# Retained focus evaluator correction — 2026-09-12

Parent-owned Windows gate reported 817 pass / 1 fail at implementation source
`4c387ccd640976ba89dd03ee922a3f63ff92b07c`. Inspected checkout:
`codex/behavior-authoring-20260910`, HEAD `c3c2d01` (later harness-only changes).
This worker ran no Cargo/compiler/native/Gitea operations and made no commit.

## Finding

The failing expectation was evaluator sequencing, not evidence of a production
focus defect. `canvas_workspace/tests.rs::retained_focus_apply` intentionally
stops a real F6 task after Collect and returns its unapplied Chain. Its comment
explicitly states native Iced runs Chain passes synchronously. The topology
ownership test then expected another F6 request before running that Apply.

`canvas_workspace/viewport.rs` sets `focus_pending` immediately on F6/Tab/Escape;
keyboard events stay blocked until Focusable::focus/unfocus applies the operation
(or legitimate pointer/window/disabled lifetime handling resets input). Keeping
`focused` intact supplies Collect with its actual traversal witness. Allowing the
test's second F6 through would undermine the intended pending-input protection.

## Change and preserved challenge

Only `crates/oa-desktop/src/behavior/topology/layout_tests.rs` changed:

- Assert that a second F6 is denied while the first operation is pending.
- Complete the retained Apply before requesting the separate delayed Collect, at
  both chooser and review setup sites. Assert observable viewport focus after
  each completion.
- Retain that same Apply object for every existing adversarial replay. All
  chooser focus, owner return/lifetime, review focus/scroll, delayed camera,
  source/model, raw draft, snapshot identity and history assertions remain.

Replaying Apply remains meaningful: `focus.rs::Apply` does not consume its target,
members, scope or reveal; only `valid` mutates. Root emits the current Owner on
every pass, and Apply::custom replaces `valid` from its frozen scope each time.
Previously successful Apply now must change its cached validity from true to
false when replayed under the chooser/review owner. That strengthens the stale
owner challenge instead of discarding it.

Production viewport code was not changed. `git diff --check` passed. Runtime
verification is delegated to the root gate owner; no test pass is claimed here.

## Targeted verification for root

Use the existing Windows desktop gate environment and these exact test filters:

1. `behavior::topology::view::layout_tests::production_canvas_keyboard_and_delayed_tasks_respect_real_chooser_and_review_owners`
2. `app::behavior_removal_tests::mounted_behavior_tab_and_f6_retire_same_batch_delete_and_window_focus`
3. `behavior::topology::view::layout_tests::production_process_keyboard_enters_activates_draws_focus_and_returns_to_inspector`

The first directly covers the corrected evaluator; the second protects immediate
same-batch deletion admission and completed traversal/entry; the third covers
normal keyboard entry, traversal, exit and Inspector return. Preserve the parent
gate's established command/environment and add `--exact` for individual tests.