swayfx-mosaic/tooling/probes/step20c-overnight/HORIZONTAL.md

Exact annotated horizontal fixture

EXPERIMENTAL / PREPARATION. Runtime NOT RUN, independent review PENDING. No production, UX, PKGBUILD, cumulative patch, installation or desktop action. STEP20C stays NEXT; production multi-output NOT YET SUPPORTED.

Only the explicitly owned overnight LAB is accepted. phase-a.json supplies the new annotated staged binary; the previous D binary cannot satisfy the frozen identity. The retained pristine control is separately bound to its fd71 source archive, SceneFX37ccd source archive, original build receipt, exact binary and mapped SceneFX library. Both use the current exact wlroots0.20 library. Native startup log lines establish the actual FX/GL renderer; requested environment WLR_RENDERER=pixman is metadata, never renderer proof.

C0 runs pristine splith, C1 annotated splith, C2 annotated Mosaic. Every case has H1=(-800,0,800,600), H2=(0,0,800,600), scale1, transform normal. H2 is a static opaque SHM XDG client #303038; two separated initial whole RGB images must be identical and uniform. No mask, channel tolerance or excluded pixels.

The clients are copied privately from the actual retained static_cross sources and compiled with C17. Scanner regeneration must reproduce every retained XDG and virtual-pointer generated file byte for byte; XML and source hashes are frozen. TOPLEVEL→A→B hierarchy is checked against actual object IDs, get_popup wire requests, genuine left-button serials, grab-before-initial-commit, configure/ACK, buffer dimensions and mapping order. Each serial is consumed by one distinct grab; C2's second chain uses new owner/PID and four distinct ordered serials across both chains.

NativeSHM, XDG configure, IPC assigned destination, applied owner scene, global logical coordinates, output logical rectangles and physical PNG pixels remain separate. At scale1 normal the logical-to-physical transform is identity apart from output origin; all rectangles use half-open bounds. C0 has no private scene trace: its current IPC assignment is explicitly labelled, then compared to measured paint and fresh pointer wire coordinates. C1 also corroborates the assignment against the actual applied PI_OWNER and ordinary unclipped PI_SCENE. Neither establishes an atomic transaction generation or screenshot/native buffer identity.

C0/C1 open a genuine crossing A/B chain, measure full standard popup pixels on both outputs, click B inside its actual H2 paint, explicitly close B, verify A survives with no B residual on either output, click A inside its fresh H2 paint, then close the owner normally. Final whole H2 equals the initial RGB image; final H1 has no A/B colors. Four complete clicks, two grabs, one chain, 10 captures, five pointer placements; no camera or transition.

C2 opens E1 after a reserved camera correction derived from measured applied owner geometry. Owner, A and B must actually cross x=0. H1 retains A/B pixels; whole H2 stays equal. A real right click inside H1 B must reach B. A real right click in B's hypothetical H2 extent must reach neither popup; actual popup_done and destruction order must be B then A. Any reference delivery is recorded as outside-grab routing, not promised universal click-through. E1 H2 must be clean. The same compositor then opens fresh E2. A con_id-targeted splith preserves live A/B; all selected callback records preserve old Mosaic then show two coherent standard observations and clip removal through B input. Actual standard H2 A/B pixels, B input, explicit child close/A survival, A input and normal owner close are checked as in controls. Final whole H2 equality is exact. Eight clicks, four grabs, two chains, up to two camera corrections, one transition, 17 captures and ten pointer placements. No retry or calibration loop.

horizontal_adapter.py applies explicit unique-occurrence transformations to the sealed historical E2 runner. Generated runners exist only in LAB, are AST compiled, source-hashed and reviewed with every reused dependency. The original historical fixture and its source/receipts remain read only. The transition validator is rebound to the exact annotated output/transaction/XDG sources; old binary/source acceptance is never transferred.

Global ledger:18 runs,220 PNG and exactly three C runs, durable reservation before compositor creation/capture. Local action ledgers additionally reserve every click, move, grab, chain, camera and transition before the corresponding action. Reserved and observed consumed counts remain separate; failures never refund. Per-run maximum150s, active watchdog143s and bounded logs/process waits. Private runtime0700, inherited desktop/loader sockets removed, explicit swaymsg -s on every IPC command. Only owned process groups are stopped/reaped; runtime and sockets are removed. Actual terminal IPC/client/compositor codes are preserved.

The C controls are comparison evidence, not automatic dispatch vetoes. A shared fixture defect requires review before continuing; otherwise each case can pass its own preflight. Missing/failed control prevents a full comparative verdict and must be reported explicitly; no inferred pristine PASS.

Preparation and review

horizontal_gate.py prepare LAB compiles only C clients; it creates no socket and reserves no graphical run. horizontal_tests.py --output RECEIPT executes pure/isolated negative tests. Failed first-pass receipts are preserved separately. horizontal_gate.py seal LAB freezes final fixture/dependency/client/generated runner/binary/library/source/provenance/test bytes; it cannot create acceptance.

A genuine independent read-only reviewer writes LAB/horizontal/review.json: status ACCEPTED, independent=true, read_only=true, scope OVERNIGHT_HORIZONTAL_FINAL_BYTES, blockers=[], freeze_sha256=SHA256(freeze.json), files=the exact freeze files mapping, report_file=absolute report path, report_sha256=its exact SHA256. No historical or synthetic acceptance is valid. Final byte changes invalidate acceptance. horizontal_gate.py preflight LAB --case C0 is read only and requires that review. run.py LAB C0 then consumes a unique O_EXCL case token before the run debit; C1/C2 have separate tokens. Existing runs, sockets, bad identity, changed reviewed bytes and exhausted budgets fail closed. No actual run has been performed during fixture preparation.

Remaining gates include wider outputs/migration, complete damage/intermediate frames, atomic generation, static effects/hidden-owner/saved buffers and ABI/distribution/legal/maintenance. Successful C alone is bounded horizontal feasibility, never STEP20C production readiness.