packages/cua-driver/docs/e2e-convergence-journal.md
Historical record. Use action-support.md and the hosted platform support
reference for current support claims.
This journal records changes and test evidence for the Rust desktop harness convergence work. It omits machine names, credentials, and partner names.
| Commit | Change | Verification or finding |
|---|---|---|
8296b82b to 16fb314a | Reused stable Sway origins, normalized occluded zero-geometry fallbacks, and retained renderer identities across accessibility and compositor queries | Shared run 29199656600 passed 29/36 Electron rows, up from 23/36. Focused run 29200827296 passed all 9 Electron PX-background rows at the replacement source, leaving foreground AX right/double click and foreground AX/PX hotkey open. All 9 focused Tauri rows remained explicitly environment-limited by the missing DRM/EGL renderer tree. |
88d700f4 to a78f525a | Made nested pointer hit-testing target-subtree-local, reused the entered child pointer resource, fell back to the owning root resource, and completed wheel frames | Full shared run 29199596935 passed 26/36 Electron rows before these focused repairs. Run 29200462634 then passed 7/9 occluded PX background rows, including raw right click, text, key, hotkey, child-window click, and drag. Dedicated run 29200854535 failed both scroll rows, so renderer scroll, two click rows, and one AX right-click timeout keep the shared environment experimental. |
8937209c to edb64a25 | Executed the Linux support-completion plan: reconciled stale fixture docs, added compositor/input-route metadata, packaged the nested compositor, restored typed shared/native/capture lanes, pinned VM source identity, and formalized Linux release validation | Automatic Linux unit, distribution, script, docs, and source-package gates remained green. X11 run 29194456173 retained all 108 accepted outcomes on the exact source. |
d11c026e to 676b9ef4 | Replaced fire-and-forget nested injection with a versioned acknowledged protocol, PID targeting, exact resource errors, pointer/keyboard/scroll/hotkey/drag verbs, logical focus routing, and stale-surface cleanup | Early typed runs deliberately failed on ambiguous targets, missing logical seat focus, and stale surface resources. Each failure became a driver/compositor fix; unsupported keys and missing resources now refuse instead of returning false success. |
6ab4e930 to 0b0b0e2c | Stabilized nested client identity and coordinate spaces across AT-SPI, screencopy, scene hit-testing, desktop scope, and private surface input | Run 29197643541 passed the native GTK3 matrix 31/31. Run 29197887387 passed capture/scope 5/5, including the previously failing screen-absolute GTK click and exact LinuxCuaCompositorInject route metadata. The shared renderer result remains recorded separately. |
1280021b to 1fe2ae35 | Reconstructed Sway renderer geometry through stable compositor identity, cropped window capture by that identity, and connected renderer AT-SPI frames to the same window origin | Run 29195551765 retained native GTK3 31/31 and capture/scope 5/5. Shared run 29196452551 passed 23 Electron rows, exposed 13 renderer-coordinate/hotkey gaps without losing the 36 declared Tauri environment failures, and supplied the focused replacement target. |
| Representative GNOME/KDE audit | Reused the unchanged desktop entrypoint against real compositor sessions | GNOME's accepted 31 native GTK, three capture, and two desktop-scope contracts remain valid. Plasma 6 reached session startup, GTK AT-SPI discovery, and portal-interface preflight, but no KDE behavioral row was accepted because target-addressable activation and interactive portal consent remain absent. Real-Xorg MPX and DRM/EGL WebKitGTK also remain explicit environment gaps. |
9736e19b to ff1071af | Removed nested AT-SPI runtimes, repaired Wayland trajectory target resolution, preserved 64-bit action identities, and routed foreground renderer typing through real keyboard events | Focused Sway run 29180903640 proved foreground/background Electron AX clicks delivered after the runtime repair. Run 29181552459 proved complete before/after AX state, screenshots, and click markers after the recorder fix. Run 29182130646 then passed Electron foreground AX type text with fixture-state evidence. AX hotkey now reaches the target but has no DOM effect, and PX hotkey still exposes a hosted-Sway renderer-origin gap; both remain explicit failures. |
f8e4b37b and 74a29a20 | Completed the Linux X11, Sway, and GNOME Wayland convergence pass and published WinRects helper metadata v3 | Exact X11 run 29179817332 passed all 108 rows: 71 delivered and 37 exact refusals. The split Sway run proved all 31 native GTK3 rows and all five capture/scope rows with playable per-cell videos. A real GNOME 46 session passed 31 GTK3 rows, three capture contracts, and two desktop-scope contracts. |
346f6f73 | Added the direct xkbcommon link dependency to the Nix release package | The final source gate exposed -lxkbcommon after the portal/libei feature became part of the release build. libxkbcommon now belongs to the package's build inputs rather than only the interactive Wayland shell. |
fabf4a20 | Stabilized GNOME Wayland capture and foreground input through the WinRects helper and portal/libei | A real GNOME 46 session passed all 31 GTK3 rows. The fix separates Mutter frame and surface-buffer origins, waits for the complete EIS device announcement, selects the newest resumed pointer, uses monotonic frame timestamps, restores target activation after consent, and persists the grant until the user revokes it. AX background rows passed with the target fully occluded; unsupported background PX gestures returned their declared exact refusals. |
79e5ac2a to 8161cf56 | Repaired Linux fixture scrolling, Wayland event flushing, accessibility enablement, metadata, portal-input feature packaging, and Linux CI compilation | Exact X11 run 29173767528 passed the expanded GTK3 matrix, while the prior complete X11 run 29148643166 passed all 80 declared outcomes. The portable release build now includes GNOME/KDE RemoteDesktop/libei input without requiring the newer PipeWire capture dependency. |
8719e292 | Made native Wayland pointer coordinates, scroll-at-point, keyboard priming, libei key sequences, and cropped window capture target-aware | Sway GTK3 run 29175153270 passed all 23 rows: 17 delivered outcomes and 6 exact background refusals, with no failures or skips. |
9c65c153 and 7b985276 | Added native GNOME observation, targeted Chromium accessibility, generic ext_foreign_toplevel_list_v1, stable identity enrichment, and Chromium frame-origin reconstruction | Linux unit and distro compatibility checks passed. A controlled GNOME probe showed driver-launched Electron in both the Shell window list and AT-SPI without globally enabling the screen reader. |
c9c82908 | Split pure-Wayland shared, native, and capture owners onto independent clean runners | Run 29175548524 no longer exhausted one runner disk. It isolated one Sway hotkey failure, one obsolete standalone-activation failure, and the hosted WebKitGTK renderer limitation instead of hiding later lanes. |
a07ba769 | Routed hybrid GNOME/KDE sessions through native Wayland, enumerated GNOME windows from authoritative Shell metadata, translated every pointer gesture from window-local pixels, and required verified target activation before portal/libei input | Clean Linux unit and six-distro compatibility runs passed at the exact SHA. GNOME now has a verified Shell activation adapter; unsupported KDE foreground injection fails closed rather than acting on the user's currently focused application. Exact X11 and split Wayland E2E reruns are active. |
Native GNOME validation also exposed a verification-host issue: Nix path:
inputs copy untracked target/ directories when a synced VM checkout has no
Git metadata. Stale source snapshots consumed the VM disk and were removed;
this is not a driver failure. Clean GitHub runners are unaffected.
| Commit | Change | Verification or finding |
|---|---|---|
7623f7be to 55307b38 | Added canonical native WebView2 and WPF PX background single-left-click rows with fixture-owned state and foreground geometry probes | An active Windows RDP replay passed both rows through UIA Invoke. Each result proved FixtureState, Focus, ZOrder, NoLeakedInput, and Cursor and produced complete before/after evidence plus video. WebView2 derives its real DOM screen point through CDP, proves it with a foreground PX click, then dispatches the occluded PX action. WPF reads an atomic JSON state file written by the fixture. All 31 testkit tests, strict testkit Clippy, and host compile checks passed. |
6aaa914b | Restored direct Chromium/Electron single-left background clicks through PostMessage for both AX-resolved and PX-resolved targets | In an active Azure RDP session, raw UIA delivered the click but raised Electron and displaced the occlusion sentinel. A VM-only PostMessage diagnostic then delivered both AX and PX cells in 3/3 seeded runs while FixtureState, Focus, ZOrder, NoLeakedInput, and Cursor all passed. The production build passed all 12 Electron left/right/double-click rows; only the two single-left background rows changed from refusal to delivery. |
768f0650 to 6e05424a | Completed the macOS convergence pass and bound local evidence to a clean exact source SHA | The full local matrix passed 83/83 contractual outcomes: 79 deliveries and 4 exact refusals. Fixes cover PX background hit-testing, foreground typing's first character, structured scroll/drag refusals, desktop HID scope, AppKit fixture stability, and per-connection daemon sessions. |
d39c71c9 | Made the Windows sentinel physically acquire foreground before each background action | Hosted runs no longer fail during sentinel posture. WinUI3, WebView2, WPF background actions, and the shared catalog all reach their behavior boundary with the original focus, z-order, cursor, and leaked-input checks intact. |
0c2331b4 to 3f6fbd53 | Completed foreground PX activation, removed volatile UIA metadata from the WPF drag-refusal oracle, and aligned WPF combo selection with the background UIA recipe | The replay passed 19/20 WPF rows, all WinUI3 and WebView2 rows, and all capture/scope rows; its only native failure was the separately owned minimized-launch contract. Electron child-window delivery and keyboard refusal codes were updated from empirical side-effect-clean results. |
00a29c49 and e43c2946 | Tested CreateProcessW startup show-state control, then made minimized launch fail closed when Windows cannot guarantee no activation | Electron can override STARTF_USESHOWWINDOW, so startup hints alone are insufficient. The driver now returns exact background_unavailable before spawning when the foreground lock is denied; the canonical refusal proves no new window and no desktop side effect. |
8d28beec | Added the native WKWebView shared catalog, fixed AppKit AX scroll, separated SwiftUI popover activation from transient AX discovery, and expanded native AppKit/SwiftUI action rows | The exact local run passed all 130 rows: 124 deliveries and 6 structured refusals. WKWebView passed 35 deliveries plus its background-drag refusal. AppKit foreground/background AX scroll, foreground/background PX right and double click, foreground slider drag, SwiftUI background click/value, and SwiftUI foreground popover activation passed fixture-state checks. AppKit background drag was a silent no-op, so the driver now returns exact background_unavailable; the refusal row proves unchanged fixture state, focus, z-order, cursor, and input journal. |
| Commit | Change | Verification or finding |
|---|---|---|
0fda31bf | Added typed case declarations, results, and lane preflight | Testkit unit tests passed locally. The first Windows and Linux runs exposed fixture and recording failures before behavioral classification. |
f2e5804c | Added full result dimensions to the reporter | Reporter tests reject changed contracts and missing rows. |
6fa9311e | Removed the synthetic calculator fixture | The canonical shared target now uses only controls in the repo-local web harness. |
891d4c94 | Added the platform-independent desktop observer core and Windows backend | Unit tests prove that transient focus changes, z-order changes, cursor movement, and input leaks fail independently. |
3a48ba0d | Made the Linux desktop preflight reject blank recordings | Run 29131453240 stopped with 94/2073600 non-dark pixels. This was an environment failure, so it produced no behavioral verdicts. |
28ce18b6 | Added fail-closed cell filtering | An unmatched filter now fails instead of reporting a green zero-cell run. |
303c7bf3 to 056728ec | Added the occluding Electron sentinel and staged its preload | A local sentinel smoke test wrote direct ready and focus events to its JSONL journal. |
640fcc9a | Replaced the default route label with explicit backend routes | Unit coverage keeps Windows Chromium PX background delivery on WindowsTargetedInjection; it remains a required capability. |
580708f7 | Added the direct macOS observer | Fifteen testkit tests and strict testkit Clippy passed locally. A native snapshot smoke test read the foreground app and real cursor. |
00a1d31f | Added the direct X11 observer and attached desktop checks to background shared cells | Independent review found and corrected XWayland, reparenting, raw input-focus, and occlusion traps. Sixteen testkit tests passed locally. |
bcc53fe7 | Expanded the shared catalog from a 19-cell diagonal to 32 cells per host | Route tests cover every declared Win32, Quartz, X11, and Wayland combination. |
21f3f6e0 | Fixed workflow dispatch checkout semantics | Earlier branch dispatches had selected the branch workflow but checked out the default inputs.ref=main. Their behavioral results were discarded. |
69c7c2c1 | Made each OS runner select only the typed shared catalog | Legacy tests remain in source until their assertions pass the deletion ledger, but they no longer define the canonical shared run. |
6733efe9 to b52d239f | Removed duplicate Windows modality-input probes, normalized desktop-scope ownership, and corrected Electron's X11 show path | Local testkit checks stayed green. Linux run 29133849724 still rejected a blank root-desktop recording, so it produced no behavioral verdict. |
c3454d1b to e54088f3 | Shared the Electron foreground sentinel and attached its Focus, ZOrder, Cursor, and NoLeakedInput contract to WPF background actions | Windows run 29134124533 passed all 18 WPF tests. Its lane failed later on an independent WebView2 CDP-readiness race. |
48afc293 to 842f3c86 | Moved background capture, minimized launch, and agent-cursor behavior into their action-owned tests | The replacements assert application or pixel state plus the desktop observer instead of a focus-only guard. |
c49dd59d | Rejected Chromium UIA Invoke's false-positive and tested coordinate injection as a replacement route | Focused run 29134320325 proved the route still refused a fully occluded target. That route was not accepted as a fix. |
521508aa to 99897fed | Added the reusable typed executor and typed WPF, launch, capture, and cursor records | Sixteen testkit tests and host compile checks passed. Fresh native and capture runs are validating the Windows-only bodies. |
ad891b48 | Made CDP page discovery wait for the first usable target | The earlier native run's only failure was WebView2 exposing a listener before /json contained a page. The DOM-state assertion remains unchanged. |
10a1a749 | Preserved the old guard's anti-overclaim check in canonical background text/key rows and aligned action-owned video labels | An independent deletion audit identified protocol honesty as the only unique old-guard assertion. Chromium AX background click now probes a target-bound LegacyIAccessible action rather than a coordinate route. |
5bca25be | Mapped the normal Electron harness at construction | Linux's deferred BrowserWindow was enumerable and capturable but absent from the X11 root recording. A focused preflight run is validating this lifecycle correction. |
c83c99ac | Limited each CI lane to the fixtures it consumes | Windows and Linux focused runs built only their internal shared, native, or capture partition while the contributor command remained selector-free. |
8e41859f | Published WebView2 readiness after DOM navigation, gave typed WPF rows exact recording labels, removed the duplicate modality-background target, and classified strict Chromium AX background click as a refusal | Run 29135420638 passed all 18 WPF, 7 WinUI3, and 3 WebView2 tests plus all four typed WPF background rows. Run 29135420139 returned the exact background_occluded refusal with all desktop-side-effect oracles passing. |
0a5352c5 | Reduced workflow dispatch to one canonical matrix and added row-level evidence links | Shared, native, and capture remain internal parallel jobs. The link renderer converts each exact MP4 path into a link to its owning lane artifact. |
ac1f19cc | Added scoped Windows foreground locking and X11 alpha-shaped cursor-overlay bounds | A placement-only Linux rerun (29135421864) retained the exact blank-root signature, confirming placement was not the cause. The X11 fix addresses the full-screen ARGB overlay on non-composited sessions; Windows now prevents activation before launch instead of restoring it afterward. |
c190228e | Tightened the controlled Chromium refusal declaration | The fully occluded test setup allows only background_occluded; generic or message-matched refusals remain rejected. |
a9953533 to 2c960eaf | Corrected Windows foreground dispatch and made unsupported background routes report structured refusals instead of silent success | Run 29137293235 passed every shared foreground row. Its remaining background failures were used to define exact Chromium and embedded-WebView capability boundaries rather than weakening fixture-state assertions. |
f50b7170 to 64377935 | Required real fixture launch, split keyboard actions into independent cells, and targeted visible native controls | The shared catalog is now 36 cells per host. GTK3 and Linux desktop-scope lanes passed in run 29137481789; Windows fixture geometry failures from run 29137143798 were removed without hard-coded replacement coordinates. |
6d973d2c and 309740a6 | Awaited the first minimized-launch sweep and routed explicit Windows expand requests through UIA ExpandCollapse | Run 29137992025 caught a Windows-only compile error in the new pattern route before any behavioral verdict; 465f4a2f unwraps the pattern result and the replacement run compiles. |
b284b521 | Exposed complete Linux renderer targets and removed the last Python accessibility write path | Shared lookup now searches the raw accessible name, fixture-state assertions poll fresh trees, AT-SPI text writes stay native Rust, and the silent 150-node bounds cutoff is gone while the 20-second budget remains. |
c473e045 | Reduced each OS to one contributor-facing E2E command | CI partitions remain internal through CUA_E2E_INTERNAL_LANE; shared, native, and capture are no longer public runner selectors. |
a86f8208 to 94a0509e | Allocated CDP ports per process and replaced Windows page-test sleeps with DOM polling | WebView2 and Electron page owners no longer share ports 9222/9223 or assume fixed startup/action delays. |
cd922be9 | Preserved the macOS signing identity during install-local | The installer now signs and verifies a staged bundle, refuses to downgrade a certificate-signed live app to ad-hoc, and keeps a rollback copy until installation succeeds. |
d835c15e and e820aaf5 | Rejected known Windows Tk keyboard drops and activated desktop-scope click targets before SendInput | Run 29138176800 passed all 29 native rows and 71 of 72 shared rows. Its capture video proved the WPF desktop click coordinates were correct but the target was non-activating; the branch now activates the resolved root window before dispatch. |
541b06ba and 7a369cfa | Kept one process-lifetime AT-SPI registry listener and initialized it outside the daemon Tokio runtime | Run 29138635957 first exposed the nested-runtime startup panic before any cells. The replacement run 29138842890 passed GTK3 native and capture/desktop-scope preflight and behavior; the shared renderer lane remains the active validation. |
2ef2d9bd | Looked for keyboard focus across every descendant UI thread of a Windows target | The previous top-level-thread-only lookup posted Tauri/WebView2 keys to the native frame while the renderer lived on another input thread. The existing external fixture-state cell remains unchanged and is validating the route. |
e8b8aee5 and c3ef25ab | Exposed the Windows foreground helper and made strict desktop fixture launch/readiness fail closed | Run 29138842358 caught the missing helper export at compile time. Canonical desktop-scope helpers now reject launch errors and readiness timeouts instead of returning a reduced green run. |
676fce44 | Cleaned interrupted macOS signing state before fallback signing | A bounded certificate signing attempt left cua-driver.cstemp; signing over it produced a resource seal for a transient file. The installer now removes partial seals and temp files, and a local reinstall produced a bundle that passes codesign --verify --deep --strict. |
f7a010c9 to 3c7d03a3 | Corrected foreground pointer ordering, renderer focus lookup, fixture isolation, targeted input, and Linux CI ownership | Windows replays reduced the matrix to one fixture-side WPF false negative; Linux native GTK3 and capture/scope owners stayed green while the shared renderer failures became individually classified. |
16275cb0, c18a8142, and 85ed9d25 | Made the fixture journal retry, observed WPF's handled routed event correctly, and removed speculative driver delays | Windows run 29143137292 reported all 110 typed cells passing. The later physically foreground sentinel invalidated its background focus verdicts, but the WPF routed-event finding remains valid and no timing workaround remains in the driver. |
793def12 to cf900891 | Built a pure-Wayland Nix session with an explicit D-Bus/AT-SPI host, compositor-aware preflight, honest oracle availability, and startup diagnostics | The original hard-coded /run/current-system/sw/bin/dbus-daemon failure is gone. Run 29143078987 reached a real Sway session but mapped no fixture surface; later runs now preserve Electron stderr, detect early process exit, and save the Sway tree without weakening the AX, capture, or non-blank-video gates. |
689f732a and 628239fd | Made source tests select the profile-local driver and aligned Linux tool discovery | The Nix schema test now executes the binary built in the same derivation. Linux no longer advertises the deprecated type_text_chars alias, matching macOS and Windows while retaining invoke-time compatibility. |
71c07881 to 26be3644 | Made Linux text, keyboard, pointer, and scroll routes target-aware and refusal-safe | Exact AT-SPI editable writes no longer choose another process field; editable-only nodes enter the index space; focus-dependent fallbacks refuse background dispatch; foreground keyboard and wheel input execute inside the foreground transaction. The latest Nix and X11 runs are validating these source changes. |
ab12e6a7 | Kept Linux accessibility geometry in the same captured tree snapshot | Chromium AT-SPI traversal order can change between walks. The driver now returns element metadata and bounds from one traversal, so an element index cannot be paired with another node's rectangle. Existing PX cells remain the regression test and contain no fixture-layout coordinates. |
ecffaf34 | Added a compact declared-coverage grid to the typed summary | The grid groups cells by harness and action across AX/PX and foreground/background delivery while preserving the detailed result and evidence tables. Undeclared combinations stay visibly distinct from pass, refusal, failure, and skip. |
3a5eec8b | Isolated the prebuilt Linux Electron fixture from Nix's glibc library path | Wayland run 29143812672 proved that the fixture exited before mapping because LD_LIBRARY_PATH mixed Nix glibc 2.42 libraries with the host Electron binary. The staged launcher removes those variables for Electron only; the native Wayland, accessibility, capture, and video gates remain strict. |
afb16821 to 8eed7730 | Tightened source identity, fixture ownership, readiness, and incomplete-result checks | The Nix source gate now tests the platform schema it actually advertises, required shared fixtures fail closed, and cold WebView2 startup has a bounded 30-second readiness budget instead of disappearing from the matrix. |
349e308c | Stabilized Windows background key targeting | Known silent-drop classes are rejected before UIA focus, while embedded renderer keys wait for an observable focused descendant rather than posting to the native frame. |
8b1c7357 and 19e2eaab | Corrected X11 window discovery, double-click timing, and Linux cursor motion | Empty EWMH client lists no longer fall back to stale root children, no-window-manager discovery keeps only viewable windows, XTest double clicks flush between pairs, and Linux accepts the shared Bezier/timing cursor schema. |
c4214672 | Made the Windows sentinel physically own foreground before every background cell | The next run invalidated the earlier all-green Windows result: a visible but unfocused sentinel had not exercised the no-activation contract. With real foreground ownership, Electron remained clean while WPF F5 and six Tauri routes exposed honest product failures. |
cb91c556 and f075f3c9 | Required a live pure-Wayland AT-SPI registry and fixed the Linux source build | The exact Nix AT-SPI launcher starts and activates org.a11y.atspi.Registry; the subsequent preflight now fails later because no application registers in the accessibility tree. The Nix source check passes at f075f3c9. |
4fe1047f | Classified background WPF key drops without removing foreground delivery | WPF pointer messages remain class-level refusals. Keystrokes and chords refuse only while another native window owns foreground; the canonical F5 cell asserts exact background_unavailable, no fixture mutation, and all desktop-side-effect oracles. |
470d4827 | Hardened background WebView input mechanics | Posted clicks hold a non-activation guard, preserve unrelated window styles, restore the user's foreground if a renderer self-activates, and emit WM_*BUTTONDBLCLK only for classes that advertise CS_DBLCLKS. Embedded WebView AX keys focus through the proven posted-click route and fail closed on focus timeout; UIA scroll is guarded through handler settlement. |
0cef4992 to 557a59c4 | Completed the supported X11 matrix without weakening background contracts | Linux WebKit foreground typing now uses XTest, exact AT-SPI writes retry transient registry races, and unsupported background WebKit text and save actions return background_unavailable. Exact run 29147126435 passed all 80 X11 rows. |
e65f49f4 and 6f8d4368 | Matched addressed WebView key delivery to the proven pixel route | Run 29147294209 proved that releasing the outer no-activation guard did not fix the remaining Tauri AX key cell. Artifact comparison showed that GUITHREADINFO focus metadata was absent even when the equivalent PX route delivered. The AX route now posts its focus click, settles, and returns an explicitly unverifiable result while fixture state remains the delivery oracle. |
eaa59957 | Made backend-reported video failure visible to callers and manifests | A recorder backend Err now fails session shutdown, persists video.error, and has a focused core regression test. Commit 022dd537 closes the separate invalid-success metadata path. |
18005272 | Changed pure-Wayland sentinel discovery and screenshot scaling | The sentinel uses its unique CDP title and launched PID instead of comparing connection-local Wayland IDs. Run 29148643790 validated discovery and native screenshot scaling; remaining backend gaps stay required failures under issue #1922. |
022dd537 | Rejected invalid successful video metadata | Core now treats finalized:false, a missing file, or an empty file as a recording-stop error even when a backend returned Ok. Unit tests cover unfinalized, empty, and valid metadata. |
0a28495a | Closed desktop-oracle false passes | Window-scope gates require the exact structured desktop_scope_disabled error, background actions require the target to be fully occluded before dispatch, and sentinel journal read errors fail the cell. |
8abf0950 | Pinned every interactive lane to one exact source SHA | Dispatch accepts only a full commit SHA or the immutable dispatch SHA. Every lane verifies git rev-parse HEAD, records the SHA in environment.jsonl, and prints it in the typed summary. |
9c76eb5f | Routed addressed WebView key focus through the complete pixel actuator | Run 29147987757 proved that a direct posted focus click still did not deliver the Tauri AX key. The AX center now converts back to screenshot coordinates and calls the same layered ClickTool route as the passing PX cell, including targeted-injection fallback. |
69d3538c | Checked occlusion at the authoritative dispatch snapshot | The sentinel rejects a cell when the target rises between the initial precondition check and the desktop observer's before-action snapshot. |
900bfe8d | Separated desktop-wide sentinel observations from background-target observations | Run 29148642577 passed all 72 shared rows and all 8 capture rows, proving the WebView key and strict scope fixes. Its two native failures showed that launch and agent-cursor cells intentionally observe the foreground sentinel because no background target exists. They now use an explicit desktop-observation API; real background actions keep both occlusion checks. |
7fafe2c0 | Ordered pure-Wayland native and renderer focus checks | The Sway-only sentinel path waits for native readiness, explicitly focuses the launched PID, verifies the compositor foreground state, and only then waits for the renderer focus journal. Windows and X11 ordering is unchanged. |
516cddb2 | Replaced WinUI3's cold-start sleep with external readiness polling | Run 29149160683 passed all 72 shared rows and all 8 capture rows. Its sole native failure was the first WinUI3 UIA lookup; six later WinUI3 rows passed. Native setup now polls the external UIA tree for the app marker and canonical checkbox before executing any WinUI3 cell. |
3b67ee30 | Made compositor focus authoritative for pure-Wayland sentinel startup | Run 29149710714 proved the sentinel was natively foreground and stable, but Electron emitted no renderer focus event because the window could be focused before preload listeners attached. The startup gate now uses the compositor snapshot; action-time native focus, z-order, and journal input-leak checks remain mandatory. |
The earlier conclusion that fully occluded Chromium clicks required a z-order
change was incomplete. A VM-only diagnostic confirmed that UIA Invoke delivers
but activates Electron, so UIA still violates the background contract. The
same diagnostic also proved that post_click_screen reaches the renderer while
it remains fully occluded: both AX-resolved and PX-resolved left clicks
delivered in three consecutive runs without changing focus, z-order, or the
real cursor. Commit 6aaa914b restores that route only for the proven
single-left-click shape; right-click, double-click, drag, and other unproven
gestures retain their existing refusal behavior.
The first rows are the accepted landing evidence. Older rows remain below as superseded historical checkpoints; they are not current support baselines.
| Platform | Run | Purpose | State |
|---|---|---|---|
| Windows | 29211506624 | Final conv2 matrix at 6d7f02e4 | Passed all 114 rows: 93 delivered and 21 exact refusals, with 0 failures or skips. Shared, native, and capture/scope artifacts contain per-row trajectories and MP4 evidence. |
| macOS | Logged-in local matrix at 448d052f | Final conv2 matrix with the installed app's stable TCC identity | Passed all 133 rows with 0 failures or skips and an owned MP4 for every row. |
| Linux X11 | 29213365684 | Final Openbox/Xvfb matrix at 72083bb4 | Passed all 108 rows: 71 delivered and 37 exact refusals, with 0 failures or skips. |
| Linux Sway | 29213349962 | Final stock-wlroots matrix at 72083bb4 | Passed the same 108-row contract as X11: 71 delivered and 37 exact refusals, with 0 failures or skips. Roleless WebKitGTK and live compositor geometry are covered by the accepted Tauri rows. |
| Nix Linux source | 29213921494 | Final package, compositor, and Rust source checks at 49e8a4cd | Passed all three checks on the exact Nix landing head after its rebase onto merged Linux. |
| Linux X11 | 29179817332 | Final expanded shared, native, capture, and desktop-scope matrix at f8e4b37b | Passed all 108 rows: 71 delivered and 37 exact refusals, with 0 failures or skips. The three lane artifacts contain 108 cell videos plus three preflight videos, and the combined summary links every row to its owning artifact. |
| Linux Wayland | 29179817787, 29182130646 | Split Sway shared, native, capture, and focused Electron validation | Native passed all 31 rows: 24 delivered and 7 exact refusals. Capture and desktop scope passed all 5 rows. The shared lane executed all 72 Electron/Tauri rows: Electron exposed a small keyboard cluster and Tauri was environment-limited by WebKitGTK's missing DRM/EGL renderer tree. Focused repairs now prove Electron foreground/background AX left click and foreground AX type text; foreground hotkey and hosted renderer PX-origin reconstruction remain explicit failures. |
| Linux GNOME | Real GNOME 46 session | Validate native Mutter discovery, capture, AX/PX dispatch, occlusion, and persistent portal/libei input | Passed 31 GTK3 rows, 3 capture contracts, and 2 desktop-scope contracts. A second driver process reused the explicitly revocable portal grant without another consent dialog. |
| Windows | Azure RDP focused replay | Recheck occluded Electron AX/PX background left-click delivery and neighboring pointer contracts at 6aaa914b | The background-safe PostMessage diagnostic delivered AX and PX in 3/3 runs with all five side-effect oracles. The production build then passed 12/12 Electron left/right/double-click rows and emitted a video for every row. |
| Windows | 29149710089 | Final exact full matrix at 516cddb2 with strengthened desktop oracles and external WinUI3 readiness | Passed all 110 rows: 87 delivered and 23 exact refusals, with 0 failures or skips. All three lane summaries identify the full source SHA; 110 cell videos plus 3 preflight videos were uploaded and parsed successfully. |
| Windows | 29166454913 | Exact converged matrix at e43c2946 after macOS parity, native PX, sentinel, and launch-contract work | Passed all 113 rows: 92 delivered and 21 exact refusals, with 0 failures or skips. Shared passed 54/18, native passed 30/3, and capture/scope passed 8/0. The three lane artifacts contain 113 cell videos plus 3 preflight videos; every row links its exact trajectory path. |
| Nix Linux source | 29150690892 | Package build, Linux unit/protocol gate, and source identity at 3b67ee30 | Passed. The package and source-owned Rust tests completed in the pinned Nix environment at the final code SHA. |
| Linux X11 | 29148643166 | Exact supported Linux matrix at 69d3538c with strengthened occlusion and scope gates | Passed all 80 rows: 48 delivered and 32 exact refusals, with 0 failures or skips. All three summaries and environment records identify the full source SHA; 80 cell videos plus 3 preflight videos were uploaded. |
| macOS | Local complete matrix at 6e05424a | Validate the converged shared, native, capture, and desktop-scope catalog with stable TCC identity | Passed all 83 declared rows: 79 delivered and 4 exact refusals, with 0 failures or skips. Every row produced a typed result and video, and both the summary and environment record contain the full source SHA. |
| macOS | Local complete matrix at 8d28beec | Validate native WKWebView and the expanded AppKit/SwiftUI catalog at one exact source SHA | Passed all 130 declared rows: 124 delivered and 6 exact refusals, with 0 failures or skips. The 108 shared rows cover Electron, Tauri, and WKWebView; all native, capture, and desktop-scope rows passed. Every row produced a typed result and validated video. |
The earlier macOS replay fixed PX background click focus steals, foreground PX typing's
first-character loss, silent web-content background scroll/drag no-effects,
desktop-scope HID delivery, AppKit native PX background click coverage, and
daemon transport loss of structured refusal codes. Electron background scroll
and Electron/Tauri background drag now return exact background_unavailable
refusals. The current pass proves SwiftUI popover activation through fixture
state; only transient-panel AX enumeration remains unproven. A targeted CDP
wheel experiment could mutate Electron while visible or ordinarily
backgrounded, but had no effect under the canonical full-occlusion sentinel.
The experiment was removed, and Electron background scroll keeps its exact
background_unavailable contract.
Repeated local runs also exposed two evidence-harness defects. The macOS runner now refuses a dirty tracked tree and derives a full source SHA when CI does not supply one. Desktop-scope tests no longer reuse a fixed daemon session ID after that session has ended; each proxy connection keeps its own minted session identity.