swayfx-mosaic/tooling/probes/step20c-overnight/HORIZONTAL.md

# Exact annotated horizontal fixture

EXPERIMENTAL / PREPARATION. Runtime **NOT RUN**, independent review **PENDING**.
No production, UX, PKGBUILD, cumulative patch, installation or desktop action.
STEP20C stays NEXT; production multi-output NOT YET SUPPORTED.

Only the explicitly owned overnight LAB is accepted. `phase-a.json` supplies the
new annotated staged binary; the previous D binary cannot satisfy the frozen
identity. The retained pristine control is separately bound to its fd71 source
archive, SceneFX37ccd source archive, original build receipt, exact binary and
mapped SceneFX library. Both use the current exact wlroots0.20 library. Native
startup log lines establish the actual FX/GL renderer; requested environment
`WLR_RENDERER=pixman` is metadata, never renderer proof.

C0 runs pristine splith, C1 annotated splith, C2 annotated Mosaic. Every case has
H1=(-800,0,800,600), H2=(0,0,800,600), scale1, transform normal. H2 is a static
opaque SHM XDG client #303038; two separated initial whole RGB images must be
identical and uniform. No mask, channel tolerance or excluded pixels.

The clients are copied privately from the actual retained static_cross sources
and compiled with C17. Scanner regeneration must reproduce every retained XDG
and virtual-pointer generated file byte for byte; XML and source hashes are
frozen. TOPLEVEL→A→B hierarchy is checked against actual object IDs, get_popup
wire requests, genuine left-button serials, grab-before-initial-commit,
configure/ACK, buffer dimensions and mapping order. Each serial is consumed by
one distinct grab; C2's second chain uses new owner/PID and four distinct ordered
serials across both chains.

NativeSHM, XDG configure, IPC assigned destination, applied owner scene,
global logical coordinates, output logical rectangles and physical PNG pixels
remain separate. At scale1 normal the logical-to-physical transform is identity
apart from output origin; all rectangles use half-open bounds. C0 has no private
scene trace: its current IPC assignment is explicitly labelled, then compared
to measured paint and fresh pointer wire coordinates. C1 also corroborates the
assignment against the actual applied PI_OWNER and ordinary unclipped PI_SCENE.
Neither establishes an atomic transaction generation or screenshot/native
buffer identity.

C0/C1 open a genuine crossing A/B chain, measure full standard popup pixels on
both outputs, click B inside its actual H2 paint, explicitly close B, verify A
survives with no B residual on either output, click A inside its fresh H2 paint,
then close the owner normally. Final whole H2 equals the initial RGB image;
final H1 has no A/B colors. Four complete clicks, two grabs, one chain,
10 captures, five pointer placements; no camera or transition.

C2 opens E1 after a reserved camera correction derived from measured applied
owner geometry. Owner, A and B must actually cross x=0. H1 retains A/B pixels;
whole H2 stays equal. A real right click inside H1 B must reach B. A real right
click in B's hypothetical H2 extent must reach neither popup; actual popup_done
and destruction order must be B then A. Any reference delivery is recorded as
outside-grab routing, not promised universal click-through. E1 H2 must be clean.
The same compositor then opens fresh E2. A con_id-targeted splith preserves live
A/B; all selected callback records preserve old Mosaic then show two coherent
standard observations and clip removal through B input. Actual standard H2 A/B
pixels, B input, explicit child close/A survival, A input and normal owner close
are checked as in controls. Final whole H2 equality is exact. Eight clicks,
four grabs, two chains, up to two camera corrections, one transition,
17 captures and ten pointer placements. No retry or calibration loop.

`horizontal_adapter.py` applies explicit unique-occurrence transformations to
the sealed historical E2 runner. Generated runners exist only in LAB, are AST
compiled, source-hashed and reviewed with every reused dependency. The original
historical fixture and its source/receipts remain read only. The transition
validator is rebound to the exact annotated output/transaction/XDG sources;
old binary/source acceptance is never transferred.

Global ledger:18 runs,220 PNG and exactly three C runs, durable reservation before
compositor creation/capture. Local action ledgers additionally reserve every
click, move, grab, chain, camera and transition before the corresponding action.
Reserved and observed consumed counts remain separate; failures never refund.
Per-run maximum150s, active watchdog143s and bounded logs/process waits. Private
runtime0700, inherited desktop/loader sockets removed, explicit `swaymsg -s`
on every IPC command. Only owned process groups are stopped/reaped; runtime and
sockets are removed. Actual terminal IPC/client/compositor codes are preserved.

The C controls are comparison evidence, not automatic dispatch vetoes. A shared
fixture defect requires review before continuing; otherwise each case can pass
its own preflight. Missing/failed control prevents a full comparative verdict
and must be reported explicitly; no inferred pristine PASS.

## Preparation and review

`horizontal_gate.py prepare LAB` compiles only C clients; it creates no socket
and reserves no graphical run. `horizontal_tests.py --output RECEIPT` executes
pure/isolated negative tests. Failed first-pass receipts are preserved separately.
`horizontal_gate.py seal LAB` freezes final fixture/dependency/client/generated
runner/binary/library/source/provenance/test bytes; it cannot create acceptance.

A genuine independent read-only reviewer writes LAB/horizontal/review.json:
status ACCEPTED, independent=true, read_only=true,
scope OVERNIGHT_HORIZONTAL_FINAL_BYTES, blockers=[],
freeze_sha256=SHA256(freeze.json), files=the exact freeze files mapping,
report_file=absolute report path, report_sha256=its exact SHA256.
No historical or synthetic acceptance is valid. Final byte changes invalidate
acceptance. `horizontal_gate.py preflight LAB --case C0` is read only and requires
that review. `run.py LAB C0` then consumes a unique O_EXCL case token before the
run debit; C1/C2 have separate tokens. Existing runs, sockets, bad identity,
changed reviewed bytes and exhausted budgets fail closed. No actual run has been
performed during fixture preparation.

Remaining gates include wider outputs/migration, complete damage/intermediate
frames, atomic generation, static effects/hidden-owner/saved buffers and
ABI/distribution/legal/maintenance. Successful C alone is bounded horizontal
feasibility, never STEP20C production readiness.