14 KiB
Native Saved spacing: complementary correctness evidence
Decision and scope
Codex-ytr83r, the session owning this validation, accepted candidate B below on 2026-09-13 for the native comparison of source b10b28cefd1d0794073ba241a0c8de9a83e85f68. Shared integration/release ownership remains with Codex-956atf under issue #27. This addendum changes an agent-authored evaluation method, not the user requirement for correct, usable graphical and textual editing. The original immutable native plan remains historical evidence. No native pass follows from this decision.
Use available native endpoint and edit/recovery observations together with complete saved-Project change-scope checks and independent numerical tests at the application event boundary. Temporal tracking requires separate observation where the workflow supports it. Exact operating-system pointer packet values remain unobserved and unclaimed. Never infer an expected exact coordinate from saved output, and never relabel a scoped-change check as an exact-coordinate oracle.
The baseline-bound coordinate/direction checker was independently reviewed, built against b10 and passed both original and scoped-motion self-checks. Its separate build and admission evidence preserves the implementation, guards and actual outcomes. Those synthetic checks establish comparator behavior; they do not establish native motion acceptance.
Why the native exact-bit requirement is not currently observable
The b10 canvas in crates/oa-desktop/src/behavior.rs constructs spacing Begin and Finish from cursor.position() and the actual Scene scale. behavior/scenario/spacing/controller.rs::Session::update computes the active-axis displacement as (release - press) / captured_scale; begin_spacing verifies the supplied camera against the displayed camera. These are logical f32 values.
Pinned iced_winit 0.14.0, src/window/state.rs::State::cursor and src/conversion.rs::cursor_position, convert stored physical coordinates through the viewport scale into logical coordinates. The documented automation coordinates and screenshot coordinate convention do not independently establish the final converted bits. The application has no production hook that reports the admitted spacing endpoints and captured scale.
The 100% control is also not a bit witness. behavior/canvas_workspace.rs::toolbar requests Some(1.); behavior/scenario.rs::State::camera_zoom converts that request into next / current.scale, and canvas_workspace::change_with_minimum multiplies the old scale by that factor. The percentage label rounds for display. This source path does not justify asserting exact captured scale bits from the displayed text. Even a future direct exact-size assignment would leave the native pointer-conversion gap.
Candidates considered
| Candidate | What it establishes | Cost and remaining limits |
|---|---|---|
| A: opt-in production input-bit capture | A new diagnostic could report admitted Begin/Finish endpoints and captured scale using to_bits(), with token, representation and revision. An independent checker could compute expected source coordinates from those inputs and an immutable pre-edit baseline. |
Requires changed, reviewed source, a newly frozen binary and relevant gates. App-observed bits still do not independently prove automation-to-OS conversion. Raw-input logging must precede candidate calculation; producer-computed deltas or saved results cannot supply the expectation. |
| B: complementary native, model and event-boundary evidence | Available native endpoint and recovery observations; exactly scoped saved-model changes; exact Undo/Redo/reopen comparisons; independent arithmetic and transaction tests with known logical input values. Temporal tracking is established only where independently observed. | Does not claim individual native pointer bits or unobserved within-drag/release behavior. Small native-only input discrepancies, native release-position staleness or DPI conversion problems can remain below visual detectability. Test gaps must be reported rather than presumed covered. |
B is selected because correct graphical behavior, exact model-change scope and durable recovery can be verified without adding a production diagnostic solely to satisfy an agent-authored measurement requirement. This does not permit arbitrary motion, unrelated changes, silent source loss or weakened semantic admission. A becomes appropriate if a reproducible native tracking/landing discrepancy remains unexplained, or a concrete precision requirement requires measurement beyond B. It is not added merely to complete a checklist.
Verified automated evidence and its limits
The source inventory contains 28 normal tests across these four modules. Each exact name appears once with ... ok in both the actual b10 focused log and full log. This was checked against source declarations, not inferred from aggregate counts.
app::scenario_spacing::tests: seven tests.behavior::scenario::spacing::controller::tests: six tests.behavior::scenario::workspace::spacing_tests: six tests using real mounted widgets.behavior::scenario::spacing::tests: nine pure preparation/Document tests.
The published focused evidence at b09d9d5 records three actual passing processes: 107/101/93 tests, with 988/994/1002 filtered respectively. The published full evidence at f69897b records 1091 passed, four ignored and zero failed. Both bind unchanged 612 source inputs. The focused raw log SHA256 is dbb7ee3d2c4599359e0143274c7547e356c861f3ebc9b0a3d4ad11369e286d4d; the full raw log is 00ad4766b65e148bb05d8679fdb916c2f989cd8d137d3d9c993a734609146c84.
| Concrete source test | Verified assertion | Boundary of that assertion |
|---|---|---|
behavior/scenario/spacing/controller/tests.rs::fractional_screen_packet_preserves_subpixel_motion_in_preview_and_finish |
Explicit canvas origin (17,23), scale .5, nonzero y pan bits 0x43cb0001, press y 503 + 2^-15, release y 513. Independently constructs expected send-y 168 - 2^-14 (0x4327fffc) and the entire expected Project; verifies actual Scene endpoint bits and the Finish command through core execute_batch. Original Document/source/history/camera remain unchanged. |
The Move and Finish use the same final point. This is a controller/core-command test, not native input or Document source-writing of that fractional result. It is a message-y case, not a fractional lane-x case. |
behavior/scenario/workspace/spacing_tests.rs::saved_message_same_batch_pointer_events_commit_once_and_one_undo_redo_restores_exact_source |
Real mounted Begin/Move/Release at asserted .5 scale. Independently establishes an integer logical displacement of 10, expects Saved A send-y 252→272, compares the whole Project, one revision increment, complete Undo/Redo bundles, and re-admission of the accepted bundle. |
It deliberately rounds the press and asserts exact input displacement. It is not proof that native packets have those values. Move and release coincide. |
behavior/scenario/workspace/spacing_tests.rs::saved_header_preview_survives_frames_and_freezes_fit_while_actual_bounds_expand |
Actual header drag survives mounted tree rebuilds, moves near 640→670→700, keeps the captured visible camera through preview/commit, changes only the selected lane and re-admits the accepted source. |
Position checks use 0.001 tolerance; the whole-Project scope expectation inserts observed actual_x. This supports visual movement and change scope, not an independently exact lane-coordinate result. |
app/scenario_spacing/tests.rs::same_batch_preview_is_immutable_and_one_commit_undo_redo_has_exact_source_parity |
Actual App event admission preserves Project/source during preview and commits one lane edit with exact Undo/Redo Project and bundle parity. | Its expected candidate uses the production capture/prepare helper. It is transaction/lifecycle evidence, not an independent arithmetic oracle. |
behavior/scenario/spacing/tests.rs::one_repeated_message_moves_in_one_view_with_exact_document_undo_redo_and_reopen and horizontal_lane_move_changes_actual_header_and_attached_endpoints_only_in_selected_view |
Independently constructed exact Projects for message 240→200 and lane 400→500; untouched saved view and occurrence identities, real Scene anchors, source/history/re-admission where asserted. |
Input is a known world delta to pure preparation, without native or mounted pixel conversion. |
Controller click_threshold_is_active_axis_and_return_to_zero_is_not_a_click; mounted saved_drag_return_to_origin_preserves_redo_selection_and_original_fit_camera |
Orthogonal motion does not become an active-axis drag; final return to origin produces no commit and preserves existing redo, selection and camera. | Return-to-zero exercises a changed final position, but is not a positive commit at a new release-only coordinate. |
App source_write_failure_cannot_commit_candidate_or_materialize_camera; mounted saved_valid_preview_then_refused_self_call_never_commits_last_valid_candidate and saved_escape_and_outside_pointer_cancel_actual_held_preview |
Failed write, invalid self-Call geometry, Escape and outside cancellation cannot retain a previously valid preview as an accepted edit; source/history/camera protections are asserted. | These are controlled application/widget events. They do not observe OS scheduling or DPI behavior. |
Gaps retained explicitly
No positive test in these modules makes a valid release position differ from the last valid Move and independently asserts the new committed coordinate. The test named invalid_move_discards_prior_candidate_and_finish_rechecks_final_pointer moves to NaN and finishes at NaN; it proves refusal and preview retirement, not that positive variant. finish_spacing does call session.update(screen) in production, but source inspection is not execution of the missing case.
There is no mounted/App test carrying the exact fractional controller fixture through Document source writing and Undo/Redo, and no matching fractional lane-x oracle. Existing complementary tests are useful but must not be described as those combined cases. These are narrow potential additions if stronger event-boundary closure is required; this note neither adds nor reports them as passed. Native OS conversion, final native pointer precision and a DPI change during a held drag remain outside the automated evidence.
Native obligations under B
These are required observations/comparisons, not results reported by this addendum.
- Before each edit, preserve an immutable saved source and complete admitted Project. Identify the Saved Diagram, exact occurrence endpoint or lifeline, active coordinate field and intended direction before reading the result. For the current A fixture, use its existing coordinate entry; do not allow general insertion/deletion or normalize away other layout differences.
- At two visibly distinct zoom levels, observe a meaningful message-y and lane-x movement. Record the requested drag start/end and path, plus available before/after pointer positions, object endpoints and attached geometry. The documented Sky API in this workflow performs a single drag call; it does not provide an independently captured held midpoint. Without an independent observation during the drag, within-drag tracking/lag and a jump specifically on release remain unobserved. Correct tracking, attached geometry and stable release remain target behavior; before/after screenshots cannot establish those temporal properties. Avoid panel/viewport changes during the endpoint comparison. Do not turn a rounded percentage or screenshot measurement into an exact-bit assertion.
- The separately reviewed scoped checker must require precisely the preselected coordinate to change, with a finite nonzero delta of the intended sign, and compare the entire remaining Project exactly. Preserve IDs, other views, other coordinate entries, Steps, names, relationships, payloads and ordered arrays. A whitelist match alone cannot establish the right magnitude: reject visibly wrong tracking/landing rather than accepting any positive value. Do not choose a tolerance after seeing output.
- Observe one native model Undo restoring the complete pre-edit checkpoint and one Redo restoring the accepted checkpoint, then Save/close/reopen and compare the complete accepted Project again. Comparing the recorded accepted checkpoint on Redo proves restoration, not an independently expected coordinate. Keep editor-local Undo distinct from model Undo, and keep saved-Project equality distinct from native history/draft observations.
- Preserve refusal/cancellation tests and exact pre-edit source/model comparisons. Dirty drafts, unsupported fallback and invalid self-Call movement must retain the established protection and recovery behavior. A failed or ambiguous observation remains recorded; another route must not replace it silently.
Independent before/after pointer/object screenshots at two zooms can expose practical endpoint direction, scaling, offset and attached-geometry defects. They cannot distinguish correct continuous tracking from lag, intermediate jumps or a jump specifically on release; those require independent temporal observation. Keep the mounted preview/camera tests as separate evidence, not a substitute native observation. Endpoint screenshots also do not eliminate subpixel uncertainty or prove an unobserved release packet. If available observations suggest a defect, stop claiming that behavior passed, isolate the failing condition, and choose a discriminating event test, an appropriate temporal observation or candidate A diagnostic. No acceptance statement should call unknown native inputs exact or unobserved temporal behavior passed.