feat(panes): panes.state(id) — let a plugin apply its own pane's values

mirrorGlobal covers the case where a pane drives a plain global that some
renderer reads each frame. It does not cover the far more common one: a
plugin whose MAIN-realm code is the authority — it clamps, it persists, it
emits events, it owns the audio graph or the camera rig — and which must
therefore APPLY the pane's values itself rather than have core splat them
somewhere.

Camera Director is the case that forced this. Its brain is the sole writer
of the camera store, the sole broadcaster on splitscreen's channel, and the
only thing that clamps an axis to its legal range. A pane cannot write
window.__h3dCamCtl behind its back without desynchronising its presets, its
persistence, and the panel's own sliders — and running the brain inside the
pane realm would make it a SECOND store writer and a second broadcaster,
racing the real one.

So: `panes.state(id)` hands the main realm the open pane's store
(get/set/all/subscribe). A plugin seeds it on `panes:opened`, subscribes,
and applies what comes back through its own API. The pane stays
realm-agnostic — it only ever touches ctx.state — and the plugin stays the
single source of truth.

For that to work, the hub now broadcasts EVERY change to the store, not just
the ones a pane asked for: it subscribes to the store on connect rather than
echoing pane-originated writes by hand. A value the plugin clamps or corrects
therefore reaches the pane window immediately, and there is exactly one path
by which state arrives in a pane — so it cannot drift.

Signed-off-by: topkoa <topkoa@gmail.com>

static/panes/pane-hub.js

@@ -109,7 +109,20 @@
 
     function _connect(paneId) {
         if (conns.has(paneId)) _disconnect(paneId);   // a reloaded pane window says hello again
-        conns.set(paneId, { streams: new Map(), pending: null, rafId: null });
+        const entry = panes._entry(paneId);
+
+        // Broadcast EVERY change to the authoritative store, whoever made it —
+        // not just the ones a pane asked for. A plugin's main-realm code is often
+        // the real authority (it clamps, it persists, it owns the rig), and when
+        // it corrects or seeds a value through panes.state(id).set(), the pane
+        // window has to see that too. Subscribing here means the pane's own write
+        // is echoed by the same path that carries a main-realm write, so there is
+        // exactly one way state reaches a pane, and it cannot drift.
+        const unsubState = entry ? entry.state.subscribe((_all, change) => {
+            if (change) send('state', paneId, change);
+        }) : null;
+
+        conns.set(paneId, { streams: new Map(), pending: null, rafId: null, unsubState });
         const spec = panes.get(paneId);
         if (spec) spec.events.forEach(_hookEvent);
     }
@@ -118,6 +131,7 @@
         const conn = conns.get(paneId);
         if (!conn) return;
         conn.streams.forEach((unsub) => unsub());
+        if (conn.unsubState) conn.unsubState();
         if (conn.rafId != null) cancelAnimationFrame(conn.rafId);
         conns.delete(paneId);
         const spec = panes.get(paneId);
@@ -183,10 +197,11 @@
             case 'state': {
                 const entry = panes._entry(paneId);
                 if (!entry) return;
-                // The main realm is authoritative: apply, then echo to everyone.
-                // A pane's own optimistic paint is corrected by the echo, so two
-                // panes racing on one key converge instead of diverging.
-                if (entry.state.set(p.path, p.value)) send('state', paneId, { path: p.path, value: p.value });
+                // The main realm is authoritative: a pane's write is a request. We
+                // apply it here; the store subscription in _connect() does the
+                // echoing, so a pane's optimistic paint is corrected by exactly the
+                // same path that carries a main-realm write.
+                entry.state.set(p.path, p.value);
                 break;
             }
 

static/panes/pane-manager.js

@@ -330,6 +330,29 @@
         // participate without a private import.
         registerHost,
 
+        // The main realm's handle on an open pane's state.
+        //
+        // `mirrorGlobal` covers the case where a pane drives a plain global that
+        // some renderer reads. It does NOT cover the far more common one: a
+        // plugin whose main-realm code is the authority — it clamps, it persists,
+        // it emits events, it owns the audio graph or the camera rig — and which
+        // therefore needs to APPLY the pane's values itself rather than have core
+        // splat them somewhere.
+        //
+        // Such a plugin subscribes here on `panes:opened`, seeds the store with
+        // its current values, and applies whatever comes back. The pane stays
+        // realm-agnostic (it only ever touches ctx.state) and the plugin keeps
+        // being the single source of truth. Returns null when the pane is closed.
+        state: (id) => {
+            const entry = open.get(id);
+            return entry ? {
+                get: (path) => entry.state.get(path),
+                set: (path, value) => entry.state.set(path, value),
+                all: () => entry.state.all(),
+                subscribe: (fn) => entry.state.subscribe(fn),
+            } : null;
+        },
+
         // Host-internal. pane-hub.js serves a pop-out realm from the
         // authoritative state store, which only lives here. Not part of the pane
         // API — panes must never reach for this.