ARCADIA-Studio/harness/experiments/canvas-union-a57c334-20260911/canvas-renderer-final-review.md

Frozen canvas renderer union — independent source review

Reviewer: Codex-ytr83r /root/windows_release_gap_review, 2026-09-11. Verdict: no material integration finding in the three reviewed frozen files. This is a source-review verdict, not compiler, test or native acceptance. Root owns combined integration and validation.

Reviewed worktree: .local/canvas-union-ytr83r-20260911, root baseline 32334c66317692befb6517a917dc7ae90641c11a, peer renderer/camera source a31b40d0f8551ed87c8cd66250b9afb4809b3a79.

Reviewed file	SHA256
crates/oa-desktop/src/behavior.rs	82DCAAED9EB17F15329F80BCC7442FFF94C17D426A50DEA68455339F60FFA246
crates/oa-desktop/src/behavior/scenario_lifecycle/render.rs	BF1C05EA1E709B3503D8BCF92F091446FD7A9B80B1A29C5A55919DF58F3B0271
crates/oa-desktop/src/behavior/scenario_lifecycle/render_tests.rs	A95201F7D0DCC88C9C54863F0E95E09C1DB204668743ABBD32C495B577EA53EF

Findings and preservation

All three hashes matched the worker's freeze. The parent frame, header text child frame and Create-label child frame each apply screen-space translation before uniform scale. Both clip helpers compute pan + scale * world once and intersect the actual parent frame size. Neither adds the widget origin or subtracts the clip origin. The reviewed draw call sites therefore agree with the underlying Iced transform/clip behavior.

The numerical regression correctly distinguishes missing or misordered pan. For header rectangle(100,200,204,70), scale2, pan(-200,-400), viewport(300,100), the padded clip is(20,16,280,84). For Create rectangle(100,200,140,28), the corresponding clip is(16,8,248,40). Other asserted positive/negative pan, partial-edge, fully offscreen and nonfinite-pan cases were checked against their arithmetic.

Independent readback from the frozen Git blobs and candidate files, explicitly decoded as UTF-8 and normalizing line endings, confirmed:

• The entire impl Scene geometry/hit section matches root32334c6 except initialization of scroll_offset becoming camera_pan.
• The lifecycle rendering prefix before draw_markers and suffix from marker_distance remain unchanged.
• All 15 existing lifecycle render test names remain, including minimum-scale marker/header and ordinary-message priority regressions. Two tests were added: panned_header_and_create_clips_use_screen_translation_and_actual_viewport and real_scene_panned_zoomed_program_keeps_header_birth_and_death_hit_identity.

The new Program test exercises OA/SA header, Create and Delete selection through mouse events at scales0.5/1/2, positive/negative pan and nonzero widget origin. Its canvas::Program::update, Action::into_inner, message matching and fixture API usage showed no source-level mismatch. Source inspection also confirmed the intended single Select publication for the tested press/release paths. No test execution by this reviewer is claimed.

An initial comparison using Python's platform-default text decoding produced a comparison failure around Unicode punctuation. Repeating the readback with explicit UTF-8 for both sides resolved that reviewer-tool issue and established the preservation results above; it did not require or identify a production change.

Direct Iced provenance

The actual locked dependencies are registry packages, not a located Git fork: iced_graphics0.14.0, iced_wgpu0.14.0, iced_tiny_skia0.14.0, iced_widget0.14.2 and iced_core0.14.0. The inspected copies are under main .local/toolchain/cargo/registry/src/index.crates.io-1949cf8c6b5b557f, matching Cargo.lock.

• iced_graphics/src/geometry/frame.rs::with_clip drafts a child frame and then pastes it.
• iced_wgpu/src/geometry.rs:116 initializes the frame transform to identity. draft:412 constructs a fresh frame with the supplied clip; paste:416 appends its primitives without reapplying the parent transform or intersecting the parent's clip. fill_text:306 records transformed text position/font size and the child's clip bounds.
• Tiny-skia's geometry.rs uses the same fresh-identity draft and direct-paste behavior.
• iced_widget/src/canvas.rs:300 applies widget-origin translation outside Program::draw, establishing canvas-local coordinates for these clip and text operations.
• iced_core/src/rectangle.rs::intersection uses floating-point min/max followed by positive-dimension checks; it is not itself a general finite-input validator.

Limits and remaining root validation

The new Program test does not dispatch App camera messages: its separately held Document remains untouched. It supports Scene hit identity and lifecycle equality, not complete App camera/history integration. Existing App/workspace camera, source and Undo/Redo gates must remain in combined validation.

The clip helpers reject nonfinite pan and invalid scale. General invalid rectangle/viewport coordinates and transformed arithmetic overflow are not fully covered or newly guarded. Production Scene geometry and peer camera event validation supply the ordinary finite-domain assumptions; this review found no demonstrated reachable regression requiring a broader camera rewrite. The original obligations note documents additional robustness falsifiers and remains unchanged.

Arithmetic clip tests do not establish native glyph containment. The reviewed child-frame call sites match the inspected Iced implementation, but actual rendered pixels, ancestor clipping, combined compiler/tests/Clippy and runtime acceptance remain root-owned. Earlier root707 and peer729 results retain their original source/runtime scope and do not validate this union.

No candidate source edits, compiler/test/native execution, Git mutations or WSL/Linux actions were performed by this reviewer. This file persists the already completed review; no additional investigation was performed to write it.