Make the macOS shell a first-class host

Pty children are exec'd with their own TERM/COLORTERM/TERM_PROGRAM instead of
inheriting a .app launch's empty environment, and ttyTaken finally answers on
darwin — libproc walks the tty's foreground process group — so Escape reaches
the child and Exec stops believing every pane sits at its prompt. The
occupancy suite runs on both platforms now.

The workspace tag row moves into the native menu bar as a Builtins menu.
-Dworkspace-tag (default off for -Dplatform=macos, on everywhere else) drives
it, and Pardes.topBarHeight replaces the TOPBAR_H constant so the core stops
reserving the row.

The view pins every variable-font axis to the file's own default (Maple Mono
came up Thin otherwise), shapes ligatures, carries per-shape pointer cursors,
and draws the look-hover affordance as refracted glass. Tag rows fill edge to
edge, with the anchor box painted back on top of that fill and its mode glyph
centred on the same square. Theme accents re-saturated across the set.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

1 files changed, 35 insertions, 3 deletions

diff --git a/docs/macos.md b/docs/macos.md
index 9190ca67..e104d3a6 100644
--- a/docs/macos.md
+++ b/docs/macos.md
@@ -369,6 +369,14 @@ second spelling of builtins — `AppDelegate` calls `run("New")`, `run("Save")`,
 `run("Help")`, `run("Tutor")` — and the items with no builtin behind them are
 left out rather than stubbed.
 
+The workspace tag row — the topmost tagline, the one carrying `Newcol Joincol
+Find Grep …` — is not drawn on this shell. `-Dworkspace-tag` (default off for
+`-Dplatform=macos`, on everywhere else) hands the row to the menu bar: the
+core stops reserving the row (`Pardes.topBarHeight`), the grid starts at the
+column tags, and the row's commands live in a **Builtins** menu instead. The
+items are the tag's own words, spelled exactly as a tag Exec would type them,
+and nothing in that menu is editable — it is the tag's buttons, not the tag:
+
 | menu | item | chord | what it does |
 |---|---|---|---|
 | pardes | About pardes | — | AppKit's panel |
@@ -378,6 +386,7 @@ left out rather than stubbed.
 | | New | ⌘N | the `New` builtin |
 | | Save | ⌘S | the `Save` builtin |
 | | Close Window | ⌘W | AppKit; the app terminates after the last one |
+| Builtins | Newcol / Joincol / Find / Grep / Changelog / Dump / NextColor / Debug / Kill | — | the workspace tag's own builtins, `run(word)` |
 | Edit | Paste | ⌘V | the view's own paste path, not a second one |
 | View | Zoom In / Zoom Out / Actual Size | ⌘= / ⌘- / ⌘0 | point size, host-side |
 | Window | Minimize / Zoom | ⌘M / — | AppKit |
@@ -455,6 +464,32 @@ Nested launches use the same inherited 9P address and pane serial as other
 native hosts. They do not inspect ancestor processes or executable names.
 See [the control filesystem](fs.md) for paths and transports.
 
+Two more things this host cannot inherit from its launcher, because a `.app`
+has none:
+
+- **The terminal's identity.** `host_io.ChildEnv` writes `TERM`, `COLORTERM`
+  and `TERM_PROGRAM` over whatever the environment carried and the child is
+  `execve`'d with that array — built before the fork, because a `setenv`
+  between fork and exec can deadlock on the heap a pty reader thread was
+  holding. Every pane is emulated by the bundled VT, so the value describes
+  pardes and never the terminal pardes was started from; `-Dplatform=gui` and
+  the tty shell take the same path, where the difference is only that their
+  launcher usually happened to set something. The names come from
+  `config.child_term` / `child_colorterm` / `child_term_program`, and `TERM`
+  is deliberately `xterm-256color` rather than a name with no installed
+  terminfo entry — `clear`, colour and cursor addressing all resolve through
+  that lookup.
+- **Whether a program has the terminal.** `host_io.ttyTaken` is what
+  `Pardes.takesCommandLine` asks before deciding that Escape is the `Last`
+  builtin rather than a keystroke for the child, and what `Exec` asks before
+  believing a pane is at its prompt. Linux descends `/proc/<pid>/task/<pid>/
+  children`; darwin has neither that nor a children list, so it enumerates the
+  tty's foreground process group with `proc_listpids(PROC_PGRP_ONLY)` and
+  compares each member's `proc_pidpath` against the shell's own. A nested
+  interactive shell is therefore still a prompt, and `bash -c 'sleep 30'` is
+  still taken — the wrapper wears the shell's binary, but `sleep` shares its
+  group. The occupancy suite in `src/host_io.zig` runs on both platforms.
+
 ## Fonts and zoom
 
 The face is the shell's business and the size is the window's, so the two are
@@ -1109,9 +1144,6 @@ used for the table and is not folded into the direct-path claim.
   says nothing either. Wiring it up means a unix-socket frontend loop beside
   the AppKit one, which is `src/detached/client.zig`'s job in the tty and SDL
   shells; see `docs/detached.md`.
-- **`tty_taken` on darwin.** The pull is wired (`ttyTaken`, `src/macos.zig:1838`)
-  but `look.ttyTaken` has no libproc implementation and answers `false`, so an
-  `Exec` here always believes the pane is still at the prompt it forked.
 - **IME and marked text.** Only finished characters reach `pardes_key`, so a
   dead key composes nothing and Option is Alt rather than a compose modifier.
   Real composition means implementing `NSTextInputClient` *and* giving the core