docs: adopt Qt+GPUI native desktop strategy, retire CEF (Wave 0, PR A)

CLAUDE.md

@@ -167,7 +167,7 @@ Wrap each major view root with `components/ui/ViewErrorBoundary.tsx` — provide
 
 **Container queries:** Resizable panels set `containerType: 'inline-size'` via inline style. Use `@container` CSS queries or the Tailwind `@container` variant for responsive panel content.
 
-**Tauri build isolation:** `vite.config.ts` uses `external: [/^@tauri-apps\//]` (regex) to exclude all Tauri packages from the web build. When adding new Tauri plugin imports to `services/tauriRuntime.ts`, the regex already covers them.
+**Tauri build isolation:** `vite.config.ts` uses `external: [/^@tauri-apps\//]` (regex) to exclude all Tauri packages from the web build. The regex covers any `@tauri-apps/*` import, but new Tauri capability access should go through `packages/desktop-contracts` (the `DesktopPlatform` interface, consumed via `services/desktopPlatform.ts`) rather than a direct import — enforced by `pnpm run guardrail:desktop-imports` (`scripts/check-tauri-import-boundary.mjs`), a zero-tolerance CI gate.
 
 **Tauri CSP:** When adding a new external endpoint, extend `connect-src` in `src-tauri/tauri.conf.json`. Web `fetch` alone is not enough.
 
@@ -309,7 +309,7 @@ All `.md` guides listed in **[`README.md`](README.md#-documentation-hub) § Docu
 - Gemini API calls must use `NetworkOnly` caching (never cache AI responses in the Service Worker).
 - Use `focus-visible:ring-2` for keyboard focus styles.
 - `dangerouslySetInnerHTML` only with DOMPurify-sanitized content — never raw.
-- No direct `@tauri-apps/api` imports in `components/ui/` atoms; abstract through `services/tauriRuntime.ts`.
+- No direct `@tauri-apps/api` imports in `components/ui/` atoms; abstract through the `DesktopPlatform` interface (`packages/desktop-contracts`, consumed via `services/desktopPlatform.ts`), mechanically enforced by `pnpm run guardrail:desktop-imports`.
 - File size target: **200–700 lines**. Over 700 → split into submodules, hooks, or selectors.
 - Never skip failing tests to green CI — fix the root cause. `it.skip` requires a file-level comment with reason + ticket.
 - **Modus operandi — tests:** When you modify, add, or delete a code file, check whether a corresponding test file exists (`tests/unit/` or `tests/e2e/`). If it does, update it. If it doesn't and the change is non-trivial, create it. Run with `pnpm exec vitest run <path>` to verify. Write fully deterministic tests: mock `Date.now()` / fake timers; no real network; reset Redux store + IDB in `beforeEach` (patterns from `tests/setup.ts`). Use `@testing-library/user-event` for interactions; `findBy*` / `waitFor` for async assertions.

README.md

@@ -774,8 +774,8 @@ See **[`CONTRIBUTING.md`](CONTRIBUTING.md)** for the full dev setup, Biome / Vit
 | [`docs/DEEPSOURCE-REVIEW-LOOP.md`](docs/DEEPSOURCE-REVIEW-LOOP.md) | DeepSource static-analysis correction loop (living runbook; complements the CodeAnt loop) |
 | [`docs/DEEPSOURCE-REMEDIATION-PLAN.md`](docs/DEEPSOURCE-REMEDIATION-PLAN.md) | Prioritised DeepSource backlog tracker (P0-security→P5-docs) with triage decisions |
 | [`docs/adr/`](docs/adr/README.md) | Architecture Decision Records — state-management boundaries, local-AI stack layering, WorkerBus v2 hybrid routing |
-| [`docs/cef/ROADMAP-CEF-DESKTOP-MIGRATION.md`](docs/cef/ROADMAP-CEF-DESKTOP-MIGRATION.md) | CEF desktop-runtime migration roadmap (ADR-0019) — 22-wave plan to succeed Tauri; risk register, competency matrix, Tauri-coupling inventory, and UI/domain-state classification live alongside it in `docs/cef/` |
-| [`docs/architecture/native-readiness.md`](docs/architecture/native-readiness.md) | Native-Readiness scorecard (CEF roadmap §7.4.5) — cross-cutting architecture-quality checklist, re-scored at every architecture-changing PR |
+| [`docs/native/ROADMAP-QT-GPUI-DESKTOP.md`](docs/native/ROADMAP-QT-GPUI-DESKTOP.md) | Qt 6 + GPUI native desktop roadmap (ADR-0021) — 24-wave plan: renderer-neutral Rust Core → Qt Hardened Edition → GPUI Vision Edition, succeeding Tauri; CEF retired, historical record in `docs/historical/cef/` |
+| [`docs/architecture/native-readiness.md`](docs/architecture/native-readiness.md) | Native-Readiness scorecard (see ADR-0021) — cross-cutting architecture-quality checklist, re-scored at every architecture-changing PR |
 | [`docs/ACCESSIBILITY.md`](docs/ACCESSIBILITY.md) | A11y architecture (live regions, focus, WCAG 2.2, Lighthouse 0.95 gate) |
 | [`docs/BEST-PRACTICES.md`](docs/BEST-PRACTICES.md) | Engineering + content guidelines, glossary, CI parity checklist |
 | [`docs/Design-System.md`](docs/Design-System.md) | Tokens, Tailwind preset, UI primitives under `components/ui` |

ROADMAP.md

@@ -22,13 +22,19 @@ Benchmarks from the UI/PWA deep-dive (implemented in repo, no new mandatory docs
 ---
 
 
-## Desktop runtime — CEF migration (PLANNED, Wave 0 in progress)
-
-WorldScript Studio intends to migrate its desktop runtime from Tauri 2 / system WebView to Chromium
-Embedded Framework (CEF) as a long, gated, multi-wave program — not part of the v2.0 Foundation
-scope below, tracked separately. Full strategy, waves, and gates:
-[ADR-0019](docs/adr/0019-cef-desktop-runtime-strategy.md) ·
-[`docs/cef/ROADMAP-CEF-DESKTOP-MIGRATION.md`](docs/cef/ROADMAP-CEF-DESKTOP-MIGRATION.md).
+## Desktop runtime — Qt 6 + GPUI native strategy (PLANNED — Rust Core prerequisite work not yet started)
+
+WorldScript Studio's desktop runtime plan is React/PWA (first-class web product) → Tauri 2
+(transitional only, retired once Qt reaches Stable) → an authoritative Rust Core → Qt 6/Qt Quick
+(QML) as the primary native desktop product → GPUI admitted later as a secondary native product
+behind a strict gate. CEF was evaluated and retired from the target architecture because Crashpad
+cannot produce sandboxed-renderer crash dumps under Linux's default Yama `ptrace_scope=1` without
+weakening the sandbox — R-19. Not part of the v2.0 Foundation scope below, tracked separately. Full
+strategy, waves, and gates:
+[ADR-0021](docs/adr/0021-qt-gpui-native-desktop-strategy.md) ·
+[`docs/native/ROADMAP-QT-GPUI-DESKTOP.md`](docs/native/ROADMAP-QT-GPUI-DESKTOP.md). Superseded CEF
+decision record: [ADR-0019](docs/adr/0019-cef-desktop-runtime-strategy.md) ·
+[`docs/historical/cef/README.md`](docs/historical/cef/README.md).
 
 ---
 

docs/adr/0019-cef-desktop-runtime-strategy.md

@@ -1,6 +1,6 @@
 # ADR 0019: CEF as the next-generation WorldScript Studio desktop runtime
 
-**Status:** Accepted (strategy only — no implementation yet). This ADR locks the direction; it does not add any CEF code, dependency, or build target. Full context, waves, and gates: `docs/cef/ROADMAP-CEF-DESKTOP-MIGRATION.md`.
+**Status:** Superseded by [ADR-0021](0021-qt-gpui-native-desktop-strategy.md), adopted 2026-08-20 — CEF is no longer WorldScript Studio's target desktop-runtime decision. This status change reflects the *decision*, not completed execution: ADR-0021's companion cleanup PR (Wave 0 PR B) removes the actual CEF source/CI separately. Preserved below as the historical record of the original decision and its reasoning; do not treat it as current direction. See `docs/historical/cef/README.md` for what is being retired.
 
 ## Context
 

docs/adr/0020-cef-binding-choice-thin-cpp-host.md

@@ -1,6 +1,6 @@
 # ADR 0020: CEF integration choice — thin C++ host + Rust core (Option B)
 
-**Status:** Accepted, backed by a real hands-on spike (not a desk decision). Scope: the Wave 2 "constrained spike" required by `docs/cef/ROADMAP-CEF-DESKTOP-MIGRATION.md` §10 and its Appendix H decision scorecard. This ADR does not add CEF to the production build — no `src-tauri/` or app code changed. The spike lives outside the repository (disk-space reasons, see Consequences) and is not committed.
+**Status:** Superseded by [ADR-0021](0021-qt-gpui-native-desktop-strategy.md), adopted 2026-08-20 — CEF is no longer WorldScript Studio's target desktop-runtime decision. This status change reflects the *decision*, not completed execution: ADR-0021's companion cleanup PR (Wave 0 PR B) removes the actual CEF source/CI separately. Preserved below as the historical record of a real, evidence-backed spike; do not treat it as current direction. See `docs/historical/cef/README.md` for what is being retired.
 
 ## Context