feat(r3-a): prove the offline PMTiles map on macOS

[Morialkar]

Third and last capability R3-A had to demonstrate. macOS now passes all three; the target matrix is still open, so no Go/No-go is declared.

Result

The probe runs when the native window starts and records its verdict in the spike database, so the Windows, iOS and Android smoke runs can read it without driving a UI:

{
  "ok": true,
  "sourceFeatures": 87,
  "renderedFeatures": 7,
  "blockedRequests": [],
  "transport": "tauri-fs"
}

87 features decoded from the bundled archive and 7 actually painted — the map draws, it does not merely load. blockedRequests: [] means no network resource was even asked for; the style deliberately carries no glyphs or sprites, which would be hidden network dependencies.

The fixture

Built from the Natural Earth country geometry already vendored for the gazetteer — public domain, so redistributable, and nothing is downloaded. No OSM-derived data, no tile-server prefetching, as the spec requires.

packages/core/scripts/build-pmtiles-fixture.mjs writes the PMTiles v3 container directly instead of shelling out to tippecanoe, so the archive rebuilds from a clean checkout with pnpm alone. 598 KiB, zooms 0–4.

It is validated two ways: a test asserts the v3 header, MVT tile type, declared layer and size; and every tile was parsed with @mapbox/vector-tile (7/7 decoded with a populated countries layer) before any of this was blamed on Tauri.

Two platform findings

Tauri's app protocol does not do HTTP byte serving. PMTiles reads an archive as byte ranges. tauri://localhost answers Range: bytes=0-126 with 200, no Content-Range, and all 612 390 bytes — and the reader refuses such a backend outright ("Check that your storage backend supports HTTP Byte Serving"). Serving the archive over tauri:// does not work. It ships as a bundle resource and is read through the fs plugin instead, which is closer to what a local-first build would do anyway.

That native path needs its own ACL grants — fs:allow-open, fs:allow-seek, fs:allow-read, fs:allow-fstat — separate from the readFile/writeTextFile helpers. Note fs:allow-close does not exist and fails the build.

Reads must be serialized. A seek followed by a read is two round trips over one shared cursor, and MapLibre requests tiles concurrently. Interleaved seeks hand each reader another range's bytes; the symptom appears far from the cause, as a corrupt tile ("Extra bytes past the end").

Both are written up in the evidence bundle so the mobile targets do not rediscover them.

Verification

• native verdict above, read back from probe_verdicts in the spike database
• 82 client tests (4 new on the fixture), tsc -b, ESLint, Prettier clean

Scope

Spike-only and disposable. The production map still uses OSM raster tiles over the network; this probe deliberately does not, because the spike has to show the map standing up with no connectivity.

Remaining before any decision: Windows, iOS simulator, Android emulator.