[gregoreesmaa]

[energy] Launch/disk I/O: fonts, remote re-downloads, decode churn, plugin spawns, Carbon edge. Closes #390. Cold-open I/O diet across five areas; no behavior change (still images, GIF first frames, placeholders, screenshots pixel-identical by construction - confirm via CI suite). FULL BODY FOLLOWS IN COMMENTS - placeholder

[gregoreesmaa]

What changed (all in worktree energy/390-launch-io, 5 files, +521/-49)

[gregoreesmaa]

1. Fonts (macos.m register_app_fonts + bundle scripts) - Resolves Contents/Resources/Fonts bundle-relative FIRST via mainBundle URLForResource, registers only existing paths. Source-relative assets/fonts/* kept as dev fallback. Ship (which never ships top-level assets/) pays zero failed stats; dev keeps working. make_app_bundle.sh vendors the 5 TTFs into Resources/Fonts (data files, never linked - ship __TEXT untouched); check_app_bundle.sh hard-gates their presence. No @embedfile (would cost ~800 KiB __TEXT).

[gregoreesmaa]

2. Remote images (macos.m image_session + ImageFetchDelegate) - New NSURLSessionDataDelegate enforces the remote_policy.zig contract the old session ignored: 8s request/resource timeouts (were 20/30s), MAX_IMAGE_BYTES via didReceiveResponse expectedContentLength cancel + didReceiveData byte counter (was unbounded NSData), max 3 redirects via willPerformHTTPRedirection, no credential/cookie persistence (credentialStorage=nil, cookieStorage=nil, acceptPolicy=Never). Per-task counters live in a static 16-slot ring (no NSDictionary heap churn; >16 concurrent fetches degrade fail-safe to early-cancel placeholders). Session contract probe platform_test_image_session tightened to exact values + delegate non-nil + no-cookie assertions.

[gregoreesmaa]

3. Image decode churn (macos.m loader) - load_image_source_into_record decodes frame 0 only; frames 1..N decode lazily via decode_frame_on_demand (displayed frame +1 prefetch), called from platform_draw_image and gif_advance_frame. A 44-frame GIF now pays 1 decode + 1 prime at load instead of 44+44. Source retained per record (released with it; records are never evicted so no lifecycle change). load_image_sync goes vector-first for .svg/.pdf (skips doomed ImageIO source + frame-0 probe; advisory extension check, still fails closed). Resolved path stored in record at creation - arrivals and platform_arm_images never re-resolve (one resolve per record lifetime). image_load_completed invalidates rect-only via the last drawn rect; off-viewport arrivals skip invalidation entirely. platform_test_image_primed counts decoded frames so primed==total still holds for scroll_profile.sh.

[gregoreesmaa]

4. Plugins (main.zig) - pluginKickForDocument: hasPluginFences fast path before cache-root getenv/job scan/per-job stats (one scan over resident line structs, no bytes walk). pluginWriteShim: hash-skip via pluginFileContentMatches (no rewrite/chmod/mtime churn when bytes identical). New pluginTidyCache(root) per open, before the fence fast path so plain docs clean too: root-derived renderer dirs (cross-session), drops stale probe-.src/.out sentinels, prunes PNGs past 64 files oldest-mtime-first; bounded (256-scan/dir, 32 deletes), best-effort, zero heap (local readdir/stat externs via @extern symbol rename since std.c exposes them Darwin-only; no std.Io/std.fs in ship). pluginJoinPath wraps pluginChildPath (one join codegen site). New unit test pins sentinel matching + join NUL/exactness.

[gregoreesmaa]

5. Launch/Carbon (macos.m + build.zig + main.zig) - Carbon framework link removed from all three link sites; IsSecureEventInputEnabled arrives via dlopen in secure_input_active (cached, fail-open to inactive; dlfcn is libSystem, definition at EOF per SIZE NOTE). All 3 call sites (context menu x2, validateMenuItem) switched with identical truth table. activateMappedFile calls adviseSequential so in-place opens and external reloads get the same SEQUENTIAL+WILLNEED prefetch as cold start.

[gregoreesmaa]

Verification (Windows host - macOS build blocked, done rigorously instead) - Linux-cross zig build test compiles (mod_tests ReleaseFast x86_64-linux-gnu success; only foreign-binary execution fails, pre-existing). Native zig test of the identical tidy algorithm (std.Io variant, same match/prune/delete logic): 3/3 pass - stale sentinels removed, live shim kept, 70 PNGs pruned to exactly 64, content-match exact/mismatch/missing all correct. Notably the harness caught a REAL bug pre-commit: sentinel tail length 10 vs correct 6 (fixed). Exact ship bodies compile for x86_64-macos via build-obj. sh -n clean on both touched scripts. New pure-function unit test added (runs on macOS CI). strict_benchmarks.zig untouched (never loosened).

[gregoreesmaa]

Platform-blocked gaps (need macOS CI) - zig build test -Doptimize=ReleaseFast --summary all (full gate incl. strict benchmarks); ./scripts/size_gate.sh with twin-delta for the PR body (new ship code: tidy + shim-skip + delegate + on-demand fault + secure_input_active; expect small plugin-account growth, core roughly flat minus Carbon load command); screenshot_suite.sh regen + staging + byte-compare; fs_usage cold-open I/O confirmation (fewer stats, no re-downloads, bounded decodes). Screenshots should be pixel-identical by construction: stills decode frame 0 as before, GIF first paint is frame 0, placeholders/rect math unchanged.