[macOS] Fix back buffer cache returning a wrong-size surface (Impeller null deref in Canvas::SetupRenderPass) - #192522

…nt state

Disable Impeller on macOS (flutter/flutter#192522), F-33 Countdown Swing
stories/task board, F-32 board archive, PRD update, version/pubspec
sync, persona state updates, and golden failure diffs from macOS run.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

## Problem

XPath 1.0.0 (54) crashed on macOS 26.7.1 while it was in the background:
`EXC_BAD_ACCESS` at `0x0` on `io.flutter.raster`, in
`impeller::Canvas::SetupRenderPass()` (canvas.cc:1615), called from
`EmbedderExternalViewEmbedder::SubmitFlutterView`.

## Root cause: a Flutter engine bug

This is
[flutter/flutter#185394](flutter/flutter#185394),
"[Impeller] Crash on macOS when app is foregrounded" (open, P2,
team-macos). The macOS back-buffer cache (`FlutterBackBufferCache`) can
hand back a surface of the wrong size when the window's frame size
changes and then changes back (A → B → A). Examples are a display
hot-plug or reconfiguration, a Space or full-screen change, a window
drag, or bringing the app to the front. Impeller wraps the mismatched
`MTLTexture`, the texture invalidates itself, and the render target
silently drops it. `SetupRenderPass` then dereferences the null texture.

- Fix:
[flutter/flutter#192522](flutter/flutter#192522)
is still **open** (not merged). It is not in 3.47.7 (the latest stable,
per its CHANGELOG) or in the 3.50 beta.
- Also reported: #193095 (same stack) and #192829 (Cmd-Tab on macOS 27,
closed as a duplicate).

**Reproduced on our pinned SDK (3.47.6, release build).** This used a
minimal scratch app, not XPath. A Swift timer shrinks the window by 1 pt
and restores it every 2.5 s, which is the driver from #192522. The
Flutter side redraws a text once a second, the way `XpClock` does:

| Renderer | UI | Result |
|---|---|---|
| Impeller (default) | 1 s ticking text | **SIGSEGV after 5 s, at flip
#1.** The stack matches the field crash frame for frame (canvas.cc:1615
/ 372, dl_dispatcher.cc:1318, embedder_external_view_embedder.cc:376 /
598). |
| Impeller | still UI | survived 60 s (17 flips) |
| Skia (`FLTEnableImpeller=false`) | 1 s ticking text | **survived 90 s
(36 flips)**, with no validation errors and the log line `Using the Skia
rendering backend (Metal).` |

## Changes

1. **`macos/Runner/Info.plist`: `FLTEnableImpeller = false`** (with a
comment linking the issues). I checked the 3.47.6 engine source to
confirm macOS still reads this key: `FlutterDartProject.enableImpeller`
reads it, and `FlutterEngine runWithEntrypoint` then skips
`--enable-impeller=true` and uses Skia (Metal). XPath uses no
Impeller-only features (no fragment shaders, Flutter GPU or backdrop
filters). Goldens and widget tests are unaffected because `flutter test`
does not read `Info.plist`.
2. **`XpClock` follows the app lifecycle** using an
`AppLifecycleListener`. It ticks only while the app is `resumed`. When
the app is `inactive` (visible but not in front), `hidden` (occluded or
minimised) or `paused`, the timer stops. On resume, every live duration
is rebuilt at once against the current time. The new
`XpClock.isLive(context)` tells widgets whether the app is in front.
3. **`XpSpinner`** stands still while `!XpClock.isLive`, as it already
does under Reduce Motion.

Change 1 is the fix. Changes 2 and 3 mean XPath draws no frames of its
own while it is not in front (it used to draw one a second for the
clock, and 60 fps per spinner). That lowers the crash exposure and saves
CPU and battery. On its own it does **not** fix the engine bug: a
display change still causes a frame, and upstream reports idle apps
crashing too.

## Tests

`apps/xp_desktop/test/widgets/xp_clock_test.dart` drives the real
`flutter/lifecycle` platform channel, the same messages the macOS
embedder sends:
- `XpClock ticks every second while the app is in front`
- `XpClock stops while inactive|hidden|paused and catches up on resume`
- `XpClock a still clock stays still in front and away`
- `XpClock starts still when the app is already away`
- `XpClock without a clock above, the system time is live`
- `XpClock spinners stand still while the app is away`

## Trade-offs and follow-ups

- Skia is Flutter's legacy renderer on macOS. The Flutter docs warn that
the Impeller opt-out will be removed in a future release, and with Skia
there is no wide-gamut colour. Once a Flutter stable ships #192522,
remove the key (the Info.plist comment says so).
- While XPath is visible but not in front, elapsed times stay frozen
until it comes back to the front, and then catch up at once.

Impeller's back-buffer cache can hand a wrong-size surface to the raster
thread after the window/display size flip-flops (wake from sleep with an
external monitor, resize, fullscreen), which null-derefs in
impeller::Canvas::SetupRenderPass and kills the app with SIGSEGV on
io.flutter.raster.

Upstream: flutter/flutter#185394, fix in flutter/flutter#192522 (open,
not in any stable release yet). Re-enable FLTEnableImpeller once a
stable Flutter ships that fix.

The Mirror pane now takes iPhones. On macOS the picture comes from
QuickTime's capture route: once screen-capture devices are allowed,
macOS offers a USB iPhone as a camera (IosScreenCapturePlugin.swift, so
camera permission). Elsewhere it is CoreDevice screenshots, under two a
second.

Input goes through the CoreDevice HID services in Xcode 27's developer
disk image, the ones Device Hub uses (api/ios_mirror.rs, behind
IosMirrorService): live touch, keys as HID usages, Home / Lock / volume,
paste through the pasteboard service, and rotation. Without Developer
Mode and the disk image the mirror is view-only and says why.

What an iPhone 16e (iOS 26.6) showed, and the code now relies on:
- Starting the capture re-enumerates the phone on USB, so input
  connects only after the first frame.
- A drag that stops and then lets go flings unless the still finger
  wobbles a pixel; the input worker does that every 16 ms.
- The phone opens its per-session virtual touchscreen about 150 ms
  after connecting and queues or drops events sent earlier, so a session
  is handed out after 300 ms, and closing waits 100 ms.
- Send calls are synchronous bridge calls, so touches keep their order.

On iOS 27 the phone wants an open displayservice stream before it takes
HID events; the session opens one and drains it, untried on hardware.
The plugin holds its redraws back while the window changes, to dodge an
unfixed Flutter Impeller crash (flutter/flutter#192522).

test/device/ios_mirror_device_test.dart passes on the iPhone 16e.

Co-Authored-By: Claude Opus 5.5 <[email protected]>