#505 Reform pass 2: GPUI main pin, restored UI and review fixes

Second radical reform pass, integrated with GPUI main f82ca3fe and the restored Editor UI, followed by fixes for every finding from the codebase review.

What's in it

• Integration: bounded content storage, native list virtualisation, shared components; GPUI main pin (native D3D11 on Windows, vendored optimized syntect/onig); the original Editor appearance restored.
• Forge: unchecked PUT /settings/{key} closed, correct 404/409/500 mapping, policy moved from the store to forge-runs, store split into modules, migration steps instead of magic version hooks, kind_type/parent_id as indexed columns (migration 16), cached project icons and device keys, accept-loop backoff, logs with route and cause.
• Engines/API: one approval shape on the gated item for all engines (migration 17), Forge-resolved agent-message targets, Codex frames parsed once into typed structs, one settle step instead of per-decoder memory accounting, transcript snapshot tests instead of private-state tests, artisan-api back to wire types (new forge-content, artisan-mentions), ACP sign-in by error code.
• Editor: conversation and sidebar rows are cached views again; body preparation owned by Conversation (Bodies) with per-row splices; one text row kind; HostData split into owners; one RangeWindow with task cancellation instead of generation counters; editor-core no longer depends on editor-ui (editor-sources); theme as a GPUI global; Settings/Marketplace on shared page components; picker on shared popover/tooltip/hover primitives; theme tokens for radii and text sizes.
• Fixes: lines stuck on "Loading content…", transcript losing its place on placeholder splits, paging flapping; Claude compaction progress no longer creates one item per frame (migration 18 removes stored repeats), and a compaction stays inside its run's work section.
• Tool rows: plain-sentence tool rows, markdown previews per activity, received agent/session messages; subagent rows read "Agent ".

Verification

• cargo test -p <crate> for all 21 crates: 688 passed, 0 failed (forge-store and artisan-api with --all-features).
• cargo clippy --all-targets --no-deps: 0 errors in every crate.
• Not done: native Windows/macOS runtime or screenshot qualification of this combination.

PROTOCOL_VERSION is 5: Editor and Forge must be updated together. Migrations 16–18 run on first start.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Second reform pass, pinned to GPUI main (native D3D11 on Windows, vendored optimized syntect/onig), with the original Editor appearance restored and fixes applied for every review finding. Protocol version is now 5, so Editor and Forge must update together.

Forge and engines

• Policy moves from the store to forge-runs; kind_type/parent_id become indexed columns (migration 16), and approvals live on the tool/plan item they gate (AwaitingUser) for every engine — ItemKind::Approval is gone (migration 17).
• Large authored text and collection records become immutable content-addressed references; artisan-markdown-index stores parsed Markdown leaves so prose can be replayed without owning the source.
• Codex frames parse once into typed structs, agent messages carry a Forge-resolved target, and Item::native_id leaves the wire type; artisan-api is back to wire types.
• Offline ae forge normalize repairs agent-message 64 KiB ranges; mention grammar ($skill/@connector) lives in the shared artisan-mentions crate.
• Audio playback is a maintained decoder feeding a bounded PCM queue; seeks never retain the full track.

Editor

• Conversation rows are cached views again with one text row kind and per-row splices; bodies are prepared by one owner, fixes to "Loading content…", paging flapping includes a follow check, and compaction lines stay within the run.
• Tool-call rows read as plain sentences with markdown previews (highlighted files, diffs, command output); subagent rows read "Agent ".
• editor-core no longer depends on editor-ui; theme becomes a GPUI global; composer picker splits into modules with cached views and shared popover/tooltip primitives.

All 21 crates pass cargo test (688 tests) and clippy with no errors; native Windows/macOS runtime and screenshot qualification are not yet done.