+The investigation itself is separate work with its own brief:
+`docs/gpu-ledger-wall-brief.md` (runs on the `Mac15,6` machine, where the
+wall reproduces). This handoff's shared-renderer plan remains stopped.
+
+Do not repeat these mistakes: the falsified gate was treated as closing
+the architecture question when it only closed the baseline theory; and
+"reproduces on machine A, absent on machine B" was nearly misread twice
+(first as security software, then as measurement artifact). Both machines'
+numbers are honest; the difference is the finding.
+
+### 2026-07-30 — the wall is named; shared-renderer plan re-opened
+
+The GPU-ledger investigation (`docs/gpu-ledger-wall-brief.md`, "Recorded
+results") named the 85 MB with an on/off receipt from bare probes
+containing no Weaver code. Summary of what it is:
+
+- The Apple GPU driver's **per-process command-submission working set** on
+  the M3 Pro / macOS 26.5.2 class: ~95 MB committed as soon as a process
+  submits Metal command buffers in a sustained cadence (>= ~1 Hz), plus
+  ~2.4 MB per additional presenting layer. Presentation is not required —
+  offscreen renders trigger it; window/device setup alone does not
+  (~1 MB). Reclaimed after ~2-5 s of submission silence.
+- Weaver pins it forever on every widget because `renderFrame` presents
+  unconditionally from a 60 Hz display timer — including the software
+  backend, which presents through the same CAMetalLayer.
+- A device-less process showing frames via IOSurface contents on a plain
+  CALayer measures ~10 MB footprint even at 60 Hz content updates: the
+  compositing charge lands in WindowServer, never on the widget's ledger.
+- The M2 Air's driver sizes the same working set near zero (34.3 MiB
+  total). Driver policy per hardware class, not a Weaver allocation.
+
+Consequences for this plan, per Dara (2026-07-30): **the shared-renderer
+architecture is re-approved on the new receipt** — one render host pays
+the ~95 MB arena once, device-less widget processes pay ~0. The original
+Phase 0 gate stays honestly failed (its "Metal baseline" theory was
+wrong), but the new probes answer the question that gate was built to
+answer: the wall is real, it moves with whoever submits, and it is paid
+per process. Event-driven presenting (drop the unconditional 60 Hz pump;
+Windows already works this way — "frames exist only on demand") is worth
+doing for CPU/battery and makes the shared host cheap, but is NOT the
+memory fix by itself for the measured seconds-clock workload: 1 Hz submission
+still holds the full arena, while the measured 0.2 Hz workload does not
+establish it. Intermediate cadences were not measured.
+
+Phase 1 (the one-widget spike, myclock through an out-of-process Metal
+presenter into an IOSurface-backed CALayer) is therefore the next step, with
+the recalibrated gate: the widget process must keep
+`ledger_tag_graphics_footprint` near zero. Report the hardware-specific content
+cost separately from the removed arena; do not treat a fixed total-footprint
+estimate as the acceptance criterion.
+
+## Validation status at handoff
+
+- Native platform tests: pass.
+- `test-canvas`: 841/841 pass after the tile patch.
+- Direct runtime suite: 57 pass, 1 skip.
+- Known false negative: `zig build test` wrapper misclassifies an intentional
+  provider-timeout warning on stderr as failure; the direct test executable
+  passes. Don't chase it.
+- ReleaseFast build + codesign: pass.
+
+## Commands
+
+```sh
+# build (from runtime/)
+mise exec zig@0.16.0 -- zig build -Doptimize=ReleaseFast
+
+# isolated bakeoff (myclock is the clean fixture; Noro can't run isolated —
+# its media provider intentionally requires Weaverd)
+# Use `--candidate software` for the software-path comparison.
+python3 scripts/macos-renderer-bakeoff.py \
+  --runtime runtime/zig-out/bin/weaver-widget \
+  --candidate software \
+  --bundles examples/myclock/dist \
+  --count 1 --warmup-seconds 5 --sample-seconds 5 \
+  --output .zig-cache/myclock-software.json --stage-trace
+
+# live measurement (get ACTIVE pid from weaver status --json first)
+footprint --noCategories --swapped --format bytes -p <PID>
+vmmap -summary <PID>
+```
+
+## Reference numbers (all measured 2026-07-29, old laptop, may drift)
+
+| Metric | Before | After fixes 1-3 |
+|---|---|---|
+| Noro raster cache | 99 entries / 12.93 MB | 37 / 7.87 MB |
+| Noro IOAccelerator resident | 20.5 MB | 14.2 MB |
+| Noro mutable raster backing | 16.4 MB | 23 KB |
+| Noro heap | 33.1 MB | 19.2 MB |
+| Noro phys_footprint | ~161-166 MB | ~166 MB (noisy; category shifts confirm wins) |
+| Myclock phys_footprint (isolated) | — | 131.9 MB metal / 128.6 MB software |
+| Per-process graphics baseline | — | ~89-91 MB (the wall) |
diff --git a/docs/macos-visualizer-perf-2026-07-31.md b/docs/macos-visualizer-perf-2026-07-31.md
new file mode 100644
index 0000000..293d4fb
--- /dev/null
+++ b/docs/macos-visualizer-perf-2026-07-31.md
@@ -0,0 +1,84 @@
+# macOS Visualizer rendering cost — 2026-07-31
+
+Recorded on an Apple M2 running macOS 26.5.1 (25F80), arm64, Zig 0.16.0,
+and Node 23.11.0. Every workload used two production Widget processes, one
+host-owned deterministic 48 kHz mono audio source, the production provider
+pipe/FFT/fan-out, Metal presentation, and ten one-second cumulative-CPU
+samples from `scripts/macos-audio-cost.py`. CPU is percent of one core summed
+across `weaverd` and both Widget processes. WindowServer is recorded beside
+each run as the system-wide background control.
+
+## Pixel-aligned translucent rectangle quads
+
+Both variants used the Native renderer with direct premultiplied-alpha flat
+quads. The control read the fractional-width Visualizer from Weaver
+`4e97a4a`; the treatment changed only its bar geometry to integral points.
+
+| Variant | Mean CPU | Per-process CPU: host / widget / widget | WindowServer | Frames | Physical footprint | RSS |
+|---|---:|---:|---:|---:|---:|---:|
+| Fractional bar geometry | 16.316% | 0.685% / 7.719% / 7.913% | 42.981% | 293 | 54,589,099.2 B | 231,324,057.6 B |
+| Pixel-aligned bar geometry | 13.225% | 0.784% / 6.466% / 5.976% | 43.693% | 293 | 53,058,833.6 B | 230,214,860.8 B |
+
+The aligned geometry reduced the complete active workload by **18.9%** under
+adjacent, equally busy WindowServer conditions. A five-second process sample
+of the aligned treatment contained zero
+`rasterCacheBuildEntryForCommand`/`compositeScratchTextureForCommand` frames;
+the fractional control entered that CPU-raster/texture-upload path.
+
+Raw total-CPU samples:
+
+- fractional: `17.631200, 18.661772, 16.644116, 14.726483, 12.670263, 14.578599, 16.590786, 17.550643, 18.518812, 15.586492`
+- aligned: `14.771535, 11.759939, 14.650708, 15.633389, 13.715161, 12.719057, 13.761920, 10.797748, 11.755784, 12.685285`
+
+## Retained Canvas update versus full view rebuild
+
+These runs were immediately adjacent at Weaver `5c4dbba`, with identical
+aligned Visualizer source and renderer. The full-rebuild control was built
+from the same working tree with only the two opt-in `WidgetApp` entries
+(`view_revision` and `project_update`) removed. The treatment enabled them and
+used the batched retained-immediate-command update. Both were ReleaseFast with
+the normal production trace configuration.
+
+| Variant | Mean CPU | Per-process CPU: host / widget / widget | WindowServer | Frames | Physical footprint | RSS |
+|---|---:|---:|---:|---:|---:|---:|
+| Full TSX + layout rebuild per Canvas frame | 6.425% | 0.778% / 2.728% / 2.920% | 2.142% | 264 | 47,915,896.0 B | 224,200,294.4 B |
+| Retained Canvas command update | 3.597% | 0.778% / 1.458% / 1.361% | 2.431% | 264 | 43,875,553.6 B | 222,919,065.6 B |
+
+The retained update reduced the complete workload by **44.0%** and the two
+Widget processes' combined CPU by **50.1%**, without dropping provider frames.
+The treatment sample contained no `UiApp.rebuild` or raster-cache build frame;
+the remaining visible loop cost is primarily the JS Canvas callback/command
+decode, display-list diff, tracing, and presentation.
+
+Raw total-CPU samples:
+
+- full rebuild: `5.868174, 7.737061, 6.794842, 6.864278, 4.869452, 6.811353, 5.816060, 6.839024, 6.832127, 5.822501`
+- retained update: `2.932559, 3.889978, 3.885490, 3.904691, 3.888527, 2.906125, 3.872326, 3.881980, 3.890509, 2.918751`
+
+## Widget trace default
+
+After the retained-update run, the same treatment was rebuilt
+with `-Dtrace=off`. The ordinary Native SDK `events` mode writes every runtime
+event to `native-sdk.jsonl`; for a Canvas Widget that means an open/stat/
+append/close cycle at every completion frame. Weaver already has a dedicated
+per-widget diagnostic log, and explicit profiling builds retain
+`-Dtrace=events|runtime|all`, so the production Widget default now omits this
+continuous event journal.
+
+| Variant | Mean CPU | Per-process CPU: host / widget / widget | WindowServer | Frames | Physical footprint | RSS |
+|---|---:|---:|---:|---:|---:|---:|
+| Retained update, event trace | 3.597% | 0.778% / 1.458% / 1.361% | 2.431% | 264 | 43,875,553.6 B | 222,919,065.6 B |
+| Retained update, trace off | 2.818% | 0.875% / 0.972% / 0.972% | 2.430% | 268 | 44,042,716.0 B | 223,266,406.4 B |
+
+Disabling the continuous event journal reduced total CPU by **21.7%** and the
+two Widget processes' combined CPU by **31.0%**, while the treatment delivered
+four more frames. Memory differences at this size are run noise, not a claim.
+
+Raw trace-off total-CPU samples:
+
+- `2.900773, 2.935771, 1.941347, 2.905832, 2.919207, 2.927449, 2.907781, 2.920701, 2.916573, 2.904058`
+
+Do not compare the absolute CPU values between the two sections: the first
+pair ran while WindowServer was consuming about 43% of a core and the later
+runs while it consumed about 2%. The within-section adjacent A/B comparisons
+are the receipts.
diff --git a/docs/receipt-sweep-brief.md b/docs/receipt-sweep-brief.md
new file mode 100644
index 0000000..17fe2fd
--- /dev/null
+++ b/docs/receipt-sweep-brief.md
@@ -0,0 +1,155 @@
+# Receipt sweep — every limit gets a measurement or gets resized
+
+Handoff brief for a one-pass audit of every numeric limit in weaver. Vocabulary
+is from CLAUDE.md (receipt, tripwire, landmine): a limit without a measurement
+is a landmine; a correctly sized limit is a tripwire — placed past where any
+good widget goes, so only broken things touch it. The precedent for both the
+sizing method and the receipt format is the Native SDK's
+`runtime/native-sdk/src/runtime/canvas_limits.zig` comment block (measured the
+worst realistic good view at ~500 nodes, set the cap at 1024, wrote the math
+down) and weaver's own `runtime/src/tree.zig:11-18` canvas-budget comment
+(the 336-rect meter receipt).
+
+**Out of scope:** making limit violations visible (error boundaries, named
+budget errors, check-time validation). That is `docs/error-propagation-brief.md`
+and runs as its own pass, governed by CLAUDE.md's "DX is for humans and
+agents" and "A limit developers can hit is a limit they must see". This sweep
+only answers: is each number justified, and if not, what should it be?
+
+## Deliverables
+
+1. An inventory table (append it to this doc or a sibling results doc):
+   constant, value, file:line, has receipt (Y/N), measured worst good case,
+   verdict (keep / resize to N / delete).
+2. For every no-receipt constant that survives: a receipt comment at the
+   definition site, in the `tree.zig:11-18` style — what was measured, what it
+   needed, what headroom the value leaves, and what the memory cost of the
+   headroom is (usually ~zero: reserve big, commit lazily, pages touched only
+   on use — but say so).
+3. Resizes applied, with mirrors updated (see "Mirrored constants" below).
+4. A short list of limits that should not exist at all (protocol invariants
+   masquerading as budgets, or caps whose removal costs nothing).
+
+## How to find the full set
+
+The seed inventory below was produced with:
+
+```sh
+rg -n 'pub const max_|const max_|_cap|Limit|MAX_' runtime/src cli/src sdk/src
+```
+
+Re-run it — don't trust the seed to be complete. Also sweep `sdk/src` for any
+soft limits (array slicing, string truncation) that don't announce themselves
+as constants.
+
+## Seed inventory — known suspects
+
+### The starved tier (measure and resize first — these are the active pain)
+
+- `runtime/src/tree.zig:4` `max_nodes = 128`. No receipt. Known too small:
+  noro-shell + ~6 retained nodes kills the process
+  (`docs/error-propagation-brief.md`, intro). The Native SDK documents why it
+  abandoned 128/256 and sits at 1024/view
+  (`canvas_limits.zig:17-28`). Measure noro-shell, visualizer, and the
+  worst widget we'd call good; expect the answer to land near the Native SDK's
+  1024 tier. Memory cost of the raise is address space, not resident pages —
+  but verify the arena is not eagerly zeroed before claiming that
+  (grep the tree-arena init for `zeroes`/memset; lazy commit dies if it is).
+- `runtime/src/tree.zig:5` `max_children = 24`. No receipt. Surfaces as a bare
+  "appendChild failed". A 25-item list is a normal widget, not pathology —
+  this is almost certainly not a tripwire today.
+- `runtime/src/tree.zig:6` `max_text_bytes = 192`. No receipt. 192 bytes is
+  ~2 lines of text; measure real widgets' longest text node.
+- `runtime/src/tree.zig:10` `max_canvases = 8`. No receipt, probably fine —
+  but write the receipt saying why 8 clears any good widget.
+- `runtime/src/tree.zig:7-9` `max_source_bytes = 260`,
+  `max_icon_path_bytes = 8 KiB`, `max_font_family_bytes = 63`. Some of these
+  are protocol/OS facts (260 smells like MAX_PATH, 63 like a null-terminated
+  64-byte field) — if so, the receipt is "this is an OS/protocol bound, not a
+  budget" and they should say that rather than look arbitrary.
+
+### Already receipted (verify, don't rework)
+
+- `runtime/src/tree.zig:19-21` canvas commands/points/wire values — receipt
+  present (the 336-rect meter). Check the math still holds after any node
+  resize.
+- `runtime/native-sdk/src/runtime/canvas_limits.zig` — the model citizen.
+  Read it before writing any receipt; match its format.
+- `runtime/src/main.zig` `max_images = 16` and
+  `max_image_load_attempts = 3` — receipts are present; verify only that their
+  assumptions and mirrors remain synchronized.
+
+### Runtime, unreceipted
+
+- `runtime/src/bridge.zig:27-28` `max_timers = 16`, `max_fetches = 4`.
+  4 concurrent fetches for a widget that polls two APIs plus loads art may be
+  tight; measure.
+- `runtime/src/network.zig:10-11` request/response caps at 5 MiB each.
+- `runtime/src/provider_protocol.zig:5-7` frame/ack queue capacity 4,
+  command_line_capacity 256.
+- `runtime/src/media_protocol.zig:3-5` text 512, source_app 256, art_path 259.
+- `runtime/src/geometry.zig:18` `max_file_bytes = 512` for the geometry file.
+- The decoded-image cap is now 1 MiB. A 256×256 RGBA image is 256 KiB and
+  passes; verify the receipt and CLI/runtime mirror rather than treating that
+  measured fixture as over-budget.
+- QuickJS stack bounds (see commit `20b5a46`) — find where the bound is set
+  and whether it has a receipt.
+
+### CLI / packaging, unreceipted
+
+- `cli/src/index.ts:85-86` `MAX_WIDGET_FONTS = 2`, font bytes 512 KiB.
+- `cli/src/weave.ts:7-14` archive 64 MiB, file 16 MiB, entries 1024,
+  name/author 256. Probably fine; write the one-line receipt ("a weave is a
+  widget bundle; the largest real example is N") or shrink.
+- Widget asset limit hit by the generated grille (commit `c67b4e3` "Fit
+  generated grille within widget asset limit") — locate the constant, that
+  commit is evidence a real asset already collided with it.
+
+## Mirrored constants — resizes must move in lockstep
+
+- `cli/src/index.ts` mirrors the runtime tree limits for nodes (1024), depth
+  (32), children (64), text bytes (1024), source bytes (1024), and canvases
+  (8) so `weaver check` can fail early. `scripts/release-audit.mjs` enforces
+  lockstep; any new mirror must join that audit.
+- `cli/src/index.ts:maxImageStreamBytes` ↔
+  `runtime/src/main.zig:max_image_stream_bytes`.
+- `cli/src/index.ts:nativeImagePixelByteLimit` ↔
+  `runtime/src/main.zig:max_image_rgba_bytes`.
+- `cli/src/index.ts:nativeWidgetSourceByteLimit` ↔
+  `runtime/src/tree.zig:max_source_bytes`.
+- Depth limit 32: find the runtime-side counterpart and receipt both.
+- Precedent for cross-boundary pinning done right:
+  `canvas_limits.zig:46-57` documents that the AppKit host pins
+  `NATIVE_SDK_PACKET_RETAINED_COMMAND_CAP` to the same value and what happens
+  on mismatch. That's the bar.
+
+## How to measure
+
+- Real widgets are the ruler: `examples/noro-shell`, `examples/visualizer`,
+  the native-sdk examples (notes, system-monitor, deck), and anything in
+  recent history that hit a cap (the 336-rect meter, the 24-panel row, the
+  grille asset).
+- For tree budgets, count the lowered tree, not the JSX — `weaver check`'s
+  `validateLoweredTreeBudgets` (`cli/src/index.ts:1011`) already computes
+  lowered node count and depth; reuse it as the measuring tool.
+- Sizing rule from precedent: cap ≈ 2× the worst realistic good case
+  (Native SDK: measured ~500, set 1024).
+- Before being generous, verify the lazy-commit claim per arena: fixed
+  capacity is only free if construction is in-place and large fields stay
+  uninitialized (`canvas_limits.zig:26-28`). An arena that memsets on init
+  pays resident memory for the whole cap.
+
+## Acceptance
+
+- Re-run the full inventory query—including `_cap`, `Limit`, `MAX_`, and
+  camelCase `max...` names—across `runtime/src`, `cli/src`, and `sdk/src`, plus
+  the separate SDK soft-limit sweep for slicing and truncation. For every
+  result, inspect the definition site and require an adjacent receipt or
+  protocol/OS-bound comment; counting names alone is not an acceptance check.
+- `tree.zig`, `runtime/src/main.zig`, and `cli/src/index.ts` budget mirrors
+  agree (ideally by construction).
+- noro-shell with the +6-node repro from the error-propagation brief renders
+  fine under the resized budgets.
+- Nothing in this pass adds a new error path or check rule — if you find
+  yourself doing that, you've drifted into the error-propagation brief's
+  territory; note it there and move on.
diff --git a/examples/myclock/tsconfig.json b/examples/myclock/tsconfig.json
new file mode 100644
index 0000000..bb61204
--- /dev/null
+++ b/examples/myclock/tsconfig.json
@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "jsx": "react-jsx",
+    "jsxImportSource": "@weaver/sdk",
+    "types": ["@weaver/sdk"]
+  },
+  "include": ["widget.tsx"]
+}
diff --git a/examples/myclock/widget.tsx b/examples/myclock/widget.tsx
new file mode 100644
index 0000000..878dead
--- /dev/null
+++ b/examples/myclock/widget.tsx
@@ -0,0 +1,34 @@
+import { useProviderSignal, widget, type TimeData } from "@weaver/sdk";
+
+function hourMinute(value: TimeData): string {
+  return `${value.hh}:${value.mm}`;
+}
+
+function seconds(value: TimeData): string {
+  return value.ss;
+}
+
+function date(value: TimeData): string {
+  return `${value.weekday}, ${value.month} ${value.day}`;
+}
+
+export default widget({
+  name: "Myclock",
+  size: [240, 110],
+  anchor: { corner: "top-right", offset: [24, 24] },
+  subscribe: ["time"],
+}, () => {
+  const time = useProviderSignal("time");
+  const hourMinuteSignal = time.map(hourMinute);
+  const secondsSignal = time.map(seconds);
+  const dateSignal = time.map(date);
+  return (
+    <column class="p-4 gap-1 bg-[#11141c]/86 rounded-2xl">
+      <row class="items-baseline gap-2">
+        <text class="text-3xl font-light">{hourMinuteSignal}</text>
+        <text class="text-sm opacity-70">{secondsSignal}</text>
+      </row>
+      <text class="text-xs opacity-60">{dateSignal}</text>
+    </column>
+  );
+});
diff --git a/examples/visualizer/widget.tsx b/examples/visualizer/widget.tsx
index 8805588..6315422 100644
--- a/examples/visualizer/widget.tsx
+++ b/examples/visualizer/widget.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useProvider, useState, widget } from "@weaver/sdk";
+import { useEffect, useProviderSignal, useState, widget, type AudioData } from "@weaver/sdk";
 
 // A canvas gets no host GPU surface if any ancestor clips, or if a layer with
 // opacity paints behind it. So: no overflow-hidden anywhere (each overlay image
@@ -12,6 +12,7 @@ const cellCount = 14;
 const cellHeight = 3;
 const cellGap = 2;
 const barGap = 2;
+const barWidth = 11;
 const segments = 24;
 
 const levels = Array.from({ length: barCount }, () => 0);
@@ -23,6 +24,14 @@ function readout(rms: number): string {
   return `${db > 0 ? "+" : ""}${db} DB`;
 }
 
+function readoutValue(audio: AudioData): string {
+  return readout(audio.rms);
+}
+
+function hasSignal(audio: AudioData): boolean {
+  return audio.bands.some((value) => value > 0.002);
+}
+
 export default widget({
   name: "Visualizer",
   size: [340, 158],
@@ -30,12 +39,12 @@ export default widget({
   layer: "desktop",
   subscribe: ["audio"],
 }, () => {
-  const audio = useProvider("audio");
-  const signalActive = audio.bands.some((value) => value > 0.002);
-  const [active, setActive] = useState(signalActive);
-  useEffect(() => {
-    if (signalActive) setActive(true);
-  }, [signalActive]);
+  const [active, setActive] = useState(false);
+  const audio = useProviderSignal("audio");
+  useEffect(() => audio.subscribe((next) => {
+    if (hasSignal(next)) setActive(true);
+  }), [audio]);
+  const readoutSignal = audio.map(readoutValue);
   return (
     <stack class="size-full rounded-[20px]">
       <column class="size-full bg-[#1a1a1a] rounded-[20px] border border-[#000000] shadow-[0_1px_2px_0_#ffffff1a] shadow-inner p-[14px]">
@@ -45,8 +54,13 @@ export default widget({
               class="w-[312px] h-[75px]"
               fps={active ? 30 : 0}
               onFrame={(ctx, frame) => {
+                const sample = audio.value;
                 ctx.clear();
-                const barWidth = (ctx.width - barGap * (barCount - 1)) / barCount;
+                // Integer point geometry remains pixel-aligned at every
+                // integral backing scale, so solid cells stay direct Metal
+                // quads instead of taking the antialiased raster fallback.
+                const meterWidth = barCount * barWidth + (barCount - 1) * barGap;
+                const meterX = Math.floor((ctx.width - meterWidth) / 2);
                 const pitch = cellHeight + cellGap;
                 const ladder = cellCount * pitch - cellGap;
                 const base = ctx.height - (ctx.height - ladder) / 2;
@@ -55,17 +69,17 @@ export default widget({
                 // Drawing every cell individually would need barCount * cellCount
                 // rects, over the 256-command frame budget.
                 for (let index = 0; index < barCount; index += 1) {
-                  const source = index * (audio.bands.length - 1) / (barCount - 1);
+                  const source = index * (sample.bands.length - 1) / (barCount - 1);
                   const lower = Math.floor(source);
                   const blend = source - lower;
-                  const target = (audio.bands[lower] ?? 0) * (1 - blend) +
-                    (audio.bands[Math.min(lower + 1, audio.bands.length - 1)] ?? 0) * blend;
+                  const target = (sample.bands[lower] ?? 0) * (1 - blend) +
+                    (sample.bands[Math.min(lower + 1, sample.bands.length - 1)] ?? 0) * blend;
                   const response = target > levels[index] ? 18 : 7;
                   levels[index] += (target - levels[index]) * (1 - Math.exp(-response * dt));
                   // Peak-hold falls far slower than the bar, the way a hardware
                   // meter parks its cap after a transient.
                   peaks[index] = Math.max(levels[index], peaks[index] - 0.22 * dt);
-                  const x = index * (barWidth + barGap);
+                  const x = meterX + index * (barWidth + barGap);
                   ctx.fillRect(x, base - ladder, barWidth, ladder, "#ffffff17");
                   const lit = Math.round(levels[index] * cellCount);
                   if (lit > 0) {
@@ -84,21 +98,23 @@ export default widget({
                 // widget profile caps one GPU frame packet at 64 KiB and node
                 // count is what blows it.
                 // dB, not linear: rms * 6 pegged the strip on anything loud.
-                const level = audio.rms > 0.0005
-                  ? Math.max(0, Math.min(1, (20 * Math.log10(audio.rms) + 48) / 48))
+                const level = sample.rms > 0.0005
+                  ? Math.max(0, Math.min(1, (20 * Math.log10(sample.rms) + 48) / 48))
                   : 0;
                 const lit = Math.round(level * segments);
+                const stripWidth = segments * 13 - 1;
+                const stripX = Math.floor((ctx.width - stripWidth) / 2);
                 for (let index = 0; index < segments; index += 1) {
-                  ctx.fillRect(index * 13, ctx.height - 3, 12, 3, index < lit ? "#ffffffff" : "#ffffff17");
+                  ctx.fillRect(stripX + index * 13, ctx.height - 3, 12, 3, index < lit ? "#ffffffff" : "#ffffff17");
                 }
-                if (!signalActive && levels.every((value) => value < 0.008) && peaks.every((value) => value < 0.02)) {
+                if (!hasSignal(sample) && levels.every((value) => value < 0.008) && peaks.every((value) => value < 0.02)) {
                   setActive(false);
                 }
               }}
             />
             <row class="w-full pl-[12px] pr-[2px] items-center gap-[4px] h-[22px]">
               <text class="grow text-[13px] tracking-wide text-[#ffffff] font-[Cozette-Subset]">SPECTRUM</text>
-              <text class="w-[72px] text-right text-[13px] text-[#ffffff] font-[Cozette-Subset]">{readout(audio.rms)}</text>
+              <text class="w-[72px] text-right text-[13px] text-[#ffffff] font-[Cozette-Subset]">{readoutSignal}</text>
             </row>
           </column>
           <image src="./assets/GrainTile.png" tile class="size-full opacity-20 rounded-t-[16px] rounded-b-[4px]" />
diff --git a/myclock/dist/bundle.js b/myclock/dist/bundle.js
new file mode 100644
index 0000000..8361886
--- /dev/null
+++ b/myclock/dist/bundle.js
@@ -0,0 +1 @@
+"use strict";(()=>{var N=Object.freeze({"red-50":"#FEF2F2FF","red-100":"#FFE2E2FF","red-200":"#FFC9C9FF","red-300":"#FFA2A2FF","red-400":"#FF6467FF","red-500":"#FB2C36FF","red-600":"#E7000BFF","red-700":"#C10007FF","red-800":"#9F0712FF","red-900":"#82181AFF","red-950":"#460809FF","orange-50":"#FFF7EDFF","orange-100":"#FFEDD4FF","orange-200":"#FFD6A7FF","orange-300":"#FFB86AFF","orange-400":"#FF8904FF","orange-500":"#FF6900FF","orange-600":"#F54900FF","orange-700":"#CA3500FF","orange-800":"#9F2D00FF","orange-900":"#7E2A0CFF","orange-950":"#441306FF","amber-50":"#FFFBEBFF","amber-100":"#FEF3C6FF","amber-200":"#FEE685FF","amber-300":"#FFD230FF","amber-400":"#FFB900FF","amber-500":"#FE9A00FF","amber-600":"#E17100FF","amber-700":"#BB4D00FF","amber-800":"#973C00FF","amber-900":"#7B3306FF","amber-950":"#461901FF","yellow-50":"#FEFCE8FF","yellow-100":"#FEF9C2FF","yellow-200":"#FFF085FF","yellow-300":"#FFDF20FF","yellow-400":"#FDC700FF","yellow-500":"#F0B100FF","yellow-600":"#D08700FF","yellow-700":"#A65F00FF","yellow-800":"#894B00FF","yellow-900":"#733E0AFF","yellow-950":"#432004FF","lime-50":"#F7FEE7FF","lime-100":"#ECFCCAFF","lime-200":"#D8F999FF","lime-300":"#BBF451FF","lime-400":"#9AE600FF","lime-500":"#7CCF00FF","lime-600":"#5EA500FF","lime-700":"#497D00FF","lime-800":"#3C6300FF","lime-900":"#35530EFF","lime-950":"#192E03FF","green-50":"#F0FDF4FF","green-100":"#DCFCE7FF","green-200":"#B9F8CFFF","green-300":"#7BF1A8FF","green-400":"#05DF72FF","green-500":"#00C950FF","green-600":"#00A63EFF","green-700":"#008236FF","green-800":"#016630FF","green-900":"#0D542BFF","green-950":"#032E15FF","emerald-50":"#ECFDF5FF","emerald-100":"#D0FAE5FF","emerald-200":"#A4F4CFFF","emerald-300":"#5EE9B5FF","emerald-400":"#00D492FF","emerald-500":"#00BC7DFF","emerald-600":"#009966FF","emerald-700":"#007A55FF","emerald-800":"#006045FF","emerald-900":"#004F3BFF","emerald-950":"#002C22FF","teal-50":"#F0FDFAFF","teal-100":"#CBFBF1FF","teal-200":"#96F7E4FF","teal-300":"#46ECD5FF","teal-400":"#00D5BEFF","teal-500":"#00BBA7FF","teal-600":"#009689FF","teal-700":"#00786FFF","teal-800":"#005F5AFF","teal-900":"#0B4F4AFF","teal-950":"#022F2EFF","cyan-50":"#ECFEFFFF","cyan-100":"#CEFAFEFF","cyan-200":"#A2F4FDFF","cyan-300":"#53EAFDFF","cyan-400":"#00D3F2FF","cyan-500":"#00B8DBFF","cyan-600":"#0092B8FF","cyan-700":"#007595FF","cyan-800":"#005F78FF","cyan-900":"#104E64FF","cyan-950":"#053345FF","sky-50":"#F0F9FFFF","sky-100":"#DFF2FEFF","sky-200":"#B8E6FEFF","sky-300":"#74D4FFFF","sky-400":"#00BCFFFF","sky-500":"#00A6F4FF","sky-600":"#0084D1FF","sky-700":"#0069A8FF","sky-800":"#00598AFF","sky-900":"#024A70FF","sky-950":"#052F4AFF","blue-50":"#EFF6FFFF","blue-100":"#DBEAFEFF","blue-200":"#BEDBFFFF","blue-300":"#8EC5FFFF","blue-400":"#51A2FFFF","blue-500":"#2B7FFFFF","blue-600":"#155DFCFF","blue-700":"#1447E6FF","blue-800":"#193CB8FF","blue-900":"#1C398EFF","blue-950":"#162456FF","indigo-50":"#EEF2FFFF","indigo-100":"#E0E7FFFF","indigo-200":"#C6D2FFFF","indigo-300":"#A3B3FFFF","indigo-400":"#7C86FFFF","indigo-500":"#615FFFFF","indigo-600":"#4F39F6FF","indigo-700":"#432DD7FF","indigo-800":"#372AACFF","indigo-900":"#312C85FF","indigo-950":"#1E1A4DFF","violet-50":"#F5F3FFFF","violet-100":"#EDE9FEFF","violet-200":"#DDD6FFFF","violet-300":"#C4B4FFFF","violet-400":"#A684FFFF","violet-500":"#8E51FFFF","violet-600":"#7F22FEFF","violet-700":"#7008E7FF","violet-800":"#5D0EC0FF","violet-900":"#4D179AFF","violet-950":"#2F0D68FF","purple-50":"#FAF5FFFF","purple-100":"#F3E8FFFF","purple-200":"#E9D4FFFF","purple-300":"#DAB2FFFF","purple-400":"#C27AFFFF","purple-500":"#AD46FFFF","purple-600":"#9810FAFF","purple-700":"#8200DBFF","purple-800":"#6E11B0FF","purple-900":"#59168BFF","purple-950":"#3C0366FF","fuchsia-50":"#FDF4FFFF","fuchsia-100":"#FAE8FFFF","fuchsia-200":"#F6CFFFFF","fuchsia-300":"#F4A8FFFF","fuchsia-400":"#ED6AFFFF","fuchsia-500":"#E12AFBFF","fuchsia-600":"#C800DEFF","fuchsia-700":"#A800B7FF","fuchsia-800":"#8A0194FF","fuchsia-900":"#721378FF","fuchsia-950":"#4B004FFF","pink-50":"#FDF2F8FF","pink-100":"#FCE7F3FF","pink-200":"#FCCEE8FF","pink-300":"#FDA5D5FF","pink-400":"#FB64B6FF","pink-500":"#F6339AFF","pink-600":"#E60076FF","pink-700":"#C6005CFF","pink-800":"#A3004CFF","pink-900":"#861043FF","pink-950":"#510424FF","rose-50":"#FFF1F2FF","rose-100":"#FFE4E6FF","rose-200":"#FFCCD3FF","rose-300":"#FFA1ADFF","rose-400":"#FF637EFF","rose-500":"#FF2056FF","rose-600":"#EC003FFF","rose-700":"#C70036FF","rose-800":"#A50036FF","rose-900":"#8B0836FF","rose-950":"#4D0218FF","slate-50":"#F8FAFCFF","slate-100":"#F1F5F9FF","slate-200":"#E2E8F0FF","slate-300":"#CAD5E2FF","slate-400":"#90A1B9FF","slate-500":"#62748EFF","slate-600":"#45556CFF","slate-700":"#314158FF","slate-800":"#1D293DFF","slate-900":"#0F172BFF","slate-950":"#020618FF","gray-50":"#F9FAFBFF","gray-100":"#F3F4F6FF","gray-200":"#E5E7EBFF","gray-300":"#D1D5DCFF","gray-400":"#99A1AFFF","gray-500":"#6A7282FF","gray-600":"#4A5565FF","gray-700":"#364153FF","gray-800":"#1E2939FF","gray-900":"#101828FF","gray-950":"#030712FF","zinc-50":"#FAFAFAFF","zinc-100":"#F4F4F5FF","zinc-200":"#E4E4E7FF","zinc-300":"#D4D4D8FF","zinc-400":"#9F9FA9FF","zinc-500":"#71717BFF","zinc-600":"#52525CFF","zinc-700":"#3F3F46FF","zinc-800":"#27272AFF","zinc-900":"#18181BFF","zinc-950":"#09090BFF","neutral-50":"#FAFAFAFF","neutral-100":"#F5F5F5FF","neutral-200":"#E5E5E5FF","neutral-300":"#D4D4D4FF","neutral-400":"#A1A1A1FF","neutral-500":"#737373FF","neutral-600":"#525252FF","neutral-700":"#404040FF","neutral-800":"#262626FF","neutral-900":"#171717FF","neutral-950":"#0A0A0AFF","stone-50":"#FAFAF9FF","stone-100":"#F5F5F4FF","stone-200":"#E7E5E4FF","stone-300":"#D6D3D1FF","stone-400":"#A6A09BFF","stone-500":"#79716BFF","stone-600":"#57534DFF","stone-700":"#44403BFF","stone-800":"#292524FF","stone-900":"#1C1917FF","stone-950":"#0C0A09FF","mauve-50":"#FAFAFAFF","mauve-100":"#F3F1F3FF","mauve-200":"#E7E4E7FF","mauve-300":"#D7D0D7FF","mauve-400":"#A89EA9FF","mauve-500":"#79697BFF","mauve-600":"#594C5BFF","mauve-700":"#463947FF","mauve-800":"#2A212CFF","mauve-900":"#1D161EFF","mauve-950":"#0C090CFF","olive-50":"#FBFBF9FF","olive-100":"#F4F4F0FF","olive-200":"#E8E8E3FF","olive-300":"#D8D8D0FF","olive-400":"#ABAB9CFF","olive-500":"#7C7C67FF","olive-600":"#5B5B4BFF","olive-700":"#474739FF","olive-800":"#2B2B22FF","olive-900":"#1D1D16FF","olive-950":"#0C0C09FF","mist-50":"#F9FBFBFF","mist-100":"#F1F3F3FF","mist-200":"#E3E7E8FF","mist-300":"#D0D6D8FF","mist-400":"#9CA8ABFF","mist-500":"#67787CFF","mist-600":"#4B585BFF","mist-700":"#394447FF","mist-800":"#22292BFF","mist-900":"#161B1DFF","mist-950":"#090B0CFF","taupe-50":"#FBFAF9FF","taupe-100":"#F3F1F1FF","taupe-200":"#E8E4E3FF","taupe-300":"#D8D2D0FF","taupe-400":"#ABA09CFF","taupe-500":"#7C6D67FF","taupe-600":"#5B4F4BFF","taupe-700":"#473C39FF","taupe-800":"#2B2422FF","taupe-900":"#1D1816FF","taupe-950":"#0C0A09FF",white:"#FFFFFFFF",black:"#000000FF",transparent:"#00000000"});var m=class extends Error{constructor(n,t){super(t),this.name="UtilityError",this.utility=n}},ve={xs:12/14,sm:1,base:16/14,lg:18/14,xl:20/14,"2xl":24/14,"3xl":30/14,"4xl":36/14},Ce={xs:16,sm:20,base:24,lg:28,xl:28,"2xl":32,"3xl":36,"4xl":40},ye={none:1,tight:1.25,snug:1.375,normal:1.5,relaxed:1.625,loose:2},Ee={tighter:-.05,tight:-.025,normal:0,wide:.025,wider:.05,widest:.1},Y={shadow:"0 1 3 0","shadow-sm":"0 1 2 0","shadow-md":"0 4 6 -1","shadow-lg":"0 10 15 -3","shadow-xl":"0 20 25 -5","shadow-inner":"0 2 4 0"},ke={shadow:"#0000001A","shadow-sm":"#0000000D","shadow-md":"#0000001A","shadow-lg":"#0000001A","shadow-xl":"#0000001A","shadow-inner":"#0000000F"},Z={"text-shadow":"0 1 2","text-shadow-sm":"0 1 1","text-shadow-md":"0 2 4","text-shadow-lg":"0 4 8"},T={rounded:4,"rounded-md":6,"rounded-lg":8,"rounded-xl":12,"rounded-2xl":16,"rounded-3xl":24,"rounded-full":9999},j=1e6;function d(e,n,t=1){let r=Number(e)*t;if(!Number.isFinite(r)||Math.abs(r)>j)throw new m(n,`Class utility "${n}" has a non-finite or absurd numeric value (maximum ${j})`);return r}var Ae=["p-4","p-[13px]","px-4","py-4","pt-4","pr-4","pb-4","pl-4","m-4","mx-4","my-4","mt-4","mr-4","mb-4","ml-4","-mt-4","gap-2","gap-[13px]","rounded","rounded-md","rounded-lg","rounded-xl","rounded-2xl","rounded-3xl","rounded-full","rounded-[13px]","bg-[#11141c]/86","text-[#ffffff]","text-xs","text-sm","text-base","text-lg","text-xl","text-2xl","text-3xl","text-4xl","font-light","font-normal","font-medium","font-semibold","font-bold","opacity-70","items-start","items-center","items-end","items-baseline","items-stretch","justify-start","justify-center","justify-end","font-bold","font-sans","font-mono","font-[CozetteVector]","text-left","text-center","text-right","text-[13px]","leading-tight","tracking-wide","line-clamp-2","tabular-nums","shadow","shadow-sm","shadow-md","shadow-lg","shadow-xl","shadow-inner","shadow-red-500","shadow-[0_4px_12px_-2px_#00000066]","text-shadow","text-shadow-sm","text-shadow-md","text-shadow-lg","hover:bg-zinc-800","hover:text-white","hover:opacity-90","hover:border-zinc-600","pressed:bg-zinc-950","pressed:text-white","pressed:opacity-70","pressed:border-zinc-400","justify-between","justify-around","justify-evenly","grow","grow-2","shrink","shrink-0","self-auto","self-start","self-center","self-end","self-stretch","flex-wrap","flex-nowrap","w-12","w-[48px]","w-full","w-1/2","w-auto","h-12","h-[48px]","h-full","size-12","min-w-12","max-w-[160px]","min-h-12","max-h-[160px]","aspect-square","aspect-video","aspect-[4/3]","truncate","overflow-hidden"];function ie(e){let n={};for(let r of e.trim().split(/\s+/).filter(Boolean))O(n,r);let t=14*(n.fontScale??1);return n.lineHeightPx!==void 0&&(n.lineHeight=n.lineHeightPx/t),n.letterSpacingEm!==void 0&&(n.letterSpacing=n.letterSpacingEm*t),n.shadowGeometry!==void 0&&(n.shadow=`${n.shadowGeometry} ${n.shadowColor??"#0000001A"}`),n.hoverShadowGeometry!==void 0&&(n.hoverShadow=`${n.hoverShadowGeometry} ${n.hoverShadowColor??"#0000001A"}`),n.pressedShadowGeometry!==void 0&&(n.pressedShadow=`${n.pressedShadowGeometry} ${n.pressedShadowColor??"#0000001A"}`),n.textShadowGeometry!==void 0&&(n.textShadow=`${n.textShadowGeometry} #00000026`),delete n.lineHeightPx,delete n.letterSpacingEm,delete n.lineHeightExplicit,delete n.shadowGeometry,delete n.shadowColor,delete n.hoverShadowGeometry,delete n.hoverShadowColor,delete n.pressedShadowGeometry,delete n.pressedShadowColor,delete n.textShadowGeometry,n}function O(e,n){let t=/^(hover|pressed):(.+)$/.exec(n);if(t){Se(e,t[1],t[2],n);return}if(/^(?:bg-gradient|from-|via-|to-|focus:|active:|transition)/.test(n))throw new m(n,`Class utility "${n}" arrives in M2+`);let r;if(n in Y){e.shadowGeometry=Y[n],e.shadowColor??(e.shadowColor=ke[n]),e.shadowInset=n==="shadow-inner";return}if(n==="shadow-none"){delete e.shadowGeometry,delete e.shadowColor,e.shadow="",e.shadowInset=!1;return}if(r=/^shadow-\[(-?\d+(?:\.\d+)?)(?:px)?_(-?\d+(?:\.\d+)?)(?:px)?_(\d+(?:\.\d+)?)(?:px)?_(-?\d+(?:\.\d+)?)(?:px)?_(#[0-9a-fA-F]{3}|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{8})\](?:\/(\d{1,3}))?$/.exec(n)){e.shadowGeometry=`${d(r[1],n)} ${d(r[2],n)} ${d(r[3],n)} ${d(r[4],n)}`,e.shadowColor=P(r[5],r[6]),e.shadowInset=!1;return}if(r=/^shadow-\[(#[0-9a-fA-F]{3}|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{8})\](?:\/(\d{1,3}))?$/.exec(n)){e.shadowColor=P(r[1],r[2]);return}if(r=/^shadow-([a-z]+(?:-\d+)?)(?:\/(\d{1,3}))?$/.exec(n)){let o=N[r[1]];if(o!==void 0){e.shadowColor=ae(o,r[2]);return}}if(n in Z){e.textShadowGeometry=Z[n];return}if(n==="text-shadow-none"){delete e.textShadowGeometry,e.textShadow="";return}if(r=/^p-(\d+(?:\.\d+)?)$/.exec(n)){e.padding=d(r[1],n,4),ne(e);return}if(r=/^p-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){e.padding=d(r[1],n),ne(e);return}if(r=/^(px|py|pt|pr|pb|pl)-(\d+(?:\.\d+)?)$/.exec(n)){re(e,r[1],d(r[2],n,4));return}if(r=/^(px|py|pt|pr|pb|pl)-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){re(e,r[1],d(r[2],n));return}if(r=/^(-)?(m|mx|my|mt|mr|mb|ml)-(\d+(?:\.\d+)?)$/.exec(n)){te(e,r[2],d(r[3],n,4)*(r[1]?-1:1));return}if(r=/^(-)?(m|mx|my|mt|mr|mb|ml)-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){te(e,r[2],d(r[3],n)*(r[1]?-1:1));return}if(r=/^gap-(\d+(?:\.\d+)?)$/.exec(n)){e.gap=d(r[1],n,4);return}if(r=/^gap-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){e.gap=d(r[1],n);return}if(n in T){e.radius=T[n],ee(e);return}if(r=/^rounded-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){e.radius=d(r[1],n),ee(e);return}if(r=/^rounded-(t|r|b|l|tl|tr|br|bl)(?:-(md|lg|xl|2xl|3xl|full|\[(\d+(?:\.\d+)?)px\]))?$/.exec(n)){let o=r[3]===void 0?r[2]===void 0?T.rounded:T[`rounded-${r[2]}`]:d(r[3],n);Pe(e,r[1],o);return}if(n==="border"){e.borderWidth=1,e.borderColor??(e.borderColor="#E5E7EBFF");return}if(r=/^border-(\d+(?:\.\d+)?)$/.exec(n)){e.borderWidth=d(r[1],n),e.borderColor??(e.borderColor="#E5E7EBFF");return}if(r=/^border-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){e.borderWidth=d(r[1],n),e.borderColor??(e.borderColor="#E5E7EBFF");return}if(r=/^border-\[(#[0-9a-fA-F]{3}|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{8})\](?:\/(\d{1,3}))?$/.exec(n)){e.borderColor=P(r[1],r[2]);return}if(r=/^bg-\[(#[0-9a-fA-F]{3}|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{8})\](?:\/(\d{1,3}))?$/.exec(n)){e.background=P(r[1],r[2]);return}if(r=/^text-\[(#[0-9a-fA-F]{3}|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{8})\](?:\/(\d{1,3}))?$/.exec(n)){e.textColor=P(r[1],r[2]);return}if(r=/^text-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){let o=d(r[1],n);if(o>0){e.fontScale=o/14;return}}if(r=/^(bg|text|border)-([a-z]+(?:-\d+)?)(?:\/(\d{1,3}))?$/.exec(n)){let o=N[r[2]];if(o!==void 0){let a=ae(o,r[3]);r[1]==="bg"?e.background=a:r[1]==="text"?e.textColor=a:e.borderColor=a;return}}if(r=/^text-(xs|sm|base|lg|xl|2xl|3xl|4xl)$/.exec(n)){e.fontScale=ve[r[1]],e.lineHeightExplicit||(e.lineHeightPx=Ce[r[1]],delete e.lineHeight);return}if(r=/^font-(light|normal|medium|semibold|bold)$/.exec(n)){e.fontWeight=r[1];return}if(r=/^opacity-(\d{1,3})$/.exec(n)){let o=d(r[1],n);if(o<=100){e.opacity=o/100;return}}if(r=/^items-(start|center|end|baseline|stretch)$/.exec(n)){e.crossAlign=r[1];return}if(r=/^justify-(start|center|end|between|around|evenly)$/.exec(n)){e.mainAlign=r[1];return}if(n==="grow"){e.grow=1;return}if(n==="font-sans"||n==="font-mono"){e.fontFamily=n.slice(5);return}if(r=/^font-\[([A-Za-z0-9][A-Za-z0-9_-]{0,62})\]$/.exec(n)){e.fontFamily=r[1];return}if(r=/^text-(left|center|right)$/.exec(n)){e.textAlign=r[1]==="left"?"start":r[1]==="right"?"end":"center";return}if(r=/^leading-(none|tight|snug|normal|relaxed|loose)$/.exec(n)){e.lineHeight=ye[r[1]],delete e.lineHeightPx,e.lineHeightExplicit=!0;return}if(r=/^leading-(\d+(?:\.\d+)?)$/.exec(n)){e.lineHeightPx=d(r[1],n,4),delete e.lineHeight,e.lineHeightExplicit=!0;return}if(r=/^leading-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){e.lineHeightPx=d(r[1],n),delete e.lineHeight,e.lineHeightExplicit=!0;return}if(r=/^leading-\[(\d+(?:\.\d+)?)\]$/.exec(n)){let o=d(r[1],n);if(o>0){e.lineHeight=o,delete e.lineHeightPx,e.lineHeightExplicit=!0;return}}if(r=/^tracking-(tighter|tight|normal|wide|wider|widest)$/.exec(n)){e.letterSpacingEm=Ee[r[1]],delete e.letterSpacing;return}if(r=/^tracking-\[(-?\d+(?:\.\d+)?)px\]$/.exec(n)){e.letterSpacing=d(r[1],n),delete e.letterSpacingEm;return}if(r=/^tracking-\[(-?\d+(?:\.\d+)?)em\]$/.exec(n)){e.letterSpacingEm=d(r[1],n),delete e.letterSpacing;return}if(r=/^line-clamp-([1-9]\d*)$/.exec(n)){e.lineClamp=d(r[1],n);return}if(n==="line-clamp-none"){e.lineClamp=0;return}if(n==="tabular-nums"){e.tabularNums=!0;return}if(n==="normal-nums"){e.tabularNums=!1;return}if(r=/^grow-(\d+(?:\.\d+)?)$/.exec(n)){e.grow=d(r[1],n);return}if(r=/^grow-\[(\d+(?:\.\d+)?)\]$/.exec(n)){e.grow=d(r[1],n);return}if(n==="shrink"){e.shrink=1;return}if(n==="shrink-0"){e.shrink=0;return}if(r=/^self-(auto|start|center|end|stretch)$/.exec(n)){e.alignSelf=r[1];return}if(n==="flex-wrap"){e.flexWrap=!0;return}if(n==="flex-nowrap"){e.flexWrap=!1;return}if(r=/^(w|h)-(\d+(?:\.\d+)?)$/.exec(n)){w(e,r[1],d(r[2],n,4));return}if(r=/^(w|h)-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){w(e,r[1],d(r[2],n));return}if(r=/^(w|h)-full$/.exec(n)){R(e,r[1],100);return}if(r=/^(w|h)-(\d+)\/(\d+)$/.exec(n)){let o=d(r[2],n),a=d(r[3],n);if(a>0&&o>0&&o<=a){R(e,r[1],o*100/a);return}}if(r=/^(w|h)-auto$/.exec(n)){De(e,r[1]);return}if(r=/^size-(\d+(?:\.\d+)?)$/.exec(n)){let o=d(r[1],n,4);w(e,"w",o),w(e,"h",o);return}if(r=/^size-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){let o=d(r[1],n);w(e,"w",o),w(e,"h",o);return}if(n==="size-full"){R(e,"w",100),R(e,"h",100);return}if(r=/^(min|max)-(w|h)-(\d+(?:\.\d+)?)$/.exec(n)){oe(e,r[1],r[2],d(r[3],n,4));return}if(r=/^(min|max)-(w|h)-\[(\d+(?:\.\d+)?)px\]$/.exec(n)){oe(e,r[1],r[2],d(r[3],n));return}if(n==="aspect-square"){e.aspectRatio=1;return}if(n==="aspect-video"){e.aspectRatio=16/9;return}if(n==="aspect-auto"){delete e.aspectRatio;return}if(r=/^aspect-\[(\d+(?:\.\d+)?)\/(\d+(?:\.\d+)?)\]$/.exec(n)){let o=d(r[1],n),a=d(r[2],n);if(a>0){let i=o/a;if(!Number.isFinite(i)||i>j)throw new m(n,`Class utility "${n}" has an absurd aspect ratio`);e.aspectRatio=i;return}}if(r=/^aspect-\[(\d+(?:\.\d+)?)\]$/.exec(n)){let o=d(r[1],n);if(o>0){e.aspectRatio=o;return}throw new m(n,`Class utility "${n}" requires an aspect ratio greater than zero`)}if(n==="truncate"){e.truncate=!0;return}if(n==="overflow-hidden"){e.overflowHidden=!0;return}throw Be(n)}function Se(e,n,t,r){if(t==="shadow"||t.startsWith("shadow-")){let s=n==="hover"?"hoverShadow":"pressedShadow",f=n==="hover"?"hoverShadowInset":"pressedShadowInset",M=n==="hover"?"hoverShadowGeometry":"pressedShadowGeometry",p=n==="hover"?"hoverShadowColor":"pressedShadowColor",F={shadow:e[s]==="none"?"":void 0,shadowInset:e[f],shadowGeometry:e[M],shadowColor:e[p]};try{O(F,t)}catch{throw S(r,n)}if(Object.keys(F).some(xe=>!["shadow","shadowInset","shadowGeometry","shadowColor"].includes(xe)))throw S(r,n);if(F.shadow===""&&F.shadowGeometry===void 0){e[s]="none",delete e[M],delete e[p],e[f]=!1;return}if(F.shadowGeometry!==void 0){delete e[s],e[M]=F.shadowGeometry,F.shadowColor===void 0?delete e[p]:e[p]=F.shadowColor,e[f]=F.shadowInset??!1;return}F.shadow===""&&(e[s]="none"),F.shadowColor===void 0?delete e[p]:e[p]=F.shadowColor;return}let o={};try{O(o,t)}catch{throw S(r,n)}let a=Object.keys(o);if(a.length!==1)throw S(r,n);let i=a[0],l=(n==="hover"?{background:"hoverBackground",textColor:"hoverTextColor",opacity:"hoverOpacity",borderColor:"hoverBorderColor"}:{background:"pressedBackground",textColor:"pressedTextColor",opacity:"pressedOpacity",borderColor:"pressedBorderColor"})[i];if(l===void 0)throw S(r,n);e[l]=o[i]}function S(e,n){return new m(e,`State variant "${e}" supports only ${n}:bg-<color>, ${n}:text-<color>, ${n}:opacity-N, ${n}:border-<color>, or ${n}:shadow-*`)}function ee(e){delete e.radiusTopLeft,delete e.radiusTopRight,delete e.radiusBottomRight,delete e.radiusBottomLeft}function Pe(e,n,t){let r={t:["radiusTopLeft","radiusTopRight"],r:["radiusTopRight","radiusBottomRight"],b:["radiusBottomLeft","radiusBottomRight"],l:["radiusTopLeft","radiusBottomLeft"],tl:["radiusTopLeft"],tr:["radiusTopRight"],br:["radiusBottomRight"],bl:["radiusBottomLeft"]};for(let o of r[n])e[o]=t}function ne(e){delete e.paddingTop,delete e.paddingRight,delete e.paddingBottom,delete e.paddingLeft}function re(e,n,t){let r={px:["paddingLeft","paddingRight"],py:["paddingTop","paddingBottom"],pt:["paddingTop"],pr:["paddingRight"],pb:["paddingBottom"],pl:["paddingLeft"]};for(let o of r[n])e[o]=t}function te(e,n,t){let r={m:["marginTop","marginRight","marginBottom","marginLeft"],mx:["marginLeft","marginRight"],my:["marginTop","marginBottom"],mt:["marginTop"],mr:["marginRight"],mb:["marginBottom"],ml:["marginLeft"]};for(let o of r[n])e[o]=t}function w(e,n,t){n==="w"?(e.width=t,delete e.widthPercent):(e.height=t,delete e.heightPercent)}function R(e,n,t){n==="w"?(e.widthPercent=t,delete e.width):(e.heightPercent=t,delete e.height)}function De(e,n){n==="w"?(delete e.width,delete e.widthPercent):(delete e.height,delete e.heightPercent)}function oe(e,n,t,r){let o=`${n}${t==="w"?"Width":"Height"}`;e[o]=r}function P(e,n){let t=e.slice(1);if(t.length===3&&(t=t.split("").map(r=>r+r).join("")),t.length===6&&(t+="ff"),n!==void 0){let r=Number(n);if(r>100)throw new m(e,`Color alpha must be between 0 and 100, received ${r}`);t=t.slice(0,6)+Math.round(r*255/100).toString(16).padStart(2,"0")}return`#${t.toUpperCase()}`}function ae(e,n){if(n===void 0)return e;let t=Number(n);if(t>100)throw new m(e,`Color alpha must be between 0 and 100, received ${t}`);let r=Number.parseInt(e.slice(7,9),16),o=Math.round(r*t/100).toString(16).padStart(2,"0").toUpperCase();return`${e.slice(0,7)}${o}`}function Be(e){let n=/^pad-(\d+(?:\.\d+)?)$/.exec(e),t=n?`p-[${n[1]}px]`:Te(e,Ae);return new m(e,`Unknown class utility "${e}". Did you mean "${t}"?`)}function Te(e,n){let t=n[0],r=Number.POSITIVE_INFINITY;for(let o of n){let a=Re(e,o);a<r&&(t=o,r=a)}return t}function Re(e,n){let t=Array.from({length:n.length+1},(r,o)=>o);for(let r=1;r<=e.length;r+=1){let o=t[0];t[0]=r;for(let a=1;a<=n.length;a+=1){let i=t[a];t[a]=Math.min(t[a]+1,t[a-1]+1,o+(e[r-1]===n[a-1]?0:1)),o=i}}return t[n.length]}var $e=globalThis.__weaverHotSwapSeed,b=Je($e),q=b!==null,U=Symbol("weaver.fragment"),u=null,h=null,Fe=null,D=null,W=!1,se=0,L=[],I=new Map,E=new Map,de=Object.create(null);native.onCanvasResize((e,n,t)=>{let r=E.get(e);!r||!Number.isFinite(n)||!Number.isFinite(t)||n<0||t<0||r.width===n&&r.height===t||(r.width=n,r.height=t,r.ctx=_(r),g(e,Date.now()/1e3))});function B(e,n,...t){let r=n??{},o=r.children,a=ge(t.length>0?t:o===void 0?[]:[o]);if(e==="icon"){if(a.some(X))throw new Error("<icon> does not accept children");if(typeof r.iconPath!="string"||r.iconPath.length===0||typeof r.iconViewBox!="string"||typeof r.iconStroke!="number")throw new Error("<icon> must be lowered to path data by weaver bundle");r.class=`w-[24px] h-[24px] ${typeof r.class=="string"?r.class:""}`.trim()}if(e==="image"){if(r.fit!==void 0&&r.fit!=="cover"&&r.fit!=="contain"&&r.fit!=="stretch")throw new Error('<image> fit must be "cover", "contain", or "stretch"');if(r.tile!==void 0&&typeof r.tile!="boolean")throw new Error("<image> tile must be boolean")}if(e==="button"){if(typeof r.onPress!="function")throw new Error("<button> requires onPress={() => ...}");if(r.onDoublePress!==void 0&&typeof r.onDoublePress!="function")throw new Error("<button> onDoublePress must be a function");if(r.onRightPress!==void 0&&typeof r.onRightPress!="function")throw new Error("<button> onRightPress must be a function")}return{__weaverElement:!0,type:e,props:r,key:r.key,children:a}}function H(e,n,t){return B(e,t===void 0?n:{...n,key:t})}var A=H;function J(e,n){if(Ue(e,n),u!==null)throw new Error("A widget bundle may call widget() exactly once");return Fe=e,u=n,me(),Object.freeze({config:e})}function v(e){let n=be("useState"),t=n.hookIndex++,r=n.hooks[t];if(r){if(r.kind!=="state")throw pe("useState",t)}else{let o=typeof e=="function"?e():e;r={kind:"state",value:Ke(n,t,"state",o)},n.hooks[t]=r}return[r.value,o=>{let a=typeof o=="function"?o(r.value):o;Object.is(a,r.value)||(r.value=a,Ge())}]}function C(e,n){let t=be("useEffect"),r=t.hookIndex++,o=t.hooks[r];if(!o)o={kind:"effect"},t.hooks[r]=o,Qe(t,r);else if(o.kind!=="effect")throw pe("useEffect",r);qe(o.deps,n)||(o.deps=n?.slice(),o.effect=e,L.push(o))}function K(e){if(!Fe?.subscribe?.includes(e))throw new Error(`useProvider("${e}") requires subscribe: ["${e}"] in the widget config`);if(e==="time"){let[r,o]=v(()=>we());return C(()=>on.subscribe(o),[]),r}if(!native.hostAvailable())throw new Error(`Provider "${e}" requires weaverd; run "weaver up"`);if(e==="cpu"){let[r,o]=v(()=>({percent:0,perCore:[]}));return C(()=>$.subscribeCpu(o),[]),r}if(e==="memory"){let[r,o]=v(()=>({usedMb:0,totalMb:0,percent:0}));return C(()=>$.subscribeMemory(o),[]),r}if(e==="audio"){let[r,o]=v(()=>({rms:0,bands:Array.from({length:32},()=>0)}));return C(()=>$.subscribeAudio(o),[]),r}let[n,t]=v(()=>({title:"",artist:"",album:"",status:"stopped",playing:!1,sourceApp:"",positionMs:0,durationMs:0}));return C(()=>$.subscribeMedia(t),[]),n}var le=null,ce=!1;function fe(e,n={}){let t=n.method??"GET",r=n.headers??{};if(t!=="GET"&&t!=="POST")return Promise.reject(new Error("wfetch method must be GET or POST"));for(let[o,a]of Object.entries(r))if(!o||/[:\r\n]/.test(o)||typeof a!="string"||/[\r\n]/.test(a))return Promise.reject(new Error("wfetch headers must be string values without CR/LF"));return native.fetch(e,t,JSON.stringify(r),n.body??"").then(o=>({status:o.status,ok:o.status>=200&&o.status<300,text:async()=>o.body,json:async()=>JSON.parse(o.body)}))}function me(){if(u){L.length=0,native.beginBatch();try{h=Q(null,h,B(u,null));let e=Ve(h);e!==se&&(native.setRoot(e),se=e)}finally{native.endBatch()}for(let e of L.splice(0)){e.cleanup?.();let n=e.effect?.();e.cleanup=typeof n=="function"?n:void 0}}}function Q(e,n,t){return typeof t.type=="function"?Ie(e,n,t,t.type):t.type===U?He(e,n,t):Me(e,n,t,t.type)}function Ie(e,n,t,r){let o=n?.kind==="component"&&n.type===r&&n.key===t.key?n:{kind:"component",type:r,key:t.key,hooks:[],hookIndex:0,child:null};o!==n&&n&&k(n),o.hookIndex=0;let a=D;D=o;let i;try{i=r()}finally{D=a}if(!ue(i))throw new Error("A Weaver component must return one JSX element");if(o.child=Q(e,o.child,i),o.hookIndex!==o.hooks.length)throw new Error(`Hook order changed in ${r.name||"component"}`);return o}function He(e,n,t){let r=n?.kind==="fragment"&&n.key===t.key?n:{kind:"fragment",key:t.key,children:[]};return r!==n&&n&&k(n),r.children=he(e,r.children,t.children),r}function Me(e,n,t,r){let o=n?.kind==="host"&&n.type===r&&n.key===t.key,a=o?n:{kind:"host",type:r,key:t.key,id:native.createNode(r),props:{},elementProps:{},children:[]};!o&&n&&k(n);let i=ie(typeof t.props.class=="string"?t.props.class:"");if(je(a.id,a.props,i),a.props=i,Oe(a,t.props),r==="text"){let c=t.children.map(l=>{if(typeof l!="string"&&typeof l!="number")throw new Error("<text> children must be strings or numbers");return String(l)}).join("");native.setText(a.id,c)}else if(r==="canvas"){if(t.children.some(X))throw new Error("<canvas> does not accept children")}else a.children=he(a.id,a.children,t.children);return!o&&e!==null&&native.appendChild(e,a.id),a}function he(e,n,t){let r=t.filter(X).map(_e),o=new Map,a=[];for(let s of n){let f=Le(s);f===void 0?a.push(s):o.set(f,s)}let i=0,c=new Set,l=r.map(s=>{let f=s.key===void 0?a[i++]??null:o.get(s.key)??null;return f&&c.add(f),Q(e,f,s)});for(let s of n)c.has(s)||k(s);return e!==null&&Ne(e,n.flatMap(y).filter(s=>l.flatMap(y).includes(s)),l.flatMap(y)),l}function Ne(e,n,t){let r=n.slice();for(let o of t)r.includes(o)||r.push(o);for(let o=0;o<t.length;o+=1){if(r[o]===t[o])continue;let a=r.indexOf(t[o]);a>=0&&r.splice(a,1);let i=r[o]??0;native.insertBefore(e,t[o],i),r.splice(o,0,t[o])}}function je(e,n,t){let r={padding:0,paddingTop:-1,paddingRight:-1,paddingBottom:-1,paddingLeft:-1,marginTop:0,marginRight:0,marginBottom:0,marginLeft:0,gap:0,radius:0,radiusTopLeft:-1,radiusTopRight:-1,radiusBottomRight:-1,radiusBottomLeft:-1,borderWidth:0,borderColor:"",shadow:"",shadowInset:!1,textShadow:"",background:"",textColor:"",fontScale:1,fontWeight:"normal",fontFamily:"sans",textAlign:"start",lineHeight:0,letterSpacing:0,lineClamp:0,tabularNums:!1,opacity:1,crossAlign:"stretch",hoverBackground:"",hoverTextColor:"",hoverOpacity:-1,hoverBorderColor:"",hoverShadow:"",hoverShadowInset:!1,pressedBackground:"",pressedTextColor:"",pressedOpacity:-1,pressedBorderColor:"",pressedShadow:"",pressedShadowInset:!1,mainAlign:"start",grow:0,shrink:1,alignSelf:"auto",flexWrap:!1,width:-1,height:-1,minWidth:0,minHeight:0,maxWidth:-1,maxHeight:-1,widthPercent:0,heightPercent:0,aspectRatio:0,truncate:!1,overflowHidden:!1};for(let o of Object.keys(r)){let a=n[o]??r[o],i=t[o]??r[o];Object.is(a,i)||native.setProp(e,o,i)}}function Oe(e,n){let t=e.elementProps,r={};if(e.type==="button"){if(typeof n.onPress!="function")throw new Error("<button> requires onPress={() => ...}");r.onPress=n.onPress,r.onDoublePress=n.onDoublePress,r.onRightPress=n.onRightPress}else if(e.type==="slider"){if(typeof n.onChange!="function")throw new Error("<slider> requires onChange={(value) => ...}");if(typeof n.value!="number"||!Number.isFinite(n.value))throw new Error("<slider> value must be a finite number");if(typeof n.max!="number"||!Number.isFinite(n.max)||n.max<=0)throw new Error("<slider> max must be positive");r.onChange=n.onChange,r.value=Math.max(0,Math.min(n.value,n.max)),r.max=n.max}else if(e.type==="image"){if(typeof n.src!="string"||n.src.length===0)throw new Error("<image> requires a local src string");if(!/^[a-z]:[\\/]/i.test(n.src)&&/^[a-z][a-z0-9+.-]*:/i.test(n.src)||n.src.startsWith("//"))throw new Error("RemoteImageUnsupported: <image> remote sources arrive in M3; use a local widget path");if(r.src=n.src,n.fit!==void 0&&n.fit!=="cover"&&n.fit!=="contain"&&n.fit!=="stretch")throw new Error('<image> fit must be "cover", "contain", or "stretch"');if(n.tile!==void 0&&typeof n.tile!="boolean")throw new Error("<image> tile must be boolean");r.fit=n.fit??"stretch",r.tile=n.tile??!1}else if(e.type==="icon"){if(typeof n.iconPath!="string"||n.iconPath.length===0)throw new Error("<icon> requires lowered iconPath");if(typeof n.iconViewBox!="string"||n.iconViewBox.length===0)throw new Error("<icon> requires lowered iconViewBox");if(typeof n.iconStroke!="number"||!Number.isFinite(n.iconStroke)||n.iconStroke<0)throw new Error("<icon> iconStroke must be non-negative");r.iconPath=n.iconPath,r.iconViewBox=n.iconViewBox,r.iconStroke=n.iconStroke}else if(e.type==="canvas"){if(typeof n.onFrame!="function")throw new Error("<canvas> requires onFrame={(ctx, frame) => ...}");if(n.fps!==void 0&&(typeof n.fps!="number"||!Number.isFinite(n.fps)||n.fps<0))throw new Error("<canvas> fps must be zero or a positive number when provided");r.onFrame=n.onFrame,r.fps=n.fps===void 0?void 0:Math.min(60,n.fps)}!!t.onPress!=!!r.onPress&&native.setHandler(e.id,"press",!!r.onPress),!!t.onDoublePress!=!!r.onDoublePress&&native.setHandler(e.id,"doublepress",!!r.onDoublePress),!!t.onRightPress!=!!r.onRightPress&&native.setHandler(e.id,"rightpress",!!r.onRightPress),!!t.onChange!=!!r.onChange&&native.setHandler(e.id,"change",!!r.onChange),!Object.is(t.value,r.value)&&r.value!==void 0&&native.setProp(e.id,"value",r.value),!Object.is(t.max,r.max)&&r.max!==void 0&&native.setProp(e.id,"max",r.max),!Object.is(t.src,r.src)&&r.src!==void 0&&native.setProp(e.id,"source",r.src),!Object.is(t.iconPath,r.iconPath)&&r.iconPath!==void 0&&native.setProp(e.id,"iconPath",r.iconPath),!Object.is(t.iconViewBox,r.iconViewBox)&&r.iconViewBox!==void 0&&native.setProp(e.id,"iconViewBox",r.iconViewBox),!Object.is(t.iconStroke,r.iconStroke)&&r.iconStroke!==void 0&&native.setProp(e.id,"iconStroke",r.iconStroke),!Object.is(t.fit,r.fit)&&r.fit!==void 0&&native.setProp(e.id,"imageFit",r.fit),!Object.is(t.tile,r.tile)&&r.tile!==void 0&&native.setProp(e.id,"imageTile",r.tile),e.elementProps=r,e.type==="canvas"&&r.onFrame&&We(e.id,r.onFrame,r.fps,e.props.width??0,e.props.height??0),r.onPress||r.onDoublePress||r.onRightPress||r.onChange?I.set(e.id,r):I.delete(e.id)}function k(e){if(e.kind==="component"){for(let n of e.hooks)n.kind==="effect"&&n.cleanup?.();e.child&&k(e.child);return}if(e.kind==="fragment"){for(let n of e.children)k(n);return}I.delete(e.id),ze(e.id),native.removeNode(e.id)}function We(e,n,t,r,o){let a=E.get(e),i=a===void 0,c=a?.fps!==t;if(!a)a={onFrame:n,fps:t,timerId:0,surfaceClock:!1,width:r,height:o,batch:new Float64Array(32768),batchLength:0,active:!1,ctx:void 0},a.ctx=_(a),E.set(e,a);else{let l=a.width!==r||a.height!==o;a.onFrame=n,a.width=r,a.height=o,l&&(a.ctx=_(a))}if(c&&a.timerId!==0&&(native.clearInterval(a.timerId),a.timerId=0,a.lastT=void 0,a.nextT=void 0,a.nativeTimestampStarted=!1),c&&a.surfaceClock&&(native.clearCanvasFrame(e),a.surfaceClock=!1,a.lastT=void 0,a.nextT=void 0,a.nativeTimestampStarted=!1),a.fps=t,t===0){i&&g(e,Date.now()/1e3);return}if(t===void 0){g(e,Date.now()/1e3);return}if(t>=60){a.surfaceClock||(native.onCanvasFrame(e,l=>g(e,l)),a.surfaceClock=!0,g(e,Date.now()/1e3));return}if(a.timerId===0){let l=Math.max(1,Math.round(1e3/t));a.timerId=native.setInterval(l),native.onTimer(a.timerId,s=>g(e,s??Date.now()/1e3)),g(e,Date.now()/1e3)}}function ze(e){let n=E.get(e);n&&(n.timerId!==0&&native.clearInterval(n.timerId),n.surfaceClock&&native.clearCanvasFrame(e),E.delete(e))}function g(e,n){let t=E.get(e);if(!t)return;n!==void 0&&!t.nativeTimestampStarted&&(t.lastT=void 0,t.nativeTimestampStarted=!0);let r=typeof n=="number"&&Number.isFinite(n)&&n>0?n:Date.now()/1e3,o=t.lastT===void 0?0:Math.max(0,r-t.lastT);t.lastT=r,t.batchLength=0,t.active=!0;try{t.onFrame(t.ctx,{t:r,dt:o})}finally{t.active=!1}if(t.batchLength===2&&t.batch[0]===0){let a=t.batchLength;t.batch[a]=1,t.batch[a+1]=0,t.batch[a+2]=0,t.batch[a+3]=0,t.batch[a+4]=0,t.batch[a+5]=0,t.batchLength+=6}native.setCanvasCommands(e,t.batch.subarray(0,t.batchLength))}function _(e){let n=()=>{if(!e.active)throw new Error("CanvasCtx methods may only be called inside onFrame")},t=r=>{if(e.batchLength+r>e.batch.length)throw new Error(`Canvas frame needs ${e.batchLength+r} wire values; the limit (max_canvas_wire_values) is ${e.batch.length} \u2014 draw fewer commands per frame`);let o=e.batchLength;return e.batchLength+=r,o};return Object.freeze({width:e.width,height:e.height,clear(r="#00000000"){n();let o=t(2);e.batch[o]=0,e.batch[o+1]=x(r)},fillRect(r,o,a,i,c){n();let l=t(6);e.batch[l]=1,e.batch[l+1]=r,e.batch[l+2]=o,e.batch[l+3]=a,e.batch[l+4]=i,e.batch[l+5]=x(c)},fillRoundRect(r,o,a,i,c,l){n();let s=t(7);e.batch[s]=2,e.batch[s+1]=r,e.batch[s+2]=o,e.batch[s+3]=a,e.batch[s+4]=i,e.batch[s+5]=c,e.batch[s+6]=x(l)},fillCircle(r,o,a,i){n();let c=t(5);e.batch[c]=3,e.batch[c+1]=r,e.batch[c+2]=o,e.batch[c+3]=a,e.batch[c+4]=x(i)},line(r,o,a,i,c,l){n();let s=t(7);e.batch[s]=4,e.batch[s+1]=r,e.batch[s+2]=o,e.batch[s+3]=a,e.batch[s+4]=i,e.batch[s+5]=c,e.batch[s+6]=x(l)},polyline(r,o,a){if(n(),!Array.isArray(r)||r.length<4||r.length%2!==0)throw new Error("CanvasCtx polyline points must be a flat [x,y,...] array with at least two points");let i=t(4+r.length);e.batch[i]=5,e.batch[i+1]=o,e.batch[i+2]=x(a),e.batch[i+3]=r.length/2;for(let c=0;c<r.length;c+=1)e.batch[i+4+c]=r[c]}})}function x(e){let n=de[e];if(n!==void 0)return n;if(typeof e!="string")throw new Error("Canvas colors must be #rgb, #rrggbb, or #rrggbbaa");let t;if(/^#[0-9a-f]{3}$/i.test(e))t=`${e[1]}${e[1]}${e[2]}${e[2]}${e[3]}${e[3]}ff`;else if(/^#[0-9a-f]{6}$/i.test(e))t=`${e.slice(1)}ff`;else if(/^#[0-9a-f]{8}$/i.test(e))t=e.slice(1);else throw new Error(`Invalid canvas color "${e}": use #rgb, #rrggbb, or #rrggbbaa`);let r=Number.parseInt(t,16)>>>0;return de[e]=r,r}function y(e){return e.kind==="host"?[e.id]:e.kind==="component"?e.child?y(e.child):[]:e.children.flatMap(y)}function Ve(e){let n=y(e);if(n.length!==1)throw new Error("A widget root must resolve to exactly one native element");return n[0]}function Le(e){return e.key}function X(e){return e!=null&&e!==!1}function ue(e){return typeof e=="object"&&e!==null&&e.__weaverElement===!0}function _e(e){return ue(e)?e:B("text",null,e)}function ge(e){let n=[];for(let t of e)Array.isArray(t)?n.push(...ge(t)):n.push(t);return n}function Ge(){W||(W=!0,Promise.resolve().then(()=>{W=!1,me()}))}function be(e){if(!D)throw new Error(`${e} must be called while rendering a component`);return D}function pe(e,n){return new Error(`${e} changed hook order at slot ${n}`)}function qe(e,n){return!e||!n||e.length!==n.length?!1:e.every((t,r)=>Object.is(t,n[r]))}function Ue(e,n){if(!e||typeof e!="object")throw new Error("widget config must be an object");if(!e.name?.trim())throw new Error("widget config.name must be a non-empty string");if(!Array.isArray(e.size)||e.size.length!==2||e.size.some(t=>!Number.isFinite(t)||t<=0))throw new Error("widget config.size must contain two positive numbers");if(typeof n!="function")throw new Error("widget component must be a function");if(e.capabilities&&e.capabilities.some(t=>t!=="media-transport"))throw new Error('Widget capabilities support only "media-transport"')}function Je(e){if(typeof e!="string")return null;try{let n=JSON.parse(e);return!Array.isArray(n)||n.some(t=>!t||typeof t!="object"||!["state","ref","effect"].includes(String(t.kind)))?null:n}catch{return null}}function G(e){return e===null?"null":Array.isArray(e)?"array":typeof e}function Ke(e,n,t,r){if(e.type!==u||!b)return r;let o=b[n],a=G(r);return!o||o.kind!==t||o.valueType!==a||o.transferable!==!1&&G(o.value)!==o.valueType?(q=!1,r):o.transferable===!1?r:o.value}function Qe(e,n){e.type!==u||!b||b[n]?.kind!=="effect"&&(q=!1)}function Xe(){if(h?.kind!=="component"||h.type!==u)return null;try{return JSON.stringify(h.hooks.map(e=>{if(e.kind==="effect")return{kind:"effect"};let n=e.kind==="ref"?e.value.current:e.value,t=G(n);return["undefined","bigint","symbol","function"].includes(t)?{kind:e.kind,valueType:t,transferable:!1}:{kind:e.kind,valueType:t,value:n}}))}catch{return null}}function Ye(){return b?q&&h?.kind==="component"&&h.type===u&&h.hooks.length===b.length:!0}function Ze(e){let n=JSON.stringify(e);if(nn(n)>64*1024)throw new Error("StorageQuotaExceeded: widget storage exceeds 64 KB");return n}function en(){!ce||!le||(native.storageWrite(Ze(le)),ce=!1)}function nn(e){let n=0;for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);r<128?n+=1:r<2048?n+=2:r>=55296&&r<=56319&&t+1<e.length&&e.charCodeAt(t+1)>=56320&&e.charCodeAt(t+1)<=57343?(n+=4,t+=1):n+=3}return n}function z(e){let n=e.w>0?Math.max(0,Math.min(1,e.x/e.w)):0,t=e.h>0?Math.max(0,Math.min(1,e.y/e.h)):0;return{x:e.x,y:e.y,u:n,v:t}}native.onEvent((e,n,t)=>{let r=I.get(e);n==="press"?r?.onPress?.(t&&typeof t=="object"?z(t):void 0):n==="doublepress"&&t&&typeof t=="object"?r?.onDoublePress?.(z(t)):n==="rightpress"&&t&&typeof t=="object"?r?.onRightPress?.(z(t)):n==="change"&&typeof t=="number"&&r?.onChange?.(t)});Object.defineProperty(globalThis,"wfetch",{value:fe,configurable:!1,writable:!1});Object.defineProperty(globalThis,"__weaverFlushStorage",{value:en,configurable:!1,writable:!1});Object.defineProperty(globalThis,"__weaverCaptureHotSwap",{value:Xe,configurable:!1,writable:!1});Object.defineProperty(globalThis,"__weaverHotSwapAccepted",{value:Ye,configurable:!1,writable:!1});var rn=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"],tn=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"];function V(e){return String(e).padStart(2,"0")}function we(){let e=new Date;return{hh:V(e.getHours()),mm:V(e.getMinutes()),ss:V(e.getSeconds()),weekday:rn[e.getDay()],month:tn[e.getMonth()],day:e.getDate(),year:e.getFullYear(),epochMs:e.getTime()}}var on=(()=>{let e=new Set,n=0,t=()=>{let r=we();for(let o of e)o(r)};return{subscribe(r){return e.add(r),n===0&&(n=native.setInterval(1e3),native.onTimer(n,t)),()=>{e.delete(r),e.size===0&&n!==0&&(native.clearInterval(n),n=0)}}}})(),$=(()=>{let e=new Set,n=new Set,t=new Set,r=new Set,o=!1,a=()=>{o||(o=!0,native.onProvider(i=>{let c=JSON.parse(i);if(c.provider==="cpu"){let l=c.value;for(let s of e)s(l)}else if(c.provider==="memory"){let l=c.value;for(let s of n)s(l)}else if(c.provider==="audio"){let l=c.value;for(let s of t)s(l)}else if(c.provider==="media"){let l=c.value;for(let s of r)s(l)}}))};return{subscribeCpu(i){return a(),e.add(i),()=>e.delete(i)},subscribeMemory(i){return a(),n.add(i),()=>n.delete(i)},subscribeAudio(i){return a(),t.add(i),()=>t.delete(i)},subscribeMedia(i){return a(),r.add(i),()=>r.delete(i)}}})();var Cn=J({name:"Myclock",size:[240,110],anchor:{corner:"top-right",offset:[24,24]},subscribe:["time"]},()=>{let e=K("time");return A("column",{class:"p-4 gap-1 bg-[#11141c]/86 rounded-2xl",children:[A("row",{class:"items-baseline gap-2",children:[A("text",{class:"text-3xl font-light",children:[e.hh,":",e.mm]}),H("text",{class:"text-sm opacity-70",children:e.ss})]}),A("text",{class:"text-xs opacity-60",children:[e.weekday,", ",e.month," ",e.day]})]})});})();
diff --git a/myclock/dist/widget.json b/myclock/dist/widget.json
new file mode 100644
index 0000000..29a84c4
--- /dev/null
+++ b/myclock/dist/widget.json
@@ -0,0 +1,24 @@
+{
+  "name": "Myclock",
+  "size": [
+    240,
+    110
+  ],
+  "anchor": {
+    "corner": "top-right",
+    "offset": [
+      24,
+      24
+    ]
+  },
+  "layer": "desktop",
+  "clickThrough": false,
+  "transparent": true,
+  "origins": [],
+  "subscribe": [
+    "time"
+  ],
+  "capabilities": [],
+  "renderBackend": "software",
+  "fonts": []
+}
diff --git a/runtime/build.zig b/runtime/build.zig
index da36f15..aa78b62 100644
--- a/runtime/build.zig
+++ b/runtime/build.zig
@@ -8,6 +8,11 @@ pub fn build(b: *std.Build) void {
     }), .{
         .name = "weaver-widget",
         .widget_profile = true,
+        // One runtime event per 30 Hz Canvas completion otherwise opens,
+        // stats, appends, and closes native-sdk.jsonl on every frame. Widget
+        // diagnostics live in the dedicated per-widget log; explicit
+        // profiling builds can still opt back in with -Dtrace=events|all.
+        .trace_default = .off,
     });
     // QuickJS measured 70 trivial recursive calls with its 4 MiB guard,
     // clearing the 32-level widget-tree contract by >2x. Reserve a 16 MiB
diff --git a/runtime/native-sdk b/runtime/native-sdk
index 7368f7f..4c5c099 160000
--- a/runtime/native-sdk
+++ b/runtime/native-sdk
@@ -1 +1 @@
-Subproject commit 7368f7f59e09c372311e884190d88006a73ce97f
+Subproject commit 4c5c0999c2324b8dc2016625e85571e554b2484a
diff --git a/runtime/src/js_engine.zig b/runtime/src/js_engine.zig
index 2342003..1b91404 100644
--- a/runtime/src/js_engine.zig
+++ b/runtime/src/js_engine.zig
@@ -120,6 +120,12 @@ pub const Engine = struct {
         return &self.bridge_state.timers;
     }
 
+    pub fn memoryUsage(self: *const Engine) c.JSMemoryUsage {
+        var usage: c.JSMemoryUsage = undefined;
+        c.JS_ComputeMemoryUsage(self.runtime, &usage);
+        return usage;
+    }
+
     pub fn setTree(self: *Engine, tree: *tree_mod.Tree) void {
         self.bridge_state.tree = tree;
     }
diff --git a/runtime/src/main.zig b/runtime/src/main.zig
index bff7950..4e91b13 100644
--- a/runtime/src/main.zig
+++ b/runtime/src/main.zig
@@ -666,6 +666,56 @@ fn view(ui: *WidgetUi, model: *const Model) WidgetUi.Node {
     return result;
 }
 
+/// The retained TSX projection depends on the authored tree plus the global
+/// log-failure fallback. Immediate Canvas pixels deliberately use their own
+/// generation and are projected by `projectSameViewUpdate` below.
+fn viewRevision(model: *const Model) u64 {
+    return model.tree.generation *% 2 +% @intFromBool(widget_log.failed());
+}
+
+/// Canvas callbacks mutate fixed command storage in `Tree.canvases`; the
+/// retained Native layout already owns the corresponding widget geometry.
+/// Re-point the retained slices (their lengths may change), emit once for all
+/// canvases, and keep TSX construction + flex layout off the frame loop.
+fn projectSameViewUpdate(
+    runtime: *native_sdk.Runtime,
+    window_id: native_sdk.platform.WindowId,
+    canvas_label: []const u8,
+    model: *const Model,
+    msg: Msg,
+) anyerror!bool {
+    switch (msg) {
+        .canvas_frame => {},
+        else => return true,
+    }
+
+    var updates: [tree_mod.max_canvases]native_sdk.runtime.CanvasWidgetImmediateUpdate = undefined;
+    var update_count: usize = 0;
+    for (&model.tree.canvases, 0..) |*canvas_state, canvas_index| {
+        if (!model.tree.canvas_occupied.isSet(canvas_index)) continue;
+        const id = canvas_state.owner;
+        if (id == 0) continue;
+        const node = try model.tree.nodeConst(id);
+        // These decorations are also stored in `immediate_commands`; until
+        // the batch API carries a composed metadata tail, keep their exact
+        // semantics by taking the ordinary rebuild path.
+        if (!node.hover_style.isEmpty() or !node.pressed_style.isEmpty() or
+            node.shadow != null or node.text_shadow != null or node.iconPathSlice().len != 0)
+        {
+            return false;
+        }
+        updates[update_count] = .{
+            .id = native_sdk.canvas.globalWidgetId(.stack, native_sdk.canvas.uiKey(id)),
+            .commands = canvas_state.slice(),
+        };
+        update_count += 1;
+    }
+    if (update_count > 0) {
+        _ = try runtime.setCanvasWidgetImmediateCommands(window_id, canvas_label, updates[0..update_count]);
+    }
+    return true;
+}
+
 fn noteProjectionFailure(comptime format: []const u8, args: anytype) void {
     projection_failed_this_view = true;
     if (projection_failure_latched) return;
@@ -1306,6 +1356,8 @@ pub fn main(init: std.process.Init) !void {
         .tokens = tokens,
         .fonts = fonts,
         .update_fx = update,
+        .view_revision = viewRevision,
+        .project_update = projectSameViewUpdate,
         .init_fx = initEffects,
         .view = view,
         .sync = syncNativeState,
@@ -1356,6 +1408,31 @@ pub fn main(init: std.process.Init) !void {
         if (std.mem.eql(u8, provider, "audio")) app_state.model.provider_poll_interval_ms = 33;
     }
     try engine.evaluate(loaded.bundle, "bundle.js");
+    if (init.environ_map.get("WEAVER_MEMORY_RECEIPT")) |value| {
+        if (value.len != 0 and !std.mem.eql(u8, value, "0")) {
+            const usage = engine.memoryUsage();
+            std.log.info(
+                "widget memory receipt model_bytes={d} widget_app_bytes={d} tree_bytes={d} node_bytes={d} canvas_state_bytes={d} engine_bytes={d} quickjs_malloc_bytes={d} quickjs_memory_used_bytes={d} quickjs_atoms_bytes={d} quickjs_strings_bytes={d} quickjs_objects_bytes={d} quickjs_properties_bytes={d} quickjs_shapes_bytes={d} quickjs_functions_bytes={d} quickjs_function_code_bytes={d}",
+                .{
+                    @sizeOf(Model),
+                    @sizeOf(WidgetApp),
+                    @sizeOf(tree_mod.Tree),
+                    @sizeOf(tree_mod.Node),
+                    @sizeOf(tree_mod.CanvasState),
+                    @sizeOf(js_engine.Engine),
+                    usage.malloc_size,
+                    usage.memory_used_size,
+                    usage.atom_size,
+                    usage.str_size,
+                    usage.obj_size,
+                    usage.prop_size,
+                    usage.shape_size,
+                    usage.js_func_size,
+                    usage.js_func_code_size,
+                },
+            );
+        }
+    }
     if (app_state.model.tree.root == null) {
         std.log.err("widget bundle completed without rendering a root; expected the default widget() registration to render synchronously", .{});
         app_state.model.tree.showError("WidgetDidNotRenderRoot\nThe bundle completed without rendering a widget root.");
diff --git a/runtime/src/tree.zig b/runtime/src/tree.zig
index e2f458a..8d8502e 100644
--- a/runtime/src/tree.zig
+++ b/runtime/src/tree.zig
@@ -239,8 +239,10 @@ pub const CanvasState = struct {
 };
 
 /// JS mutates this tree; the Native SDK view is a pure derivation of it.
-/// `generation` advances only for an effective mutation, which gives the app
-/// loop one cheap batch boundary for future no-op timer callbacks.
+/// `generation` advances only for an effective retained-tree mutation.
+/// Immediate canvas pixels have their own `canvas_generation`, so a draw-only
+/// frame does not trigger unrelated authored-tree work such as image-source
+/// synchronization.
 pub const Tree = struct {
     allocator: std.mem.Allocator = std.heap.page_allocator,
     // Occupancy makes the large node arena a lazy reservation: never inspect
@@ -251,6 +253,7 @@ pub const Tree = struct {
     canvases: [max_canvases]CanvasState = undefined,
     root: ?NodeId = null,
     generation: u64 = 0,
+    canvas_generation: u64 = 0,
     next_node_lifetime: u64 = 1,
     batch_depth: u8 = 0,
     batch_changed: bool = false,
@@ -423,6 +426,7 @@ pub const Tree = struct {
         resetEmpty(destination, self.allocator);
         destination.root = self.root;
         destination.generation = self.generation;
+        destination.canvas_generation = self.canvas_generation;
         destination.next_node_lifetime = self.next_node_lifetime;
         destination.batch_depth = self.batch_depth;
         destination.batch_changed = self.batch_changed;
@@ -980,7 +984,7 @@ pub const Tree = struct {
         canvas.fingerprint = fingerprint;
         canvas.command_layout_width = canvas.layout_width;
         canvas.command_layout_height = canvas.layout_height;
-        self.changed();
+        self.canvas_generation +%= 1;
     }
 
     pub fn appendChild(self: *Tree, parent_id: NodeId, child_id: NodeId) Error!void {
@@ -1117,6 +1121,7 @@ fn resetEmpty(tree: *Tree, allocator: std.mem.Allocator) void {
     tree.canvas_occupied = std.StaticBitSet(max_canvases).initEmpty();
     tree.root = null;
     tree.generation = 0;
+    tree.canvas_generation = 0;
     tree.next_node_lifetime = 1;
     tree.batch_depth = 0;
     tree.batch_changed = false;
@@ -1262,6 +1267,7 @@ test "aborting a render batch restores the exact committed tree" {
     try tree.appendChild(root, canvas);
     try tree.setRoot(root);
     const committed_generation = tree.generation;
+    const committed_canvas_generation = tree.canvas_generation;
 
     try tree.beginBatch();
     try tree.setText(label, "partial");
@@ -1269,9 +1275,11 @@ test "aborting a render batch restores the exact committed tree" {
     try tree.setCanvasCommands(canvas, &.{ 5, 2, 0xff0000ff, 3, 10, 11, 12, 13, 14, 15 });
     const partial = try tree.createNode(.panel);
     try tree.appendChild(root, partial);
+    try std.testing.expectEqual(committed_canvas_generation +% 1, tree.canvas_generation);
     tree.abortBatch();
 
     try std.testing.expectEqual(committed_generation, tree.generation);
+    try std.testing.expectEqual(committed_canvas_generation, tree.canvas_generation);
     try std.testing.expectEqual(@as(usize, 4), tree.nodeCount());
     try std.testing.expectEqualStrings("committed", (try tree.nodeConst(label)).textSlice());
     try std.testing.expectEqualStrings("M 0 0 L 1 1", (try tree.nodeConst(icon)).iconPathSlice());
@@ -1492,7 +1500,13 @@ test "canvas wire decodes packed colors and polyline points" {
         4,          8,
         9,          3,
     };
+    const retained_generation = tree.generation;
+    const canvas_generation = tree.canvas_generation;
+    try tree.setCanvasCommands(id, &wire);
+    try std.testing.expectEqual(retained_generation, tree.generation);
+    try std.testing.expectEqual(canvas_generation +% 1, tree.canvas_generation);
     try tree.setCanvasCommands(id, &wire);
+    try std.testing.expectEqual(canvas_generation +% 1, tree.canvas_generation);
     const canvas = try tree.canvasStateConst(id);
     try std.testing.expectEqual(@as(usize, 3), canvas.command_count);
     try std.testing.expectEqual(@as(usize, 3), canvas.point_count);
@@ -1504,6 +1518,7 @@ test "canvas wire decodes packed colors and polyline points" {
     try std.testing.expectEqual(@as(f32, 96), (try tree.canvasStateConst(id)).layout_width);
     try std.testing.expectEqual(@as(f32, 48), (try tree.canvasStateConst(id)).layout_height);
     try tree.setCanvasCommands(id, &wire);
+    try std.testing.expectEqual(canvas_generation +% 2, tree.canvas_generation);
     try std.testing.expectEqual(@as(f32, 96), (try tree.canvasStateConst(id)).commands[0].fill_rect.rect.width);
     try std.testing.expectEqual(@as(f32, 48), (try tree.canvasStateConst(id)).commands[0].fill_rect.rect.height);
 }
diff --git a/scripts/macos-audio-cost.py b/scripts/macos-audio-cost.py
index e1863fc..81f5c8b 100755
--- a/scripts/macos-audio-cost.py
+++ b/scripts/macos-audio-cost.py
@@ -26,6 +26,11 @@ def parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser()
     parser.add_argument("--sample-seconds", type=int, default=10)
     parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--visualizer-revision",
+                        help="read examples/visualizer/widget.tsx from this git revision instead of the working tree")
+    parser.add_argument("--active-sample-output", type=Path,
+                        help="write a macOS sample of the first active Visualizer process")
+    parser.add_argument("--active-sample-seconds", type=int, default=5)
     return parser.parse_args()
 
 
@@ -49,20 +54,77 @@ def wait_for(description: str, predicate: Callable[[], Any], timeout: float = 20
     raise RuntimeError(f"timed out waiting for {description}")
 
 
-def process_sample(pids: list[int]) -> dict[str, Any]:
-    rows = command(["/bin/ps", "-o", "pid=,%cpu=,rss=", "-p", ",".join(map(str, pids))]).splitlines()
-    values = [row.split() for row in rows if row.strip()]
+def cpu_seconds(value: str) -> float:
+    """Parse macOS ps cputime ([[dd-]hh:]mm:ss.xx) into seconds."""
+    days = 0
+    if "-" in value:
+        day_text, value = value.split("-", 1)
+        days = int(day_text)
+    parts = value.split(":")
+    if len(parts) == 3:
+        hours, minutes, seconds = parts
+    elif len(parts) == 2:
+        hours, minutes, seconds = "0", parts[0], parts[1]
+    else:
+        hours, minutes, seconds = "0", "0", parts[0]
+    return days * 86400 + int(hours) * 3600 + int(minutes) * 60 + float(seconds)
+
+
+def process_cpu_times(pids: list[int]) -> dict[int, float]:
+    requested = list(dict.fromkeys(pids))
+    rows = command([
+        "/bin/ps", "-o", "pid=", "-o", "cputime=", "-p", ",".join(map(str, requested)),
+    ]).splitlines()
+    snapshot: dict[int, float] = {}
+    for row in rows:
+        fields = row.strip().split(maxsplit=1)
+        if len(fields) == 2:
+            snapshot[int(fields[0])] = cpu_seconds(fields[1])
+    missing = [pid for pid in requested if pid not in snapshot]
+    if missing:
+        raise RuntimeError(f"ps CPU snapshot omitted pids: {missing}")
+    return snapshot
+
+
+def process_sample(pids: list[int], window_server_pid: int,
+                   interval_seconds: float = 1.0) -> dict[str, Any]:
+    sampled_pids = [*pids, window_server_pid]
+    cpu_before = process_cpu_times(sampled_pids)
+    interval_before = time.monotonic()
+    time.sleep(interval_seconds)
+    cpu_after = process_cpu_times(sampled_pids)
+    interval_after = time.monotonic()
+    rows = command(["/bin/ps", "-o", "rss=", "-p", ",".join(map(str, pids))]).splitlines()
     footprint = command(["/usr/bin/footprint", "-f", "bytes", *sum((["-p", str(pid)] for pid in pids), [])])
     match = re.search(r"^\s*phys_footprint:\s+(\d+) B$", footprint, re.MULTILINE)
     if not match:
         raise RuntimeError("footprint did not report aggregate phys_footprint")
+    cpu_percent_by_pid = {
+        str(pid): max(0, cpu_after[pid] - cpu_before[pid]) / (interval_after - interval_before) * 100
+        for pid in pids
+    }
     return {
-        "cpu_percent_one_core": sum(float(value[1]) for value in values),
-        "rss_bytes": sum(int(value[2]) * 1024 for value in values),
+        "cpu_percent_one_core": sum(cpu_percent_by_pid.values()),
+        "cpu_percent_one_core_by_pid": cpu_percent_by_pid,
+        "window_server_cpu_percent_one_core": (
+            max(0, cpu_after[window_server_pid] - cpu_before[window_server_pid])
+            / (interval_after - interval_before) * 100
+        ),
+        "rss_bytes": sum(int(row.strip()) * 1024 for row in rows if row.strip()),
         "physical_footprint_bytes": int(match.group(1)),
     }
 
 
+def replace_unique(source: str, old: str, new: str, *, label: str, revision: str) -> str:
+    count = source.count(old)
+    if count != 1:
+        raise RuntimeError(
+            f"Cannot prepare Visualizer from {revision}: expected exactly one {label} marker "
+            f"{old!r}, found {count}. Select a compatible revision or update the harness source markers."
+        )
+    return source.replace(old, new, 1)
+
+
 def summarize(samples: list[dict[str, Any]]) -> dict[str, Any]:
     return {
         field: {
@@ -70,7 +132,8 @@ def summarize(samples: list[dict[str, Any]]) -> dict[str, Any]:
             "min": min(sample[field] for sample in samples),
             "max": max(sample[field] for sample in samples),
         }
-        for field in ("cpu_percent_one_core", "rss_bytes", "physical_footprint_bytes")
+        for field in ("cpu_percent_one_core", "window_server_cpu_percent_one_core",
+                      "rss_bytes", "physical_footprint_bytes")
     } | {"samples": samples}
 
 
@@ -78,6 +141,8 @@ def main() -> int:
     if sys.platform != "darwin":
         raise RuntimeError("macOS audio cost harness requires macOS")
     args = parse_args()
+    visualizer_source = (command(["git", "show", f"{args.visualizer_revision}:examples/visualizer/widget.tsx"])
+                         if args.visualizer_revision else VISUALIZER.read_text(encoding="utf-8"))
     scratch = Path(tempfile.mkdtemp(prefix="weaver-audio-cost-", dir="/tmp"))
     environment = dict(os.environ)
     environment["HOME"] = str(scratch / "home")
@@ -87,6 +152,7 @@ def main() -> int:
     data_root = Path(environment["HOME"]) / "Library" / "Application Support" / "Weaver"
     status_path = data_root / "status.json"
     node = shutil.which("node") or "node"
+    window_server_pid = int(command(["/usr/bin/pgrep", "-x", "WindowServer"]).splitlines()[0])
     installed: list[str] = []
 
     def cli(*arguments: str) -> str:
@@ -103,8 +169,7 @@ def measure(label: str) -> dict[str, Any]:
         pids = [before["hostPid"], *[widget["pid"] for widget in before.get("widgets", [])]]
         samples = []
         for _ in range(args.sample_seconds):
-            samples.append(process_sample(pids))
-            time.sleep(1)
+            samples.append(process_sample(pids, window_server_pid))
         after = status()
         return {
             "label": label,
@@ -113,6 +178,12 @@ def measure(label: str) -> dict[str, Any]:
             "providers_after": after["providers"],
             "provider_frame_delta": after["providers"]["audioProviderFrames"] - before["providers"]["audioProviderFrames"],
             "pipe_frame_delta": after["providers"]["audioPipeFrames"] - before["providers"]["audioPipeFrames"],
+            "cpu_percent_one_core_by_pid": {
+                str(pid): round(statistics.fmean(
+                    sample["cpu_percent_one_core_by_pid"][str(pid)] for sample in samples
+                ), 3)
+                for pid in pids
+            },
             **summarize(samples),
         }
 
@@ -126,7 +197,9 @@ def measure(label: str) -> dict[str, Any]:
         "zig": command(["zig", "version"]),
         "node": command([node, "--version"]),
         "sample_seconds": args.sample_seconds,
-        "cpu_metric": "ps percent of one core summed across weaverd and participating Widget processes",
+        "visualizer_source": args.visualizer_revision or "working tree",
+        "cpu_metric": "one-second deltas of ps cumulative CPU time divided by monotonic wall time, summed across weaverd and participating Widget processes; 100 percent is one saturated core",
+        "window_server_cpu_metric": "aligned one-second deltas of WindowServer cumulative CPU time; this is system-wide and the unsubscribed-host workload is its per-run background control",
         "memory_metrics": {
             "physical_footprint": "footprint aggregate phys_footprint, de-duplicated across selected processes",
             "rss": "ps RSS summed across selected processes",
@@ -143,9 +216,15 @@ def measure(label: str) -> dict[str, Any]:
         for index in (1, 2):
             directory = scratch / f"visualizer-{index}"
             cli("init", directory.name)
-            source = VISUALIZER.read_text(encoding="utf-8")
-            source = source.replace('name: "Visualizer"', f'name: "Visualizer {index}"')
-            source = source.replace("offset: [24, 24]", f"offset: [{24 + (index - 1) * 312}, 24]")
+            shutil.copytree(VISUALIZER.parent, directory, dirs_exist_ok=True,
+                            ignore=shutil.ignore_patterns("dist", "tsconfig.json", "widget.tsx"))
+            source = visualizer_source
+            revision = args.visualizer_revision or "working tree"
+            source = replace_unique(source, 'name: "Visualizer"', f'name: "Visualizer {index}"',
+                                    label="widget name", revision=revision)
+            source = replace_unique(source, "offset: [420, 400]",
+                                    f"offset: [{24 + (index - 1) * 352}, 24]",
+                                    label="anchor offset", revision=revision)
             (directory / "widget.tsx").write_text(source, encoding="utf-8")
             cli("install", str(directory))
             installed.append(f"Visualizer {index}")
@@ -156,6 +235,12 @@ def measure(label: str) -> dict[str, Any]:
                  and status()["providers"]["audioAvailability"] == "live"
                  and status()["providers"]["audioProviderFrames"] > 2)
         output["workloads"].append(measure("host + two active Visualizers"))
+        if args.active_sample_output:
+            active = status()
+            widget_pid = active["widgets"][0]["pid"]
+            args.active_sample_output.parent.mkdir(parents=True, exist_ok=True)
+            command(["/usr/bin/sample", str(widget_pid), str(args.active_sample_seconds), "1",
+                     "-file", str(args.active_sample_output)])
 
         control.write_text("s", encoding="utf-8")
         wait_for("silent provider parking", lambda: status().get("providers", {}).get("audioSilent") is True)
diff --git a/scripts/release-audit.mjs b/scripts/release-audit.mjs
index 1f79a43..84a27ba 100755
--- a/scripts/release-audit.mjs
+++ b/scripts/release-audit.mjs
@@ -7,7 +7,7 @@ import { dirname, extname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const expectedNativeCommit = "7368f7f59e09c372311e884190d88006a73ce97f";
+const expectedNativeCommit = "4c5c0999c2324b8dc2016625e85571e554b2484a";
 
 function filesBelow(root) {
   const output = [];
@@ -61,7 +61,7 @@ const trackedBuildProducts = tracked.filter((path) =>
 assert.deepEqual(trackedBuildProducts, [], `tracked build products found:\n${trackedBuildProducts.join("\n")}`);
 
 const nativeCommit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: join(repoRoot, "runtime", "native-sdk") }).toString("utf8").trim();
-assert.equal(nativeCommit, expectedNativeCommit, "Native SDK submodule is not pinned to the reviewed fork-stack head");
+assert.equal(nativeCommit, expectedNativeCommit, "Native SDK submodule is not pinned to the reviewed merge commit");
 
 const treeSource = readFileSync(join(repoRoot, "runtime", "src", "tree.zig"), "utf8");
 const runtimeMainSource = readFileSync(join(repoRoot, "runtime", "src", "main.zig"), "utf8");
diff --git a/sdk/CONTRACT.md b/sdk/CONTRACT.md
index 19f5208..126f302 100644
--- a/sdk/CONTRACT.md
+++ b/sdk/CONTRACT.md
@@ -79,6 +79,13 @@ export function useRef<T>(initial: T): { current: T };
 export function useEffect(fn: () => void | (() => void), deps?: unknown[]): void;
 export function useInterval(fn: () => void, ms: number): void;   // native-clocked, auto-cleaned
 export function useProvider(name: "time"): TimeData;             // M1: "time" only
+export function useProviderSignal(name: "time"): Signal<TimeData>;
+
+export interface Signal<T> {
+  readonly value: T;
+  subscribe(listener: (value: T) => void): () => void;
+  map<U>(project: (value: T) => U): Signal<U>;
+}
 
 export interface TimeData {   // updates once per second while subscribed
   hh: string; mm: string; ss: string;             // zero-padded locale-agnostic
@@ -91,6 +98,19 @@ export interface TimeData {   // updates once per second while subscribed
 Rules: hooks follow React's rules (top level, stable order). `useProvider`
 requires the provider in `config.subscribe` — checked at `weaver check`,
 error: `useProvider("time") requires subscribe: ["time"] in the widget config`.
+`useProviderSignal` carries the same requirement and names the hook in its
+error: `useProviderSignal("audio") requires subscribe: ["audio"] in the widget
+config`.
+
+`useProvider` is the declarative path: each value schedules a component render.
+`useProviderSignal` is the high-frequency retained path: it updates `.value`
+without rendering the component. A canvas samples `.value` inside `onFrame`.
+A `<text>` may contain one mapped signal, which updates only that native text
+node; format the whole label in `signal.map(...)`. `subscribe` is for edge
+transitions such as waking a paused canvas, not for rebuilding the tree on each
+provider frame. `map` memoizes by source signal and projector identity. Define a
+projector once outside the component (`const label = signal.map(format)`) so
+unrelated renders reuse the binding instead of unsubscribing and resubscribing.
 
 ## Hot swap
 `weaver dev` evaluates a valid changed bundle in a fresh JS context before replacing the running one.
@@ -105,7 +125,7 @@ Evaluation failure leaves the prior context, window, and state running; window-c
 | `<column>` | yes | — |
 | `<row>` | yes | — |
 | `<panel>` | yes | — (a styled box; column layout) |
-| `<text>` | yes | — (children: strings/numbers only) |
+| `<text>` | yes | — (children: strings/numbers, or one `Signal<string \| number>`) |
 | `<icon>` | yes | exactly one of literal `name` or literal `d`; custom paths also accept `viewBox`/`stroke`; no children |
 | `<image>` | check-error "arrives in M2" | `src` |
 | `<button>` | check-error "arrives in M2" | `onPress` |
@@ -273,6 +293,8 @@ interface CanvasCtx {
 ```ts
 useProvider("audio")  // { rms: number, bands: number[] }   32 bands 0..1, 30 Hz,
                       // system loopback — silence sends nothing (idle-zero)
+useProviderSignal("audio") // same data without scheduling a root render;
+                           // canvas reads .value, text binds with .map(...)
 useProvider("media")  // { title: string, artist: string, album: string,
                       //   playing: boolean, positionMs: number, durationMs: number }
                       // change-pushed; 1 Hz position while playing
diff --git a/sdk/index.d.ts b/sdk/index.d.ts
index af249fc..73cc525 100644
--- a/sdk/index.d.ts
+++ b/sdk/index.d.ts
@@ -1,4 +1,4 @@
-export type WidgetChild = JSX.Element | string | number | null | undefined | false;
+export type WidgetChild = JSX.Element | string | number | Signal<string | number> | null | undefined | false;
 export interface PressEvent { x: number; y: number; u: number; v: number }
 
 export interface WidgetConfig {
@@ -34,6 +34,11 @@ export interface TimeData {
 export interface CpuData { percent: number; perCore: number[] }
 export interface MemoryData { usedMb: number; totalMb: number; percent: number }
 export interface AudioData { rms: number; bands: number[] }
+export interface Signal<out T> {
+  readonly value: T;
+  subscribe(listener: (value: T) => void): () => void;
+  map<U>(project: (value: T) => U): Signal<U>;
+}
 export interface MediaData {
   title: string;
   artist: string;
@@ -88,6 +93,11 @@ export function useProvider(name: "cpu"): CpuData;
 export function useProvider(name: "memory"): MemoryData;
 export function useProvider(name: "audio"): AudioData;
 export function useProvider(name: "media"): MediaData;
+export function useProviderSignal(name: "time"): Signal<TimeData>;
+export function useProviderSignal(name: "cpu"): Signal<CpuData>;
+export function useProviderSignal(name: "memory"): Signal<MemoryData>;
+export function useProviderSignal(name: "audio"): Signal<AudioData>;
+export function useProviderSignal(name: "media"): Signal<MediaData>;
 export function useMediaTransport(): MediaTransport;
 export function useStorage<T>(key: string, initial: T): [T, (next: T | ((prev: T) => T)) => void];
 export function wfetch(url: string, init?: WFetchInit): Promise<WFetchResponse>;
@@ -116,7 +126,7 @@ declare global {
 
     interface TextProps {
       class?: string;
-      children?: string | number | (string | number)[];
+      children?: string | number | Signal<string | number> | (string | number)[];
     }
 
     type IconProps =
@@ -145,4 +155,3 @@ declare global {
 declare global {
   function wfetch(url: string, init?: WFetchInit): Promise<WFetchResponse>;
 }
-
diff --git a/sdk/src/index.ts b/sdk/src/index.ts
index 32d9e4e..e096a93 100644
--- a/sdk/src/index.ts
+++ b/sdk/src/index.ts
@@ -5,6 +5,7 @@ export {
   useInterval,
   useMediaTransport,
   useProvider,
+  useProviderSignal,
   useRef,
   useState,
   useStorage,
@@ -18,6 +19,7 @@ export {
   type MediaData,
   type MediaTransport,
   type PressEvent,
+  type Signal,
   type TimeData,
   type WFetchInit,
   type WFetchResponse,
@@ -25,4 +27,3 @@ export {
   type WidgetConfig,
   type WidgetModule,
 } from "./reconciler.js";
-
diff --git a/sdk/src/reconciler.ts b/sdk/src/reconciler.ts
index 6d0e48d..d678b57 100644
--- a/sdk/src/reconciler.ts
+++ b/sdk/src/reconciler.ts
@@ -17,7 +17,7 @@ const MAX_CANVAS_WIRE_VALUES = 32_768;
 // the clamp itself retains no memory.
 const MAX_CANVAS_FPS = 60;
 
-export type WidgetChild = VNode | string | number | null | undefined | false;
+export type WidgetChild = VNode | string | number | Signal<string | number> | null | undefined | false;
 export type Component = () => VNode;
 export type NodeType = "column" | "row" | "stack" | "panel" | "text" | "icon" | "button" | "slider" | "image" | "canvas";
 export type ProviderName = "time" | "cpu" | "memory" | "audio" | "media";
@@ -55,6 +55,11 @@ export interface TimeData {
 export interface CpuData { percent: number; perCore: number[] }
 export interface MemoryData { usedMb: number; totalMb: number; percent: number }
 export interface AudioData { rms: number; bands: number[] }
+export interface Signal<out T> {
+  readonly value: T;
+  subscribe(listener: (value: T) => void): () => void;
+  map<U>(project: (value: T) => U): Signal<U>;
+}
 export interface MediaData {
   title: string;
   artist: string;
@@ -73,6 +78,7 @@ export interface MediaTransport {
   previous(): Promise<boolean>;
   seek(ms: number): Promise<boolean>;
 }
+type ProviderValue = TimeData | CpuData | MemoryData | AudioData | MediaData;
 export interface WFetchInit { method?: "GET" | "POST"; headers?: Record<string, string>; body?: string }
 export interface WFetchResponse { status: number; ok: boolean; text(): Promise<string>; json(): Promise<unknown> }
 export interface CanvasFrame { t: number; dt: number }
@@ -103,8 +109,13 @@ interface HostInstance {
   type: NodeType;
   key?: string | number;
   id: number;
+  className?: string;
   props: ClassProps;
   elementProps: HostElementProps;
+  text?: string;
+  textBinding?: Signal<string | number>;
+  textUnsubscribe?: () => void;
+  mounted: boolean;
   children: Instance[];
 }
 
@@ -143,7 +154,7 @@ interface FragmentInstance {
 type Instance = HostInstance | ComponentInstance | FragmentInstance;
 type Hook = StateHook<unknown> | RefHook<unknown> | EffectHook;
 interface StateHook<T> { kind: "state"; value: T }
-interface RefHook<T> { kind: "ref"; value: { current: T } }
+interface RefHook<T> { kind: "ref"; value: { current: T }; initialValueType: HotSwapValueType }
 interface EffectHook { kind: "effect"; deps?: unknown[]; cleanup?: () => void; effect?: () => void | (() => void) }
 
 type HotSwapValueType = "undefined" | "null" | "boolean" | "number" | "string" | "bigint" | "symbol" | "function" | "array" | "object";
@@ -182,7 +193,10 @@ interface CanvasBinding {
   active: boolean;
   ctx: CanvasCtx;
 }
+interface MutableSignal<T> extends Signal<T> { emit(value: T): void }
 const canvases = new Map<number, CanvasBinding>();
+const signals = new WeakSet<object>();
+const signalMaps = new WeakMap<object, WeakMap<Function, Signal<unknown>>>();
 const colorCache: Record<string, number> = Object.create(null) as Record<string, number>;
 
 native.onCanvasResize((id, width, height) => runWidgetCallback("canvas resize callback", () => {
@@ -267,7 +281,11 @@ export function useRef<T>(initial: T): { current: T } {
   const index = component.hookIndex++;
   let hook = component.hooks[index] as RefHook<T> | undefined;
   if (!hook) {
-    hook = { kind: "ref", value: { current: seedHookValue(component, index, "ref", initial) } };
+    hook = {
+      kind: "ref",
+      value: { current: seedHookValue(component, index, "ref", initial) },
+      initialValueType: hotSwapValueType(initial),
+    };
     component.hooks[index] = hook as RefHook<unknown>;
   } else if (hook.kind !== "ref") {
     throw hookOrderError("useRef", index);
@@ -309,44 +327,26 @@ export function useProvider(name: "memory"): MemoryData;
 export function useProvider(name: "audio"): AudioData;
 export function useProvider(name: "media"): MediaData;
 export function useProvider(name: ProviderName): TimeData | CpuData | MemoryData | AudioData | MediaData {
-  if (!activeConfig?.subscribe?.includes(name)) {
-    throw new Error(`useProvider("${name}") requires subscribe: ["${name}"] in the widget config`);
-  }
-  if (name === "time") {
-    const [value, setValue] = useState<TimeData>(() => currentTime());
-    useEffect(() => timeProvider.subscribe(setValue), []);
-    return value;
-  }
-  if (!native.hostAvailable()) throw new Error(`Provider "${name}" requires weaverd; run "weaver up"`);
-  if (name === "cpu") {
-    const [value, setValue] = useState<CpuData>(() => ({ percent: 0, perCore: [] }));
-    useEffect(() => hostProviders.subscribeCpu(setValue), []);
-    return value;
-  }
-  if (name === "memory") {
-    const [value, setValue] = useState<MemoryData>(() => ({ usedMb: 0, totalMb: 0, percent: 0 }));
-    useEffect(() => hostProviders.subscribeMemory(setValue), []);
-    return value;
-  }
-  if (name === "audio") {
-    const [value, setValue] = useState<AudioData>(() => ({ rms: 0, bands: Array.from({ length: 32 }, () => 0) }));
-    useEffect(() => hostProviders.subscribeAudio(setValue), []);
-    return value;
-  }
-  const [value, setValue] = useState<MediaData>(() => ({
-    title: "",
-    artist: "",
-    album: "",
-    status: "stopped",
-    playing: false,
-    sourceApp: "",
-    positionMs: 0,
-    durationMs: 0,
-  }));
-  useEffect(() => hostProviders.subscribeMedia(setValue), []);
+  requireProvider(name, "useProvider");
+  const [value, setValue] = useState<ProviderValue>(() => initialProviderValue(name));
+  useEffect(() => subscribeProvider(name, setValue), [name]);
   return value;
 }
 
+export function useProviderSignal(name: "time"): Signal<TimeData>;
+export function useProviderSignal(name: "cpu"): Signal<CpuData>;
+export function useProviderSignal(name: "memory"): Signal<MemoryData>;
+export function useProviderSignal(name: "audio"): Signal<AudioData>;
+export function useProviderSignal(name: "media"): Signal<MediaData>;
+export function useProviderSignal(name: ProviderName): Signal<ProviderValue> {
+  requireProvider(name, "useProviderSignal");
+  const holder = useRef<MutableSignal<ProviderValue> | null>(null);
+  if (!holder.current) holder.current = createSignal(initialProviderValue(name));
+  const signal = holder.current;
+  useEffect(() => subscribeProvider(name, (next) => signal.emit(next)), [name, signal]);
+  return signal;
+}
+
 let nextMediaCommandId = 1;
 
 function sendMediaCommand(verb: "play" | "pause" | "next" | "previous" | "seek", seekMs?: number): Promise<boolean> {
@@ -505,18 +505,32 @@ function reconcileHost(parentId: number | null, previous: Instance | null, vnode
   const reusable = previous?.kind === "host" && previous.type === type && previous.key === vnode.key;
   const instance: HostInstance = reusable
     ? previous
-    : { kind: "host", type, key: vnode.key, id: native.createNode(type), props: {}, elementProps: {}, children: [] };
+    : { kind: "host", type, key: vnode.key, id: native.createNode(type), props: {}, elementProps: {}, mounted: true, children: [] };
   if (!reusable && previous) unmount(previous);
-  const nextProps = compileClass(typeof vnode.props.class === "string" ? vnode.props.class : "");
-  applyProps(instance.id, instance.props, nextProps);
-  instance.props = nextProps;
+  const className = typeof vnode.props.class === "string" ? vnode.props.class : "";
+  if (instance.className !== className) {
+    const nextProps = compileClass(className);
+    applyProps(instance.id, instance.props, nextProps);
+    instance.props = nextProps;
+    instance.className = className;
+  }
   applyElementProps(instance, vnode.props);
   if (type === "text") {
-    const text = vnode.children.map((child) => {
-      if (typeof child !== "string" && typeof child !== "number") throw new Error("<text> children must be strings or numbers");
-      return String(child);
-    }).join("");
-    native.setText(instance.id, text);
+    const children = vnode.children.filter(isRenderable);
+    const binding = children.find(isSignal);
+    if (binding) {
+      if (children.length !== 1) throw new Error("A bound <text> must contain exactly one Signal child; format the complete label with signal.map(...)");
+      bindHostText(instance, binding);
+    } else {
+      unbindHostText(instance);
+      const text = children.map((child) => {
+        if (typeof child !== "string" && typeof child !== "number") {
+          throw new Error(`<text> children must be strings, numbers, or one Signal; received ${typeof child}`);
+        }
+        return String(child);
+      }).join("");
+      setHostText(instance, text);
+    }
   } else if (type === "canvas") {
     if (vnode.children.some(isRenderable)) throw new Error("<canvas> does not accept children");
   } else {
@@ -656,11 +670,41 @@ function unmount(instance: Instance): void {
     for (const child of instance.children) unmount(child);
     return;
   }
+  for (const child of instance.children) unmount(child);
+  instance.mounted = false;
+  unbindHostText(instance);
   handlers.delete(instance.id);
   disposeCanvas(instance.id);
   native.removeNode(instance.id);
 }
 
+function bindHostText(instance: HostInstance, binding: Signal<string | number>): void {
+  if (instance.textBinding === binding) {
+    setHostText(instance, String(binding.value));
+    return;
+  }
+  unbindHostText(instance);
+  instance.textBinding = binding;
+  setHostText(instance, String(binding.value));
+  instance.textUnsubscribe = binding.subscribe((value) => {
+    runWidgetCallback("bound <text> update", () => {
+      if (instance.mounted) setHostText(instance, String(value));
+    });
+  });
+}
+
+function unbindHostText(instance: HostInstance): void {
+  instance.textUnsubscribe?.();
+  instance.textUnsubscribe = undefined;
+  instance.textBinding = undefined;
+}
+
+function setHostText(instance: HostInstance, text: string): void {
+  if (instance.text === text) return;
+  native.setText(instance.id, text);
+  instance.text = text;
+}
+
 function updateCanvasBinding(id: number, onFrame: (ctx: CanvasCtx, frame: CanvasFrame) => void, fps: number | undefined, width: number, height: number): void {
   let binding = canvases.get(id);
   const mounted = binding === undefined;
@@ -865,9 +909,10 @@ function firstNativeId(instance: Instance): number {
 }
 
 function instanceKey(instance: Instance): string | number | undefined { return instance.key; }
-function isRenderable(value: WidgetChild): value is VNode | string | number { return value !== null && value !== undefined && value !== false; }
+function isRenderable(value: WidgetChild): value is VNode | string | number | Signal<string | number> { return value !== null && value !== undefined && value !== false; }
 function isVNode(value: unknown): value is VNode { return typeof value === "object" && value !== null && (value as { __weaverElement?: boolean }).__weaverElement === true; }
-function toVNode(value: VNode | string | number): VNode { return isVNode(value) ? value : h("text", null, value); }
+function isSignal(value: unknown): value is Signal<string | number> { return typeof value === "object" && value !== null && signals.has(value); }
+function toVNode(value: VNode | string | number | Signal<string | number>): VNode { return isVNode(value) ? value : h("text", null, value); }
 
 function flatten(values: readonly unknown[]): WidgetChild[] {
   const output: WidgetChild[] = [];
@@ -993,6 +1038,9 @@ function captureHotSwap(): string | null {
     return JSON.stringify(rootInstance.hooks.map((hook): HotSwapSlot => {
       if (hook.kind === "effect") return { kind: "effect" };
       const value = hook.kind === "ref" ? hook.value.current : hook.value;
+      if (hook.kind === "ref" && value !== null && typeof value === "object" && signals.has(value)) {
+        return { kind: "ref", valueType: hook.initialValueType, transferable: false };
+      }
       const valueType = hotSwapValueType(value);
       if (["undefined", "bigint", "symbol", "function"].includes(valueType)) return { kind: hook.kind, valueType, transferable: false };
       return { kind: hook.kind, valueType, value };
@@ -1087,6 +1135,100 @@ function currentTime(): TimeData {
   };
 }
 
+function requireProvider(name: ProviderName, hook: "useProvider" | "useProviderSignal"): void {
+  if (!activeConfig?.subscribe?.includes(name)) {
+    throw new Error(`${hook}("${name}") requires subscribe: ["${name}"] in the widget config`);
+  }
+  if (name !== "time" && !native.hostAvailable()) {
+    throw new Error(`Provider "${name}" requires weaverd; run "weaver up"`);
+  }
+}
+
+function initialProviderValue(name: ProviderName): ProviderValue {
+  if (name === "time") return currentTime();
+  if (name === "cpu") return { percent: 0, perCore: [] };
+  if (name === "memory") return { usedMb: 0, totalMb: 0, percent: 0 };
+  if (name === "audio") return { rms: 0, bands: Array.from({ length: 32 }, () => 0) };
+  return {
+    title: "",
+    artist: "",
+    album: "",
+    status: "stopped",
+    playing: false,
+    sourceApp: "",
+    positionMs: 0,
+    durationMs: 0,
+  };
+}
+
+function subscribeProvider(name: ProviderName, listener: (value: ProviderValue) => void): () => void {
+  if (name === "time") return timeProvider.subscribe(listener);
+  if (name === "cpu") return hostProviders.subscribeCpu(listener);
+  if (name === "memory") return hostProviders.subscribeMemory(listener);
+  if (name === "audio") return hostProviders.subscribeAudio(listener);
+  return hostProviders.subscribeMedia(listener);
+}
+
+function createSignal<T>(initial: T): MutableSignal<T> {
+  let current = initial;
+  const listeners = new Set<(value: T) => void>();
+  const signal: MutableSignal<T> = {
+    get value(): T { return current; },
+    subscribe(listener: (value: T) => void): () => void {
+      if (typeof listener !== "function") throw new Error("Signal.subscribe(listener) requires a function");
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    map<U>(project: (value: T) => U): Signal<U> {
+      if (typeof project !== "function") throw new Error("Signal.map(project) requires a function");
+      return mapSignal(signal, project);
+    },
+    emit(value: T): void {
+      current = value;
+      let failed = false;
+      let firstError: unknown;
+      // Deliver one coherent emission to the subscription snapshot before
+      // failing the widget. A user listener must not prevent retained text or
+      // later listeners from observing the value that was already committed.
+      for (const listener of [...listeners]) {
+        try {
+          listener(value);
+        } catch (error) {
+          if (!failed) firstError = error;
+          failed = true;
+        }
+      }
+      if (failed) failWidget("signal listener", firstError);
+    },
+  };
+  signals.add(signal);
+  return signal;
+}
+
+function mapSignal<T, U>(source: Signal<T>, project: (value: T) => U): Signal<U> {
+  let projections = signalMaps.get(source);
+  if (!projections) {
+    projections = new WeakMap<Function, Signal<unknown>>();
+    signalMaps.set(source, projections);
+  }
+  const cached = projections.get(project);
+  if (cached) return cached as Signal<U>;
+  const mapped: Signal<U> = {
+    get value(): U { return project(source.value); },
+    subscribe(listener: (value: U) => void): () => void {
+      if (typeof listener !== "function") throw new Error("Signal.subscribe(listener) requires a function");
+      return source.subscribe((value) => listener(project(value)));
+    },
+    map<V>(next: (value: U) => V): Signal<V> {
+      if (typeof next !== "function") throw new Error("Signal.map(project) requires a function");
+      return mapSignal(mapped, next);
+    },
+  };
+  signals.add(mapped);
+  projections.set(project, mapped as Signal<unknown>);
+  return mapped;
+}
+
 const timeProvider = (() => {
   const listeners = new Set<(value: TimeData) => void>();
   let timerId = 0;
diff --git a/sdk/test/contract-tables.test.mjs b/sdk/test/contract-tables.test.mjs
index 228f188..488b53f 100644
--- a/sdk/test/contract-tables.test.mjs
+++ b/sdk/test/contract-tables.test.mjs
@@ -4,6 +4,8 @@ import test from "node:test";
 import { compileClass, UtilityError } from "../src/class-compiler.ts";
 
 const contract = readFileSync(new URL("../CONTRACT.md", import.meta.url), "utf8").replaceAll("\r\n", "\n");
+const declarations = readFileSync(new URL("../index.d.ts", import.meta.url), "utf8").replaceAll("\r\n", "\n");
+const reconciler = readFileSync(new URL("../src/reconciler.ts", import.meta.url), "utf8").replaceAll("\r\n", "\n");
 const consolidated = contract.slice(contract.indexOf("## Consolidated v0.4 authoring tables"));
 
 function firstColumnAfter(header) {
@@ -44,3 +46,24 @@ test("consolidated class table representatives compile and omitted families stay
     assert.throws(() => compileClass(authored), UtilityError, authored);
   }
 });
+
+function declarationBlock(source, pattern, label) {
+  const match = source.match(pattern);
+  assert.ok(match, `missing ${label}`);
+  return match[0];
+}
+
+function providerOverloads(source, hook) {
+  return source.match(new RegExp(`^export function ${hook}\\(name: "[^"]+"\\): [^;]+;`, "gm")) ?? [];
+}
+
+test("public Signal and provider declarations match their runtime source", () => {
+  const signalPattern = /^export interface Signal<out T> \{[\s\S]*?^\}/m;
+  assert.equal(
+    declarationBlock(declarations, signalPattern, "public Signal declaration"),
+    declarationBlock(reconciler, signalPattern, "runtime Signal declaration"),
+  );
+  for (const hook of ["useProvider", "useProviderSignal"]) {
+    assert.deepEqual(providerOverloads(declarations, hook), providerOverloads(reconciler, hook));
+  }
+});
diff --git a/sdk/test/reconciler.test.mjs b/sdk/test/reconciler.test.mjs
index 91fd922..280ec83 100644
--- a/sdk/test/reconciler.test.mjs
+++ b/sdk/test/reconciler.test.mjs
@@ -85,6 +85,7 @@ test("widget renders one native generation and providers use native timers", asy
       sdk.h("text", { class: "text-[13px] text-center leading-tight tracking-[-0.5px] line-clamp-2 tabular-nums font-bold font-mono text-shadow-md" }, time.ss),
       sdk.h("text", null, cpu.percent.toFixed(1)),
       sdk.h("text", null, audio.bands[0].toFixed(2)),
+      sdk.h("text", null, false, null, undefined, "conditional"),
       sdk.h("text", null, media.title),
       sdk.h("text", null, `${media.status}:${media.sourceApp}`),
       media.artPath
@@ -276,6 +277,113 @@ function isolatedNative() {
   };
 }
 
+test("provider signals update bound text and sampled values without a root render", async () => {
+  const source = `
+    import { h, useProviderSignal, useState, widget } from "./src/index.ts";
+    const percent = (value) => Math.round(value.rms * 100);
+    widget({ name: "Signal fixture", size: [100, 50], subscribe: ["audio"] }, () => {
+      const audio = useProviderSignal("audio");
+      const [visible, setVisible] = useState(true);
+      const mapped = audio.map(percent);
+      globalThis.mappedSignalIsStable = mapped === audio.map(percent);
+      globalThis.audioSignal = audio;
+      globalThis.laterSignalListenerCalls = 0;
+      globalThis.installThrowingSignalListeners = () => {
+        audio.subscribe(() => { throw new Error("signal listener exploded"); });
+        audio.subscribe(() => { globalThis.laterSignalListenerCalls += 1; });
+      };
+      globalThis.readRms = () => audio.value.rms;
+      globalThis.hideText = () => setVisible(false);
+      return visible
+        ? h("text", { class: "text-white" }, mapped)
+        : h("panel", null);
+    });
+  `;
+  const output = await build({
+    stdin: { contents: source, resolveDir: fileURLToPath(new URL("..", import.meta.url)), sourcefile: "provider-signal-fixture.ts" },
+    bundle: true, format: "iife", platform: "neutral", write: false,
+  });
+  const fixtureOperations = [];
+  let fixtureProviderCallback;
+  const native = {
+    ...isolatedNative(),
+    hostAvailable() { return true; },
+    onProvider(callback) { fixtureProviderCallback = callback; },
+    createNode(type) { fixtureOperations.push(["createNode", type]); return 1; },
+    setProp(...args) { fixtureOperations.push(["setProp", ...args]); },
+    setText(...args) { fixtureOperations.push(["setText", ...args]); },
+    setRoot(...args) { fixtureOperations.push(["setRoot", ...args]); },
+    beginBatch() { fixtureOperations.push(["beginBatch"]); },
+    endBatch() { fixtureOperations.push(["endBatch"]); },
+    abortBatch() { fixtureOperations.push(["abortBatch"]); },
+    reportError(...args) { fixtureOperations.push(["reportError", ...args]); },
+  };
+  const context = { native };
+  vm.runInNewContext(output.outputFiles[0].text, context);
+  assert.equal(context.mappedSignalIsStable, true);
+  assert.equal(fixtureOperations.filter(([name]) => name === "beginBatch").length, 1);
+  assert.equal(fixtureOperations.findLast(([name]) => name === "setText")[2], "0");
+
+  fixtureProviderCallback('{"provider":"audio","value":{"rms":0.42,"bands":[0.75]}}');
+  await Promise.resolve();
+
+  assert.equal(context.readRms(), 0.42);
+  assert.equal(fixtureOperations.findLast(([name]) => name === "setText")[2], "42");
+  assert.equal(fixtureOperations.filter(([name]) => name === "beginBatch").length, 1);
+  assert.equal(fixtureOperations.some(([name]) => name === "reportError"), false);
+
+  context.hideText();
+  await Promise.resolve();
+  assert.ok(fixtureOperations.some(([name, type]) => name === "createNode" && type === "panel"),
+    "the fixture did not re-render to <panel>; the unmount assertion would be vacuous");
+  const textWritesAfterUnmount = fixtureOperations.filter(([name]) => name === "setText").length;
+  fixtureProviderCallback('{"provider":"audio","value":{"rms":0.7,"bands":[0.9]}}');
+  assert.equal(context.readRms(), 0.7);
+  assert.equal(fixtureOperations.filter(([name]) => name === "setText").length, textWritesAfterUnmount);
+
+  assert.throws(() => context.audioSignal.subscribe(null), /Signal\.subscribe\(listener\) requires a function/);
+  assert.throws(() => context.audioSignal.map(null), /Signal\.map\(project\) requires a function/);
+  context.installThrowingSignalListeners();
+  fixtureProviderCallback('{"provider":"audio","value":{"rms":0.8,"bands":[1]}}');
+  assert.equal(context.laterSignalListenerCalls, 1);
+  const signalReport = fixtureOperations.findLast(([name]) => name === "reportError");
+  assert.equal(signalReport[1], "signal listener");
+  assert.match(signalReport[2], /signal listener exploded/);
+});
+
+async function signalTextValidationError(children) {
+  const source = `
+    import { h, useProviderSignal, widget } from "./src/index.ts";
+    widget({ name: "Signal validation", size: [100, 50], subscribe: ["audio"] }, () => {
+      const audio = useProviderSignal("audio");
+      return h("text", null, ${children});
+    });
+  `;
+  const output = await build({
+    stdin: { contents: source, resolveDir: fileURLToPath(new URL("..", import.meta.url)), sourcefile: "signal-validation-fixture.ts" },
+    bundle: true, format: "iife", platform: "neutral", write: false,
+  });
+  const reports = [];
+  const native = {
+    ...isolatedNative(),
+    hostAvailable() { return true; },
+    reportError(...args) { reports.push(args); },
+  };
+  vm.runInNewContext(output.outputFiles[0].text, { native });
+  return reports[0]?.[1] ?? "";
+}
+
+test("signal text validation errors stay exact and actionable", async () => {
+  assert.match(
+    await signalTextValidationError("audio, audio"),
+    /A bound <text> must contain exactly one Signal child; format the complete label with signal\.map\(\.\.\.\)/,
+  );
+  assert.match(
+    await signalTextValidationError('h("panel", null)'),
+    /^Error: <text> children must be strings, numbers, or one Signal; received object/,
+  );
+});
+
 async function runBoundaryFixture(mode) {
   const source = `
     import { h, useEffect, useInterval, useState, widget } from "./src/index.ts";