Status: Implemented. Geode and the editor render and present through Donner's own GPU runtime: native Metal on macOS, native Vulkan on Linux, and the browser's WebGPU in the WebAssembly editor and standalone Geode packages. No production build or shipped artifact contains the transitional WebGPU adapter or a Rust-built GPU library. This page keeps the design number and points to the current documentation; the full design is in Git history.\ Created: 2026-07-05\ Updated: 2026-10-06\ Author: Claude Fable 5.1\ Drafted by: GPT-5.6 Sol

What shipped

donner::gpu is an original C++20 runtime between Geode and editor rendering and the platform GPU. It validates resources and handle lifetimes, records commands, submits work, maps buffers and presents frames, with backends for Metal, Vulkan and the browser's navigator.gpu. It is not a WebGPU C ABI. Every production shader is authored as WGSL, and Donner's own compiler turns it during C++ constant evaluation into the frozen WGSL, MSL or SPIR-V projection its product links; that compiler never runs at run time. When a shader module is created, Metal compiles the frozen MSL text and the browser compiles the frozen WGSL text, while Vulkan takes the SPIR-V words.

Each platform defaults to its own backend, and a requested backend the host cannot provide fails closed. Runtime devices over one selected root share its native device and loss state while keeping their own handles and serials, and a texture of one runtime device reaches another only through export and registration. Waits that detect a hung device measure time without progress rather than the time a whole backlog takes, except two Vulkan waits whose progress the queue cannot judge. Geode's queue-idle drain, a Metal present, Metal's wait for room under its command-buffer backstop, the editor's native UI submission admission and framebuffer readback, and the cross-context registration helper declare the device lost when progress stops; the other waits, such as a host access to a busy buffer, a texture upload and the Metal teardown drain, give up without declaring a loss. The one remaining wgpu-native consumer is a checksum-pinned, Linux-only, test-only resvg comparison reference; the lexical no-Rust verifier and the configured dependency audits keep it out of every product.

The browser editor keeps its device, retained tile textures and canvas on the application thread. Raster workers dispatch validated commands and resource identities; the desktop compositor draws those retained tiles directly into the canvas backbuffer. The GPU runtime reference describes explicit CPU captures and the normal browser residency gates.

Documentation

GPU runtime reference: ownership, backends, backend selection and failure modes.
Embedding Geode in a native host: the internal native embedding seam.
WGSL shader compilation: the shader profile and its projections.
0064: GPU release matrix and binary-size budgets: which lanes exercise each GPU and browser combination, and the size budgets.

Cutover Acceptance

The cutover was qualified on one integrated revision against gates for pixels, validation, bounded resources, frame time, artifact size, dependency closure and an independent security and implementation-provenance review; the pull request that closes #1413 records the evidence for each gate. That review found no critical or high findings (summary), and changes made after the revision it covered fall to the v0.8 release-candidate review in #1422.

The maintainer decided:

GPU matrix. Apple silicon Metal, a discrete Vulkan GPU and lavapipe are mandatory; every other GPU and driver combination is best-effort.
Browser matrix. The browser editor qualifies on Chromium, Playwright's WebKit and real Safari. Physical iOS is outside the cutover's GPU qualification matrix: the maintainer skipped it for #1410, and physical-iPhone checks are v0.8 release preparation in #1420.
Vulkan validation. Per-feature development runs of Khronos synchronization validation on lavapipe, which reported no findings, are sufficient for the cutover. No CI lane enables the Vulkan validation layers.
Native embedding surface. v0.8 exposes none beyond internal callers: the editor, the in-tree embed example and Donner's own tests.
Vulkan suballocation. Not needed; each buffer keeps its own allocation.

Accepted performance exceptions

Chromium editor input-to-frame p95 in the cold-pointer, cold-zoom and warm-pointer phases; the cause is not yet established (#1712).
Five Metal renderer_bench p95 cells, attributed to Apple GPU idle-to-active latency, and one discrete Vulkan GPU p50 cell, caused by the C library allocator in the readback snapshot copy (#1716).

Post-cutover follow-ups

#1647: let a function-scope WGSL name shadow a module-scope one, removing the gradient shader's rename.
#1648: map MSL-reserved WGSL entry names to native names, removing feBlend's rename.
#1718: account the renderer's GPU working set byte for byte, publish the worker renderer's resource statistics in the browser editor, and measure DPR2 thumbnail workloads against the 256 MiB native and 128 MiB WebAssembly working-set caps and DPR2 filter workloads in the browser editor against the 128 MiB cap, keeping them under their caps with the measured peaks recorded on the issue.
#1697: keep a 64-frame overlapped zoom-8 drain on Metal from tripping the system GPU timeout.
#1719: find why a discrete Vulkan GPU's driver reported device loss in the same drain.
#1721: build Geode and the native GPU runtime through the generated CMake build.
#1634: the Firefox Geode lane intermittently captures a blank editor page.
#1643: the hosted macOS browser presentation test can hang on its first browser command.
#1683: a Firefox settled click intermittently never presents on the hosted macOS Perf job.
#1691: a hosted macOS smoke case times out when the browser GPU device request misses its settle window.
#1702: hosted macOS Chromium thumbnail cases time out when offscreen thumbnails never render.
#1642: restore or remove the editor suspend statistics that lost their producer with the reference adapter.
#1420: qualify browser interaction and touch input on WebKit and a physical iPhone.

Original design

The full design, with its implementation checklist, runtime contracts, verification tables and cutover gates, is in Git history at e1016864.