Module remote 

The remote renderer: a window’s frames drawn by the workspace’s render service instead of a GPU in this process.

The render worker’s contract is unchanged — the main thread still lays out, records each frame as a vello Scene and sends it with its damage through RenderThreadHandle — so app code does not change. What the worker does with a frame does: it writes the scene into the shared ring (tilo_render_protocol::frame), names fonts and images by id (a font from the shared read-only view by its path, anything else uploaded once into a sealed memfd this process owns, so its memory is the app’s), and tells the service. The service answers with the buffer the frame is in; the worker attaches it to the window’s own surface and commits, so the compositor takes it like any client buffer. No GPU device, no surface, no pipelines in the app.

Each window renders on a channel of its own, which the worker asks the compositor’s render broker for (tilo_render_protocol::broker). When the service goes away (it crashed, or the workspace moved to another one), the window keeps showing its last frame, the worker asks for a new channel and the next frame is a whole one: the toolkit always has the full scene.

Functions

active

Whether frames go to a render service, cheaply, for code that records what the service will need (font origins).

note_font_file

font was loaded from path.

requested

Whether this process draws through a render service: the launcher handed it a broker connection, or (outside a sandbox) it was pointed at the broker’s socket. TILO_RENDER=local keeps the in-process renderer.