feat(genui): the backend defines the widget, and its buttons route

[AimTune]

Two halves of PROTOCOL.md §10.

Server-defined components. Markup, styles and prop defaults travel once in a genui_components frame; the client registers each as a custom element and a plain ui chunk mounts it from then on. Adding a widget becomes a server deploy. The catalog is versioned by a sha256 the client caches and hands back in hello, so an unchanged catalog costs one tiny frame.

What its buttons do. Until now a genui_event did exactly one thing — a submit naming an open interrupt was coerced to a resume — and everything else was accepted and silently dropped. A data-event button was decorative.

The routing model

The attribute picks the addressee:

markup	scope	who receives it
component-event="rate_delivery"	"component"	the node parked on onEvent waiting for that name — nothing else
mekik-event="track_order"	"graph"	the app's onGenUiEvent, which may start a turn
data-event="…"	absent	component route first, then graph (the original form, still supported)

Resolved in that order, with the §4.4 shortcut ahead of both: a payload id naming an open interrupt is a direct address, so it outranks scope. A frame matching none of the three is accepted and dropped — the right cost for a decorative button, and the first thing to check when a button looks dead.

Two new author-facing pieces

onEvent / Shuttle.OnEvent — approve for widgets. The run parks, but a button on a component already on screen answers it:

deliveryCard(ctx, props, { id: "card-1" });                 // mount it first
const rating = await mekik.onEvent<{ stars: number }>(ctx, "rate_delivery");

An ordinary ilmek interrupt, so it inherits everything a pause already gives you — checkpointed, survives a restart, re-announced in welcome.pending. Its frame carries data.event so a client knows to wait for the widget instead of rendering Approve/Cancel. The pause the node holds is the binding, so nothing carries an interrupt id.

onGenUiEvent / OnGenUiEvent — input for components. A mapper, not a place to do work: return a graph input update to run a turn on the interaction, or nothing to ignore it. The turn obeys §5 (busy, interrupted) and writes no text frame on the user's behalf, because a click is not an utterance.

Also here

• withTurn / WithTurnAsync extracted, so text, resume and a component-driven turn take the local lock and cross-node lease through one path and can't drift apart on the locking rules.
• The .NET example self-test never ran in CI while its TypeScript twin did. It's in the probe step now, so the routing is covered on both sides.
• Conformance scenarios 15 and 16, with 16 added to the "ports tend to break this" list — scope precedence is exactly the kind of rule that can be silently wrong.
• Both server-components examples now demonstrate all three routes end to end, including a second pause the card's own Rate button answers. The settled beat is journaled because of it — without that, the rating's replay pass would re-emit states the client already rendered.

Verified

TypeScript	111 tests + every example self-test (pnpm check)
.NET	76 tests + every example and probe
Docs	site builds under onBrokenAnchors: "throw"
Parity	both server-components self-tests emit identical frame sequences

Note for the reviewer

The client half lives in AimTune/chativa — component-event / mekik-event have to be bound there for the new attributes to fire. That PR is up alongside this one and I checked the two agree on the wire by feeding chativa's frame factory output straight into a real mekik app.

.vscode debugger config is deliberately not in here — it's #9, off main, touching disjoint files.

🤖 Generated with Claude Code