swayfx-mosaic/tooling/probes/step20c-corec-v2

COREC_V2_REDERIVED — private source-only reconstruction kit

EXPERIMENTAL. This is a new derivation, never a recovery of the deleted historical CORE, CORE-C or G1 bytes. STEP20A DONE; STEP20B EXPERIMENTAL; STEP20C NEXT; STEP20D–G PLANNED; production multi-output NOT YET SUPPORTED. No production source, package, installed library, session or ABI is changed by this kit. Independent source/C review remains required before a private build.

The kit contains two complete cumulative deltas, source assembly/verification, exact-body C extraction/tests, executable wrong variants and compact evidence. It contains no upstream fork, archive, generated C slice, library or binary. An optional graphics/ directory can coexist without affecting the native source manifests; its gates and native runtime evidence remain separate.

Source authority and reproduction

Parents:

Component	Exact commit	Parent tree
Mosaic	cd550382b311efdbfe3ed892f4e1d281d852e754	6be2d6cada19bd84673c30dfc4fb900a48b87e86
SceneFX	37ccd723bef49e6891156ffafce8f549f01446cc	685a78b94f9e44ee683e5fea93874557a9fed457
SwayFX pristine audit	fd71a6bdc061bd633b488ae7b83e8a6981d22f86	Not an assembly parent
wlroots source audit	d783533489e1f75d6886c2ab5c5960090ef268f8	Not copied or patched by this kit

The Mosaic pin is in the project Git history; use a normal project clone that contains it. SceneFX is fetched from https://github.com/wlrfx/scenefx.git at its exact commit. An optional --scene-git /path/to/scenefx.git uses an existing read-only bare cache after verifying commit and parent-tree identity. No missing historical LAB is referenced by executable code.

Requirements: Git, Python 3.12+ (safe tar extraction filter), POSIX shell; for C tests, a C17 compiler with GCC-compatible sanitizer flags, pkg-config, Wayland server, Pixman and wlroots 0.20 development headers/library. No install or system package changes are performed. The compiler/library pair itself is not installed or upgraded by the scripts.

Example, from a trusted checkout containing this kit (adjust only project/kit paths; use a NEW absent destination under /var/tmp):

umask 077
KIT="$PWD/tooling/probes/step20c-corec-v2"
LAB=$(mktemp -d /var/tmp/swayfx-mosaic-corec-v2-reproduce-XXXXXXXX)
mkdir -m700 "$LAB/scratch" "$LAB/cache" "$LAB/pycache" "$LAB/data"
export TMPDIR="$LAB/scratch" TMP="$LAB/scratch" TEMP="$LAB/scratch"
export XDG_CACHE_HOME="$LAB/cache" PYTHONPYCACHEPREFIX="$LAB/pycache"
export CCACHE_DIR="$LAB/cache/ccache" XDG_DATA_HOME="$LAB/data"
python3 -B "$KIT/assemble.py" --project-git "$PWD" --destination "$LAB/source"
python3 -B "$KIT/verify.py" "$LAB/source"
python3 -B "$KIT/tests/run.py" --sources "$LAB/source" --output "$LAB/c-tests"
python3 -B "$KIT/tests/mutations.py" --sources "$LAB/source" --output "$LAB/mutations"

The assembler requires an absent explicit destination strictly below /var/tmp, rejects symlink ancestors and creates it with current UID/mode0700. All temp/cache/data directories are explicitly scoped below that destination. It removes inherited desktop socket/display variables, reads Git objects, checks exact commit/tree/patch SHA, extracts the pinned trees, checks/applies patches without fuzz, and verifies the complete resulting file list, bytes and modes against provenance.json (85 SceneFX + 417 Mosaic regular files). Git apply replaces changed files using umask; their declared pinned file modes are restored explicitly. No Git index/ref/config/history is modified. Failed partial destinations remain for diagnosis; use another absent path. The test runners likewise redirect temp/cache/data under their private output, verify all source hashes before extraction, set RLIMIT_CORE=0, and require Linux PR_SET_DUMPABLE=0 at each C child entry before expected aborts.

verify.py detects added/deleted/changed source files and mode changes. It does not certify a compiler, binary, renderer, live session or graphically correct compositor. provenance.json fixes the new patch/tree hashes and distinguishes REUSED_VERSIONED_SOURCE, PINNED_UPSTREAM_FETCH, RECONSTRUCTED_NEW_DERIVATION, HISTORICAL_REPORTED_ONLY and MISSING_NOT_RECOVERABLE. The old eight-patch stack, old private reduced scene.c SHA and missing closeout receipts are not required.

New private behavior and boundaries

The complete SceneFX types/scene/wlr_scene.c now allocates a private 64-byte sidecar before native scene_tree_init publishes the new tree. Reservation failure frees the unpublished tree and returns NULL with no listener or parent list entry. After native node signal initialization, the successful reservation attaches a destroy listener. No public tree/node field is added. The private header API remains void wlr_scene_tree_set_clip(...) plus bool get_clip(...).

The setter does not allocate. NULL deactivates but retains a reservation until destroy; inactive entries are absent to get/render/hit. A zero box is active and masks pixels/input. Idempotent setters do not run updates. Passing an unreserved embedded root aborts explicitly even with NDEBUG; production callers are audited to target factory-created workspace/popup trees. This precondition check is not the failed-reservation behavior and is not a native OOM policy. Lookup is linear in the number of reserved factory trees, including inactive entries. Measured native tree128B and sidecar64B; allocator overhead NOT MEASURED. Every factory-created tree reserves one sidecar, not just Mosaic-clipped trees.

Functional clips cover tree-local visibility and hit filters, applied-owner root popup clips and nested inheritance, actual leaf-owner hidden masking, CURRENT ancestor fullscreen exemption, standard clip retirement and helper refresh in the fading branch. Integer translation/intersection and ancestor coordinates are checked before narrowing; invalid camera values never convert before finite/range checks. Unrepresentable clips fail closed. This does not qualify unrelated renderer scale/transform arithmetic or complete effects.

Concrete constructor safety repairs are limited to IME refocus and protocol back-pointer admission, container dim-rect NULL first use, xdg image-capture rollback, and defined nullable partial-constructor cleanup in output/workspace/ view/seat. See evidence/callsite-audit.json and callsite-locations.json for source ownership, rollback, root, reactivation and listener limits. wlroots helper sources check factory NULL before first use; the actual linked provider still requires independent ELF qualification. Unchecked tinywl/examples remain outside the Mosaic compositor build and are not qualified by this kit.

Three passive traces are intentionally retained, not called uninstrumented:

SPIKE_CLIP tree=%p rect=%d,%d %dx%d
PROBE_POPUP_CLIP owner=%p local=%d,%d %dx%d
PROBE_POPUP_HIDDEN_OWNER owner=%p applied=%d,%d %dx%d viewport=%d,%d %dx%d

A state-changing NULL setter and active zero both print rect=0,0 0x0; idempotent inactive NULL does not print. The logs alone cannot distinguish those states. Logging timing/cost neutrality is NOT PROVEN; there is no transaction-generation, commit/present or GPU identity claim. SPIKE_DAMAGE is removed; PI/OPT diagnostic hooks are not included. Ordinary renderer and transaction-timeout logs remain.

Exact-body C evidence

tests/extract.py generates slices only into private output, recording each full source-file SHA, start/end byte offsets, first line and slice SHA. Native SceneFX struct definitions (with WLR_PRIVATE), real Wayland signals, addon sets and Pixman regions are used. The actual factory, scene_tree_init/scene_node_init, full native destroy, set_enabled, reparent, coords, clip setter/getter, numerical guards, clip intersection/input filter and native hit iterator are compiled. IME refocus and popup/workspace helpers use exact bodies with explicitly reduced Sway/protocol structs in handwritten support includes.

Adapters replace scene_node_update/visibility and buffer/effect helpers outside the exercised tree paths; they count/consume callback inputs and do not prove native damage or rendering. Buffer/effect stubs abort if unexpectedly exercised. The full private source retains native old/new visibility and damage update; no stub replaces that path in a compositor source tree.

Executed tests cover NULL/box/idempotent/zero/NULL/reuse without setter allocation, first and separately second reservation failure before publication/listeners, parent/child destroy orders, reparent/back, reservation-address reuse without false stale clips, embedded root rejection, native hit iterator zero masking, applied leaf owner hidden/return, nested inheritance, current non-leaf fullscreen, standard clip retirement, IME failure/refocus/descriptor rollback/destroy, aliases, INT_MIN/MAX, NaN/infinities and large scroll. Full native fading/transaction execution, native OOM survival, graphics and effects are NOT TESTED here.

Normal C17, UBSan (including float-cast-overflow/signed-integer-overflow/bounds), and ASan+UBSan passed. Root rejection is an expected SIGABRT (raw rc-6), never an OOM-survival success. Ten executable wrong variants all compile and are detected: publish-before-reserve, allocating setter, visible inactive reservation, NULL-free reservation, silently accepted root, unchecked caller NULL, zero hit, doublefree/listener, unsafe intersection and unchecked float conversion. The root-accepted mutant exits0, which is detected because the correct root test must abort. A compile failure does not count as killing a mutant.

Ten early expected-SIGABRT systemd coredumps were observed before dumpability was disabled (2,261,704 bytes, outside LAB under system management); eight additional journal-only events had corefile:none after RLIMIT_CORE=0 and before prctl. No deletion or sudo was used. RLIMIT_CORE alone is insufficient for a piped Linux core handler. The final parent audit observed no new coredump entry for either final corpus after the checked prctl fix. The final harness requires PR_SET_DUMPABLE=0 before any tested assertion and checks PR_GET_DUMPABLE. Do not claim zero writes outside LAB for early runs.

Initial extractor/header setup failures and the first mutation campaign failure are retained in the private command logs and summarized in evidence/c-tests.json. The mutant root-return harness initially leaked its root, causing ASan to mask that mutant; the corrected return destroys it, and all ten mutants are then exercised and detected. Evidence is newly generated, not historical inheritance.

Gates, budgets and persistence

evidence/reproduction.json: source reproduction EXACT_FOR_NEW_TREE, including second independent public-fetch assembly with identical receipt/manifests. evidence/c-tests.json: PASS_BOUNDED_REVIEW_PENDING. Source audit is SOURCE_AUDITED_REVIEW_PENDING. Independent source/C review must set the final gates; successful compile/test adapters alone authorize no native runtime.

This kit consumes no functional Meson build, no DESTDIR stage, no compositor, Wayland client, socket, IPC, graphical/OOM run or capture budget. Its C campaign is serial, within j<=8, and never exhausts real RAM. gates.json gives the small machine-readable source-only gate contract. Generated output remains private; retain LAB for audit and do not automatically purge it. Publication and the outer source-only bundle manifest are owned by the parent workflow after review.