# Queue

- **Apple's keyframes lowering (SVG and box motion) ends on the first of repeated 100% blocks** (2026-11-12, read, not run). `forward` in `host/apple/src/svg_lower.rs` builds its own track, so it neither merges a block naming the animation's timing function with one naming none nor holds the last block at offset 1, both of which `Keyframes::track` and `Animation::value_at` in `exact-motion` now do as Chrome does. Build the lowered track from `Keyframes::track`.
- **An iOS navigation-collapse test fails on main** (2026-11-12, run at 00037e6f on an iOS 27 simulator, twice, at low load). `NavigationCollapseIOSTests.testWrappedScrollerLosesAndRegainsTheHeaderWhenContentMovesAboveIt` fails after about 8 s: its route does not push, so it never reaches the scrolling it tests. The class's other 20 tests pass (`bun host/apple/build.mjs --test --ios --only NavigationCollapseIOSTests`).
- **Apple's storage roots are one per process** (2026-11-12, read). `ROOTS` in `host/apple/src/picker.rs`, which answers `pickedPath`, `appRoots` and `appFile`, holds the roots of whichever app activated last, so a host process running two different apps' sessions can hand the earlier one the later one's directories. Key them by app.
- **Android headless carrier: a secret write fails with `sync /: Invalid argument`** (2026-11-12, #203). `bun exact.mjs test android --headless` on the OAuth fixture signs in and then cannot keep the session: the store's directory sync is refused (os error 22) on the emulator's filesystem. The APK carrier passes the same test. Evidence was an Android 16 (API 36.1) arm64 emulator.
- **Android headless carrier: the default store level refuses to start** (2026-11-12, #204). A TypeScript app built with `bun exact.mjs android --headless` and no `deploy.store.linux` stops at launch with "the baked store level requires the delivery adapter; regenerate the app entry"; with `"deploy": {"store": {"linux": "0"}}` (as apps/oauth-fixture has) it runs. Either the headless Android build should bake level 0 or the message should name the setting.
- **Android: no sustained frame measurement** (2026-11-12, #231). `agent android perf frames live` is refused as unsupported and `dumpsys gfxinfo` saw three frames in five seconds of an infinite animation under the test carrier's virtual clock, so the 3D-card fix (7de13f61) has no before/after number on a device.
- **Warn about top-level Intl on Android without Intl** (#205). The bake knows the target, but inspects bytecode with the host Hermes. Pass the selected Android bundle’s receipt availability through the captured bake inputs (including receipt-change invalidation), then warn on global Intl uses during module initialization in app and imported code. Reuse the scope-aware TypeScript walker; cover guarded and deferred uses and both Android carriers. The published v5 bundle still has no Intl.

- **OAuth credentials in Contract answers** (2026-11-12, #208). Neither `provider.accessToken(store)` nor `provider.idToken(store)` is guarded against being returned to Contract: both are ordinary strings with a documentation-only restriction. Decide whether to enforce that boundary.
- **The native prelude looks up a module's names in plain objects** (2026-11-12, read, not run). `js/src/prelude.js` `tool` reads `global.exact.tools[name]` and `failureCode` reads `FETCH_FAILURE[e.kind]`, so a handler name or a fetch failure kind of `constructor` or `toString` finds Object.prototype's member: `tool("constructor", args)` answers `Object(args)` where the web JS target now answers no handler (`host/web-js/ts-data.js`). Read each with `Object.hasOwn`, as host/web-js does.
- **Linux's `showPicker` and `saveFile` can ask the desktop portal too** (2026-11-12). The document pickers now ask `org.freedesktop.portal.FileChooser` (`host/linux/src/portal.rs`), while `input type=file`'s `showPicker` (LLP 1069.002 D8, which rules the portal) and `saveFile` (LLP 1069.010 D3) still refuse outside the agent. Their agent answers (`answer_picker`, `answer_save` in `presenter/picker.rs`) already copy a file in or out given a path, which is what `portal::choose` returns.
- **EAS worker qualification (#48).** Run the app-owned native build recipes on a real EAS worker with distribution signing, upload and store submission. Local artifact checks do not establish these.

- **`difftest explore … --js-only` drives every program and 18 diverge** (2026-11-12). Run over `contract/corpus apps/*/app.contract`, these remain undiagnosed. A module call is refused for a missing grant, which the runner answers as `prompt` (`contacts-calendar-fixture`, `geofence-fixture`, `photo-editor`, `photos-fixture`, `recorder`). The oracle has no answer for a source the runner never called (`bench` `portList`, `lights` `lights`). The driver's DOM has no `getBoundingClientRect` (`native-fixture`). The rest have no diagnosis yet: `agents`, `auth-fixture`, `expose`, `metronome`, `orientation-fixture`, `shelf`, `unsaid`, `grouped-touch`, `inline-image` and `share`. Each is either the driver's gap or the JS target's defect; tell which before fixing.
- **The workers publish an `exactBodyTo` file when an abort or a deadline lands between the body's end and the rename** (2026-11-12, read, not run). `host/apple/src/executor_body_to.rs` checks for an abort around each read and not between the last one and `staged.publish()`. The asynchronous machine admits the publish under the executor's lock (`executor_async_body_to.rs`); the workers could do the same.
- **The workers' retirement leaves a retired completion's accounting standing** (2026-11-12, read, not run). `complete` in `host/apple/src/executor_core.rs` returns at `state.retired` before it releases the run's bytes and counts, so they stay in the shared state for as long as a waker or a clone holds it. The asynchronous machine now applies physical ends after retirement (`executor_async_retire.rs`).
- **`exactBodyTo` is refused on Apple's own asynchronous lane** (2026-11-12). The machine's portable lanes write a reply to a file (LLP 1162 D8 item 5); `DarwinLane`'s callbacks run on URLSession's delegate queue, which must not block on a disk, so it refuses by name. It needs a download task or writes handed to another thread before the machine can be measured on a device.
- **Shelf's test file fails three tests on macOS on main** (2026-11-12).
- **`exact-data` tests share machine state across checkouts** (2026-11-12). Its lock and kept-document tests fail when two checkouts on one machine run them at once.
- **`exact-linux --lib` exhausts worker slots at the default 96 test threads** (2026-11-12). The asynchronous-core tests run out of slots; use 16 threads until the tests isolate their workers.
- **Rust receipt requirements pin a different ABI from the module builder** (2026-11-12). `bake/src/receipt.rs` writes `rustAbi: 2` in a Rust artifact's requirements, and its test pins it; `scripts/rust.mjs` writes the module ABI.

- **The photo-upload executor test can miss the uploads it must feed** (2026-11-11). `a_burst_of_photo_uploads_goes_three_at_a_time_and_leaves_other_streams_their_places` gathers open uploads before feeding them; uploads that open after that gather get no feed, and the test waits five seconds for an outcome that needs one. It failed 7 of 12 runs of the unchanged executor on a 96-core Linux machine.
- **The executor's quit test fails under a parallel run** (2026-11-11). `a_quit_ends_every_group` fails intermittently on the 96-core Linux machine.
- **The incremental runner test fails for geofence-fixture on Linux** (2026-11-11). `runner/tests/it/incremental.rs` fails for `geofence-fixture` at `18b358e0`.
- **App icons not yet seen running** (2026-11-11, LLP 1163 §4). tvOS's brand assets and the watch app's icon compile, and `assetutil` shows them, but no Apple TV or watch simulator runtime was installed to see them on a Home Screen. The Windows icon resource is linked only by a build on Windows, which has not run. The Android drive's check for an APK older than its sources (`exact-build.json`) counts no icon file, so an edit to an icon alone leaves the old APK looking current.
- **The Android build does not compile on origin/main** (2026-11-11, found building LLP 1163's icons). `host/linux/src/lower.rs:326`, Android-only, passes `n.style.cx` by value to `point`, and `Dimension` is no longer `Copy` since `2c765f970`. Taking `&Dimension`, returning `*v`, and calling `point(&n.style.cx)` and `point(&n.style.cy)` compiles (tried, not kept).
- **The branded-Chrome cleanup test counts other drives' bundle copies** (2026-11-11). `scripts/agent-browser.test.mjs`'s "branded Chrome removes its bundle copies after script and test shutdown" (macOS, `CHROME` naming branded Chrome) compares the shared `code_sign_clone` directory before and after; a Chrome another drive starts meanwhile and keeps open fails it. Check only the copies its own browsers made.
- **An inline Tab stop on the page joins a dialog popover's focus search** (2026-11-11, seen while fixing Tab from a negative-index control). `host/linux/src/presenter/typing.rs` `focus_stop` admits any inline Tab stop wherever its paragraph is, so when a `dialog` popover opens (`alert.rs:268`, which passes only the dialog's boxes), an inline link on the page can be chosen as the dialog's first stop. Restrict inline stops to paragraphs among the candidates, as starting points already are. Separately, `alert.rs:268` still takes a fragment's starting point when a dialog opens, though HTML's dialog focusing steps do not use one.
- **Android select menu (#243).** Replace the page-painted menu with LLP 1115.001 D10's anchored popup window, including touch scrolling, accessible option rows, focus restoration and the platform's transitions. A menu left open while layout moves its control paints from the previous frame's geometry, but taps use the new geometry. Long menus cannot be scrolled by touch (also documented in the Android README).
- **Later SVG switch children lose reference targets** (2026-11-11). `host/svg-file/src/lower.rs` skips every child after a switch takes one. `<switch><rect width="5" height="10"/><rect id="r" width="10" height="10"/></switch><use href="#r" x="5"/>` draws only the first rectangle. Reproduced with the lowerer at `9e53578f22` and after the `systemLanguage` fix; retain unselected children for references without drawing them in the switch.
- **Tamber parameter range probes omit package tokens** (2026-11-11). With `brand = reading.card` supplied by a package and `Card.inset: length = 8px in 0..24`, the server accepts `set-param Card.inset=99px` while the build refuses it. `contract/cli/src/tamber_ops.rs` passes the app design alone to `written_ranges`; its probes cannot fold the package reference and return no range errors. Join the package tokens in those probes as in the ordinary fold.
- **Crawler files: three gaps the reviews of #240 found** (2026-11-11, read and partly run; not this change's). `host/web/serve.mjs:28`'s `PUBLIC_FILES` leaves `robots.txt` and `sitemap.xml` out, so `staticFile` and `listPublicFiles` return nothing for a wasm build's two files (run). The Bun render server (`host/web-js/render.mjs` `--serve`, near the static lookup) answers a GET of `/robots.txt` or `/sitemap.xml` for a `render=build` route at that path with a 500, since that route's build is a directory it sends as a file. `host/web-js/src/pages.rs:12` leaves a `render=build` route whose pattern has a parameter out of `pages.json`, so an app whose only build route is parameterized never runs the JS renderer and its pages are not built. A fix of all three, branch `fix/q0003-crawler-files-three-gaps-the` in the fleet checkout, is not landed: its escaping of built page paths (`host/web-js/route-pattern.js` `buildPageFile`) makes distinct routes share a file (`/.x` and `/%2Ex`, `/a` and `/%61`), and `host/web/serve.mjs` answers an enumerated page asked with any `Accept` but `text/html` with nothing.
- **Two tests fail on origin/main under Linux, and pass on macOS** (2026-11-11, `2099b234`, x86_64). `exact-apple`'s `inherited::a_percentage_min_height_on_a_list_row_has_no_basis` (`host/apple/tests/it/inherited.rs:447`: the row is 19.2 points tall, not 52) and `exact-runner`'s `incremental::every_app_plan_updates_incrementally_exactly_as_it_does_in_full` (`runner/tests/it/incremental.rs:706`, an app making fewer than a quarter as many commits as steps). Both fail alone too.
- **Swatch's Apple fixture needs native targets.** `packages/fixtures/swatch/test/apple.mjs` calls the Apple builder directly after `exact new`, whose default app has no Apple crate. Enroll the platforms the suite runs before building; today it stops at `Cargo has no swatchfixture-apple target`.

- **Virtualized iOS snap geometry (#219):** unmounted rows do not contribute a target on a descendant of the row root, a root displaced by a transform, a root with a font-relative or percentage inset or margin, or a target farther than the bounded window from the projection. The synchronous drag-end query examines at most 64 rows; with sparse targets, the nearest one can lie outside that window.

- **Android loses scroll travel before a delayed hit reply** (#233). A first fix exists on `wave18/android-scroll` (`6de28f5c`), not landed: it claims a hosted text field's gesture before the field receives it; a pending release can start a fling after the activity stops; net travel loses a reversal at a scroll limit; a lifted tracked pointer can leave a drag with no finger; an UP sample moves the content before flinging and counts that travel twice. Qualification needs a device, hosted fields, nested scrollers, multi-touch and lifecycle transitions.
- **More's pop to its list that ends while another tab shows sends no Back** (2026-11-11, `NavigationMoreIOSTests.testMoreTappedAgainThenAnotherTabLeavesTheRoutersStack`). More tapped again above a tab's root, then a tab on the bar tapped before the pop ends: the pop ends with More showing its list while the router is on the other tab, so `followMoresList` sends no Back, and Exact writes the routes above the root back into the tab's own controller, where picking its row shows them again. A pop within the tab's routes keeps its Back until More shows again (`morePopTab`); here More's record would have to wait until the row's tab shows.
- **A tab on the bar tapped during another tab's own Back loses that Back** (2026-11-11, read, not run). Home's animated Back, then a tab other than More tapped on the bar before it ends: that tab's press syncs, `syncTabs` writes Home's routes back into Home's controller during the pop and records them, and the pop's end finds nothing departed while navigation follows the other tab, so Detail is there again on Home. A pop of More within a tab's routes keeps More's record for this case (`morePopTab`); the same for a tab's own controller would skip its writes while a native pop is pending on it and keep its record when navigation stops following it.
- **The agent's tap on the router's own tab under More does nothing while More shows its list** (2026-11-11, read, not run). After the agent's `back` at a tab's root under More, More shows its list and the router stays on that tab. A `tap` on that tab's authored tab presses it, the router's tab does not change, and no selection is written, so More keeps showing its list; a person's pick of the row shows the tab. An app's navigation within the router's tab meanwhile writes into a controller off screen.
- **A press made from More's delegate call during a sync is not projected** (2026-11-11, read, not run). An ordinary batch's sync lays the tab container out, which can start More's push for a row picked in the turn before; More's `willShow` then presses the tab while `syncing`, and `sync`, called for that press's batch, returns at its re-entry guard, so its `children` ops do not reach `logicalChildren`, which takes a panel's children only from the batch `sync` is given; no later batch brings them back. By reading, for a plain tab that its row's press builds (Six in the More fixture), Exact's record of the panel then stays empty, and `declineMoreRow` declines each later pick of its row. `syncNextTurn` lays out before its sync for this reason; on re-entry, folding the batch's `children` ops and calling `syncNextTurn()` would fix it.
- **While More keeps a Back, `syncTabs` writes no tab's routes** (2026-11-11, read; `NavigationMoreIOSTests.testATabNotBuiltTappedWhileMoreKeepsABackIsFilledWithinTheTap` shows that a tab not built, tapped then, is still filled within the tap). A pop of More within a tab's routes that ends while another tab shows keeps More's record until More shows again (`morePopTab`); until then `syncTabs` writes no tab's routes and records neither More nor the own controller of the tab whose routes More holds, so a tab whose routes changed while it was not the router's tab is written only once it is, by `sync`. Writing every tab's routes but the popped tab's would end it; no test has shown a difference yet.
- **More selected again during its own pop can be read as a push within the tab** (2026-11-11, read, not run). More's Back under a tab's routes, a tab on the bar tapped, then More tapped again before the pop ends (about 0.47 s, LLP 1075.003 §9.16): if More's `willShow` for the tab's root comes while the pop's coordinator is still More's, its `from` controller is the popped route, so `followMore` presses nothing though the router is on the other tab, and the router follows only through the tab container's `didSelect`, which a selection of More in code does not send. `NavigationMoreIOSTests.testMoreTappedAgainBeforeItsBackLeftByAnotherTabEndsKeepsTheBack` passes with a tap. Pressing nothing only for an animated transition, as UIKit's push and pop are and More selected again was not (§9.16), would close it.
- **A tab's root route replaced while More holds it is written into the tab's own controller** (2026-11-11, read, not run). `moreTab` finds the tab by the tabpanel of More's first route; if the app replaces that route's node, `moreTab` is nil, and `syncTabs` writes the new root into the tab's own controller while More still shows the old one.
- **With an app's own delegate on More, a pop of More holds `changing` until the next batch** (2026-11-11, read, not run). While navigation follows More, `nativePopPending(on: more)` counts a pop whose end Exact, hearing no `didShow`, cannot see; `syncTabs` records More at the next sync, so until a batch comes the agent reads the transition `in-progress` and `popMayBegin` refuses More's back swipe. Applying `morePopTab`'s delegate condition in `nativePopPending` would end it.
- **The agent's `back` to More's list can reply before More reports its list** (2026-11-11, Duo Lab on the iPhone 18 Pro simulator, iOS 27.0, `--chrome platform`, on `main` `35ac89eb7b`, with and without the change that keeps More's Back when another tab is tapped during it). After `back` at a tab's root under More, the next `state navigation` read `transition` `in-progress` and an empty `stack` in every drive on `main` and in some with that change, and `idle` with the tab's root in the others. More's `willShow` and `didShow` for its list come after the pop call returns (LLP 1075.003 §9.16); the reply did not always wait for them. The same drives log UIKit's "Unbalanced calls to begin/end appearance transitions" for a `RouteController` once.
- **Duo Lab's Panes title draws over its first line on the iPhone 18 Pro simulator** (2026-11-11, iOS 27.0, `main` `35ac89eb7b`, `--chrome platform`). On Panes' root, and on `panes-next` ("Pushed panes"), the large title overlaps the text "Responsive layout. Split and Overlay require the native iOS app on iOS 27.1 or later." at the top of the screen.
- **Android status bar scope when native sheets land** (LLP 1105 D7, #209). The presenter resolves `modal` routes as covering pages today. When Android reports native presentations, use their coverage, detent/width and settled transition state; iOS leaves the bar behind a medium or iPad sheet and holds the committed style through transitions. Android still ignores `status-bar-animation`. Qualify the independent bar flags on a phone in both schemes, across routes and a sheet; no device/emulator run was available for this change.
- **iOS launch after `didFinishLaunching` (LLP 1047.001.001 Q2).** Find what moved about 16 ms after the callback when SafariServices was linked, in the phone measurements of §2.2.
- **SafariServices for other Apple entries (LLP 1047.001.001 Q3).** Measure an app extension and the watch companion before extending the device app executable’s launch link to them. An App Clip copies its parent’s executable and carries the link unmeasured.
- **Permission resources on return from Settings** (2026-11-11, found in #217). Android does not re-ask `enumerateDevices` after the camera is allowed in Settings. Announcing it on resume must wait for the camera provider: before it is ready the list has no cameras, so a bare invalidation would drop the anonymous entry. The JVM tests have no fixture for a provider with a camera. Android's `Pedometer.kt` does not invalidate `pedometerStatus` on resume, and `SpeechRecognition.kt` does not refresh `speechRecognitionStatus`. Apple's media-capture module does not invalidate `enumerateDevices` on return to the foreground either.
- **Tests seen failing while landing issue fixes that the fixes did not touch** (2026-11-11). `exact-linux`'s `agent::tests::exit::an_orderly_exit_waits_for_a_request_with_effects` (`host/linux/src/agent/tests/exit.rs:216`, `must_finish` still true after the exit's bound) failed 1 run in 20 on origin/main at a load average near 15, and 5 in 12 near 40. `pump::held_work_tests::a_wake_without_a_reply_releases_held_work` and `pump::abort_tests::an_abort_whose_answer_was_replaced_is_still_cancelled_on_an_empty_pump` failed in whole-suite runs and passed alone. `scripts/agent-launch.test.mjs` "a native build is stale when a setting its module inlined has another value now" failed once in a run of the whole file and passed in the next three. The first run of `host/web-js/build.test.mjs` in a checkout whose web compiler is not yet built fails about fourteen tests in a millisecond each, and the second run passes. `PressFocusIOSTests.testADismissedSheetHandsNothingOn` fails on origin/main's own sources on an iOS 27.0 simulator, alone as well as in its class. `contract`'s `growth` test `resource_clock_advice_grows_with_derives` (`contract/cli/tests/growth.rs:130`, a ratio of two best-of-three timings near 150 µs and 1 ms held to 6.0) failed at 6.9 in a whole-suite run and in one of three runs alone. `host/web-js/answer-timers.test.mjs` "a live page waits the full delay after an async answer resumes" failed 14 runs in 24 alone, at a load average under 10: the two timers armed after the answer resumes are due in 500 and -500 ms where the test expects 2000 and 1000, as if measured from when the page's clock last moved and not from now. If that is the runtime and not the test's paused clock, a live page's timer set after a long wait fires early. `scripts/agent-test.test.mjs` "authored media preferences apply before observations, override by name, and survive reload" expects `prefer: unknown dark: expected`, and the message now carries a `did you mean` hint before `expected`. `executor::core::stream::tests::a_burst_of_photo_uploads_goes_three_at_a_time_and_leaves_other_streams_their_places` failed once in a whole-suite run of `exact-apple` and once of `exact-linux` (the test is shared source), at load averages near 25 to 40, and passed five times alone. `contract`'s `growth` test `resource_clock_advice_grows_with_functions` failed once in a whole-suite run and passed three times alone.
- **Setup's cargo advice on Windows can blame the wrong file** (2026-11-11, read in #3, not run). `cargoProxyFault` (`scripts/exact.mjs`) probes whatever `cargo` the shell runs and then looks up `cargo.exe` across the whole `PATH`. Windows runs the first match by `PATHEXT` in each directory, so with a `cargo.cmd` shim ahead of rustup's `cargo.exe` the fault names the working proxy as the one that refuses `+<pin>` and skips its directory. Resolving the failing file as the shell does, and comparing directories by real path without case, would close it.
- **A standalone app whose first boot is refused draws nothing** (2026-11-11, found in #163). A Rust source whose `answer` returns `Unavailable` at boot refuses the boot. A release iOS build then shows a blank view (the session is `failed` with the reason in `bootError`), Linux prints `exact: boot: …` and exits, and the web JS target empties its root. LLP 1031 D8 leaves the previous generation or the embedder's fallback visible; a standalone app's first boot has neither. What it should show is undecided.
- **An inline run's opacity: what Apple's fix left, and Linux** (2026-11-11). Apple now fades a nested `text` run's colour, background, shadow and stroke by its opacity (`paragraph` ops carry it). Still full ink: the paragraph's decoration lines drawn through a faded run, the widgets and watchOS path (`HeadlessSession`), and a button title's direct text child. The Linux painting host applies no run opacity at all. An infinitely animated run re-sends its paragraph every frame, as a changing run colour already does.
- **A positioned box inside an aligned multi-column container is not where Chrome places it** (2026-11-11). A 320×100 container with `column-count:2`, `column-gap:0` and `align-content:end` holds a 20px block, then a `position:relative` block whose child is `position:absolute; top:0; left:0` and 10×10. The kernel paints the child at (160, 80) (`kernel/src/fragment/cut.rs`). Chrome 156.0.8078.4 paints it at (800, 80), and the container's scroll width is 960; with 30px blocks it paints both `top:0` and a static position at (480, 80). Chrome's rule seems to be one for every inset: the column is `floor((flow_y + align) / pitch)`, and y is the remainder plus the alignment. An `overflow:hidden` containing block keeps its child with it at (160, 80). This entry first said Chrome paints the child unshifted at (160, 0); it does not, and the attempt built on that, branch `fix/q0024-a-positioned-box-inside-an`, is not landed. Not declared in LLP 1093 D10; Chrome fixture rows in `kernel/tests/it/browser_columns.rs` would hold it.
- **A build script that watches a directory outside its package** (2026-11-11, #171). A bake refuses one (`completeBuild` in `scripts/app.mjs`), naming the package and the directory: a watch of `../..` above a path dependency holds the app, its target directory and the bake's output. Recording one needs the receipt and the drive's freshness check (`receiptChanges`, `watchedNewer` in `scripts/agent-launch.mjs`) to share one list of the directories builds and tools write, directory listings recorded without those, each link's target recorded, and link cycles skipped.
- **Web JS sends before source activation refuse finite arguments** (2026-11-11). When `data.answer()` returns `null`, `host/web-js/rt.js` refuses the send's action instead of waiting for `data.ready()`. Reproduced on `db0f0618` and with the non-finite argument fix; the runner already waits for activation.
- **Android's island pictures, what an emulator showed and what a phone still owes** (2026-11-11, LLP 1159.000 D1; `issues/closed/20261110-android-recorder-drops-island-images.md`). On an API 36 emulator a page with `text-shadow`, `-webkit-text-stroke`, `background-clip: text`, a `clip-path`, a `mask-image` and a blurred SVG shape draws as the web's does, and a blended SVG element draws unblended and says so once in the log, as the schema's `mix_blend_mode` row records. Not measured: what a shadow or a stroke that animates costs, since each paint sends a new picture; and nothing was seen on a phone's GPU.
- **On Apple a one-axis `overflow` clip on a node with an overlay or a material clips both axes** (2026-11-11). `clip` beside `visible` puts the children in the shadow's clip box (`BoxShadow.swift`), which a node with an overlay or glass cannot take, so those keep the both-axes mask. The clip box also reaches only 65,536 points past the node on the visible axis. Neither is declared in LLP 1001.
- **An outside app's Rust workspace after its checkout moves, and a bake source built with arguments** (2026-11-11, #163). After exact2 moves, `bun exact.mjs update` repairs `exact-*` paths and leaves any other exact2 crate (`contract`) on the old path, so Cargo cannot read it; the way out is to write that path as `<exact2>/…` again and run `update`. `buildModule` (`host/web-js/module.mjs`) copies only a path, `::default()` or `::new()` into the module it generates, so a data source constructed with arguments needs a crate of the app's own named in `rust.module.package`. Its matcher reads the raw script, so a commented-out call it can copy is taken ahead of a live one it cannot, as on origin/main; that is left for the real parse. A fix for either needs edits made on a real parse of the manifest, and of the build script, not on patterns over their text.
- **Apps in SDK-named folders** (2026-11-11, token audit row 06). `exact new <path>/exact --name Everbloom` still refuses the `exact-apple` collision. Deriving a prefix from the display name needs one crate identity shared by `createApp`, `updateApp`, `ensureShells` and `resolveApp`; changing the scaffold alone would break a later update or build. Keep the directory alternative in the error until those paths agree.

- **Native executor test isolation on a shared Mac** (2026-11-11). Default-concurrency runs can exhaust test worker slots and hit request or exit deadlines in `exact-linux` and `exact-apple`. The branch's full root and Linux test commands pass with four test threads; the baseline Apple library also hits a process deadline. Qualify test worker admission and real-time waits under suite load.
- **A build does not notice a stale copy of an in-app `file:` package** (2026-11-11, #115). Bun copies a `file:` package inside the app's directory into `node_modules`, so an edit to its source builds the old copy until `bun install`, silently. A check that compares only the files a build read with the package's source (`checkInstalledReads`, one refusal rule, every producer) is built and held on branch `wave10/build`; what it still gets wrong: a Windows implementation's `exact.json` is taken from beside its Rust root, not where it is declared (`packages/device/windows` names `../linux/lib.rs`); the APK's Kotlin directories are walked whole, so a `.DS_Store` or README there refuses a build Gradle would not compile it into; web extension implementations reach the page bundle through `ext-*.js` outside both checked records; a file read through a link from one installed package directory into another (Bun's isolated installs keep them under `node_modules/.bun`) is looked up by the physical directory's name in `bun.lock`, not by its package's; a copy missing beside a present source throws `ENOENT` instead of refusing; the APK entry's test needs the Android Rust target to reach the check; one bake test sets `TARGET` for every bake in its binary; and that test fails under `EXACT_JS_ENGINE=stub`. Not covered at all: a package's Rust module files beyond its root, and Contract files a package gives an app whose data is Rust.
- **Apple readers of an `app:/` file that still take a path** (2026-11-11). Apple's `saveFile` copies the file `appFile` (`host/apple/src/picker.rs` `app_file`) joins as text, with `FileManager.copyItem`, which copies a link the app planted there. An animated `app:/` GIF or WebP opens through `AppFiles.open`, but its later frames are read from its URL (`AnimatedRaster.swift`), so a link put in its place after it opened is read. A widget's `app:/` image (`ExactSnapshot` `SnapshotRasters.resolve`) admits a link that stays below its root. Each wants the walk `readFile` takes (`AppFileWalk`).
- **Android extension writers that still follow a link planted after the path is answered** (2026-11-11, #164). Each needs app code holding `fs.write` on the directory to act in the moment between the context's check and the write. The writes Exact's own Kotlin makes go through `Files.output`/`Files.write` (`O_NOFOLLOW`), but three do not: the camera on a device, where CameraX opens the answered `File` itself when the shutter finishes (hand it a stream or descriptor opened with no-follow before `takePicture`; CameraX is not in every machine's Gradle cache, so it was not compiled with the rest); the recording encoder's output on a device, which `MediaMuxer` and `RandomAccessFile` open by path (`Recording.kt` `Encoder`, `Parts.kt` `PartWriter` and `mux`'s `.mp4.tmp`); and a parent directory swapped for a link, which is followed both inside `picker::place` itself (`host/linux/src/picker.rs` `place_from` checks the parts one at a time by path, and `file` joins the path again after `open_from`, so a directory replaced by a link between two lookups answers a path that already goes through it) and at any later write, a speech transcript's directory during a running recognition included, since `O_NOFOLLOW` guards only the last name. The fix for all of them is one thing: a descriptor-relative walk from the app root (`openat` with `O_NOFOLLOW|O_DIRECTORY`, as ibex2's `AppDirectories` does) with the parent's descriptor held through the write.
- **iOS: a batch between a resize and its layout still lays a native container out at the old size** (2026-11-10). `ExactView.fitAheadOfLayout` tells the session a new size before a trait, tint or text-size change's batches. Other batches still run in the old frames: `fit()` applies a new display scale's batches (`canvasDisplay`, `tellDisplayScale`) before the size, `tellPage` applies one on activation and from the scene notifications, and a timer or main-queue batch can land there too. On an iPhone Duo such a batch during a refresh can leave the scroller's refresh inset under a large title, as the appearance change did. Fitting from the view's own `frame` and `bounds` setters, as the Mac view fits from `resizeSubviews(withOldSize:)`, would cover them all, at the cost of a fit inside UIKit's autoresizing on every rotation and fold, which may read the safe area before UIKit settles it. The early fit also runs before the session holds a new appearance, so a view whose text colour the new width changes can be noted as painting in an appearance of its own (`noteAppearance`) and ease rather than snap at the next flip (`set_view_scheme`).
- **iOS: a refresh control there at boot is hosted by the navigation bar on an iPhone Duo** (2026-11-10, seen in a probe app on the 27.1 simulator). The stack is laid out before its window, and UIKit moves the control into the folded display's fixed 58-point large-title bar. Not yet compared with a hand-built app on the same OS; if its control stays in the scroll view, this is a tell.
- **`packages/background-transfer/test/apple.mjs macos` fails four assertions** (2026-11-11; two runs at be826004 on macOS 27.0.1): the upload's response body, download `d1`, folder `f1` and appear `f2`. The upload's `uploaded` was 8 of 8 in both; an earlier run read 0 (the carrier's `sent`, `host/apple/Sources/ExactKit/Transfers.swift`), so that count may be intermittent. The suite had not run since `exact new` stopped naming Apple by default. A first `host/apple/build.mjs` of a fresh `exact new` app is refused by the driver as stale: the build writes `.exact/shells` after the `started` its receipt records (`build.mjs` takes it from the process's start); the suite now writes the shells first.
- **A placed canvas child's layout change, with VoiceOver running** (2026-11-11, #68). On iOS a canvas whose surface places its children posts one `.layoutChanged` when the set or order of its exposed children changes, and nothing while they only move. It posts behind a dialog's sheet and under `inert` too, so a culled card there makes VoiceOver read the screen again once: the accepted cost of a rule with no reachability state. Listen for that re-read with VoiceOver on a phone. The Mac still posts `.layoutChanged` for every placed child whose placement changed, each frame (`GpuMac.swift` `readPlacements`, `NodeView.placementChanged`); a fix wants VoiceOver on a Mac to judge which element to name.
- **A look's `color` under a `color-scheme` boundary on the wasm web host** (2026-11-11, #111). The JS target gives a boundary below a hovered or focused node the look's colour (`modes.js` tags it, `colour_below` in `host/web/src/host/looks.rs`); the wasm host's boundaries still write the inherited colour onto themselves and stop it. A press colour probably does not cross a boundary on the web either, and two nested looks that both hold give the text the later rule's colour where Apple, like CSS inheritance, gives the inner one's. The iOS XCTests for the Apple path (an iPad's pointer) have not run.
- **Where a JavaScript render still differs from the render host** (2026-11-11, found in #108; `host/web-js/render-settle.test.mjs` `DIFFERS` pins each). The render host rejects a refused storage call; a JavaScript render leaves it unanswered. So a source that catches the refusal answers its fallback there and stays pending here (as LLP 1048.000 D9 has a refused source keep its placeholder), and a stream whose mapper awaits a refused call, one it makes itself or one made before the stream opened, ends its message there (a settled 200) and holds the stream to the deadline here (a 503). Rejecting the refused call here, as the render host does, would close both; it is not done, since a rejection nothing handles in a render ends the `serve` process today.
- **A detached rejection on a server promise ends a JavaScript render's process** (2026-11-11, found reviewing the render store's refusal). `host/web-js/render.mjs` hands each render's realm the server's own `fetch`, `Request`, `Response`, streams, `crypto.subtle` and `WebAssembly`, so their promises, and every promise chained on them, belong to the server's realm. When one is left rejected with a value made outside the render's realm, as `new Response('body').text().then(() => { throw 'x'; })` or a refused `store.set` caught and rethrown as its message, `render.mjs`'s `unhandledRejection` listener cannot tell which render owns it and keeps Bun's fatal handling, and the process exits. The string rethrow exits it on main too. Containing it needs every promise a render sees made in its own realm (each promise-returning server API wrapped, and the objects they return) or renders run where an unhandled rejection ends only that render.
- **`exact-linux`'s timing tests fail under a loaded Mac** (2026-11-12). `cargo test -p exact-linux --lib` on an M5 running other builds fails one or two of `presenter::pump`'s `an_abort_whose_answer_was_replaced_is_still_cancelled_on_an_empty_pump` and `a_wake_without_a_reply_releases_held_work`, and `executor::core::async_tests::the_suite_passes_on_the_asynchronous_core`, a different one each run (main failed one of five runs); each passes alone. Find the wall-clock wait each takes and give it the test clock (`docs/testing.md`). `agent::tests::exit::an_orderly_exit_waits_for_a_request_with_effects` is another (2026-11-12): it failed twice in full `--lib` runs and passes alone.
- **`exact-apple`'s executor tests fail together under load** (2026-10-27, a Mac Studio shared with long Lean lanes). `cargo test -p exact-apple --lib executor` failed nine socket and idle tests (`executor_socket_tests.rs`, "an outcome within five seconds"; `executor_idle_tests.rs`) and `the_suite_passes_on_the_asynchronous_core`; each passes alone. A short read no longer zeroes its unused buffer tail on every read (2026-11-12), which cleared the large-body timeout under contention, but the nine were not reproduced and a contended run still fails the child-process `maxBuffer` test. Find what each five-second wait waits on before lengthening it.
- **Three press tests cannot open their page on this Mac** (2026-11-12, main f72a364c). In `host/web/tests/press.test.mjs`, "only the innermost pressable shows the press…", "a pressable that declares no feedback dims while pressed…" and "the pressed paint shows by the press rule…" fail in about 2 ms with `the DevTools pipe closed (Target.createTarget)` (`open`, line 147, through `agent-launch.mjs:484`), every run; the other 27 pass. The fleet's Chromium runs them. Find which browser `open` launches there and why its pipe closes.
- **Nine web-js document and build tests fail on main on this Mac** (2026-11-12, 9e55aa1b). In `host/web-js/document-agent.test.mjs`, seven navigation cases whose data is discarded or outlives its answer (`storeStatus`, `discardedStatus`, `discardedHeldStatus`, `discardedLooseStatus`, `backgroundSync`, and two deadline cases) answer 200 where the test expects 404, or report `settled: true` at the deadline. In `host/web-js/build.test.mjs`, the production starter is 46,610 bytes against its 45 KiB budget (`build.test.mjs:101`), and an app whose head names `<script>` builds a shell without its escaped `<title>` and keywords `<meta>` (`build.test.mjs:932`). Find which commit changed each and whether the code or the test is wrong.
- **Two photos seams checks assume a 2× Mac** (2026-11-12, 17f16354). `bun packages/photos/test/seams.mjs macos` expects the module to draw `swatch:blue at 100x40` and `swatch:red at 80x60` (`seams.mjs:284`, `:285`); this Mac draws them at 50×20 and 40×30. Take the scale from the session instead of assuming 2.
- **The APK lock test needs a JDK on a Mac without one** (2026-11-12). `scripts/agent-launch.test.mjs`'s "an APK with Maven libraries refuses missing locks before any native build work" fails where `java` is unusable: `buildApk` (`scripts/agent-android.mjs:787`) asks for a JDK before it reads the locks. Read the locks first, as the test's name says, or skip the test without a JDK.
- **LLP 1133.021 on Apple: drive 1 and drive 3's wheel need an unlocked Mac** (2026-10-27). With the console session locked, MapKit places no annotation view (its frame stays at the origin) and draws no marker, so `tap map/ferry` has nothing to hit; the window server gives no capture either. Run `bun packages/maps/test/map-demo.mjs macos` on an unlocked Mac: its marker selection and wheel zoom are unchecked. `tree` on Apple now lists a package view's declared parts, as the web does.
- **A Windows receipt can certify a source Cargo did not recompile** (2026-11-12). Windows build receipts record each baked source by content (`scripts/cargo-dep-info.mjs`), refreshing a cached digest when size or mtime is unchanged but ctime moved. An edit that keeps a Rust file's size and mtime is not seen by Cargo's fingerprint, so the crate is reused while the receipt records the edited source's hash and its checks pass on a stale executable. Recompile the units whose recorded contents changed (build-script helpers too) before writing the receipt, and test by rebuilding and running after such an edit.
- **iOS: a `min-height` percentage on a list row drops the platform's row height in the kernel** (2026-11-10). With iOS's metrics, `button "Row" min-height="50%"` in an `inset-grouped` list is laid out 19.2 points tall against 52 without it, while UIKit draws its own cell at about 52: the percentage replaces the platform's minimum and has nothing to resolve against. `inherited::a_percentage_min_height_on_a_list_row_has_no_basis` (`host/apple/tests/it/inherited.rs`) expects the two heights equal; it passes on a Mac, where `host/apple/src/scale.rs` `kernel` sets the Mac column, and fails on Linux, which builds with iOS's. A fix that keeps the sheet's minimum when the percentage has no basis (2026-11-11, three review rounds, not landed) grew to 19 files with Taffy patches, and still missed: a row with `delete=` (lowered into a swipe scroll, so `row_minimum` in `kernel/src/grouped.rs` finds the section, not the list, and `restyle` never reaches the swipe content); a comparison inside arithmetic (`calc(min(30px, 50%) + 0px)` gave 52 points where `min(30px, 50%)` gave 30, since a sum takes `value()`); `calc(0% + 0px)`, which a zero-percentage guard skipped; and a destructive `link` on the Mac, given the button metric (the sheet applies it to `button` alone). Start from the swipe scroll's parent and carry the fallback through arithmetic.
- **Should hit slop keep a button native?** (2026-11-12, from #103's hit-slop item). Hit slop never reaches a native button: `appearance="auto"` with `-exact-hit-slop` is refused (`lower-button-style-attr`; hit slop is not in `NATIVE_ROWS`, `contract/lower/src/controls.rs`), and on a `button` with no `appearance` it makes the compiler build a custom button, so adding slop changes how the button looks, which LLP 1115's "would someone who knows the platform notice?" forbids. A person decides whether a native button takes slop. If it does, the web needs the button's face in its own clipped box with the slop outside it: `#exact-root [data-native] { all: revert }` (`host/web/index.html`) outranks the hit-slop rule's `position: relative`, and the button's `overflow: clip` would clip the slop. A lane built that wrapper (2026-11-11, not landed); its reviewers found a checked menu row's `::after` mark escaping the clip, an auto-width flex button cut at its longest word, and a grouped row's separator lead lost through the wrapper.
- **Web: a raster menu row's checkmark in a centred flex row or under a bound direction** (2026-11-12). `host/web/neutral.css` places a raster-faced menu row's mark 1.5em before the start of its content box, so a row written `display="flex"` with `justify-content` `center` or `end`, or `flex-direction="row-reverse"`, puts it beside the face's first item rather than after the row's padding. The gutter takes the author's left or right padding by `--exact-separator-dir`, which a bound `direction` on the JS target does not write, so there the gutter can take the other side's padding (the mark still clears the face).
- **The persisted-time warning misses a sum of two readings** (2026-11-11, found in #102). `contract/lower/src/warnings.rs` `pair` gives a time plus a time the kind of a time, and a time less a time a span, so `performanceNow() + performanceNow() - start`, and `banked` added to it, are kept unwarned though they hold a launch-relative time. A sum of two times wants its own kind, which less one time is still a time. A rewrite that tracks each value's clock coefficient (2026-11-11, three review rounds, about 960 lines in `warnings/clock.rs`; not landed) still warned falsely on a duration plus `time.epochAtZero` (an absolute instant), a duration times or divided by an unseen field (`(performanceNow() - start) * time.bpm`), `time.epochAtZero + performanceNow() - saved.at`, equal decimal scales (`performanceNow() * 0.0001 - start * 0.0001`) and scales through a built-in (`/ floor(1000)`), and missed a self-referential state (`origin = origin > 0 ? origin : time.epochAtZero`) sent with `performanceNow()` added. A coefficient of zero must stay zero under any finite scale.
- **What `host.web.head` should admit of a stylesheet, an import map and `meta http-equiv`** (2026-11-11, PR #124, whose comments hold the measurements). `scripts/web-head.mjs` refuses only what Exact writes or reads itself, so each is written as given into the shell and every pre-rendered page. A same-origin `link rel="stylesheet"` applies, though an author's CSS is Contract's. An `importmap` mapping `./app.js` to another file makes the runtime load that file wherever no CSP is sent (`serve`, the dev loop, a static host); the render server's policy (`host/render/src/csp.rs`) ignores the inline map. A `meta http-equiv` `refresh` navigates, and a `Content-Security-Policy` one can stop `app.js`, with or without that policy. Each is the maintainers' decision.

- **Issue fixes written and not landed** (2026-11-10). Each stopped after three review rounds with a defect still open, or waits on a decision; each is a local branch of the checkout the issue work ran in, one commit unless said. #36's warning for a root child no host draws, `wave2/contract` fa8a7d9c. #37's heap guard, `wave2/worktrees` f30a3a99 (a real fix wants a Hermes built with recoverable out-of-memory). #34's deferred autofocus, `wave2/canvas` 44131ce3. #45's filter redraw skip, `wave2/filter` 6dafa778. #2's XCTest, `held/issue-2-xctest`.
- **Fixes for the 2026-11-10 review's issues, written and not landed** (2026-11-11). Each is a branch of the fleet checkout the fix lanes ran in, and its issues stay open. `fix/f-doc-watch-inotify-q` (`doc-watch-keeps-dead-inotify-watch-for-replaced-folder`, `recursive-doc-watch-walks-its-tree-on-every-commit`): Linux document watches recover after a folder is replaced and skip the walk on an unchanged commit. After `/docs/sub` is renamed to `away`, a new subscription to `/docs/away/a.md` shares the old descriptor and never fires (`host/linux/src/doc_watch.rs:325`); with `MAX_FOLDERS` full, deleted children of a recursive watch stay in `truncated` and grow without bound (`:293`); a folder moved out of a recursive root keeps its stale descriptor, so writes under its new path announce the old topic (`:329`, `prune` at `:361`).
- **Markdown decorations of one text share a shadow step** (2026-11-11, Astra's review of the line-through fix). `text "~~HHHH~~ ~~HHHH~~" markup="markdown" font-size=40 color="#ff0000" text-shadow="-60px 0px 0px #00ff00"` on the Linux host: the two strikes share one `source` (`host/linux/src/paint/text_decoration.rs:75`), so their shadows merge and paint at the first span's step, and the first red strike covers the second strike's green shadow where they overlap. Give each Markdown decoration span its own identity, so each shadow paints at its own first run.
- **Defects that reviewers of the review's fixes noticed and nobody has verified** (2026-11-11). Reproduce each by running before filing it (`docs/issues.md`); a later round of the fix that surfaced one may have fixed it. Line numbers are as the reviewer saw them.
  - Compiler and semantics. The resource clock advice resolves names by spelling: `fn performanceNow(): number = 7` passed as `performanceNow()` to a resource warns `analyze-resource-clock`, and `fn elapsed(): number = performanceNow()` beside `derive elapsed = 0` leaves `read(elapsed())` silent (`contract/analyze/src/lib.rs:862`, `:925`). An app syntax error under `contract verify` with a property file prints two paths, `PROPERTY REFUSED <test>:<app>:4:20` (`semantics/difftest/src/verify.rs:89`).
  - Runner. A refused `link_activities` leaves the snapshot and its `linked` flag true, so a later `set_activities` returns `Ok(None)` while the resource shows `linked` false (`runner/src/runner/activities.rs:65`). An answer with `exact:stale` 60000 followed by a plain answer before expiry keeps the old deadline (`runner/src/runner/modules/stale.rs:24`). Text under `visibility="collapse"` stays selectable, where `hidden` does not (`runner/src/instance/text.rs:158`). Two same-group voices at one start, the later retracted before it starts: the earlier stays cut and never sounds (`runner/src/sound.rs:553`, `host/web-js/sounds.js:103`).
  - Web. Appending to a virtualized list with `scrollFollowEnd=true scroll-behavior="smooth"` on the JS target corrects without `smooth`, so the follow jumps (`host/web-js/list.js:393`; both reviewers). A finite send while `data.answer` returns null is refused with "its source is not ready", where the runner parks it until `data_ready` (`host/web-js/rt.js:586`); a worker-placed source that answers `Infinity` fails with `NonFiniteValue` (`data/src/envelope.rs:127`). A markdown field's `beforeunload` does not run after `markup-editor.js` replaces the textarea (`host/web-js/rt.js:918`). `exact_set_time` is not called when `Date.now()` jumps and the zone offset does not, so the epoch at clock zero stays the launch epoch (`host/web/glue.js:680`). An accepted `.tiff`, `.tif` or `.markdown` file is delivered as `application/octet-stream` (`host/web/picker-glue.js:278`; both reviewers). An `img` with `visibility="collapse"` is still chosen as the document hero (`host/web/src/document_before.rs:77`). A `--render rust` page's text with `:hover` has no `data-exact-looks` before adoption (`host/web/src/document.rs:922`). A dist holding `assets/.config` or `assets/.well-known/data.json` makes `listPublicFiles` throw (`host/web/serve.mjs:400`).
  - Painting hosts. A `g` with `fill="light-dark(…)"` inside an `svg` with `color-scheme="dark"` paints the light colour (`host/linux/src/paint/svg.rs:491`). A shape outside the view box of an `svg` with `overflow="scroll"` never moves when the element scrolls (`host/linux/src/paint.rs:1154`). A field paints no text shadow (`host/linux/src/paint/field.rs:551`). Under `direction="rtl"` a native `button text-align="start"` with a text child aligns left (`host/linux/src/paint/button.rs:815`).
  - Apple and Android. The draw thread's `measure` and the main thread's `apply` mutate `CanvasText.fonts` with no lock (`host/apple/Sources/ExactSurfaces/Canvas2DText.swift:34`). A scroller's own `padding-top` or height change adjusts its anchored offset (`host/apple/Sources/ExactKit/ScrollAnchoring.swift:163`; both reviewers; fixed on the painting hosts). An `svg`'s shape past the view box shows in the element's padding (`SvgScene.swift:255`). A negative used `scroll-padding` shifts the port, where a browser uses 0 (`IntoView.swift:39`). `copyNativeResources` copies a `.DS_Store` in a declared resources tree into the bundle (`host/apple/assets.mjs:662`). The speech splitter appends an empty second piece for `'a'.repeat(16384) + ' '` (`packages/speech-recognition/apple/SpeechRecognition.swift:399`, `android/SpeechRecognition.kt:435`), and the result window counts characters, not bytes (`web/index.js:56`, `android/SpeechRecognition.kt:401`).
  - Packages. A web HID reader with `history:1024` after 1,025 reports returns 1,024 with `dropped:0` (`packages/hid/web/index.js:131`). The last `close` of a plugged HID device on Linux and Windows drops the open, so `inputReports` answers empty and interrupted and `hidConnection` says disconnected (`packages/hid/linux/lib.rs:328`, `windows/lib.rs:369`); Apple's first open retains its shared log and nothing releases it (`packages/hid/apple/HID.swift:204`).
  - Game. A sprite that fails `validate` journals the same refusal on every feed (`game/render/src/quads.rs:295`; both reviewers). `executionInputFiles` walks `assets/.DS_Store` into the proof inputs (`game/inputs.mjs:77`).
  - Documents and tests. `bench/extra-heavy/EXACT2-GAPS.md:124-126` describes `text` and `image` inside `svg` as refused; `text` compiles and `image` is refused with another message. On Linux, with and without the fixes: `js/tests/it/pure.rs:36` fails parsing Chrome's output, the runner's `every_app_plan_updates_incrementally_exactly_as_it_does_in_full` fails for `geofence-fixture`, `exact-textflow` fails at `src/tests.rs:75` and `src/showpiece_tests.rs:132`, `:326`, and `tamber_rows_check::a_worst_case_write_is_checked_within_the_budget` fails under load, a wall-clock budget (`docs/testing.md`).
- **A protected-routes recipe, written and not landed** (2026-11-11, #136; `wave14/route-guards` a737ec3b, `docs/recipes/protected-routes.md`). Three versions each passed their own tests on the web and macOS and then failed a case in review. Open on the last: a first session check that fails leaves a protected screen on its placeholder with no way to sign in (`known` is false, so nothing redirects and nothing refreshes `me`); a protected tab root is described in prose and not drawn by the snippet (`replace` at depth 1 keeps the tab's root route, so the redirect is refused and its one-shot timer is spent); signing in at `/login` with no `next` replaces the entry with a second `/` visit, and the browser's Back is then refused; the fragment of a deep link is lost across the redirect. The shape does not fit a recipe's 3,072 bytes. Two things make it intricate: nothing runs when a resource's answer arrives (RealWorld polls every 100 ms for it), and a `replace` and a `push` in one commit leave the browser's entry beneath with its old URL.
- **Landed on 2026-11-11 without a Windows machine or an Android device** (no Windows machine and no Zig for a cross-check; the Android emulator does not boot). Windows, each tested as a function of the platform on a Mac and never run there: the Android build's NDK tools (#148), a verbatim drive path as the filesystem helper's root (#149; its Windows test compiled, not run), starting Gradle with the wrapper jar and splitting `JAVA_OPTS` and `GRADLE_OPTS` as the C runtime does (#150). The LF line endings (#147) were checked with an autocrlf clone on a Mac; the `exact-js` build script was not run against a CRLF tree. Android, on no device: the purchases listener's declaration order (#157; Kotlin read, not compiled), `flock` for a `secret.keep` lease (#158; compiled for `aarch64-linux-android`), the `default` store for a drive that names none (#153; Windows too).
- **Landed on 2026-11-10 without a device or the XCTests** (the Mac they were made on has no Metal toolchain, no Android device and an emulator that does not boot). Android: the Maps module without a key (#64), a placed canvas child's pixels (#50), the held-frame scratch texture (#47). iOS, seen on a simulator only: `system-bars-hidden` (#52; the home indicator's fade cannot be seen in a simulator capture), `font-feature-settings` (#41; Windows compiled only), the aria-hidden canvas child (#69, read through lldb because XCUITest would not start). XCTests written and never compiled: `StatusBarIOSTests` (two new tests), `FrameHealthMetricsTests` (on `wave4/driver`).
- **Android canvas, causes found and not fixed** (2026-11-10, #50, #53). `Each` placements are read only when the page paints, so children do not follow a surface that moves them while the page is still. No Linux-family host calls `gpu_texture`, so `Composite` is unbuilt there, and none calls `gpu_period`, so `Frame::period_ms` is 0 on Android and Linux. Each wants a phone.
- **A placed canvas child, with VoiceOver on a phone** (2026-11-11, #69). On UIKit a child the surface places hides its own drawing behind an empty mask on its layer and keeps alpha 1 (`NodeLayer.drawnElsewhere`; its writers' mask and opacity are kept aside), so VoiceOver descends into it and the snapshot XCUITest reads honours `accessibilityElementsHidden` below it; both were read on a simulator, not heard. Listen to a placed row's text and a placed control with VoiceOver on a phone. **Still open, the rest of #69:** a UIKit control inside a placed child (a switch, a native button's label) is reachable now and still reports its kernel frame, not its placed one, so VoiceOver's cursor for it is drawn where the child is not: only Exact's node views map their frame through the placement. A child the surface leaves in place at `opacity: 0` is left out of the canvas's accessibility list, as UIKit leaves a transparent view out of its own walk. Focus does not reach into a placed child (no focus item; on tvOS its `focusItems(in:)` offers none, which was compiled, not driven) until focus is mapped through the placement too. A filtered placed child's capture is its filter's picture: this simulator's filter chain draws no pixels in an XCTest, so that is read on a device or the Mac only. A context menu lifted from a run inside a placed child draws none of the child's ink (as alpha 0 did) and rises from the run's kernel frame: mapping the lift through the placement is not built. With the sky canvas on, VoiceOver's traversal of Caltrain's window returned no elements (seen once on 2026-11-10, not pursued): the sky's overlay is at alpha 0.
- **Known edges of 2026-11-10's fixes.** #56: a surface name registered by both the `gpu` crate and a declared module builds and draws the crate's; a declared GPU module's surfaces do not run on the web's JS target (refused by name). #62: with two overlapping animations the suggested `clock +N` can be the shorter one's, and the wasm target always gives the scroll sentence. #41: a bound value with more than sixteen features draws on the web's JS target and is refused natively; `font-variation-settings`, `font-stretch` and `font-optical-sizing` are not in a component's `text` group. The web writes a keyframes rule's name unquoted. #63's review found the agent's `back` cannot press the Back that UIKit's More shows. #123: on iOS a rolling paragraph rolls digit by digit (SwiftUI's numeric text) only when a raster could hold it, it is one whole line of text with no image and no white space it keeps, and what it paints lies within its box, and it has no shadow, no stroke and nothing hidden; any other rolls as a whole picture where it rasters, and otherwise not at all. Unchecked on the rolling line: a CSS `filter` on the text (its picture is the subtree drawn once, so the roll's motion may not show through it).
- **The `tests` workflow is red on Linux for reasons older than it** (2026-11-10). Until that day the Linux job stopped at clippy and never ran a test. It now runs them: about twenty Cargo tests fail on Linux (`notify::`, `local_network::`, `contacts_calendar::`, `inherited::a_percentage_min_height_on_a_list_row_has_no_basis`, `incremental::every_app_plan_updates_incrementally_exactly_as_it_does_in_full`, the executor's async suite, `tamber_rows_check`'s budget), and 25 script tests, most because the runner has no `nightly-2026-08-21` with `rust-src` ("the web artifact builds with nightly-2026-08-21 and its std sources"). macOS passes in about 95 minutes. `four_times_the_uses_compile_in_about_four_times_as_long` measured 4.7 once on a macOS runner against its 4.6 limit and 4.1 to 4.3 on an 18-core Mac before and after the day's commits. Three `exact-web-js` colour tests (`a_bound_filter_goes_through_the_colour_map` and two beside it) fail now and then in a full run and pass alone. Neither workflow compiles the Swift host. `games/garden/Cargo.lock` is stale (`bun game/app/shells.mjs game/games/garden --lock`).
- **A signed build chooses an identity and profile that match** (2026-11-10, LLP 1156.004 D1, deferred). `identity()` takes a team's first Apple Development identity and `profile()` development profiles only, so a profile without that identity's certificate signs and is refused at install or upload. Choose a matching pair for every embedded target before compiling; it needs a Mac with several identities and profiles to verify.
- **`border-width` with no `border-style` draws nothing, silently** (2026-11-10, LLP 1156.002 D6, deferred). A warning judged from the node's attributes alone would miss classes, shorthands and state styles; judge it from the effective style.
- **Caltrain's macOS footprint grows with no input** (2026-11-11, LLP 1158.003 r2, open question 1). One production launch (`--release`, a 420×860 window, no `EXACT_SMOKE`, M5 MacBook Air) read 212 MiB at 2 s and 331 MiB at 60 s by `footprint`: graphics 134 → 199 MiB, everything else 78 → 132. Hello and the AppKit floor stay flat from 2 s. One launch only: repeat it, then find what grows (its canvases, image or glyph caches, the journal ring), and say whether it levels off.
- **Compile an app's module incrementally** (2026-11-11, LLP 1156.003 D1). `bench/apple-module-compile.md` measured `swiftc -incremental -enable-batch-mode -output-file-map` on forty files sharing a 2 MB binding: a one-line edit takes 0.26 s against 31 s for `moduleArgs`' whole-module compile. Two conditions come with it. `snapshotSources` (`host/apple/arms.mjs`) must leave unchanged files untouched, since `copyFileSync` refreshes every modification time and all forty files compile again (14 s). A removed source's object, `.swiftdeps` and `.d` must be deleted, since Swift leaves them and a link of the folder's objects still exports the removed code.

- **Android canvas touch and rest on a device** (2026-11-10, #12, #13). Multi-touch on a GPU canvas and the at-rest render skip compile, build Weatherlight's APK and pass presenter tests, but ran on no device or emulator. Two fingers on a canvas, a scroll takeover, a replaced surface, and presents at rest want a phone. Hiding a canvas with `display: none` mid-touch does not cancel its remaining fingers.
- **A 30-minute soak of an alternating GPU canvas on a Vulkan Android phone** (2026-11-10, #47). A canvas whose surface answers `frame_ready() == false` on every other render now reuses one scratch texture, copy pipeline and bind group (`gpu/src/frame.rs`, `Scratch`), which the gpu crate's tests check on Metal only. Run the issue's `held` surface (or any that holds every other frame) as a full-window canvas in a release build on a Mali phone at 120 Hz, animating, for 30 minutes in one process: unpatched it aborted in wgpu-hal's descriptor allocator within 3 to 4 minutes. `adb logcat` should show no abort and `dumpsys meminfo` a flat graphics line. wgpu-hal still answers `ERROR_OUT_OF_POOL_MEMORY` and `ERROR_FRAGMENTED_POOL` with `unreachable!()` (`vendor/wgpu-hal/src/vulkan/descriptor.rs`); returning an error there would be a fifteenth local patch, and wgpu's default error handler would panic on it all the same.
- **`Body.ccd` is encoded by hand to keep old hashes** (2026-11-10, #27). It is written only when true, so reading a serialized body without it into one with CCD leaves CCD on. The derive would fix that and changes `pile-600`, `minimal-120`, forest's tick-4500 and rivals' tick-1080 pins and their save digests; `bun game/prove.mjs <game> --repin` is the way, and it refuses today because forest's and rivals' captured `Cargo.lock` lag exact2.
- **iOS: `testAHeadingsAuthoredTypographyIsTheBarsTitleFont` fails** (2026-11-11, seen landing the header search's Enter test). On an iPhone 18 Pro simulator `NavigationBarIOSTests` passes 46 and fails this one: for native-fixture's `title-font` heading, which authors no typography, `drawnLarge()` (`NavigationTitleInkIOSTests.swift:45`) finds no large title drawn.
- **An arrangement's `.intrinsic` pane on iOS 27.1** (2026-11-12). A pane holder now measures its authored content and margins for UIKit's `.intrinsic` dimension (`ArrangementSizingIOSTests`), checked on iOS 27.0, which has no native arrangement. Run those tests on an iOS 27.1 simulator to see UIKit's arrangement allocate the measured size.
- **Keyboard Check route on a Duo panel switch** (2026-11-04): folding from 130° to closed while editing returned the pushed editor to the Keyboard root. Inspect native navigation events and the app recorder; gutter checks select the pose before opening the editor.
- **Native Mac element arrangements** (2026-11-04): the AppKit prototype reset a scroller from 120 points to zero during adoption. Keep the CSS layout until native containment retains authored scroll offsets.
- **Duo native panes under the bars** (2026-11-05): qualify visible bounds through bar minimization and every fold pose before moving the Split and Overlay description into Workspace.
- **Arranged panes get no side clearance** (2026-11-08). The open Duo's 84-point side strip is the secondary pane's own right safe area; a UIKit app with the same arrangement ends its rows at it, but Exact lays the pane's content across it (pane and content both 475 points wide). LLP 1123 D3's local clearance for pane owners, or D9's `var(--exact-safe-area-inset-*)`, would keep content clear of it.
- **An iOS bar item's share test fails on main** (2026-11-07). `NavigationBarIOSTests.testAShareFromABarItemPresentsFromTheItem` misses its presentation assertion on iOS 27.1 (24A94232). It fails with this branch's navigation code and after swapping `NavigationBarIOS.swift` and `HeaderShape` back to upstream main in the same checkout. Check the native share presentation and test isolation.




- **Chrome conformance fails on seven apps on main** (2026-11-12, e494c5d2). `host/web-js/conform.mjs --build --strict` in Chrome differs on weatherlight (11 rows), fieldnotes (119), messages (40, the same rows at shifted indices), paging (56), pagetail (58), photo-editor (2) and markdown (1); bootpress differs intermittently. The Linux leg fails `slots.choice` and the radio's focus after `key radio-a ArrowRight`, and Firefox lays text out 1920 px tall against Chrome's 1536. Sort which are the JS target's defects and which the oracle's.

- **The Contract compiler's growth test crosses its CPU ratio bound on main** (2026-11-04). `contract/cli/tests/growth.rs`'s `four_times_the_uses_compile_in_about_four_times_as_long` measured 4.8× and 5.0× for 4× the input; a control with main's web files measured 4.64×, above its 4.6× bound. Other controls pass with the same compiled binary. Check the measurement and whether repeated work has returned before changing the bound. On 2026-11-12 it passed three runs in debug and failed every `--profile host-dev` run at 5.4–5.6×, while allocations and allocated bytes grew about 4× and clock inference took three rounds at both sizes. Neither a faster clock map, another sampling order nor allocator and cache controls brought it under 4.6, and profiling found no quadratic step; a control that scans every handler again measured 5.1× in debug and 6.6–6.9× in host-dev.
- **Tint edges left from the review of #1333** (2026-11-03, Fable). A native button's title or symbol in `AccentColor` with no accent of its own resolves by the key window's tint (`ButtonConfigurationIOS.color`, `SystemColor.appTint`), which misses a theme's `AccentColor` and an embedder's tint, and should resolve by its owner's `carriedTint`. `inkSymbolView` and `BarReadoutIOS` hand a colour of its own to a view as its tint and set `.normal`, where an image drawn in it (`withTintColor(_:renderingMode: .alwaysOriginal)`, as `GroupedCell.inked` does) needs no mode and leaves `tintAdjustmentMode` to the author's `-exact-tint-adjustment` (probe an original image in a colour made from `.tintColor` first). A gradient stop in `AccentColor` (resolved to the app's accent) and a face baked into a bar item's image keep their colour behind an alert.
- **iOS: a prompt's hardware keys with a real keyboard** (2026-11-03, LLP 1115 D6's amendment of that date). The alert's field hears a hardware key through a gesture recognizer (`PromptKeys`, `host/apple/Sources/ExactKit/IOS/PromptFieldIOS.swift`); its tests hand it synthetic presses and the agent's keys go round it. Type into a prompt with a Mac keyboard in Simulator.app or an iPad's: a `key` handler should hear each key once and a prevented one type nothing. If UIKit gives keyboard presses to no recognizer, Return and Backspace are still the delegate's, and the LLP's known differences grow by the other keys.
- **`-exact-continuous` past `apple_radius_limit` is not UIKit's** (2026-11-02, found reviewing the frame-health card's corners). Where a box has no room for the curve's 1.53 radii, the kernel's outline (`kernel/src/corner.rs`) reduces the radius, while UIKit's `UIBezierPath(roundedRect:cornerRadius:)` bends the curve toward a circular arc and SwiftUI's continuous `RoundedRectangle` differs from both: a 200×60 box at a 30-point radius lies 3.9 points from UIKit's, a 60×32 box at 12 points 2.1, and a 100×100 box at 40 points 7.2 (UIKit through Mac Catalyst, macOS 27.2). A layer with one radius takes Core Animation's `.continuous` there; the kernel's outline is what Linux draws, and what Apple draws where a layer cannot say the shape.
- **`image-rendering` on an `image`** (2026-11-02, Pokédex benchmark round 17: one agent of five wrote `image-rendering="pixelated"` for 96 px sprites and was refused). CSS Images 3 §5.3: `pixelated` scales by nearest neighbour, `crisp-edges` keeps edges, `auto` smooths. Each host has the filter: the web the property itself, Apple `CALayer.magnificationFilter = .nearest` (and `.minificationFilter`), Android `Paint.setFilterBitmap(false)`. A new row in `kernel/tables/schema.json`, which rotates the schema digest.
- **`formatLocale` carries a forced hour cycle on Apple only** (2026-11-02, LLP 1027.000.000). Android's shell reads the person's 24-hour setting for date controls (`Device.kt`, `DateFormat.is24HourFormat`) but tells `formatLocale` empty; `Settings.System.TIME_12_24` (`"12"`, `"24"`, or unset for the locale's own) is the forced cycle, to tell as the device's locale with `-u-hc-h12` or `-u-hc-h23`. Windows tells no place at all (the runner's `en-US` and `UTC`): `GetUserDefaultLocaleName` is the format locale, and `GetLocaleInfoEx(LOCALE_NAME_USER_DEFAULT, LOCALE_SSHORTTIME)` against the same with `LOCALE_NOUSEROVERRIDE` shows a time format the person changed (`H` for 24-hour, `h` for 12).
- **A restart keeps per-node state that a new node with the same id then picks up** (2026-10-31, found with #1228). Booting a booted session again (`ExactSession.boot` calls `resetHeld`: the dev menu's Reload, a development plan or connection reload, an update) keeps the `Presenter` and its hosts and clears them through `Presenter.reset` (`PresenterIOS.swift`, `PresenterMac.swift`), a list kept by hand that differs from what a node's destroy clears (`release(id)`, `stickies.forget`). The restarted runner numbers its nodes from 1 again, so a host's state keyed by node id outlives its node and is read for the new node with that id. #1228 fixed one case: `SegmentHost` remembered the adopted tablist by id, and the restarted tablist drew its tabs at the window's top left. Found by reading, not yet reproduced: (1) `StickyHost` (iOS, tvOS, macOS) forgets a record only on a destroy, so a header whose `position: sticky` a restart removed still sticks (`Sticky.swift`, `PixelGridIOS.swift`); (2) on macOS `SplitHost.reset` never releases `BlockHost.shown`, so text selection can meet an old and a new paragraph with one id and trap in `Dictionary(uniqueKeysWithValues:)` (`TextSelectionMac.swift`); (3) `SvgHost`'s maps survive, so a new svg can take an old scene's layer and a press can reach an old scene (`SvgScene.swift`, `PointerIOS.swift`); (4) smaller: `Canvas2DHost` keeps an old layer and `born`, the macOS `hoverMoves` keeps entries, and `ModalHost.refusedRoute` and the macOS `SegmentHost.decisions` can each drop a journal line. A browser's reload builds a new document in the same window, and nothing of the old document's state carries over unless the window holds it. The same for Exact would make a restart build a new `Presenter` and hosts, and carry over only what belongs to the session or its view, each named, so no per-node state can outlive its document and `reset` stops being a list to keep. Numbering nodes per session rather than per runner would also stop anything that does carry over from matching a new node.
- **No bulleted or numbered list** (2026-11-01, the Pokédex agent runs, rounds 5 to 8: three or four agents a round wrote `display="list-item"` with `list-style-type="disc"` or `"circle"`, were refused, and drew each bullet as a box). CSS Lists 3 §3 gives a `list-item` box a `::marker` (`disc`, `circle`, `square`, `decimal`) placed by `list-style-position`; the web would take it as written, and the kernel would need the marker box laid out beside the item's first line, with each host painting it.
- **A `table` takes no `border-collapse`** (2026-10-31, the Pokédex agent runs): `border-spacing` is a row since (one length; HTML's 2px unsaid; `border-spacing=0` with cells' `border-bottom` rules a table flush), but `border-collapse: collapse`, which merges neighbouring cells' borders by CSS 2.1 §17.6.2's conflict rules, is not: the web would take it as written, and the kernel's table grid would need the merge.
- **The fragment after LLP 1153 D5: five edges the last review left** (2026-10-30, from the delta review of ca3c18eecf). (1) The JS target's settlement (`host/web-js/router.js`) counts held.js's `Counting`, which keeps an ordinary asynchronous ticket after its resource replaced or forgot it (rt.js changes `r.ticket`; held.js drops the count only when the request finishes), so a navigation to settled content can wait on an obsolete request where the runner removes forgotten tickets from `pending`: count only current, owned tickets, or retire a count when the replacing commit lands. (2) A new navigation does not end a native hold: Linux (`host/linux/src/presenter.rs`) arms the new activation without clearing `fragment_anchor`, and `hold_fragment()` checks only the person-scroll count and the node; iOS (`Fragment.swift`) can add a second `ElementScrolls` request without dropping the first, and replacing `fragmentHeld` loses the first request's name: retire the previous hold when navigation supersedes it, a navigation that asks no fragment scroll included. (3) The deferred traversal restoration in `host/web/fragment.js` (two frames after Back, around Chrome's own scroll) checks only `personScrolls`: neither `cancel()` nor a later `arm()` invalidates it and it does not check the current history entry, so an app's `scrollIntoView` before it runs is overwritten; bind it to a cancellable activation and history entry. (4) Activation numbers restart with each `RouterContext`, but Linux's reload path and Apple's presenter resets keep `fragment_seen`/`fragmentSeen`, so after a runner replacement activations below the old watermark are not armed and run without the person-scroll check: reset the watermark with the runner, or put a runner generation in the activation's identity. (5) The JS target's `scrollBy` calls `cancel()` with its default `pending = true`, marking an armed fragment superseded, where Linux clears only the existing hold and the runner cancels a pending activation only for `scrollIntoView`: `cancel(false)` for the held-only meaning, with a pending-data test.
- **Tables after LLP 1153 D7: edges the last review left** (2026-10-30). (1) Every authored `display` on a table gets one anonymous table, `flex` included, where the browser makes `thead` and `tbody` separate flex items (CSS Flexbox §4, blockification before anonymous table generation); repair by the actual formatting context. (2) An existing anonymous table keeps a stale `direction` when only the table's direction changes (kernel/src/layout/table.rs, the reuse branch neither updates the node nor marks the table stale). (3) A caption's percentage `margin-bottom` resolves against the grid area inside the padding, not the table's width, as the three other sides now do (kernel/src/style/table.rs). (4) An empty `table display="block"` gets an anonymous grid with 2 px top and bottom padding, 4 px of height, where CSS 2.2 §17.2.1 generates one only for a misparented table child. (5) `make_table` (kernel/src/layout/table.rs, the branch with no engine node yet, and the `new_leaf` failure after it) removes `formed`, rewrites `placed` and returns without putting the table back in `stale`, leaving an anonymous grid already in `before.anon` allocated and forgotten; reinsert `formed`, keep or remove that node, and mark the table stale again. Each from the two delta reviews of 93bf5b8775; none reaches an ordinary table.
- **A fragment's scroll is driven on the JS target, by the router sweep's fragment case, and on Linux by its presenter's tests, only** (2026-10-30, the LLP 1153 D5 lane). The wasm web host (`fragment.js` from glue.js's `scrollToFragment`) and Apple's `Fragment.swift` were compiled, not driven: `bun scripts/smoke.mjs web` runs the sweep's case on the wasm host (not run here: the pinned nightly's `libLLVM.dylib` was missing), and on Apple open `/item/7#moves` and read the scroller. Two gaps remain on Apple: no host holds the target while pictures load there (the web and Linux re-align it until they land), and the Mac moves VoiceOver to the target but its key-view loop has no starting point to move. On the web, while the document still loads, Chrome holds its own fragment's element in view after Back or Forward, over the place `fragment.js` puts back.
- **Native table accessibility stops at roles** (2026-10-30, LLP 1153 D7). The Apple, Linux and Windows hosts expose a table, its rows and its cells by role (`host/apple/Sources/ExactKit/TableAccessibility.swift`, `host/linux/src/presenter/access.rs` `structure_role`, `host/windows/src/accessibility.rs`), not where each cell stands: AppKit's `AXTable` answers its rows, columns and header elements, UIKit's `.dataTable` container `UIAccessibilityContainerDataTable` (each cell's row and column ranges), AccessKit a row's and a cell's indices and spans, and Android's reader `CollectionInfo` and `CollectionItemInfo`, which `Access.kt` does not set for the new roles (it draws them, and a description list's, as groups). The kernel's placement holds every cell's row, column and spans (`kernel/src/layout/table.rs`): expose it on `Kernel` and answer each platform's table protocol from it, before the Mac's table becomes an `NSTableView` (LLP 1115.002).
- **LLP 1154 steps 2 and 3: Snapback publishes `snapback4-exact`, then exact2 deletes `snapback4/`** (2026-10-31). Step 1 is on main: the native slot's admitted and reserved storage, a package's prebuilt library fetched by hash and embedded on Apple and Linux, its web assets, and `packages/fixtures/vault` proving M5 on the Linux host, the web, macOS and the iOS simulator. What remains is Snapback's (§4: publish the package with D2's `exact.json`, dynamic libraries for Harmony's five targets, the module's call over the C ABI, `init --exact`, the guide) and then exact2's step 3 in one change (§3 Deletes; Harmony depends on the package; M1 to M6). Nothing in exact2 changes until Snapback publishes.

- **A fragment's scroll is driven on the JS target, and on Linux by its presenter's tests, only** (2026-10-30, the LLP 1153 D5 lane). The wasm web host (`fragment.js` from glue.js's `scrollToFragment`) and Apple's `Fragment.swift` were compiled, not driven: open `/item/7#moves` on each and read the scroller. Two gaps remain on Apple: no host holds the target while pictures load there (the web and Linux re-align it until they land), and the Mac moves VoiceOver to the target but its key-view loop has no starting point to move.
- **Reduce Motion for web-host motion** (2026-10-31; LLP 1061 D5, LLP 1013 D8). Verify the motion the web host starts against platform behavior under Reduce Motion. Shared-element flights (`host/web-js/shared.js`), switches and modal presentation (`host/web/neutral.css`), and reorder groups (`host/web/group-glue.js`) already read the preference. Check navigation, sheet and popover presentation, reorder glides and scrolling. Author-controlled motion reads `exactViewport().prefersReducedMotion` (`docs/recipes/motion.md`). A lane that lands host motion when Reduce Motion turns on (2026-11-12, three review rounds, about 890 lines in 17 files; not landed) still missed: a virtualized list's smooth correction under Reduce Motion already set eases where iOS and the Mac land it on the commit (`host/web/collection-glue.js`); `cancelHostScrolls` (`host/web/navigation/scroll.js`) dropping an ancestor's tracker when an inner scroller's `scrollTop` or `scrollBy` is written, which only `scrollIntoView` should do; Space on a focused button counted as a person's scroll; and an aligned fragment in a scaled, bordered scroller (`host/web/fragment.js`) never released, mixing transformed rectangles with unscaled `clientTop`.
- **17 of `host/web/tests/js-runtime.test.mjs` fail on main** (2026-11-12, f0c4c0d7, a Mac). Ten throw that `./ts-fetch.js` has no export `activeCall`, which the checkout's `host/web-js/ts-fetch.js` exports: the module they load is the baked copy under a temporary `exact-js-baked-*/web-js/`, so the bake copies a runtime older than the checkout's. Six throw `ReferenceError: Before is not defined`; one each `m.wait.length` on undefined and `Trap(IterationLimit)`. Find where the baked runtime comes from first.
- **Computed presence strings on the JS target** (2026-11-05). Bound exit and layout declarations accept complete string literals in their binding bytecode (`host/web-js/src/presence.rs`). A valid string assembled at runtime clears with a diagnostic, as `presence_tests::exit_values_write_native_css_and_clear_unlisted_values` checks with `leave  200ms both`. Support other computed values through the kernel's parser rather than a second CSS grammar; first decide how the page loads that parser.
- **The web's iOS idioms round 34 left** (2026-10-31, LLP 1115.000 D4.8, D4.14, D4.16). Graders still named: the
  segmented control's grey track and raised chip (four web pairs; a web button group or tabs may read better); the
  split's 320 px list column beside a mostly empty detail at 1440 px (shop-inventory, support-inbox); the phone's
  bottom tab bar; an unstyled bar button that opens a menu showing no affordance ("Ada"); and link rows that are
  `user-select: none`. A switch in a sheet looks like a checkbox but keeps `role="switch"`; Firefox and Safari reach
  a sheet's actions before its fields (no `reading-order`); the Linux painter's empty split still says "No
  Selection". `neutral-look.test.mjs`'s "route header geometry" reads a selector LLP 1153 D8 renamed and fails on
  origin/main.
- **A box over a navigation root sits under the iOS status bar** (2026-10-30, bake-off r34 gradebook-ios). With a native stack the session's viewport is the whole view and `env()` is 0 (`ExactViewIOS.swift` `fit`, `wantsWholeView`), so a child of the navigation root that is no route, an overlay at `position="absolute" inset=0`, is laid out from the screen's top: its first row is under the status bar, where iOS gives it no touches, and the author has no inset to pad. On the web, the layout oracle, the same box starts below the browser's chrome. The compiler now refuses the case the bake-off hit (`navigationPresentation` off a route); lay such a box out in the safe area, or give it `env()`'s insets, for the rest. A lane that subtracts the root overlay's clearance in Taffy's absolute placement (2026-11-12, `vendor/taffy/src/compute/common/absolute.rs`, three review rounds; not landed) moved boxes that were already placed: an auto-inset child whose static position is below the content (y=100 became 162), a flex-start child under a padded parent, and an `inset=0` child in a grid area already inside the safe area, which it shrank. Intersect the child's area with the safe rectangle instead of adding the clearance.
- **Contract cannot label a day a date input picked** (2026-10-30, bake-off r34 gradebook-ios and tasks). `input type="date"` answers `2026-10-16`, `formatDate` and `formatDay` take epoch milliseconds, and nothing converts one to the other, so a due date showed as written; the dates recipe now routes it through the data module (`Date.UTC`). A day key accepted by `formatDate` (runner, web JS target and the Lean semantics alike) would make that unnecessary.
- **Caltrain, Expose and Typetour swap screens by state** (2026-10-30, `lower-screen-by-state` now walks routes and pages named by one state). `apps/caltrain` chooses its stations picker and deck fixture with `screen`, and `apps/expose` and `apps/typetour` their lock, home, settings and messages screens, so each build warns and on the web none of those screens has a URL. Make them routes (`contract vocab screen`), or delete a screen nobody drives.
- **`serve`'s rendering and `render.mjs --serve`, three gaps** (2026-10-30, LLP 1153 D3's delta review). (1) `sitePages` (`host/web/serve.mjs`) renders from the generation `servedFile` picked, but between a swap's two renames the picked generation is in neither `dist` nor `dist.gen/<id>`, so it answers the shell, and an exception during a swap (the renderer's construction, a file read) is a 500 instead of a retry: wait as `generationFile` does, bounded, and retry. (2) `render.mjs --serve` builds `renderer(dist)` before any request, so a release site with only client and build routes (no `.gen/server.js`) fails at start instead of serving the shell and its pages: make the renderer lazy. (3) `render.mjs --serve` resolves a build route's directory URL (`/about/`) through `matchPattern`, which refuses a trailing slash, and renders `notfound` where `serve` serves `about/index.html`: share `serve`'s file resolution. LLP 1153.001 D1 makes the two one server, which closes (2) and (3) by construction. (4) `foreignBeside` runs once before a `--out` build; a sibling (`<out>.previous`, a non-build entry of `<out>.gen`) made during the build is still deleted by `replaceBuild` or reaped: check again just before each delete and leave the tree in place when it fails.
- **Two edges of `var(--name)` (LLP 1153 D6)** (2026-10-30). The loader writes a `var()` naming a token as the name before lowering (`contract/lower/src/var_tokens.rs`), so (1) a row it then refuses quotes the name, not what the author wrote: `color="var(--space.row)"` is refused as `` `color="space.row"`: `space.row` is a length token ``; and (2) a component argument is written only when it is one `var()` (it may be text), so `Card(edge="1px solid var(--line)")`, `line` declared, reaches its row unwritten and is refused there (`lower-css-shorthand`: `` `var(--line)` is not an admitted `border` width, style or color ``). Keep each literal's spelling beside the rewrite for the refusal's words, and write an argument where its prop reaches a style row (`params::reached` walks that path). A lane that resolves composite and forwarded props in style rows and keeps the authored spelling in refusals (2026-11-12, three review rounds, about 880 lines in 18 files; not landed) regressed two things the loader's rewrite did: a prop routed through state (`state selected = tint`, `color=selected`) stays `var(--ink)`, which the native parser refuses, and an enum-typed style prop given `var(--ink)` fails `type-prop` because the rewrite now follows type checking. Its authored-spelling fix covered only refusals worded `` `property="value"` ``, so `font-family="var(--space.row)"` still reports the token's name.
- **Glyph atlas upload nits** (2026-10-31, LLP 1149.001 M10, cut 7; Claude findings 3 and 7). Split a shelf-wrap dirty rectangle if measured worthwhile: the current union copies about 16.9 KiB per fling copy for a few KiB of masks. Packing dirty rows then copying them into staging costs two copies; Claude cites 29.8 μs for cold staging allocation/copy and a few μs per fling batch. A `(shadow, stride, rect)` device input could remove the intermediate copy. Neither optimization is needed for parity; measure before widening the device seam.
- **Complete M10's first-screen attribution and 100 ms budget** (2026-10-31, LLP 1149.001). Cut 7's atlas batch lowers main's carrier from 253.124 to 215.080 ms (qualified n=10/9; nine matched pairs save 32.862 ms median), without the other startup cuts. After the review fixes, five rest/bar pairs give −0.541%/+2.295% median CPU changes, with both ranges crossing zero: the earlier +14.084%/+6.143% singles are variance under the paired-range test. Bar still has intermittent extra carrier timer/dispatch work (40 → 2,460 timer passes in one ten-second pair); isolate its trigger before predicting a saving. Metal/wgpu and Vulkan parity pass; the Windows lane qualifies the original cut at `d008a448c7`, not the review follow-up. A7's raster workers are parked: upload waits dominated, and workers bought no saving. Chunk 2's excluded cohorts still owe observer controls and per-launch dyld attribution where available. See `bench/heavy-list/gpui/RESULTS.md`, “M10, cut 7: the atlas uploaded once” and “M10, the first screen's phases”. The six-check gate remains assigned to the Mac mini. A later layer pass that discovers new glyphs can still flush another batch; batching across an entire such frame remains unimplemented.
- **M10: confirm the combined cold lead and remove the fling instruction increase** (2026-10-31, LLP 1149.001). The six cuts over cut 7 give Ink 187.214 → 159.679 ms on the silver, n=10 per carrier, against GPUI 197.134 and egui 203.295 ms after (n=10/9). Two egui timeouts remain among 80 originals. This combined revision is below both controls in 1 of 1 qualified sessions; six-cut carrier revisions are 3 of 4, with the contrary confirmation and traced cohorts retained. Repeat the combined session before claiming a stable lead. One qualified post-boot pair meets ±5% CPU/cycles in fling, rest, bar and caret, but fling instructions add 32.095 million/s, missing the ≤30 allowance. Cumulative instructions are 258.231 million lower before fling and 63.499 million higher through its end; this pair does not establish pure displacement. The earlier three source-fix rounds stop unrepaired. Remove the remaining fling work without requesting offscreen pictures before first paint. The 100 ms obligation remains; the mini owns the six-check gate. See RESULTS.md, “M10, landed: the six cuts over cut 7”, and retained originals in `target/m10-landed/`.
- **The Rust render host keeps no answers across renders** (2026-10-30, LLP 1153.001 D7). Bun's renderer (`host/web-js/render.mjs`) puts every render's fetches through one RFC 9111 shared cache (`host/web-js/http-cache.mjs`); `host/render` starts each render with no answer in hand, so an API-backed page waits on the API every time (Pokédex home 190 to 550 ms a render there, against 5 to 12 ms warm under Bun). Give its fetch executor the same cache, under the same rules, before delivery serves such pages from it.
- **`check` on the Windows host** (2026-10-31, bake-off Windows lane). The painted presenter answers no `check` observation (`scripts/agent-check.mjs` takes web and iOS), so `verify windows` captures each screen unjudged: no contrast, target-size, overflow or largest-text findings. Answer it from the presenter as the Apple agent's `check` does, then let `verify windows` judge light and dark as iOS's does.
- **M2 rest trace on the caret workload** (LLP 1149.001 M2b). The G5m caret now presents twice per second but still uses 27.148 process / 24.661 main-thread ms/s. Its `every(250, tick)` and `every(1000, second)` fire five times per second, and the display link starts and stops twice. Attribute the service passes, link start/stop and probe on the retained workload before predicting another CPU saving; this is not M2's timer-free rest case. See `bench/heavy-list/gpui/RESULTS.md`, “G5m, after M2b”.

- **Wall-clock test bounds flake under load** (2026-10-30). In every full run on a loaded Mac one of these
  failed and then passed alone: `exact-linux`'s `an_orderly_exit_waits_for_a_request_with_effects` (the one-second
  `AGENT_EXIT_BOUND`, three full runs of three), `exact-apple`'s `a_quit_ends_every_group` ("the quit waited out the
  grace") with the asynchronous-core suite wrapper, `exact-svg-file`'s five-second deadline and the Apple
  upload-stream timeout. Each waits on the wall clock; `docs/testing.md`'s waits section says how to wait on the
  event instead, or to mark the test `async lane:` where a bound is the point.
  `workers_start_with_the_first_request` also misses its five-second completion bound with main's web files
  (2026-11-04), alone and through the asynchronous-core wrapper. The ordered request completes; the independent
  request without a grant does not. The same failure occurs with the web timeout fix restored.
  In the press-spelling checks (2026-11-07), Linux's
  `an_abort_whose_answer_was_replaced_is_still_cancelled_on_an_empty_pump` could not obtain seven
  worker slots within 30 seconds before its server-write timeout. A control with main's sources
  passed, as did the isolated case and full run after restoring the candidate.
- **The Mac table's first-click probe fails with main's sources** (2026-11-07).
  `TableFeedKeyMacTests.testTheClickThatBringsTheWindowForwardSelectsARowAndPressesAControlInIt`
  leaves the selected row at -1. The same ten assertions fail with all changed Rust, Swift and
  Contract sources from main at `70365218ab`, then with the candidate restored, in the same QA checkout.
  The other key-window cases and authored press-paint regression pass. Check the injected
  first-click event against a native reference before changing the host.
- **Trace G5m's native moving-bar cost** (2026-10-30, LLP 1149.001). Native's moving bar costs 84.49 ms/s on the main thread against the prediction below 10. Attribute that CPU cost before changing the path; M2b resolved Ink's continuous caret submissions. The quiet three-round series and captures are in `bench/heavy-list/gpui/RESULTS.md`, G5m.
- **The field adapter is what unblocks Excord's tests on the harness** (2026-10-30, LLP 1151 lane F). `clock until` is delivered (one `land`, then the `expect state` matcher), and every one of Excord's 93 blocks that reach it waits on `gateway.state`, a field path the matcher cannot read: the observation prints a record positionally, with no field names (D1's reason for leaving fields out of stage 1). Resolving fields and indices on both observations through the plan's shapes, the adapter D1 names for stage 2, is therefore the next delivery step worth its cost: it turns 93 partial blocks into candidates for whole, and it is the same adapter `expect state a.b` and a property over a field need. `semantics/difftest/src/settle.rs` stops the block at `clock until (field path)` today and the receipt counts them.
- **A Mac atom's tooltip does not follow a rewrap** (2026-11-12). `InlineAtomEditorMacTests.testTheTooltipIsAskedOfTheTextViewAndFollowsARewrap` fails at line 819 on main: after the text rewraps, the pill's tooltip rectangle does not move. Seen on a Mac whose screen was locked; check it with the screen unlocked before changing the tooltip's tracking.
- **Metal archive identity across reboots** (2026-10-30, LLP 1149.001 Stage 0b, Claude review 11). Check that the same GPU’s `registryID` and archive path survive a reboot, then require `MTLPipelineOptionFailOnBinaryArchiveMiss` to load that retained archive on the same OS and device. If the ID changes, choose a stable device key before claiming retained-cache startup across reboots.

- **Windows device-loss recovery does not reliably restore Mica within three presents** (2026-10-30, LLP 1149.001 Stage 0). The native fixture passed an isolated retry and the next complete suite, then failed with desktop composition disabled through all three retries; an earlier failure restored Mica on retry two where the fixture requires retry one. Separate the host's recovery obligation from compositor availability before changing that assertion. The Stage 0 review-fix continuation passes forced device loss in the NucBox's interactive desktop: the recovered/fresh Mica band has mean 0 and no pixels over 32. That machine needs no GO file. G6d's retry code was already in the earlier failing tip; no recovery policy changed, and the earlier intermittency remains unexplained. Failures: `target/s0/windows/native-attempt/d3d11-device_loss.log` and `target/s0/windows/native-period/d3d11-device_loss.log`; passing recheck: `target/s0/review-fixes/windows/native/d3d11-device_loss.log`. See the Stage 0 section of `bench/heavy-list/gpui/RESULTS.md`.
- **A focused Mac textarea's focus ring shows a 1 px line at its right and bottom edges** (2026-10-30, the textarea-resize lane; not caused by `resize`). Seen in a key window after a drag made the agent's window key: its pixels show the ring coming through the box's fractional last pixel. The ring's mask is `TextAreaScroll.drawFocusRingMask` (`Mac/NativeFieldsMac.swift`). A mask on the pixel grid was tried and not verified by running; look at it in a key window with a fractional-height textarea.
- **MIDIMacTests.testAFollowedClockIsBatchedAndStartGoesAtOnce failed once under load, not reproduced** (2026-10-30, iosfix2). One full parallel Mac run at load 49 (2026-10-29 19:28Z) failed `ticks alone no more often than 50 ms` (0.028 s, not above 0.04). Not reproduced since: 5 runs of the class alone beside a cargo build (load 14-18), 5 full parallel Mac suites (load 6-22), and 3 alone, all 0 failures. If it recurs, the interval it measures is wall time between delivered ticks, which a stalled process compresses: measure it on the deliveries' own timestamps.
- **IframeWindowsTests' download case, a red in rt1's 10-29 baseline, not reproduced** (2026-10-30, iosfix2). 3 runs of the class alone at load 12 and 8 full parallel iOS runs (2026-10-29/30, load 15-235) were all clean. It has flaked under load before; if it recurs, keep its log.
- **The native executor's `Proxy` wrapper reads an explicit new target's `prototype`** (2026-10-30, rt1's crossing skip; theme2's 06:26 ruling). js/src/binary.js puts the global `Proxy` and `Proxy.revocable` behind Proxies of the engine's own whose traps record every proxy made, so `keptReply` never keeps a value holding one. Hermes, constructing a callable proxy, runs `ordinaryCreateFromConstructor` on the new target before the `construct` trap, so `Reflect.construct(Proxy, args, C)` (or a bound `Proxy`) reads `C.prototype`, which the engine's `Proxy` doesn't (a getter there runs; js/tests/it/kept_json.rs pins today's one read). Fix in the engine: skip that creation when a `construct` trap is present (the spec's order), or give the executor a native Proxy predicate so the wrapper can go.
- **On the Mac a surface inside a card is darker than the card in dark mode** (2026-10-30, the Mac surface roles; theme2's 04:06 ruling). The Mac's card roles (secondary-background, secondary-grouped-background) are AppKit's underPageBackgroundColor (#f6f6f6 / #282828); tertiary-background and tertiary-grouped-background, a surface inside a card, stay controlBackgroundColor (#ffffff / #1e1e1e), white inside the grey card in light but #1e1e1e inside #282828 in dark, where iOS goes lighter (#2c2c2e inside #1c1c1e). AppKit has no solid between them (unemphasizedSelectedContentBackgroundColor #dcdcdc / #464646 is too strong in light). Revisit if AppKit gains one, or name a dark-only literal pair.
- **Windows: G6e restores cadence; its CPU gate remains open** (2026-10-30, LLP 1149 G6e). The G6d cadence regression is done: restoring the full-period wait and removing the clean-frame reservation skip gives five quiet flings with zero late intervals, p99 16.85 [16.77–16.93] ms and 58.15 [58.07–58.53] displays per gesture second. The full gate is not done: process CPU is 84.08 [74.70–93.39] ms/s against G6c’s 73.11–84.05 range. All 1,247 snapshots match successful frames. No third pacing policy was tried. The PresentMon trace qualifies cadence but has no CPU stacks to attribute the remaining range miss. Evidence: `bench/heavy-list/gpui/RESULTS.md`, “G6e”; `target/g6e/final/` and `skip-trial/`.
- **Windows: resolve G6c’s remaining startup shift** (2026-10-30, LLP 1149 G6c). The waitable reservation fixes the D3D11 fling, but startup neutrality is not established: ten quiet final launches give DWM 182.25 [171.22–211.84] ms against G6’s 175.98 [169.40–190.49]. A quiet alternating ten-pair control gives before/after medians 184.29/188.43 ms and paired increase +3.28 [−10.72–37.23] ms. Compare the startup phase timestamps and waitable admission before deciding whether this is launch variation or remaining scheduling cost. G6c stopped after three performance revisions. Evidence: `bench/heavy-list/gpui/RESULTS.md`, “G6c”; `target/g6c/final/warm-startup/` and `target/g6c/paired-waitable/`.
- **Egui heavy-list intermittently fails readiness** (2026-10-29, LLP 1149 §4.1 G4; owed to `bench/heavy-list/egui/`, not Exact). One of thirteen timed launches, `target/g4b/series/cold/egui-8.log`, timed out at 30 s with its window frontmost and key. G4a's first functional launch took 14.7 s; four G4b readiness probes did not reproduce the delay. The scoped system logs name no cause. Capture the frame, image-worker and drawable timeline on a failing launch before choosing a fix; the twelve successful launches do not close this. See `bench/heavy-list/gpui/RESULTS.md`, “G4”.
- **The s15b2 gate's web-wasm image-raster rule covers whatever is drawn over a full-bleed image** (2026-10-30, theme2's s15b2 sign-off, a follow-up). video-devi's Image box is the whole screen (a full-bleed poster), so the 4-level noise rule (scripts/stage12-named.mjs `WASM_IMAGE_NOISE`, inside Image boxes laid out alike on both sides) also covers the overlays drawn above it. Before the next gate leans on it, count a pixel as image noise only where the Image is the topmost node there (from the whole layout's order), so an overlay's change still differs. A lane that keeps overlay paint out of the rule's coverage (2026-11-12, `host/web/agent-input.js` and `scripts/stage12-named.test.mjs`; not landed) passed in the fleet's Chromium, but its own browser test failed in this Mac's Chrome: a one-level change under an 8×8 image counted as one differing pixel, not image noise. Its reviewers also found stroked overlay text still exempt, since `Range.getClientRects()` leaves out `-webkit-text-stroke`; give a nonzero stroke unknown coverage.
- **The wasm web host's scaled images vary by up to 4 levels from run to run** (2026-10-29, the s15b2 gate; theme2's 22:01 ruling). On web-wasm the package Avatar's images (42 and 52 pt, scaled) draw a few hundred pixels 1 to 4 levels apart between two drives of one build: the Bluesky clone's light chat 286 px at most 2 levels between two drives of the same side, its dark chat 288 px at most 4 against the gate's run, new-chat 243 px at most 4; another pair of drives was identical. web-js, iOS, the Mac and Linux never differ there. The s15b2 gate counts it as image-raster noise (scripts/stage12-named.mjs `WASM_IMAGE_NOISE`, inside Image boxes laid out alike on both sides). Find why the wasm host's image draw is not deterministic (its scaling path, a decode or a GPU raster), then drop the rule.
- **A module's availability source could answer from the app's grant** (2026-10-29, rt1; theme2's 21:47 ruling). Without `device.calls` the runner still substitutes `@exact/calls`' sends and sources: `startCall` lists an in-app call and `callsStatus()` answers `available: true` (probe beside `contract/cli/tests/it/voip_calls.rs`), so an app can't hide a feature from the module's own answer. Harmony doesn't need it: its test call's grants are a development build's only (LLP 1069.008, as built 2026-10-29) and the row reads Harmony's own `grants` (`testCallBuild`). For the next app that does: a module's availability source answers its unavailable form, and its grant-gated sends refuse, when the app lacks the module's grant (runner/src/runner/modules/admit.rs), calls as the first example.
- **ResetGate's known losses** (2026-10-29, rt1; triaged with theme2, by probe). `ResetGate.knownLoss` (host/apple/Sources/ExactKit/ResetGate.swift) lists 16 held Runtime calls whose content a restart's reset would lose: `storeChanged`, an incoming `share`, `picked`, an incoming `navigate`/`hostGo`, a document's paths through `change`, `controlTextChanged`, `deliverySync` (re-asked only after `applyTogether`), `canvasImage`, `canvasDisplay`, `textReady`, `midi`, `activities`, `preferExtension`, `designRows`, `setModes`. Most come from the main queue, which the hold never drains: ResetHoldTests (iOS and Mac) shows nothing queued before a restart (main queue, common-modes timer and perform) runs inside it, with a sheet open or two windows restarted together. So none is reachable today; they stay listed for the scan. Reopen if ResetHoldTests fails (the teardown turning the run loop in a common mode, or draining the main queue): then keep such an arrival at the session while held and deliver it after `replayHeld`.
- **PARKED: an import's accent offered as the packages' brand fills** (2026-10-29, dtool3; theme2's 07:21 stop rule, after six review rounds). Design: an import that carries an accent (shadcn's primary, Astryx's accent) offers it as `actions.follow-fill` and `cards.empty-button`, each with its ink token set per scheme to white or black, whichever reaches 4.5:1 (the two ratios multiply to 21 on an opaque fill, so one always does), in a `review.brands` list of its own (a tamber/1.18 line), off until ticked, left out of a bare accept below 4.5:1, on an import's first proposal only. Built and tested on branch `dt3/import-brand-parked` (8d20b67c53, not merged). The rounds found, in turn: inks gone stale through every re-hold (partial accept, edit-held, recompute: aliases, `when` lines, design-held values), designs that check only with their packages (a line-stripping measure hid accent branches), dial orphans across role and brand lines, older tools taking brand items on recomputed proposals, and, last, an offer that invalidates its own measurement (the accent's `when` branch reading the very ink token the offer rewrites). Revisit when the importer can fold the FINAL design (the import and its offers' own operations applied, with the app's packages joined) and measure every tuple there; until then an app sets the brand tokens by full name, which loses nothing but the convenience.
- **LLP 1149 S1, what G3c leaves open** (2026-10-29; `bench/heavy-list/gpui/RESULTS.md`, G3c). (1) The carrier's fling peak footprint, 592 MiB against GPUI's 409 and the native host's 229: about 340 MiB of owned-unmapped graphics memory during the fling that `vmmap` and `malloc_history` cannot attribute (S1.4). First drop decoded CPU pixels after their GPU upload and re-decode when the texture is evicted; then attribute what remains with Metal allocation profiling at launch. (2) Cold start to the first complete frame is 344 ms for ink, 312 for GPUI and 370 for the native host, all over D15's 100 ms budget; the 100 ms budget phase by phase, as S2 owes on Windows. (3) No content-cadence instrument exists for GPUI, which re-presents unchanged scenes for a second after input: the presented-drawable cadence row compares content cadence (ink) with tick cadence (GPUI) outside a gesture. (4) G3c does not rerun D15's vello-with-rows or wgpu control arms on the Mac. (5) The drawable ring's wait duplicates the per-present completion wait: use one mechanism or let the worker pipeline frames. (6) A per-frame staging arena would remove the two-slot serialization and the double copy.
- **An SVG id that n instances repeat costs n² to resolve** (2026-10-29). `Kernel::resolve_id` (`kernel/src/svg/refs.rs`) builds, for every reference, the ancestor chain of each live node the id names and each step's place among its siblings, so a component's gradient or clip id used n times costs n² chains. In a `sample` profile of the T3 Code clone's JS build (261,364 nodes) it is 8 of 41 s, from `exact_web::host::element::css_style_of` under the JS target's projection (`style::project`). Each candidate's place in tree order, found once per id, would answer a reference in time proportional to its depth.
- **Safari leaves its top-edge blur over the page after a resume, on the iPhone Duo's cover display** (2026-10-30, iOS 27.2, Safari, the Duo closed; seen on Unsaid's first screen). Brought back from the background, Safari blurs the band where a phone's status bar would be, over an unscrolled page's title, though on the cover display its status items sit in its side column; switching tabs clears it. Exact's page draws no blur there and changes nothing across the resume, and the iOS 27.1 Duo simulator does not show it, so it reads as Safari's: report it to Apple (Feedback Assistant) with a photo, and do not pad every page's top to dodge it.
- **The web's touch press under a person's scroll, not yet seen in Firefox for Android** (2026-10-29). `input-glue.js` counts a scroll as a person's when it follows a touch or pen `pointercancel` or a wheel, moves a press under any other scroll, and swallows the click of a touch lifted outside the target it began on. iOS Safari 27.2 on an iPhone passed a pan, a caught glide (Safari keeps that touch: no pointer or touch events reach the page) and a chat that keeps itself at the bottom, by a diagnostics page over the bundled glue. Firefox for Android has run it with synthetic events only.
- **LLP 1071.001 part B: the feed's rows built cheaper** (2026-10-30, re-measured by x2-perf4; the stage 1 line it replaces is done). Part A landed in 1c7b918556 (A1-A3, A5-A8). A4, snapshots compared by revision, is CLOSED: on main 1b2e291a69 (`bun bench/web-shootout/scrollprof.mjs bench/dioxus/web/dist/bounded <out> {6000,24000} 3`, load 16-19, two runs each) `JSON.stringify` has no sampled self time and `snapshot()` is 0.5-2.3 ms inclusive per 3 s, at most 1% of a 255-388 ms task. The scroll's time is now the browser's style, layout and paint of the rows just built, 60-75% of the task: collection-glue's clamped offset read carries 46-94 ms of the forced pass over the new rows. Only part B moves that: B1 (a row is one template clone) and B5 (enumerated style bindings as classes; the feed makes 5,629 `setProperty` calls per 3 s). It waits on Charlie's LLP 1071.001 §8 answers for part B (D5, its measure: a Krausest entry, which needs LLP 1152 D3, or Conduit's feed page), then a measured plan (~/x2theme/x2p4-webfeed-measure.md).
- **An author's bar beside a whole-view tab container is not its routes' bottom inset** (2026-10-28, bake-off r33's photos). The select bar, an in-flow row that replaces the hidden tablist, is laid out below the panels, but the `UITabBarController` and its routes take the whole view, so the grid's bottom inset falls from the tab bar's 83 to the home indicator's 34 and its last row ends 12 pt under the bar. Entering select mode then moves the grid down 44 pt: kept at its end as the inset shrinks, which UIKit does too (a table at its end whose toolbar hides moves down by the difference). The rest is the app's: its bar is 46 pt where Photos' toolbar takes the tab bar's height. Count an in-flow sibling below the panels in the routes' safe area (`additionalSafeAreaInsets.bottom`) while the tab bar is hidden.
- **Speech, what is owed** (2026-10-28, LLP 1133.012 §13's as-built notes). (1) On Android's reader an extension's `preferred` call lands on the main thread after the drive's next request has moved the clock, so an agent path that stamps what a drive prefers with `now()` sees it late: drive 6 of `packages/speech-recognition/test/drives.mjs android` reads 29 of 30 finals. The carrier needs a signal that the call has landed, as `polls` is for a jump's asks. (2) On the reader, `clock settle` cannot wait for an extension's answer, which only the main thread gives. (3) Synthesis has run on no Android app, and neither package's real Android engine has run; the Android 14 emulator's Google services would serve a fixture that binds them. (4) D12 item 6 and `microphone=true` on Apple wait on Charlie's decision (§13).
- **The web shootout, stage 0** (2026-10-28, LLP 1152 r2 §10). `bench/web-shootout/`: the streaming proxy that injects one probe into every arm and applies the leg's latency once, the local Conduit API server, the drives, `report.mjs`, the three baseline arms (static HTML, vanilla JS, Exact's render-served Conduit) on Mac Chrome, the pilot that fixes repetition counts and the tie rule, and the phone feasibility spike (a touch route that exists on a physical iPhone, the `PerformanceObserver` entry-type matrix per pinned engine). Stage 0 depends on none of §12's decisions; the field and the ladder wait on D1 to D8.
- **Windows clipboard colour conversion** (#196). Convert PNGs carrying gAMA, cHRM or iCCP to sRGB before offering a bitmap. PNG-only items preserve colour information, but Paint 11.2609.401.0 loses gamma interpretation and Edge 157.0.4341.46's paste editor receives no image (Windows 11 build 26200.9457).
- **Clipboard fixture large-file setup** (#196). The existing `Uint8Array.from(atob(b64), …)` path for a 3,503,857-byte PNG exceeds the native source turn’s 100 ms CPU budget on Windows 11: 421.9 ms, after `atob` and before the array conversion finishes, with no file write or clipboard call. The refusal is in agent logs while the fixture’s answer stays empty. Prepare the PNG in the app sandbox for the path test; make the fixture’s conversion yield between bounded chunks or use a file-producing source.
- **@exact/clipboard: what stage 1 still owes** (2026-10-28, LLP 1133.006 §9 as built). (1) Item 5, `storage.fs.compressImage`'s amendments: `maxDimension` omitted with `type: "image/png"` keeps the size and `maxBytes` refuses (`unfit`) rather than shrinks; `maxPixels` refuses a source over it before decoding; SVG input, on Apple through the hosts' SVG rasterizer (`host/svg-file`) and on the web through an `Image` (which a worker realm has none of), sized as an `img` is; and frame 0 of an APNG, which ImageIO does not give (`packages/clipboard/apple/Clipboard.swift` `firstFrame` does it for the clipboard). Across `js/src/binary.js`, `data/host/src/native.rs`, `data/src/image.rs` and `image/apple.rs`, and `host/web/storage-image.js`. Then the fixture's JPEG, SVG with no size and 16,000 × 1,000 buttons. (2) `ClipboardItem.supports` answers from the declaration on every target, true where the module is absent (Android, Linux, Windows): the binding is one for all targets and data code has no synchronous way to ask whether a module is linked. (3) The Rust binding has no bytes form for a keyed shape's key. (4) A person's steps: `packages/clipboard/test/checklist.md` (Preview, Messages, Safari's and Firefox's activation, D3).
- **The local listener, what is owed** (2026-10-28, LLP 1133.005 §10's as-built notes). The T3 Code clone's adoption drive is the module's acceptance (`desktop-activation.ts` on `exactListen`, its broker in TypeScript, `codex-setup-ops.ts` on `openAuthSession`, then `t3 app <dir>` from Terminal with D2's three routing differences and a real ChatGPT sign-in with a cancel and a port in use), on `daehyeon/t3-code-main`. `focus()` from Terminal against T3 Code's own activation (D10), and whether it brings the app in front of the browser after a loopback sign-in, need a person at a Mac.
- **Ink region copies** (LLP 1149 D2.5; C3f review Muse 7). Bound blend and backdrop destination copies to the affected region; they still copy the viewport. Overflow clips now flatten coverage without copying the destination.


- **Purchases' owed pieces** (2026-10-27, LLP 1133.015 §12's as-built notes). The `SKTestSession` conformance suite (stage 1) needs a development-signed hosted test (`packages/purchases/test/Weatherlight.storekit` is its configuration); the drives on the iOS simulator and the Android emulator; the merged-manifest check of D16 item 6; tier 2's Apple names, which wait for an implementation's own names (LLP 1133.001 D2); `storefront` on Apple (an alpha-3 to alpha-2 table); D21's Developer ID check; stage 3's seam tests. An app with TypeScript keeps every module source's answer under LLP 1027 D4, `unfinishedPurchases` included, which D4 says is not kept. Drive 13 waits for the accounts.
- **LLP 1133.007, what is still open** (2026-10-30, §10, §14, §17). Not built: the secret field (stage 2) and Windows (stage 3); Linux's `fork` path has not run on Linux ("Desktop processes, after stage 1" below). Every desktop app links the supervision (§14's declared difference): linking it by use needs a capability the TypeScript bake sets from the app's imports, which the Apple and Linux entries read as `host/apple/src/link.rs` reads the grammars. D13's headless origin does not exist (its declared difference), and a process request is held to its enqueuing commit's origin, not `data_origin()` (its known difference).
- **A missing-oracle divergence can print `<end>` on both sides** (2026-10-28, LLP 1148 A2): Harmony's second default walk and Shelf's swipe-delete test diverge at boot, but `verify::locate` drops the reason comments that `compare` used. Show the missing oracle answer and the runner's refusal reason when the first difference has no configuration line; the raw observations already retain both. A lane that shows both (2026-11-12, `semantics/difftest/src/verify.rs`, three review rounds; not landed) took the aggregate `outcome` reason when a refused due task precedes a refused handler, so it reported the handler's `NonFiniteValue` against "no answer for load" and dropped the task's `UnwrapNone`: match each missing-oracle comment to the refusal it follows.

- **Default `contract verify` is slow on Design Tool** (2026-10-28, LLP 1148 A2): its runner half took 515 s for 142 search scripts, including 20 walks of 40 events and 71 stored replays. A sample shows timed-task commits rebuilding the document during clock advances. Measure the cost of the 60-second advances and the search policy before making this a routine author loop; retain the coverage and receipt denominators.


- **Shelf: module effects are outside the differential oracle** (2026-10-30, LLP 1151 lane G). `contract verify apps/shelf/app.contract --walks 20 --steps 40 --walk-seed 0xeed4df11b739e972 --confirm 2` still disagrees at `clock +1`. The runner consumes `setContentIndex` and `setAppShortcuts` as module effects (`runner/src/runner/modules/declared.rs:132`, `runner/src/runner/commit.rs:682,747`); Lean retains them as host commands (`semantics/Contract/Runtime.lean:824,877`). This is not repeated-command deduplication. The one-event case is kept in `semantics/pending/shelf-module-effects.contract`; reproduce with `cargo run -p contract-difftest -- corpus semantics/pending/shelf-module-effects.contract`. Modelling these effects needs their module declarations and observation boundary; do not remove commands by name just to make comparison pass.

- **Excord: login-item sends bypass the differential oracle** (2026-10-30, LLP 1151 lane G; pre-existing host-operation boundary in §5). The login switch commits on the runner; Lean refuses because its transcript has no `registerLoginItem` answer. The runner routes module sends internally (`runner/src/runner/modules.rs:355,368`; substitute: `runner/src/runner/modules/declared/desktop.rs:105,116`); Lean asks the data oracle (`semantics/Contract/Runtime.lean:851,206`). The isolated case is `semantics/pending/excord-login-item.contract`: `cargo run -p contract-difftest -- corpus semantics/pending/excord-login-item.contract`. App receipt: `contract verify apps/excord/app.contract --walks 20 --steps 40 --walk-seed 0x986bb432cbe497dd --confirm 2`. Keep module replies and their later resource changes in scope together when extending the oracle.

- **Photo Editor: camera and photo-library sends are outside the differential oracle** (2026-10-30, LLP 1151 lane G; pre-existing, §5). `getUserMedia` and `copyPhotoAsset` commit through the runner's module route (`runner/src/runner/modules.rs:355,368`; caller: `runner/src/runner/queue.rs:397`), while Lean asks the data transcript and refuses its missing answers (`semantics/Contract/Runtime.lean:851,206`). `semantics/pending/photo-editor-host-operations.contract` keeps one input per operation; reproduce with `cargo run -p contract-difftest -- corpus semantics/pending/photo-editor-host-operations.contract`. App receipt: `contract verify apps/photo-editor/app.contract --walks 20 --steps 40 --walk-seed 0x98a7091cbe8d1f60 --confirm 2`.

- **Eight apps' explore runs diverge at their first host operation outside the oracle** (2026-10-28, pre-existing: on `8233879705` they diverged at boot; after LLP 1148 stage 1 captures the boot's host facts they diverge at `registerLoginItem`, `getUserMedia`, `getCurrentPosition`, `selectContacts`, `addGeofence`, `cancelSpeech`, `exactTime` and a live time). The harness has no answer for a host operation; LLP 1148 D12's inventory is where they get one, and until then `verify` on such an app says `OUTSIDE` for nothing and diverges instead.
- **What can still lose a request kept past its answer** (2026-10-28, LLP 1146 §8). LLP 1146 D2 keeps a let-go request with effects running until it lands: a macOS quit, the Apple driver's exit and the Linux host's orderly exit (an agent's quit, a headless run's end) wait for it within their bounds, and iOS holds a background task while one is in flight (`FinishHold`). A reload or an update ends the engine with the request in flight, and closing a window on Windows drains only the store (`host/windows/src/window.rs`): each loses its reply. Nothing protects the request on Android once the app is stopped, as the reader drains only the store at `onStop` (`host/android/canvas/src/main/java/dev/exact/canvas/ExactActivity.kt`), nor on iOS once the background time the system grants runs out: the app may then be suspended, and a process the system ends before the reply lands loses it. A rotating refresh token spent by a request whose reply is lost signs the person out at the next refresh; Lexy refreshes Lexus's rotating token about every half hour, and each refresh is exposed while it is in flight. The Windows close can wait as the Linux headless exit does (`exact_linux::teardown::finish`), driven on the NucBox; the Android reader can keep its process running while `must_finish` holds; a reload and an update need the request handed to the engine that follows.
- **A held-out OAuth case fails now and then on the Linux host under heavy load** (2026-10-27, LLP 1146 D7). Twice, a case that passes on the web failed once on Linux at a load average of 700 to 900 and passed on rerun; 64 runs of every profile's cases at 90 to 830 all passed, and no failing output survives. No known cause fits the two failures. Since 3b1a98297b, which landed after both, the Linux host writes the store on a thread drained at exit within a bound, and `reload` kills the app 2 s after closing its input (`scripts/agent-stdio.mjs` `close`), which under load could cut a write short and fail a case anew. Ruled out: `clock data`'s 20 s bound (the same on the web), and a kept connection the fixture closed, as it keeps idle connections open (`idleTimeout: 0`, `packages/oauth/test/fixture.ts`) and the Linux transport now sends a request again when a kept connection closes unanswered (expo/ibex#3, vendored). The held-out cases are withheld from the package's authors (`~/.cache/exact-oauth-heldout`): render them with `packages/oauth/test/cases.mjs` `casesFor`, never read them.
- **The local network's owed pieces** (2026-10-27, LLP 1133.036 §14 as built). Apple's probe (D8) is not built, so a reach's allowance becomes evidence only through a Bonjour browse or resolve; the bake does not refuse a literal `browseServices(type=…)` no `net.dns-sd` line lists (admission refuses it, `SecurityError`); stage 3's conformance fixture in Chromium, Firefox and WebKit, stage 4's seam tests, and the Avahi and windns browsers are not written. Every real-network drive needs a person: macOS's Local Network alert for the bundle, and drive 9 with a WLED light on an iPhone, an Android phone and Chrome (`packages/local-network/test/checklist.md`).
- **LLP 1133.021: Android's hosted views take no touches, and there is no headless session** (2026-10-27, §9 items 4 and 6). `exact-map` on Android does not pan or zoom by touch, and `MapView` hears only create, start, resume, pause and stop (not `onSaveInstanceState` or `onLowMemory`); a geofence crossing on Android waits for the next launch. map-demo has no Android crate. Each is owed by the RFC's stage 3.
- **LLP 1133.021: what is not yet built or measured** (2026-10-27). Stage 4 (each package packed into an `exact new` app, and a third party's region module reaching `context.regions`); the simulator's background relaunch for a region under `--bind geofencing`, with its boot time and `backgroundTimeRemaining`; D21's region-carrier launch cost and the time to the map on an iPhone; Caltrain's arrival notice, which waits for `@exact/notifications` (§15 question 5).
- **@exact/nfc's Apple and Android stages: injected tags, their tests and the drives** (2026-10-27, LLP 1133.035 §12 stages 2 and 3). The registries (`packages/nfc/apple/NfcRegistry.swift`, `packages/nfc/android/Nfc.kt`) are written but take no injected tag source in a test build, so the XCTests and JVM tests over claims, `busy`, `once`, writes, commands with their leases and two sessions sharing the registry do not exist. Not run: Shelf's drives on the iOS simulator and the Android emulator, drive 0 on macOS (and that its bake links no Core NFC), `--tvos --no-install` with no NFC key, the fixture's Linux drive (`packages/nfc/test/linux.mjs`), and the bound fixture on the simulator and emulator reading `available` false. The runner's permission continuation (`permits.rs`) does not call `arrival_claimed` when a write held on its permission becomes a value ticket, so a write allowed after another is held replaces nothing; the web runtime does.
- **The share extension on a device** (2026-10-27, LLP 1133.024 stage 2). A device build skips it and says so until the team registers the App Group `group.<app id>` and the App ID `<app id>.share`; `entryProfiles` (`host/apple/devices.mjs`) then has to take the share extension's id beside the widgets'. A Mac build under an Apple Development identity packages it with the team's group, which no drive has run: the drives use ad-hoc builds and a scratch inbox.
- **Android's share target, what is owed** (2026-10-27, LLP 1133.024 stage 3). Sharing text and a photo to Fieldnotes from another app's share sheet on an Android phone, and the web member's `share_target` in an installed Chromium, both by hand. The copy runs on exact2's thread with no five-second bound (D3), so a large warm share holds frames while it copies: move it off that thread, setting the token from there. The `shareIntent` hatch (D6) waits for a consumer.
- **Compose, what is owed** (2026-10-28, LLP 1133.024 stage 5). The Calendar example has no Android crate, so `@exact/compose`'s Android cell is compiled and not driven, and the iOS simulator drive was not run (CoreSimulator hung on `simctl list`); give it one (its contacts and calendar packages have Android cells) and run `examples/calendar/tests/compose.mjs android`. `share(files=)` on Android still carries text only: wire it through the reader's file provider (`dev.exact.canvas.Files`, `ExtensionContext.contentUri`) and drive a file share on the emulator. The hand steps of `packages/compose/test/checklist.md`.
- **LLP 1133.024 stages 6 to 8 are not built** (2026-10-28). Stage 6: the Rust implementation slot for the painted hosts (D22 item 4) and Windows's browser and compose cells, driven on the NucBox. Stage 7: print (the kernel's `print_layout`, the cut over pages, `@exact/print` and its cells, the Chrome oracle). Stage 8 waits on LLP 1115.004 S3.
- **The in-app browser, what is owed** (2026-10-27, LLP 1133.024 stage 4). (1) The hand steps of `packages/in-app-browser/test/checklist.md`: Safari's view and Done on the iOS simulator and an iPhone, a Custom Tab and its close on an Android device with Chrome and on one without a Custom Tabs browser, the Mac's default browser, a new tab on the web. (2) What `androidx.browser` adds to Excord's release APK after R8, measured against a build without the module (its AAR is 229,576 bytes). (3) A module's `context.log` on Android goes to logcat, not the agent's journal, so `state`/`logs` under the agent never show it there; the drive reads logcat. (4) The Custom Tab stays unpinned (LLP 1133.024 D12, ruled 2026-11-11), so the Android hand steps include a link an installed app claims (checklist step 8); nobody has watched one.
- **Payments: what is owed before stages 1 to 3 are done** (2026-10-27, LLP 1133.034 §12's as-built notes). (1) The Apple conformance suite with `--bind payments` on the simulator beyond the wallet's status (the request from the method data, the sheet over the session's window and refused over an inactive scene, a dismissal answered `AbortError`), on the model of `packages/camera/test/apple.mjs`; and the cost probe. (2) A call with no `onmerchantvalidation` and an Apple Pay method on the web is refused `payment-merchant-validation` when made; D10 has the bake refuse it. (3) The web send is `"gesture": true`, not D16 item 7's adoption by `exact-payment-button` that the declaration's `adopts` names; Safari's call-stack rule may refuse the gesture path, and no engine here can show which (Playwright's WebKit has no `PaymentRequest`). (4) Drive 11 on an emulator with a Google Play image (none on this Mac), and the async lane's second tier building the fixture's APK (`bun packages/payments/test/android.mjs`). (5) Drive 6's third part (leave during a retry, then a second Order a Print: `busy` on the web, queued natively) is held by the runner's tests, not driven.
- **A `scrollIntoView` that meets the reader's scroll: what LLP 1070.000 §2.6 leaves open** (2026-10-31). (1) iOS takes as the reader's move against a request only a finger's drag, the taps that scroll a list and the tvOS remote's step, so a request's corrections can move against an assistive technology's scroll, a hardware key's (on iPad, where `allowsKeyboardScrolling` is on) and the tvOS focus engine's. UIKit's own signals tell them: `accessibilityScroll(_:)`, `isScrollAnimating` (iOS 17.4, which a list's own requests never set, since Exact drives their animation) and `didUpdateFocus(in:with:)`; whether each comes for its path is unchecked on a simulator. On the web an assistive scroll cannot be told from momentum: a request made during it waits, then lands. macOS takes it as the reader's, as any move it did not make, and the presenter Android, Linux and Windows share does too, since it makes that scroll through the reader's own input path. (2) A nested request whose outer list waited begins its inner part in the report that admits the outer row, before the inner list's styles are computed, so an inner `scroll-padding` costs one more correction: the command's continuation phase (`runner/src/runner/into_view.rs`) has no counterpart in a report. (3) Windows: what a programmatic scroll does to the reader's momentum is unmeasured. Linux gains the rule with kinetic scrolling: GTK 4 drops a jump made during kinetic scrolling unless `gtk_scrolled_window_set_kinetic_scrolling` turns it off first. (4) No XCTest drives UIKit's moving paths through `CollectionIOS.correct`: a real deceleration (instant, and a smooth request's `stopScrollingAndZooming()` then `OffsetDriver`; Excord's "a send while the list is still moving" drive covers the instant path on a simulator), and the paths that need a finger: a smooth request's animation under a still finger, stopped where the port is when the finger drags (`scrollViewWillBeginDragging`) and then reported as a gesture, and a smooth request made while a finger drags landing at once. `isTracking` and `isDragging` cannot be set from a test, so these need a touch-driven harness (the in-process touch synthesis of the UIKit fling probe). (5) The presenter Android, Linux and Windows share reports no finger on the port and no animation, and a gesture only as the reader's move of the port: so a request made under a finger is admitted there and taken over by the drag, and a press that moves nothing is no gesture there. (6) LLP 1070 H4's motion guard is owed one rule for every host: the web makes no anchor's shift of a row list while the reader moves it; iOS and macOS do, so a card whole at only one of the two places is not judged `done` but moves (§2.6). (7) Whether AppKit carries momentum on after a second flick ends a live scroll is unmeasured; the macOS host's 300 ms quiet interval after a move outside a live scroll stands on it. (8) Whether AppKit sends `touchesBegan` for touches already resting on the trackpad when a list's document starts to accept indirect touches (as a request begins) is unmeasured: if it does, with a fresh timestamp, a resting contact cancels the request. (9) The JS target (`host/web-js/list.js`) does not look a nested request's inner target up before moving, as the runner does: it takes the first outer list with a row of the key, not the one whose row holds the inner list, and refuses an inner part only once its outer row is built, the outer row then left in view (a request that waits is refused where its wait ends, not when it is made). Matching the runner needs this target to build an unmounted row aside, as the runner's `inner_target` does. (10) The web glue keeps each list's own copy of its scrollport's offset and sequence (`offset`, `sequence`, `exact`, `clamp`), and `echo` copies one list's write into the others in that port; held once on the port's activity record, they would need no `echo`.
- **The desktop modules, what is owed** (2026-10-27, LLP 1133.025 §14's as-built notes). (1) **macOS:** the XCTests beside `MenuBarMacTests` (a status item's title, image, menu, dimming and removal; the Dock menu's order; `focus()` showing a hidden window; the unpresented first frame); the cost probe (D13) and the time from launch to the status item's placement; §12.4's timer title and its App Nap drive; the sample host's two sessions reading one chord; a document app's status item moving to its next session. (2) **A hot key's press on macOS has the device's origin:** the Carbon handler is the package's (`packages/global-shortcuts/apple/GlobalShortcuts.swift`) and a press is its `emit`; D11 items 2 and 3 want an ExactKit `hotkeys` service that raises it as a person's activation, as `exact_linux::desktop` does for the Rust hosts. (3) **Q9:** whether `SMAppService.mainApp`'s login launch carries `keyAELaunchedAsLogInItem` needs a logout and login on a Mac (`packages/dock/test/checklist.md`, Mac 6). (4) **Windows, stage 2's rest:** the notification-area icon and its flyout, `TaskbarCreated`, `keepRunning`, the launch with no window, one instance and the activation record (Windows App SDK), the startup task, the pair's `WH_KEYBOARD_LL` hook, and the session running while its window is hidden (D11 item 8); then the NucBox drives. (5) §12.1, the T3 Code clone dropping its Carbon registration, is on `daehyeon/t3-code-main`.
- **The painted presenter's focus ring keeps the last input's modality per node, where Chrome keeps it per document** (2026-10-27, LLP 1115.004 D9.2; `brush.ringless` in `surface_controls.rs` `focus_for_press`, `presenter/events.rs` `set_focus`, `presenter/arrive.rs`, `presenter/typing.rs` `key_shows_ring`). A press leaves its focus ringless, a key shows the ring, and a focus the app moves inherits from the one it leaves. Three review rounds closed the common paths; what remains follows from `ringless` naming a node instead of recording pointer-or-keyboard modality, as Chromium's `HadKeyboardEvent` does: a press on nothing focusable, or on a text field, forgets the pointer, so a later `focus()` rings; a finger on a canvas while a field keeps focus names the canvas; a key handler that navigates within the press window arrives as the press did; a canvas's focus fallback and a heading's focus handler that remounts can leave the wrong node named; on Android a key does not end touch mode for an arrival with no press; a pointer Back to a field's origin hides its `:focus-visible` look. A modality flag beside the per-focus decision (Chrome's model) would close them together. On Windows (`brush.winui_focus`, `keyless`) WinUI's model is that flag too: its programmatic focus shows the visual when the last input device was the keyboard, so a mouse moved after a key should leave a script's focus ringless (round 3 of the 2026-10-27 review: Astra, citing `focusmgr.cpp`). A bare modifier now counts on Windows.
- **The painted split's list column is a clip the runner does not know** (2026-10-26, LLP 1115.004 D16). The list route keeps the window's width and is narrowed by a cover, and paint, hit testing and accessibility clip it to the column, but `frame()`, `elementFromPoint` and the intersection observer see the whole route: content overflowing the column (Shelf's filter row at 320) answers a point in the empty detail pane. A runner placement that clips without a host block, or the list as a block of its own with `beside_a_pane` taught to keep it live, would close it. Smaller: a list element destroyed and remade while empty loses its retained split, since `retained` holds its old `ViewId`; and a pane's text takes partial damage only where native scrollbars are off, so on Windows (`refresh_scrollbar_preferences` turns them on) the painter still repaints the window, as it did before the split.
- **A layer node on the Android reader can lose its drawing the way a slot did** (2026-10-28, found reviewing `host/android/canvas/.../Slots.kt`). HWUI discards the display list of a node that leaves its tree, and exact2 sends a layer's drawing (op 30) only when it changes. A layer whose drawing rows were all freed before the row taking it over was drawn (a waiting row, or one made on the worker) would draw empty, with any slots inside it. Slots now keep their drawings and are recorded again (`Slots.refill`, also when a layer's drawing is recorded); `Layers` could keep each layer's ops the same way and record a layer again as a row drawing it is drawn. Not seen in Excord.
- **Android presents no dialog or popover its author lays out** (2026-10-26, LLP 1115.001 D10's Draft paragraph). Linux and Windows now paint one in the window (LLP 1115.004 D10.7, `host/linux/src/presenter/alert.rs`); Android still refuses one ("not yet in Android's windows"), so Excord's switcher, profile, member list and pickers do not open there. The Draft names the five pieces owed, each its own work: the subtree's op stream in the surface's window (a modal bottom sheet in a compact window, a basic dialog wider, a `PopupWindow` for a popover), the page's contact path in that window, a hosted `EditText` per window, TalkBack through D13's provider, and the framework's motion.
- **Linux and Windows: what an authored dialog or popover still lacks** (2026-10-26, LLP 1115.004 D10.7; the last review round of `presenter/alert.rs`). (1) A field in one has no edit menu (right click, the Menu key, Shift+F10): `edit_menu.rs` refuses while any surface is open, and the menu is itself a surface, of which one is open at a time; the edit menu would have to stack above the box. (2) The page's scrollbars are painted after the box and its scrim (`paint.rs`, `paint_scrollbars` after `paint_alert`), so where one crosses them it shows on top; presses on it stay inert. (3) A `focus` handler that closes the box while it opens queues `open>closed` and then `closed>open` for the same toggle, so the `toggle` event reports it open (`queue_toggle` keeps the last state). (4) Desktop Linux presents no menu popover yet, and its refusal still says "Linux does not support popover presentation" (`navigation.rs`, pinned by `tests/pinned/host.rs`); the agent's `contextmenu` op needs a shell that makes windows.
- **Windows: an authored dialog and popover wear the neutral look until D12's Fluent column** (2026-10-26, LLP 1115.004 D10.7). The kernel's starts for them are the neutral column's (`kernel/src/arena/alert.rs`, contexts 13 to 15); WinUI's ContentDialog and Flyout metrics (an 8 px corner, a 1 px stroke, 24 px padding, 320 to 548 px wide; a Flyout's 16, 15, 16, 17 padding on Acrylic) are listed in D10.7 for that column. The popover is painted in the app's window, so it is clipped by it where a Flyout is not; and D10.7 asks Charlie whether an unsaid popover opens above its invoker, as a Flyout does.
- **A box outside every route cannot clear the iPhone's status bar** (2026-10-26, Excord's image viewer, since made a full-screen route). An overlay drawn from the root, padded with `env(safe-area-inset-top)`, sits beside the Dynamic Island: under `viewport-fit="auto"` with a navigation stack `env()` is 0 (docs/agent-pitfalls.md, "A banner at the root of a tabbed app"). LLP 1123 D9's `var(--exact-safe-area-inset-top)` (stage 2, accepted) is the fix; until it is built such an overlay has no inset to read.
- **A scroller beside the primary one cannot pad the home indicator** (2026-10-27, Excord's server rail). The rail now reaches the iPhone's bottom edge, laid over the channel list's padding so the list spans the route and takes its clearance (LLP 1123 D3); UIKit gives the rail no bottom inset, so with enough servers to scroll the last one can rest under the home indicator. LLP 1123 D9's `var(--exact-safe-area-inset-bottom)` on the rail's padding is the fix.
- **Excord's Mac transcript drops frames while it scrolls on a real account** (2026-10-27, Charlie, by hand, on his account; first seen as a jerk past the end). A ⌥⌘T trace from his MacBook (120 Hz, 83 s of late frames) settles where it is not: the stretch past the end is free, since its hundreds of scroll events commit nothing. Of 82 missed frames, 8 followed the lists re-asking on every change elsewhere on the account, which the lists' own versions now stop (`live.ts`). The other 67 followed scroll events that moved the content: each took about 10 ms of the main thread (about 4 ms runtime, 4 ms apply, the rest unattributed) across about four kernel transactions, all with no tree change. An agent drive cannot stand in for it: under the agent nearly every batch the app applies is the agent's own (its clock steps and position reports; `docs/agent-pitfalls.md`), and no frame is presented, so a `sample` of one says little about a real scroll. A second trace from his account with that fix in (e2fc73048e, 2026-10-27) puts the rest in building rows: of the 66 frames missed in its last 2.7 s of scrolling, 58 came in frames that built rows as they scrolled into view (five or more row segments), each about 5.6 ms of apply, 4.0 ms of runtime and 7.8 ms no phase claims (Core Animation's commit and text drawing are not wrapped), about two frames at 120 Hz; frames that built no rows seldom missed, and a row's hover in or out cost about 5 ms of apply too. The fixture's rows (plain text) are cheap enough that no drive there shows it. The rows his trace built are the same sites as the fixture's (one text run each, few pictures), so the cost is the host building rows on main as they scroll in, not his content: macOS still fills synchronously, and LLP 1072 stage 5 (below, parked) is the fix.
- **`exact-svg-file`'s and `exact-tamber`'s wall-clock limits fail under load** (2026-10-27, LLP 1133.024 stages 1 and 2, at load averages of 700 to 1,000; every agent saw them that day). `cargo test -p exact-svg-file --lib` `a_file_that_expands_past_a_limit_draws_nothing_and_names_it` took 17.1 s against its 5 s limit (`host/svg-file/src/lib.rs:439`). `cargo test -p exact-tamber --test it` failed `import_kinds::a_document_that_multiplies_is_refused_whatever_its_shape` (13.1 s), `import_pen::every_pass_over_a_hostile_file_is_charged_to_the_budget` (23.5 s on the real budget) and `limits_sweep::a_large_tailwind_import_lands_or_is_refused_in_moments` (45.8 s). Each asserts elapsed time, not a count of work: measure them on a quiet machine, and bound the work they do rather than the wall clock.
- **A full-screen route over a Mac split is drawn in the list's column** (2026-10-27, Excord's image viewer). `SplitHost.read` ends the detail's pane at the first `modal` or `fullscreen` route, and `sheetRoutes` puts only a `modal` one in a sheet, so a `fullscreen` route stays in the page's view, which is the list's column: Excord's picture shows there, beside the chat, at the column's width (the root overlay it replaced did the same). It could cover the whole window, as Discord's desktop viewer does, or at least the detail's pane.
- **Native navigation inside an authored scroller** (2026-10-25). The main native container always takes the whole session view (LLP 1123 D1; `NavigationHost.ownerFrame` places it from the viewport), wherever it is declared, and no scroll view holds it (`DocumentMountIOS.swift`). An author who wraps it in an element with `overflow: auto` asks for a scroll view above it, and what the author writes wins: lay the container out in that box, inside the author's scroller. Not tried; UIKit then places its bars as it does in any scroll view (the search field stays in its column).
- **LLP 1072 stage 5: asynchronous fills on macOS** (2026-10-26, parked 2026-10-27 on `parked/mac-async-fills` and 2026-10-28 on `parked/mac-async-fills-seq`). One flag (`ExactSession.asyncFills` on for every Apple host); on the M5 a build with it had no late frame in the last 600 of a scroll, against a p99 of 143 ms without, and it is what Excord's Mac transcript still misses frames for (row builds on main, about 2 ms a row on a real account). The branch also orders what a landing sets off behind the batch that landed it (`holdBatch`, `publishedSeq`, `Collection.holding`); the Mac and iOS XCTests pass. Three more blind rounds (sol, Grok) each found new interleavings, several also on iOS today (its commit message lists round 3's). The second design, that one ordering rule (every batch keeps the owner sequence number of the job that made it and main applies in that order), is parked on `parked/mac-async-fills-seq` (2026-10-28) after three more rounds: its Mac and iOS XCTests pass, and round 3's review (sol) still found three interleavings, one a list's pending fill dropped while a tick is in flight (its commit message lists them). Both designs break the same assumption, that `apply` has presented before it returns, which commands, focus restore, reveals and collection reports all lean on. A third attempt should start from those callers, or take the cost off main another way (building a row cheaper there).
- **A native host refuses a data-module answer holding a lone UTF-16 surrogate** (2026-10-26, Excord). `JSON.stringify` writes one as `\udXXX`, which a browser's `JSON.parse` accepts and serde_json refuses ("unexpected end of hex escape"), so the same answer loads on the web and is refused on Apple. Excord's came from cutting a preview with `.slice`; its cuts are now by code point (`clip`), but any app's string from a server or a cut can carry one. The reader could take it as U+FFFD, as WHATWG's UTF-8 decode does for an unpaired surrogate.
- **Qualify the 65 s warm gate budget** (Codex, 2026-10-26, LLP 1142 landing). All six checks passed at `faaf45c373`, but their total was 66.61 s on a shared build host; the earlier `9369bf2a8a` run took 63.38 s. Source revisions and shared-host load both changed, so the excess is not yet attributed. Profile under controlled load without dropping coverage or weakening assertions.
- **A drawing in a widget is a picture leaf, when a widget needs one** (2026-10-26, from closing `issues/closed/20261019-widget-circular-gauge-and-svg.md`; no consumer waits). The snapshot compiler refuses `svg` (`contract/cli/src/snapshot.rs`). Its shape is LLP 1126 D4's picture leaf: one static `svg`, drawn into SwiftUI's `Canvas` from the scene `host/apple/src/svg.rs` already flattens (paths, paint, stroke), not a SwiftUI path per shape.
- **AppFunctions for Android** (2026-10-26, LLP 1133.023 D8, §14 stage 3). Not built: the AppFunctions SDK and KSP in the reader's locked Gradle graph, an `AppFunctionService`, the generated `@AppFunction`s, and their enabled state. Until then Android has no tool door, and the search-index mirror lives in the package rather than the host.
- **Windows: the app's own shortcut list and the jump list drive** (2026-10-26, LLP 1133.023 §14 stage 4). `setAppShortcuts` has no Windows implementation, so only the manifest's tasks are set. The NucBox drive (the jump list read back in the console session, and `shelf.exe /add` landing at `/add`) has not been run.
- **The JS target's calls never end `superseded`, and do not refuse `busy` while `returns` reads a pending resource** (2026-10-26, LLP 1133.023 §14 stage 5). `calls.js` cannot tell a person's commit that replaces a call's ask, and has no view of a derive's pending state. Both need the runtime to mark a request with its invocation, as the runner does.
- **Excord's fling and image numbers on a device** (2026-10-27, LLP 1144 D5, LLP 1145 §4). On the simulator (`apps/excord/diary/2026-10-27-fling.md`) six flings of #general had 2 late frames of 724 and no image shown blank, so this run gives 1145 D1 no late image to rank. A phone's run decides the budget. Under platform timing `fling.mjs`'s `--to` needs taps between its waits for Excord's data to land (LLP 1080.000 §12); a `--to` verb that lands pending `then`s without taking the clock would say so directly.
- **Qualify the GPUI rendering backend in production Excord with accessibility active.** Production uses the CPU renderer. The isolated candidate retains font source bytes and preserves sprite insertion order. With screenshot inspection before each run, two matched 200-message, 3,600-step Windows chat pairs on prototype `3d5a4bf06b` used 25.48% more CPU time and 22.40% more CPU cycles than GPUI; private memory fell 7.87%, but working set rose 10.91%. The earlier CPU lead did not qualify active accessibility: inspection activates Exact's adapter even without requesting accessibility text (below). Native UI Automation inspection of the GPUI benchmark exposes only the window controls, while Exact exposes the visible chat text; this is not an equivalent accessibility workload (`gpui-accessibility-observation.json` and `exact-accessibility-observation.json`). Font retention alone reduced private memory by 11.63% and working set by 23.07% in the earlier same-executable comparison; it did not show a CPU improvement. The candidate passes 128 font pixel cases and 864 cached-drawing cases without extra GPU batches. Four earlier frame traces had no display gaps over 25 ms at 60 Hz, so a smoothness lead is unproven. Local evidence is `external-ownedfonts-layout-performance-qualification.json` and the `external-ownedfonts-diagnostic3-*-qualification.json` reports under `target/windows-chat-comparison/`. Production clipping, SVG, opacity groups, gradients, variable fonts, device recovery, other refresh rates and cold startup remain open.

- **Reduce Windows accessibility synchronization cost without dropping behavior.** Screenshot-only inspection activates the Windows adapter; listing and activating the window do not. The adapter stays active after the helper exits. One instrumented executable used 30.26% more CPU cycles and 32.12% more CPU time with accessibility active than dormant. Its 3,600 synchronization calls took 906.78 ms elapsed, including 564.72 ms in the shared tree path. Two phase profiles attribute 41.9–42.5% of synchronization cycles to the semantic tree walk, 23.0–23.5% to AccessKit updates, 8.7–8.8% to the box lookup rebuild and 1.4% to serialization. Borrowed child traversal removes ID snapshots and repeated child lookups: two reversed-order, same-executable pairs with accessibility active used 4.07% fewer process CPU cycles and 5.80% less CPU time on average; tree-walk cycles fell 10.06%. Ten accessibility tests and 3,600 native scrolling comparisons returned identical nodes, identities and item positions. Production Excord passes scrolling, menu and composer smoke checks. Checking visibility before computing text and button names reduced process cycles by 5.60% and CPU time by 13.67% in two reversed-order prototype pairs on `b3c26d3c4e`; tree-walk cycles fell 42.86%, while private memory rose 0.67%. All 3,600 native comparisons preserved nodes, identities and item positions (`external-access-visible-quiet-qualification.json`). The profiler buffers snapshots and writes them from workers after 3,600 accessibility calls; two earlier samples with synchronous logging did not finish the workload and are excluded. These are prototype chat measurements, not an Excord-wide or GPUI lead. Continue reducing repeated tree work while preserving behavior; `external-access-borrow-qualification.json` and `external-access-phases-qualification.json` hold the measurements. Two reader-payload bypass prototypes remain isolated: serialization alone showed a small gain in two pairs; additionally skipping unused change records lowered cycles but increased CPU time by 5.62% on average. Neither establishes a reliable overall speedup. Their source patches, binaries and results are preserved under `target/windows-chat-comparison/`; see `external-access-activation-qualification.json`, `external-access-refresh-performance-qualification.json`, `external-access-refresh2-performance-qualification.json` and `external-access-refresh-adoption.json`.
- **Establish native keyboard behavior after system-menu Escape.** In Excord, the End key never reaches the HWND, and menu exit arrives only with the next click, despite the popup disappearing. Compare a native edit control before adding a keyboard workaround. First clicks after system and editing menus now use the button message's position and pass the native drive. See `menu-input-trace-qualification.json` and `button-position-qualification.json` under `target/windows-chat-comparison/`.
- **Qualify the isolated Windows GPU renderer before adoption.** The approved fresh three-round clipping/SVG pass is exhausted. Its final candidate draws nine Excord GPU frames before an opacity group causes CPU fallback. Native readbacks expose hard fractional clip edges at 100–200% scale; SVG blending differs by up to three channel levels, exceeding the unchanged one-level threshold. Keep it isolated (`excord-gpu-renewed-qualification.json` under `target/windows-chat-comparison/`). Creation, resize, presentation and glyph-failure injection recover to CPU and complete scrolling. Actual driver removal, embedded CFF/Arabic/color fonts, atlas pressure and an imperceptible late fallback remain unqualified. Keep SSE2: the isolated AVX2 release sampler gains an uneven 4.3% and has exhausted three rounds without native qualification. See `recovery-features-qualification.json`, `glyph-recovery-qualification.json`, `embedded-font-qualification.json` and `image-pair-release-qualification.json`.
- **Attribute Windows idle work.** Notification-driven image decoding eliminates the measured decoder polling. Foreground activation still triggers recurring accessibility/text queries from an unidentified client; do not subtract that cost from comparisons or assume Inspect caused it. Inspect has exited and normal release launches work. See `idle-images-qualification.json` and `wake-stages-qualification.json`. The separately rejected history-fixture launch and original fixture shutdown have not been retried.
- **Finish Windows menu, text-size and contrast qualification.** Scrolling menus pass native Home/End, wheel, thumb drag, item selection, Escape and live 225–100% reflow at 360×500. High-contrast and touch menu checks remain. Long embed metadata wraps in renderer tests but still needs native validation. Header icons grow with text; the fixed-icon attempt exhausted three rounds. Qualify contrast selection colors: the attempted repaint failed and was removed. See `menu-overflow-qualification.json`, `embed-qualification.json`, `icon-scale-qualification.json` and `target/excord-contrast-round3.log`.
- **Finish Windows dialog and display-scale checks.** Live 100–200% scale changes preserve the restored window above the taskbar, and the 100–150–100% regression preserves transcript anchors. Dialogs pass keyboard/pointer, long-content scrolling and all four contrast presets. Cross-monitor scale changes and brush transitions remain unqualified. See `target/excord-dpi-checks.json`, `dpi-scroll-qualification.json` and `target/excord-dialog-feedback-checks.json`.
- **Finish Windows regression-suite portability.** Symbolic-link privilege, Apple-host filesystem assumptions, a Tamber import and terminal fixture path escapes failed the pre-integration tests. Linux-only workspace code and Harmony's missing vendored dependency also failed. Full-workspace formatting exceeds Windows' command length. Reassess using the integration logs before changing coverage. Separately, seven `exact-js-bake` integration cases fail path or reproducibility comparisons; preserve their equality assertions (`portable-js-bake-tests.log`).
- **Make Excord app tests observe what they wait for.** Fixed real-time waits remain in three places. The Windows composer test (`fixture/composer.e2e.test.ts`) launches each of its tests with `clock +500 real`, not a wait for `gateway.state == "ready"`. Another member's vote in `app.test.contract` gets `clock +100 real` to arrive: its counts are in state only inside `win.rows`, at an index the window decides (`win.rows.138.poll.0.answers.2.count` on the web at 420x900). `fixture/routing.e2e.test.ts` waits `plus(1000, true)` for a list to go quiet (three tests) and after an arrival (`arrive`); ending these on a change of state would stop the clock short of the full second and of any timer due in it. The mutation clock also waits for held sends to time out before exposing the pending row, although the native window shows it immediately. Retain per-mutation timestamps while allowing that observation. See `find-focus-app-suite-concurrent.json` and `target/excord-held-send-trace.json`. Cancelling a held history lookup preserves a new draft; successful reuse of its late response remains unqualified (`history-hold-qualification.json`).
- **Make the Excord fixture's speed assertions hold on a loaded machine.** `world.test.ts` asserts generation under 300 ms and `transcript-world.test.ts` under one second on the wall clock, and a loaded machine fails them.
- **Finish Windows text interaction and accessibility.** Double-clicking `word,` includes the comma, unlike Notepad. Inline links are clickable but lack Tab/Enter navigation. Clicking a transcript message leaves focus unset, so Page Up does nothing until Tab reaches the list. Each attempted fix exhausted three rounds; retain current behavior until a scoped follow-up. UI Automation text geometry, ScrollPattern and Narrator behavior remain unqualified; the geometry candidate is in `target/excord-access-geometry-candidate/`.
- **Place partial GIF frames on the Windows logical canvas.** WIC reports first-frame dimensions separately from the logical screen. The isolated source handles the basic offset frame, but reduction and native use remain unqualified after three rounds. Candidate: `target/excord-gif-canvas-candidate/`.
- **Finish Windows IME qualification.** Japanese conversion, cancellation, committed clauses, undo, focus changes and 150% candidate placement pass native checks. Composition uses dotted/solid underlines without the blue selection block. Pointer placement under the prediction popup remains untested because the UI driver refuses a point owned by Windows Input Experience. Other clause decorations remain unqualified; non-text composition updates have native dispatch regression coverage.

- **Agent words for an extension an app uses only through its view** (2026-10-26, LLP 1133.027 §10 drive 1). `prefer extension camera.picture=…` is refused in Shelf, which uses `@exact/camera` only for its `exact-camera` viewfinder: the agent's words resolve through a plan module row of that extension, and a view-only use makes none. So drive 1's lookup (the ISBN fixture shown in the viewfinder, the Open Library answer, Use This Book) runs in the vision fixture app (`packages/barcode-detection/test/agent.mjs`) but not in Shelf, whose scan screen is driven with the camera's default agent picture. Resolve the words through the package's views too.
- **Apple text detection must preserve an explicit script when matching languages** (#254 review). `packages/text-detection/apple/TextDetection.swift` truncates `ms-zsm-Arab` to Malay and matches Vision's `ms-MY` on macOS, despite the requested Arabic script. Apply LLP 1133.027 D6's unsupported-language refusal before truncation, with Apple regression coverage.
- **Android for vision and translation (LLP 1133.027 §12 stage 4)** (2026-10-26). Not built: the Android half of D17's `observe` (`Tracks` in `host/android/canvas`, and CameraX `ImageAnalysis` in the camera package), the three Kotlin implementations over ML Kit with their artifacts in the locked Gradle graph (D14), Excord's Google attribution (D10), and drives 1 to 8 on an emulator. The Android `exact.json` files declare the shapes only, so Shelf and Excord on Android show no Scan Barcode, Add Quote or Translate.
- **What a scrolling list's batch still costs on iOS besides its rows** (2026-10-27, bake-off r29 feed-exact and tasks-exact, feel probe; the scrub is 0 to 9 ms/s now, SwiftUI's feed 17). Each batch of a list that is its route's `navigationScroll` syncs the navigation projection (`onlyListRows` reads the named scroller as projected, so none of its rows' batches skip it: about 13 % of `Presenter.apply` through tasks-exact's status-bar scroll to the top), and `SwipeActionsHost.sync` visits every swipe row each batch. A new post's like button is a heavy leaf, made and configured for every row the pool hands out (`ButtonConfigurationIOS.apply`, most of it UIKit updating the symbol's image view); a pool of buttons by face would keep the making. Rows that show as they are made still raster their text urgently on the main thread. An authored smooth scroll far down a list shows nothing between its ends (LLP 1070.000 §6.2, declared); it could glimpse as the indicator's drag does.
- **Should exact2's games declare `android:appCategory="game"`?** (2026-10-25, LLP 1133.029 D6, §12). Android 16 ignores orientation and resizability restrictions on screens 600 dp and wider for apps targeting API 36, and exempts games "based on the android:appCategory flag" ([behaviour changes](https://developer.android.com/about/versions/16/behavior-changes-16)). exact2's Android build sets no category, so a game's manifest `orientation` and an explicit `orientationlock` type are ignored on a tablet (`current` is not). The category also changes how Play lists the app, so it is a decision for every game, not one module's.
- **`wakelock` on Linux and Windows** (2026-10-25, LLP 1133.029 §12). Both journal `wakelock: unavailable` (`docs/reference.md`, "Keep the screen awake"), and both platforms have the capability: Windows' `PowerCreateRequest` and `PowerSetRequest(PowerRequestDisplayRequired)`, and on Linux the Inhibit portal's idle flag (8). Fill them when an app on either asks.
- **A reused canvas id on the Windows game host answers with no world** (2026-10-25, LLP 1143 §4 D4). Two diaries kept a canvas id across leaving and re-entering a scene; `state <canvas>` replied without a world instead of refusing. Refuse a gone canvas by name and name the live world canvas. Not reproduced off Windows.
- **One app's `verify` reports 500 to 625 standing findings on every run** (2026-10-25, LLP 1143 open question 2; the Scores/foldable app's diaries, exact2 63914d6c4). Classify its standing set by kind and fix the `check` heuristics that misfire on its design. The ten diaries whose `verify ios` stayed red name six refusals of targets a native title view or bar replaced; each refusal should say so.
- **Film UIKit's presented frames on iOS** (2026-10-25, LLP 1143 §5; measured 2026-11-12, `experiments/ios-film-cadence/README.md`). `screenshot … over … every … window` films the agent clock's drawings, not UIKit's presentation: a sheet filmed under agent timing is unanimated, and a diagnostic run under platform timing missed 38 of 44 recorded sheet-edge positions. A capture of live display updates with presentation timestamps remains to be chosen, and the A→B→A candidate in the probe's recording to be explained, on a device with and without observation.
- **A drag's release velocity under the agent's frozen clock** (2026-10-25, LLP 1143 §5, the Bluesky port, 8 incidents). Every sample of a drag shares one time, so `transformrelease` reads 0 velocity even with `--timing platform`. It needs its own design: the agent's clock owns the runner's.
- **Windows host and game build friction from the diaries** (2026-10-25, LLP 1143 §5): window geometry lost on each rebuild and occluded-window screenshots (about 9 diaries); disk exhaustion with no view of the build caches' size or place (about 21); `test-rust` not saying which crates it covers or how far it is (about 12).
- **Plain-iframe apps load the whole partitioned browser on Apple** (2026-10-26, LLP 1020.002 stages 1–4). The web arm (`ExactWebArm`, `host/apple/build.mjs`; built only for an app with an `iframe` and dlopened at its first create commit) grew from about 164 KB to about 537 KB stripped with the partitioned browser, its windows, dialogs and downloads, capture, the PDFKit view and automation, and an app whose frames are all plain loads all of it. Building `FrameBrowser`, `FrameWindows`, `FrameCapture`, `FramePDF` and `FrameAutomation` (`host/apple/webarm/`) into a second arm loaded at a partitioned frame's or a PDF's first use would return those apps to the base size.
- **Apple builds write no privacy manifest** (2026-10-25, LLP 1133.028 §10). No app's bundle carries a `PrivacyInfo.xcprivacy`, which App Store submission requires of an app that uses a required-reason API (`UserDefaults`, file timestamps, system boot time, disk space; [Apple](https://developer.apple.com/documentation/bundleresources/privacy-manifest-files)). Find which of those the host and runner call, and have `host/apple/build.mjs` write the manifest with their reasons; a `device.tracking` app would add `NSPrivacyTracking` and its `NSPrivacyTrackingDomains` there.
- **Read an implementation's own names, then move tracking consent's there** (2026-10-26, LLP 1133.028 stage 0; LLP 1133.001 D2). `contract/cli/src/declaration.rs` refuses names an implementation's `exact.json` declares, so `@exact/tracking-consent`'s, which LLP 1133.028 D12 makes Apple's own (`use … from "@exact/tracking-consent/apple"`), are declared in its interface with every target but iOS and tvOS `unsupported`. Once the compiler reads them, move them to `packages/tracking-consent/apple/exact.json` and change the fixture's import.
- **Watch: `InlineAtomProbeMacTests` failed one Mac suite run of two** (2026-10-25, 81c0f578c7, `bun host/apple/build.mjs --test excord-apple`). It passed in five runs since (the last a full suite at 65577096ed, 2026-10-27), two with Excord's archive and two with Caltrain's. It boots no plan, so the archive does not matter. 2026-10-30, the dev Mac (load 30 to 90): a full suite hung in it for 45 minutes (24 CPU-minutes in its `xctest`), until the process was killed. In the same run every `AccessibilityClientMacTests` case and `ComboboxAccessibilityClientMacTests` failed at the client's element lookup (`attributes(of:)` nil), as did one of them run alone on a bundle built 2026-10-23, so that is this machine's AX client, not a change.
- **JPEG, GIF and WebP on Linux and Windows** (2026-10-25, LLP 1011 §2, the remote fetch). The Linux presenter now downloads `http:` and `https:` images on Linux, Windows and Android, but on Linux and Windows decodes only PNG and SVG (`host/linux/src/image/png.rs`; `jpeg.rs` reads JPEG, GIF and WebP headers and hands the pixels to Android's `AImageDecoder`, refusing them elsewhere). No decoder for the three is in Cargo.lock; the candidates are pure-Rust `zune-jpeg`, `gif` and `image-webp` (first frame), or WIC on Windows. Excord on Windows is the consumer: its avatars, server icons and still emoji are PNG and draw, but attachments and embeds through Discord's media proxy are mostly JPEG or WebP, and an animated emoji is a `.gif`, so those are blank boxes. Until a decoder lands, Excord could ask the CDN for PNG where the host decodes nothing else (an animated emoji's still is `emojis/<id>.png`; whether the media proxy's `format` parameter gives PNG is unchecked).
- **Excord's GIF links and video attachments are still** (2026-10-25). A Tenor or Giphy link arrives as a `gifv` embed whose moving form is only an MP4 (`video.url`), and a video attachment is a file; Excord draws the first's still `thumbnail` and the second as a file row. Discord plays both in the row: a `gifv` muted, looping and without controls, a video with controls. Exact has `video` (LLP 1042; AVPlayer on Apple, the browser on the web; the Linux presenter's other backends draw nothing for it), so a still under the player would stand in where none plays. Before rows hold players, check on a phone that a muted, looping AVPlayer neither takes the audio session (pausing the reader's music) nor publishes to Now Playing (`NowPlaying.swift` leaves AVKit publishing when no player claims), and measure scrolling with several on screen.
- **A disk cache for remote images on the Linux presenter** (2026-10-25, LLP 1011 §2). Bodies are kept for the process only (an LRU of 256 spool files and 32 MiB, `host/linux/src/image/remote.rs`), so a relaunch fetches every avatar again; Apple keeps a 64 MiB `URLCache` on disk under the HTTP cache headers' policy, with `stale-while-revalidate`.
- **Contacts access picker is blank on iPhone 16 Pro, iOS 27.0.1** (2026-10-26, LLP 1133.020). With limited access, `showContactAccessPicker` opens an empty sheet. Waiting for the SwiftUI host to be presented does not resolve it. LLDB shows a 402×812 presentation with `_EXHostViewController` containing only `EXPlaceholderView`; ContactsUI is linked. Apple confirmed the same symptom as an OS bug in [FB21812568](https://developer.apple.com/forums/thread/814292), with reports on 27.0.1. An OS cause is likely, not independently proved here. Use the app’s Contacts settings to change shared contacts; picker completion remains unqualified on this phone.
- **Watch: document-render.test's two text-style cases time out under the full web-js suite at --parallel=3** (2026-10-25, dtool2, the lead's ask). "bare text styles keep their fills and inherited rows through server adoption" (at its 180 s cap) and "keyed text styles track independent shorthand and longhand fields" (at 60 s) failed together on one of two full runs on each of c9ec81b413 and a685b7b317. The file passes alone, 2/2 (23 tests). Each runs a server-rendered page and adoption through the agent, so it is load on the slow part, not a race found yet. Repro: `bun test --parallel=3 $(ls host/web-js/*.test.js host/web-js/*.test.mjs | grep -v "conform\|bundle-size\|document-agent") --timeout 900000` with contract and exact-web-js built (/tmp/dt-rv/clean-run.sh does it). If it fails alone, it is a main red.
- **Linux could draw a non-template icon file through its SVG scene renderer** (2026-10-25, LLP 1121 stage 14 C2; theme2's sign-off). An icon token on Linux is drawn only as a one-colour template (`contract/lower/src/icons.rs` `drawn`: non-Apple, non-web targets take the template path), so an icon file that is no template is refused for an app that ships Linux, though Linux's painter already renders SVG scenes. Repro: an app shipping web and Linux with `icon.ai = icon(svg "ai.svg")`, where `ai.svg` is an Illustrator export (`<svg viewBox="0 0 24 24"><defs><style>.cls-1{fill:#000}</style></defs><path class="cls-1" d="M2 2h20v20H2Z"/></svg>`): the build refuses it for linux (the web-only app draws the file). Route a non-template icon file through the SVG scene renderer on Linux, as the web draws it as written.
- **Mac XCTest failures at 61ed608c** (2026-11-12, a full `build.mjs --test` on the dev Mac under load with its screen locked, the same 30 cases with and without 54073e7c): `PixelGridMacTests`, `FieldInkMacTests`, `HostBlockMacTests`, `ScrollOriginMacTests`, `TextAreaLeadingMacTests`, `ModuleQuitHoldTests`, `NativePropsTests`, one dark-mode case of `SheetSurfaceMacTests` and one of `InlineAtomEditorMacTests`, besides the AX client classes below; `InlineAtomProbeMacTests` hung again. The screen was locked during that run (`ioreg -n Root -d1 -a`: `CGSSessionScreenIsLocked`), which stops window activation, capture and full-screen transitions; rerun these classes in an unlocked session before suspecting a change.
- **macOS XCTests in the async lane** (2026-10-25, LLP 1142 D7, §12). `scripts/async.mjs` runs only `build.mjs --test --ios`, so a failing Mac class is never reported. The Mac suite takes 6 min with its compile on an M5 Max (279 classes). Add it beside the iOS step under `appleTouched`, with its name in `retainSkippedFailures`, once it passes on main. At `65577096ed` (2026-10-27) two classes failed; `InlineAtomProbeMacTests` and `TableFeedKeyMacTests` passed. (1) `NativeButtonFidelityMacTests.testAllFixtureRowsPixelDiffAgainstHandConfiguredAppKit`, 0.028 against 0.02 for `a-plain`, in every run. Its text is identical. The difference is the `arrow.up` symbol: both buttons draw it as an SF Symbol (`NSSymbolImageRep`), with the same symbol configuration (13 pt, regular), `labelColor` tint, aqua appearance, bezel and border, and their stems match. But the native arrowhead is about a pixel wider on each side and starts a row higher (`target/1104-b3/pixels/a-plain-{native,hand}.png`). Find what else the native face sets on the image or the cell (`ButtonConfigurationMac`). (2) `BorderParityMacTests.testEveryCaseMatchesChromeOnScreen`, whose failing case changes between runs: `current light` mean 3.02 with 2.8% of pixels beyond 48, then `square4 light` mean 4.12 with 4.5%, against a band of 3.0 and 4%. It reads the window server's picture, and other apps' windows were in front during these runs.
- **A pull that starts at a Mac scroller's end bands nowhere** (2026-10-27, LLP 1142 D3). `tap <s> wheel 0 3000 hold` from the middle of Caltrain's page stretches AppKit's band past the end. From the end itself the gesture chains to the scroller around (`ChainingScrollView.routing`'s "a gesture that begins at this view's end goes to the scroller around it"), and the outermost has none, so a person's pull there does not band either. Safari's page does. Decide whether the outermost scroller (or one with nothing around it) keeps such a gesture, and judge it against a hand-built AppKit scroll view.
- **Watch: press.test's chromium "a native button eases out of its press as the press ends" fails at high load** (2026-10-24, main 768cae6767 and after). `bun test host/web/tests/press.test.mjs` failed it 1 run in 6 at load ~37, and in every run at 80–157, on main's own neutral.css as on branches: `expect([engine, finger, dim]).toEqual([engine, finger, [0.65, true, true]])` (press.test.mjs:550) got `false` for the last, the fade's opacity at `duration - 1` not above 0.95. At load under ~20 it passes. Likely the box's fade (the 0.2 s ease-out after a ≥0.1 s hold) is read after a click whose events and frames a loaded machine spreads out, not a product fault; when it fails at low load, read where the fade's `currentTime` stood.
- **symbols.js's `inked` decision may be dead** (2026-10-24; seen fixing js-symbols.test after 317ddfea6a). Since LLP 1081 stage 2 both symbol sheets (host/web-js/symbols.js `STYLE`, host/web/glue.js `symbolStyle`) give `img[data-symbol-path]` and `img[data-symbol-path][data-symbol-color]` the same `--exact-tint: currentcolor`, so `data-symbol-color`, which `refresh` toggles from `inked` (the binding's `$ink`, a boundary's implied row, `data-exact-ink`/`data-symbol-ink` from style.rs `symbol_marks`), no longer changes what is drawn. Decide whether anything still reads it (an agent report, the wasm host's twin in glue.js); if not, take out `inked`, the attribute and `symbol_marks`' ink marks, or say what they are kept for.
- **iOS: a queued hatch focus cannot keep the keyboard through native Back.** `ExactElement.focus()` queues through `ElementHatches.later`, so a claim from `willShow` arrives after UIKit starts hiding the outgoing keyboard. Duo Lab now labels and exercises a synchronous native field claim in `animate(alongsideTransition:)`, which keeps the keyboard visible through completed and cancelled swipes. The queued hatch API has no synchronous transition handoff. Keep its existing batch-safety contract; any transition-aware delivery needs its own regression before changing it.

- **Foreground services and calls: what stages 0 to 4 left** (2026-10-27, LLP 1133.033 §12). Built: the Android foreground service and its claim, the recorder's background line on iOS and Android with Android's crash-safe part writer, the runner's kept call list handed to a bound implementation, CallKit on iOS with the call claim and voice processing, Core-Telecom on Android with its `CallStyle` notification (compiled; `packages/calls/test/android.mjs`), and the web's Media Session call actions. Not built: from D9 and D10, the hold gate on a held call's tracks, pausing its players, holding the first call when a second is answered, the interruption-end activation in the call's configuration; on Android, the microphone type added at a resume, a second call's notification, a lock-screen activity, mute through Telecom, Bluetooth endpoints; the cost probes; the recording notification's Paused text and its hatch (D4). On the iOS 27 simulator CallKit ends a test call about 60 ms after starting it, with no `didActivate`: drive 12 on an iPhone says whether the simulator or the module does it. Not run: anything on Android (drives 1 to 3, the fixture's 4 to 9 with `--bind calls`, on an emulator that boots), drive 10, and `packages/recording/test/device.md` items 4 and 10 and drives 11 to 13 on phones.
- **Background work: what is left** (2026-10-27, LLP 1133.017 §14). Not built: Android's headless session (a worker with no activity in its process finds no session: a `sync` retries, a `periodicsync` waits), the host's `ExactWakeWorker` and the `android.` registration words; `@exact/background-transfer` on Android (D4's user-initiated job and worker, headers in the secret store); D10's staging before the first unlock; the cost probes and the owed update check riding the refresh request (D8, D18); the transfer's runner substitute (§10: `pending`, `fail fetch`, progress overlays, `--wake` with a finished transfer), for which the interface is its own substitute today; Harmony's photo upload (§11 drives 5 to 7), which needs a photo column and Snapback's upload route; stage 4. On an iPhone: `packages/background/test/checklist.md` step 5 (the task's expiry, now wired to the wake), the notification's look and tap, and `packages/background-transfer/test/checklist.md`.
- **Harmony's mention switch asks for notification permission; not yet tried on an iPhone** (2026-10-28, LLP 1133.004 stage 1). Turning on Notify Me of Mentions now sends `requestNotificationPermission()` from `@exact/notifications` before it registers `catch-up` (on 2026-10-26 it asked nothing, and the device test granted authorization through LLDB). Test it on an iPhone from undetermined authorization: the prompt at the switch, then a catch-up's notification opening the room.
- **Harmony in Firefox loses a message written offline** (2026-10-24, `bun packages/background/test/harmony.mjs firefox`). Under Playwright's offline switch the message shows pending, no sync round fails (so no `outbox:` tag is registered), and it is not delivered within 30 s of the network's return; Chromium and WebKit deliver it, Firefox online delivers it, and under the agent in Firefox (`EXACT_WEB_BROWSER=firefox`, failing fetches) every drive passes. Look at Snapback's web device's round while `navigator.onLine` is false in Firefox.
- **Calendar’s first live store updates were stale on an iPhone** (2026-10-26, iPhone 16 Pro, iOS 27.0.1). After the first full-access grant, events added or removed in Apple Calendar appeared only after toggling Show my calendars or changing dates. Following permission revocation, restoration and an app restart, another addition updated automatically; its trace shows EventKit announcements and both readers refreshing. A separately installed copy with fresh authorization subsequently updates both an external addition and deletion without toggling or changing dates. The initial failure is not reproduced; no cause or fix is established.
- **Contacts and calendar: what the four stages left** (2026-10-24, LLP 1133.018 §14). Built and driven: the substitute, the web (drive 7 in three engines), Contacts and EventKit on an iOS simulator and macOS. Built, not run: Android (`packages/contacts/test/android.mjs` checks the fixture's APK; its `--emulator` drives wait for an emulator that starts, which this Mac's does not), and the two checklists (`packages/*/test/checklist.md`), which need a person and the phones of LLP 1133.020 row 9. Not built: the button view `exact-contact-access-button` (an implementation's own names and views are not read yet), iPadOS's popover, D13 item 1's anchor, D16's cost probe, sizes and first-answer time.
- **The web's agent keeps no app storage between launches** (2026-10-24, found driving the Calendar). `agent.mjs web --app calendar --storage <name>` with the same name, with or without `--port`, opens a calendar without the item the last launch saved, though `agent-playwright.mjs` says Chrome keeps a named store between drives; so LLP 1133.018 drive 3's relaunch runs on native hosts only. Find where the page's SQLite store is lost (the profile, the origin, or the dev server's storage).
- **Photos by a person, and what the simulator cannot show** (2026-10-24, LLP 1133.019 §12 stage 2). PhotoKit is built and driven on an iOS simulator (`packages/photos/test/apple.mjs`). Not driven: the system's prompt and the limited selection with Manage (`simctl privacy` grants full access only), a Mac granted by a person (and which text its prompt shows, D4), iCloud downloads, an HDR save's gain map, and a photo added from outside while the app runs (`simctl addmedia` does not return while the driven app runs). Drive 9 is `packages/photos/test/checklist.md`.
- **An HDR edit of a 24-megapixel photo falls back to SDR on Apple** (2026-10-24, LLP 1133.019 stage 0). The HDR path of `data/src/image/apple_transform.rs` charges its decode twice (the half-float source and the half-float output) against the codec's 512 MiB scratch budget, so a 24 MP Ultra HDR or iPhone HDR photo is written SDR with `hdr: false`. Measure what ImageIO and the context actually hold for such a photo on an iPhone, then charge that, or draw the output in bands.
- **Check an HDR edit's gain map on an iPhone** (2026-10-24, LLP 1133.019 stage 0). The iOS simulator's ImageIO writes no gain map at all (`writes_gain_maps()` in `data/src/image/apple_transform_tests.rs` probes for it), so `transformImage` of an HDR photo there returns `hdr: false`; macOS writes one and the test reads it back. Run `cargo test -p exact-data image` on a phone, or edit an HDR photo in the photo editor and open the result in Photos.
- **Apple's HDR edit has no Core Image tone-map fallback** (2026-10-24, LLP 1133.019 D16). When the gain-map encode fails, the codec retries SDR through ImageIO's own decode, which tone-maps; LLP 1100 D13's Core Image step is not built. Add it if a drive shows ImageIO's SDR decode of an HDR source clipping.
- **Photos on Android: what the emulator drive leaves** (2026-10-28, LLP 1133.019 stage 3). `bun packages/photos/test/android.mjs --emulator` passes on API 29, 33 and 34. Left for a person (`packages/photos/test/checklist.md`'s Android part): the permission dialogs, "Select photos" and Manage, a selection's expiry, the resume re-read after Settings, the `owned` path under the add line alone (a build with other grants), `locationRedacted` true, and whether `ACCESS_MEDIA_LOCATION` shows a dialog of its own (D4); an Ultra HDR photo's gain map through a quarter turn on an API 34 phone (the repo's ISO 21496-1 fixture decodes with no gain map there). Under `--bind`, a read decided at launch waits on the runner's agent ticket, since modules bind after first pixel; binding before the first read would let a drive skip the `tap @recent allow`.

- **Watch stage 1b and 1c, after the live driver landed** (2026-10-24, LLP 1126.002 §4; PR #881's "Left for 1b"). The host says it draws `time` and `progress` live, so the runner sets no `due` for them (a countdown wakes the runner each second besides SwiftUI's own redraw); D9's runtime log line, which now also has to cover what the bake leaves to the runtime (computed or design-token paint values, a computed image source); the bordered button and `List`, control measurement, the face's parts, the whole screen and insets with `env(safe-area-inset-*)`, the reader's other settings, the `time` width, `scroll` and `scrollend`; then the per-node model and the startup budget (1c).
- **Watch: two driver nits left from the stage 1a reviews** (2026-10-24, PR #881). A pressable node inside another pressable one is a `Button` in a `Button`, so the inner never gets the tap; the early boot always passes `.dark` and nothing calls `setPreferences` when `colorScheme` changes (moot while watchOS is dark-only). A three-round attempt (2026-11-12) put the outer pressable's `Button` behind its content in `host/apple/Sources/ExactSnapshot/LiveDriver.swift`, and its reviews found the hit testing that follows: a tap on the outer's text, image or path icon reaches no button; a painted box laid over an inner control no longer takes the hit; and gathering the outer's label walked `display: none` subtrees. Hit testing has to be decided per leaf (what takes the outer's action, what passes through), as UIKit's `hitTest` does, before the nesting is changed.
- **Android reader: a module source that failed before the extensions were bound is not asked again** (2026-10-24, LLP 1133.008 drive on a Pixel 5). The camera fixture's `devices = enumerateDevices()` fails `NotSupportedError` at launch and stays failed, so it counts no cameras: the activity's `Native.bindExtensions` is applied at the host's first `requests()` (`host/linux/src/canvas/requests.rs`), after boot and `data_ready` have asked through the substitute, and `bind_extensions`' announcements re-ask only `cameraStatus` (the log: "modules bound here", then "changed (1 asked again)"). A runner test that boots unbound, calls `data_ready`, then binds re-asks it, so the difference is in the reader's boot (a baked plan, a data source not ready at boot). Bind before the first data activation, or have binding re-ask every reader of a newly routed module.
- **A disabled native audio track still delivers sound** (2026-10-25, LLP 1133.033 D8; found by its review). `setTrackEnabled(enabled=false)` in `packages/media-capture/apple/MediaCapture.swift` and `android/MediaCapture.kt` sets the flag, and the recorders write the shared input's samples regardless (`packages/recording/apple/Recording.swift`, `android/Recording.kt`), so a "muted" track is recorded. Media Capture and Streams has a disabled audio track render silence; deliver zeros to a disabled track's consumers, and drive it by the recorded level.
- **Android reader under the agent: a `clock` step waits out its 20 s bound while a bound module is polled** (2026-10-24, LLP 1133.009 drive on a Pixel 5). With `--bind recording --bind media-capture` and a take running, each `clock +N real` and `clock settle` took about 20 s and `clock settle` reported not settled: the agent's op runs on exact2's thread (`Owner.kt` `o.sync`), so the Kotlin requests the clock waits for (`host/linux/src/agent.rs` `wait_for_polls`, `SETTLE_BOUND`) cannot be dispatched or answered until it returns. Let the agent's wait turn the reader's request queue, or wait off that thread.
- **Android reader: a force-stop leaves the permission dialog in the app's task** (2026-10-24). The reader carrier force-stops the app before each drive (`scripts/agent-android.mjs`); a `GrantPermissionsActivity` the last run left up stayed in the recorder's task and covered the next launch (removed with `cmd activity stack remove`, unanswered). Stop the app's task too, or say that a permission dialog is up when the drive starts.
- **Deploy the auth fixture's public origin, then drive passkeys for real** (2026-10-24, LLP 1133.011 §11 stages 2 and 3; §13 question 4). The domain is approved (`exact-auth-fixture.expo.app`) and `bun apps/auth-fixture/origin.mjs` deploys and checks it; it waits on Charlie running that, as an agent's session refuses a production deploy. Then: build with `EXACT_BACKEND_ORIGIN=https://exact-auth-fixture.expo.app`, run drives 1 to 6 with the real sheet on the iOS simulator and an Android emulator, record the Apple origin in D6, and run `packages/passkeys/test/checklist.md` on an iPhone, a Mac with a profile and an Android phone.

- **Sign in with Apple beside a passkey (#210).** A `get` carrying both `publicKey` and passive `identity` still goes to passkeys. Its Apple implementation does not yet add the Apple ID request to its controller. Complete the per-session member table and combined-sheet conformance tests (LLP 1133.014 D10 item 2); do not forward that call to sign-in alone.

- **Sign-in's native requests and seams** (2026-10-27, LLP 1133.014 §11 stages 2 and 3; D10 items 2 to 4). The substitute, web, and standalone Apple identity request are built; still to build: the per-session credential request table in `ExactPackage` (and its Android twin) through which `SignIn.swift` puts the Apple ID request in passkeys' controller, the native auth session for an implementation (Google on Apple, with the token exchange and its local stub), a data-code call's lifetime (a superseded sign-in's sheet stays up until answered), `getCredentialState`, the hatches, Android (`SignIn.kt`, `googleid` in the locked graph), and passkeys' conformance tests for members. Then drives 9 and 10 with the clients Charlie creates (§13 question 6), which also record Apple's web `nonce` claim (D1).

- **Investigate the intermittent collection animation completion timeout**. `SmoothCollectionIOSTests.testAStoppedAnimationsEndLeavesTheNextOneRunning` exceeded its two-second wait for `animating` to clear in a full UIKit run (`/tmp/duo-back/safe-area-ios-green.log`). The isolated test and complete bare suite rerun passed unchanged. Capture the animation serial, offset driver and `FrameClock` callbacks if it recurs; the cause and baseline behavior remain unproved.

- **Watch: a Duo swipe injection finished without a recorded touch beginning** (2026-10-23, Back qualification). A content swipe reported `the runner finished and no touch had begun` after its native injection completed (`/tmp/duo-back/gestures-both-smoke.log`). Later edge and content drives passed, including explicit keyboard restoration after cancellation. The driver now rejects missing, ambiguous or changed display mappings, fixing separately reproduced wrong-display input. This swipe's cause remains unproved. If it recurs, the failure (`no touch has begun: {…}`) carries the aim, the injection result and the dispatch log; also capture the keyboard state and navigation transition before starting another gesture.

- **Watch: TableFeedKeyMacTests' held click showed no press, once in a full Mac run** (2026-10-24; dtool2's /tmp/dt-rv/latecl-mac4.out, 2026-10-23 ~11:00Z). `testAuthoredPressedPaintFollowsTheTablesClickWithoutReplacingSelection` failed its five asserts inside the click's `held` closure (`row.pressed`, `pressPaint.down`, the selection paint suppressed), 50 ms into the click; after the release everything passed (AppKit selected the row, the press action ran). Not a late release (reload1's PressPaint fix): the click holds longer than `PressFeedback.unseen`, so no release is held. Two hypotheses, neither reproduced (25/25 alone at load 11–12, the class 6/6): (1) `TableHost.pointer`'s guards missed at the mouse-down, the row not yet mounted when the fixture's `settle` returned (`feed.pressing(row)` nil); (2) another session's local event monitor, left in the shared test process, took the mouse-down first. The asserts now say which guard misses at the held moment, or that all pass then (which leaves the cause open: a guard that has recovered, hypothesis 2, or a release taken early); when it fails again, read that message and fix where it points.
- **The icon-path guard's JS scan is a tripwire with a limit** (2026-10-24, LLP 1121 stage 14 C2; theme2's ruling on Astra's round-5 finding 3). `contract/cli/tests/it/icon_path_readers.rs` scans only the JS/MJS/TS files that name a symbol source (`data-symbol`, `symbolSource`, `symbolPath`, `symbol-source`, a quoted `symbol:` or `icon|`; 10 files, tests aside), so a reader in a file that names none passes: `node.props.imageSource.split("|")` in an unselected file is not caught. The enforcement is Rust's `IconPathId` type and `iconForm` (host/web-js/symbols.js) as the one JS reader, held to `Icon::parse`'s cases. Option: widen the selection to every scanned JS file; the cost is allowlisting the 388 lines tree-wide that hold a bar or colon literal today (11 now, 8 of them on main).
- **Bound an SVG filter's island on Linux as Apple does, and charge composited layers** (2026-10-23, LLP 1011.001 D2). Linux sizes a filter's island to the filter region, up to 4,096 pixels a side, however little of it shows (`host/linux/src/paint/island.rs` `svg_filtered`); Apple caps a filter's work at 128 MiB by drawing the island smaller (`SvgIsland.budget`), and Chrome works only over what shows. One drop shadow whose region is far past the drawing costs Linux about 2.2 GB at 3× (`exact-svg-raster`'s `f32` working images; measured 845 MB for one blur at 4,096², 0.34 s), so the scene resolver's surface limit is 2.5 GiB to keep `apps/svg-gallery`'s `fx-huge-region` drawing. Linux with Apple's budget, or islands sized to what shows, would let it drop by an order of magnitude. The layers a host composites for nested opacity, blending and clips are not charged at all: 120 nested `<g opacity>` in a 2,048-pixel picture took Linux 1,087 MB and 1.3 s; a budget for them belongs in each host's painter, where their sizes are known. The same holds for three things the resolver's estimate misses (Astra, round 3): what draws inside an island the host rounds up (a pattern tile under a pixel magnifies its content, filters included); Apple's CPU morphology over a long, thin island its area cap admits (the resolver caps a radius at Linux's 4,096-pixel side); and `SvgIsland.extent`, which clamps each reduced side to one pixel and so can pass its own 16,777,216-pixel cap.
- **macOS: two cases where AppKit's popover keeps its opening gap when its margin changes while open** (2026-10-23, theme2 22:25, stated limits of the live-margin fix). (1) A toolbar item's popover: AppKit anchors it to the item (`show(relativeTo: item)`, `PopoversMac.swift`), and the host takes that anchor only while the popover's margins are zero (`usesToolbarAnchor`). Repro: a manual popover opened from a toolbar item with no margin, then `margin-top=12` set while it's open. The popover stays where it opened, since an item anchor has no rectangle to move short of closing and reopening it. (2) An unflipped source view: the gap toward the invoker applies only when the view it's shown against is flipped (`NativePopover.positioning`), as it did at opening before. A node is always flipped, so only a window-content anchor that isn't a node reaches this. A three-round attempt (2026-11-12, `PopoversMac.swift`) reapplied the gap while open; its reviews found where it still fails: a trailing toolbar button's popover opened through `showPopover` falls back to an anchor outside the visible rect, which AppKit refuses to show; a toolbar popover's cached gap is not reapplied when resizing the window moves its item; and a flipped node opened with every margin 0 does not move when `margin-top` changes while open. Seen there: `ToolbarMac.swift:426`'s comment calls the viewport's bottom edge its top.
- **iOS: a painted popover's glass blurs a little less than UIKit's own popover** (2026-10-23, Harmony revision 11's Pins; theme2 20:05, and the bounded probe of 20:06). Measured on real display pixels (`simctl io screenshot`, iPhone 18 Pro simulator, iOS 27) over 42 lines of busy text, luminance mean / sd inside the panel: the native UIPopoverPresentationController is 238.5 / 2.5 light and 65.6 / 4.8 dark; Exact's default surface (UIGlassEffect .regular) is 238.2 / 3.0 and 65.3 / 5.7, the same brightness with about 20% more of the text behind showing through. Every public route was tried against a band of 2 levels and 10% of the sd: SwiftUI's `glassEffect` (.regular, .regular.interactive(): the same numbers as UIKit's; .clear: 226.9 / 35.4); UIGlassEffect's isInteractive (no change at rest) and .clear (224.1 / 36.7); a full UIBlurEffect material under the glass (ultraThin 239.5 / 0.5 and 76.9 / 0.9, thin, systemMaterial, thick: the text erased, dark's mean moved) or alone (thin 229.0 / 0.6 and 46.4 / 0.6); a glass tint (systemBackground at 25%: 247.5 / 48.9). Only a thin blur at alpha 0.1–0.2 under the glass fits (0.2: 239.3 / 2.4 and 66.3 / 4.6), and Apple's guidance is to avoid an effect view's alpha below 1 (it may render wrongly in snapshots and animation). The native surface is a private SwiftUI GlassPopoverView (`_UIPopoverGlassBackground`) with no public knob. Hosting a real UIPopoverPresentationController matches by definition; D2's painted path doesn't take it, because the painted top layer is the host's own: its placement (`position-area`, `PositionArea.swift`), its nested popovers' stack, its light dismiss and the frames it reports to the runner (`openTopLayer`) are the host's, the same on iOS and the Mac, and a UIKit popover would take placement and dismissal from them.
- **The Bluesky clone's symbol icons lose their tints when it moves its exact2 pin** (2026-10-23, found checking x2/path-icons' Mac tint). Since 130e009940 an Apple `symbol:` image draws in its computed `color` and ignores `-exact-tint-color` (`docs/agent-pitfalls.md`). The clone at `~/.tuft/projects/bluesky-exact2-v2` writes `-exact-tint-color` 136 times, many on `symbol:` images (`white_100`, `primary_500`, `contrast_700`, … in `drawer.contract`, `graph.contract`), with no `color`. It builds against `~/.tuft/projects/exact2-bsky` at 02dd4316e2 (2026-10-18), which predates 130e009940, so its builds are right today; on a newer exact2 those icons draw in the text colour. Before bumping the pin, migrate each to `color=`. The lint theme2 ruled (a warning for `-exact-tint-color` on a `symbol:` image, naming `color=`) will flag them all.
- **The agent's `fail fetch` should match a long poll's individual requests** (2026-10-23, LLP 1016.000 D8; theme2's ruling Q4 of 2026-10-22). A fault armed for a URL is taken only by a request that isn't a stream (`host/web/http-body.js` `takeFault`; `runner/src/runner/faults.rs` `fault_dispatch` on the other hosts, LLP 1103 D5), so a long poll's backoff and `retrying` can't be driven end to end from the agent: the tests use stand-ins (`host/apple/src/executor_longpoll_tests.rs`, `host/web/http-body.test.mjs`, `host/web-js/longpoll.test.mjs`). Let each of a long poll's asks take a matching fault as a network failure, then test a backoff and its reset through `scripts/agent.mjs`.
- **A design's token count is not capped** (2026-10-23, theme2's Q3 ruling on the checker bound). The checker bounds each value (`tamber-value-size`, `tamber-value-depth`) and each length's residual (`tamber-length-size`), but each `set-token`/`add-token` may add a token, and a check is linear in the design (but for the three walks of the PRIORITY below), so a paired client can grow the design write by write. The rate is the request limits' to bound: R3's relay limits and the serve doors' (`tamber_serve.rs` LINE_LIMIT, `tamber-server.mjs` BODY_LIMIT); a count cap comes only if those prove short.
- **Re-import's per-dial checks are dials x check** (2026-10-23, what stays of the PRIORITY "checker work in token, param and dial counts" once the rest landed; theme2's ruling (5)). `export_dials.rs` `dials` and `marks` apply each dial change and check the design again, so a re-import's cost is the changed dials times a check. Dials grow only on disk (no operation adds one), so D is the developer's own design; charging the budget would refuse large legitimate designs. Fold all the dials' changes once and diff per dial, if a real design shows the cost.
- **Dial influence on overlapping closures is dials x dependents** (2026-10-26, Grok's round 1 on the counts). Each dial's probes refold the tokens that read it or name one that does; where those closures overlap (token k reading dial k and naming token k-1) the work is the sum of the closures, about n^2/2 folds: 500 dials and tokens 1.5 s, 1,000 6.7 s, 2,000 50 s in a release build, times the tuples. The answer itself (each token's dials) can be that large. Dials grow only on disk: no client operation adds one (`tamber/tests/it/limits_counts.rs` no_client_operation_adds_a_dial; a `restore` is no client's to send, `tamber_ops.rs` parse_ops), and a design asked about again unchanged is answered from the last few checked (`tamber/src/checked.rs`), so a client can't make the server pay it per request. The clone has 0 dials and Harmony 0 (the clone's `contract tamber check` about 2 s, no influence to speak of). Pick it up when a real design passes about 500 overlapping dials, or when any client path adds dials. An incremental influence (each token's dials from its names' dials, probing only where a read could be masked) is its own design.
- **A batch's blame rounds re-check the whole design** (2026-10-23, theme2's ruling (4) on the PRIORITY). Each round of `export_batch.rs` `take` is a full check, charged to the re-import's budget, so a chain of refusals each exposing the next is refused in the budget's words (nothing applied). An incremental re-check of only the reverted tokens' dependents would answer such a chain exactly and in bounded time: its own design (an incremental check API) and review.
- **A popover under a registered content region is laid out in the region, not the viewport** (2026-10-23, stage 14 B, theme2 09:54 fallback (b)). Every other top-layer box is laid out in a block the kernel implies, the viewport (`Kernel::imply_blocks`, `kernel/src/kernel/block.rs`); one under a registered region's owner keeps main's in-region absolute layout, in the region's trial, so a `width: 50%` popover there is half the owner, not half the viewport. Repro: `kernel/tests/it/content_region/top_layer.rs` `a_popover_under_a_region_stays_in_its_trial` (200 in a 400 owner; 400 of 800 once the region is gone). The kernel half of the full rule was built and tested in 5f7b1d62bb and kept through a3bf371b56 (`region/tree.rs` `Derived::build` and `frames` skip a block's subtree, `region/state.rs` `holds_absolute` skips it, `lay_out_blocks` after `compute_region_layout`; restore those with the region condition in `imply_blocks` removed). What stopped it: the Apple native region (`host/apple/src/content_region/host.rs:400`) captures every node of the content branch, so publication then fails "native publication membership mismatch". Finishing it: the capture skips a block's subtree, `native_protected_id` stops at a block root, and Swift attaches the popover under its natively presented row (the capture sends that row's children without it) for MenusIOS's lift; measured at 40-80 lines of Swift plus a native-region hosted test on iOS and the Mac, about half a day. No app has a popover in a region today (markdown-stress and the Linux stress path register regions).
- **A pull to refresh inserting two rows above 330 still makes three frames late on iOS** (2026-10-26, r22 and r24 inbox). r24's inbox, a plain `list` of 330 swipe rows whose `refreshing` ends a frame or two after the pull, had UIKit's control fire again in the same held pull (up to seven inserts a pull, 8 to 11 late frames); a control now ends only when the finger lifts (`ScrollViewIOS.swift`), and a row the insert only moved keeps its swipe row unresolved (`SwipeActionsHost.sync`'s `reshaped`). What is left, three late frames a pull (load 50 to 110; four before 2026-10-27): the large title's scroller no longer reports the pull's stretch of its safe area as a cover (`NavigationHost.stretched`: each frame of a pull had laid the page out again and synced the bar, 5 to 20 ms each, and left the inset 60 pt too large after it), and the text scans visit only what is near each scroller (`TextIndexIOS.swift`). The insert's frame is still 45 to 60 ms of main thread: the batch arrives inside UIKit's refresh event, beside the control's own state change (`_snappingMagic`, ~18 ms); `NavigationHost.sync`'s layout of the bar for the changed subtitle and Refresh enabled again (~20 ms, all UIKit's: `_UIButtonBarButton` configuration and the bar's SwiftUI); the rows' frames ~2 ms. A frame next to it is late with the main thread idle; it is not the moved rows' commit: with the moves of rows two ports away skipped (an experiment) it stays, and the insert's frame was ~10 ms shorter. Earlier, on r22's grouped list: Longest frame per pull ~50 ms, the main thread's own: of ~27 ms in `Presenter.apply` for the insert (Time Profiler, load 60-90), the navigation sync's layout of the bar after Refresh is enabled again ~5 (UIKit reconfiguring the bar button), the pixel grid's walk of each moved row's subtree ~3 (every row has a `frame` op; its children keep their drawn frames, only their absolute origins move), UIKit's diffable apply ~3, `focusedNode` asking all ~5,000 views whether each is first responder ~1, `ContextMenuHost.sync` reading `contextPopover` of every row ~1. A row's `y` moving under an insert reaches the host as 330 `frame` ops; a grid kept relative to the parent, or origins brought up to date when read, would make the walk lazy. Measure with the feel probe's `pull-top`, or the feel recorder over a few pulls with Time Profiler attached. r27's inbox (a grouped list, `refreshing` while a write is pending): one to four late frames a pull, 60 to 135 ms late, the same in r27's build and after `scroll-r27`, nearly all main queue (the insert's batch) and UIKit.
- **A grouped list builds its rows off the screen** (2026-10-23, LLP 1141.001 D13). Hackers' feed (60 posts in a `list appearance="auto"`) keeps 47 rows' views hidden at rest: 1,005 of its 1,562 layers; the D13 fixture grows 5.9 MB from 12 rows to 60. LLP 1084 D1 builds every row of a grouped list and leaves a long feed to a virtualized collection, which UIKit does not draw as cells, so a builder wanting native rows takes the grouped list. Deciding it amends D1: build a custom row's views only near its cell, or draw a virtualized collection's rows as cells. The swipe actions' buttons are built hidden at rest too, 3 layers a row, and could be built when a swipe projects them.
- **Reproduce: a Day 2 tap that did not take** (2026-10-23, LLP 1141.001 D12; GPT's React Conf Exact port, `~/ports/react-conf/runs/1g-exact`, light and dark at the largest size). Tapping the day picker's "Day 2" left Day 1's list and the large title showing; the Opus build of the same brief took the tap. Drive with the port's journey (`~/ports/react-conf/flows/journey.yaml` step 4) and read `logs`. Checked 2026-10-23 on a scratch day picker (a `radiogroup` iOS draws as a segmented control, sticky under a large title): a tap takes at rest and once pinned; one made while the scroller is still decelerating only stops it, as UIKit's does. The port's picker scrolled away under the bar until d69a50fd8e, which would have put its tap elsewhere; drive the journey again on current main.
- **Reproduce: the device's zone prints "GMT (Local)" in an Exact app on iOS** (2026-10-23, LLP 1141.001 D12; GPT's React Conf Exact port), where SwiftUI prints "GMT-07:00 (Local)" on the same simulator. Either `Intl`'s long or offset zone name on Apple hosts or the device zone the runtime reads. Read 2026-10-23: under the driver the session's zone is `EXACT_AGENT_TIME_ZONE`, else UTC (`SessionLaunch.swift`), for deterministic drives; outside it, the device's (`TimeZone.current`). So a driven Exact build prints GMT where a SwiftUI build on the same simulator prints the device's. A grader's journey that compares them should set `EXACT_AGENT_TIME_ZONE` to the simulator's zone; not a tell a person sees.
- **A release drive that checks a masked SVG image's pixels** (2026-10-23, LLP 1141.001 D1's lasting check). The bake now lists the SVG island module for a bundled `.svg` with a `mask` or `filter` (`asset_islands`, `bake/src/receipt.rs`), and the unit test covers the receipt. Nothing yet drives a release build that shows one, so a regression in the host's loader or the bundle's layout would show only in a port. Verified once by hand: `apps/hello` with React Conf's `gold-revenue-cat.svg` and `gold-redwood.svg`, `build.mjs --ios hello --release`, `Frameworks/libexact_svg.dylib`, both logos drawn. Needs a human's go-ahead (a new check): an app under `apps/` with such an image and a `smoke.mjs` step.
- **An app's iOS and macOS builds rebuild each other's JS host crates** (2026-10-23, found measuring LLP 1141.001 D2). `host/apple/build.mjs` gives an iOS build's cargo `HOST_CXXFLAGS` (`-isysroot` the Mac SDK, ~713) and a macOS build none, and the build scripts of `exact-js` and `ibex2` record it (Cargo: `EnvVarChanged { name: "HOST_CXXFLAGS" }`). Both builds share `target/host-dev`'s host units, so each build after the other compiles `ibex2`, `ibex2-sqlite`, `exact-js`, `exact-js-bake` and the app crate again: Weatherlight `--ios --no-install` after a macOS build, cargo 20.1 s against 4.5 s. Giving the macOS build the same value would end it.
- **`ElementScrollTests` (macOS) fails when the display is asleep** (2026-10-23, dtool2's overnight report). On clean `8ba85e2428` with the display awake it passes 9 of 9 alone and in the full run. `testUnsaidAndAutoRevealUseAppKitAnimation` asserts that even a hand-built `NSScrollView`'s `animator()` scroll has intermediate frames, and AppKit's display-linked animation can land at once with no display to drive it: an environment flake, not a main red. Repro: the class alone (`macTests`' class list filtered to `ExactKitTests.ElementScrollTests` in a scratch edit) with the display asleep; rerun with it awake (`caffeinate -u -t 600`) before reporting it.
- **Excord's Android emulator lane** (2026-10-23). The APK builds on expo-build-1000 (`. ~/opt/excord-android.env`, then `bun scripts/agent-android.mjs build excord --apk`), and on its x86_64 emulator the app reached the fixture's READY and op 11, but only with three scratch edits (`~/opt/excord-android-emulator-scratch.diff` there): that machine has no KVM (`sudo usermod -aG kvm <user>` would give it), so the emulator runs unaccelerated and translates the arm64 library, which then never sees the `EXACT_*` variables the reader sets with `Os.setenv` (a JNI `setenv` copy fixes it), the agent's 20 s ready wait in `scripts/agent-stdio.mjs` is too short, and the data module's turns run 20 times over the 100 ms budget. With KVM, the `setenv` copy and a longer ready wait may be all a drive needs.
- **Android's TLS trusts the compiled-in roots, not the phone's** (2026-10-23). ibex2's rustls transports (`websocket.rs`, `rustls_http.rs`) ask `rustls-native-certs`, which on Android looks only where `openssl-probe` does and finds nothing, so they fall back to `webpki-roots`: public sites verify, but a user or enterprise CA and Android's own root updates are ignored. `rustls-platform-verifier` asks Android's trust manager.
- **Excord's "a send while the list is still moving lands at the live end" fails now and then in the whole web run** (2026-10-25): once in about eight runs of `agent.mjs web --app excord --test`, `anchor` is still a history id after the send; alone it passed five of five. It drags with a real 60 ms fling (`tap "transcript" drag 0 500 over 60`), so the scroll's settling time races the send under the suite's load.
- **Excord's "paging continues while the pin request is out" test fails about half its runs on the web** (2026-10-23, also on main before Excord's sign-in): `win.firstId` stops a page short. Run it alone six times to see it.
- **The agent can't drive a drag into the iOS software keyboard, so the keyboard following a finger isn't testable** (2026-10-23, Harmony's transcript fix f7e0fce73f). A drag must end inside the viewport, and with the keyboard up the viewport stops at its top: `scripts/agent-drag.mjs:98` refuses the end, and so does the touch runner's own check in `host/apple/touches.mjs:451` (against the aim's `viewport`, `TouchIOS.swift` `aimed`). A finger that reaches the keyboard is the whole of `keyboardDismissMode` `interactive` (LLP 1115 D9.1), so neither the default nor an authored `interactive` can be pictured, and an `on-drag` regression (the keyboard gone in one frame as a scroll starts) only shows as the keyboard's absence after a drag that never reached it. The check for f7e0fce73f lifted both bounds in a scratch edit: held there, `keyboard.top` was 728.67 with the finger at 728.5 and `keyboard.interactive` true. Planned shape: an opt-in end, `tap <target> drag <dx> <dy> … into keyboard` (the test step's `into: "keyboard"`), on iOS under `--touch platform` only, refused unless the keyboard is up at the press; the start stays inside the viewport, and the end may go past the viewport's bottom down to the screen's (the aim's `screen.h`, less the bottom safe area), both bounds taking the word. `during "state"` then reads `keyboard.top` against the finger. It spans the driver's parser (`scripts/agent.mjs`, at its 1,500-line cap: move code out first), `dragArguments`, the authored-test grammar (`contract/cli/src/tests_json.rs` and the step parser) with `scripts/agent-test.mjs`, the two bounds, and a Harmony test (type, drag into the keyboard holding, `keyboard.top` follows; a short drag above it leaves the keyboard up).
- **Desktop processes, after stage 1** (2026-10-23, LLP 1133.007 §17). (1) A Rust source's `fs.flock` is refused: its storage has no runtime to hold a lock (`data/host/src/native.rs`); give it an owner whose end releases it when a consumer needs one. (2) Linux's `fork.rs` path (death signal, `close_range`, `/proc` members) is compiled, not run: drive the fixture on a Linux machine before Linux leaves provisional. (3) D5's Nushell form is untested. (4) No agent operation swaps a native app's plan, so a plan swap with a live child is covered by `executor_process_real_tests.rs` alone. (5) Stage 2, the secret field.
- **Desktop processes: a leader's pid can be reused while its group is signalled** (2026-10-28, LLP 1133.007 D9, review of #968). The waiter reaps the leader with `waitpid` as soon as it exits (`executor_process_real.rs`), and release, `kill` and the escalation then signal the group by that id; if every member has ended, the id can name a new group. Waiting with `WNOWAIT` would keep the zombie holding the id until the supervisor is done, but `group_alive` then sees the zombie as a member, so the escalation and the drain need another test of "ended".
- **Desktop processes: a tool can write a program where `process.spawn` runs one** (2026-10-28, LLP 1133.007 D13, a design question). A tool's `writeFile`, `chmod` or `symlink` into a directory a `process.spawn` line covers is not held to the person rule, so it can change what a person's later spawn runs. Decide in D13 whether such writes need the app's origin.
- **Desktop processes: after a crash, a leaderless group in a shared session survives** (2026-10-28, LLP 1133.007 §10 stage 1, r2 #1, unmet there). With the leader gone, the next launch ends a recorded group only when the app led its session; a Mac app launchd starts is in session 1, and one started from a terminal shares the shell's, so a grandchild that outlived its leader is left. Meeting it needs a mark on each member the next launch can read: start each child in a session of its own (`setsid`, which loses the terminal for a CLI child) and record that session, or record every member's pid and start time as it appears (a per-group watch), or on Linux a cgroup per child.
- **`__exact_gate_decode` goes when `VideoDecoder` comes** (2026-10-23, LLP 1133.003 §15 stage 0). The throughput gate's stub decode is a global under the agent only, natively (`js/src/binary.js`, installed by `js/src/prelude.js`; bytes door op 8, `js/src/crypto.rs`) and on the web JS target (`host/web-js/agent.js`), called by `apps/stream-fixture/app.ts`. Stage 1 (the web) and stage 2 (Apple) replace it with `@exact/webcodecs`'s `VideoDecoder.decode`; delete the global, op 8 and the fixture's declaration then, and point the fixture and `gate.mjs` at the module's names. Until then a native production binary launched with `EXACT_AGENT=1` has the stub too: the runtime knows the agent flag, not the build's trust.
- **Web: a narrow sheet bar keeps both long names, where iOS folds the second into "•••"** (2026-10-22, LLP 1116.020 D2). On iOS 27, a bar whose items don't fit keeps the first whole, folds the next into a "•••" menu item and hides the title (measured, two 23-character titles on a 402-point bar). The web ends each word in an ellipsis. Its title is one clipped line since 2026-10-23 (`neutral.css`), so with no room it is hidden as UIKit's is, instead of spilling over the button beside it. Whether the web folds a bar's items into a menu is LLP 1116.020's call.
- **Android: library-gate's slot-rendered once missed two markers' glyph change** (2026-10-22, the s13c gate's stage 12 rerun, theme2 23:03). sample-cf-near and sample-bi-dot read "its pixels are the same with both glyphs" (26 of 28) on the x2-android emulator (swiftshader GPU, headless, under the gate's other hosts' drives and a release-identity build); run alone right after, 28 of 28, and the s13c profile's run of the same cells 28 of 28. Likely the marker's tap landing before the second shot; a wait for the glyph's re-render before the shot would end it.
- **The top layer as a computed-style default, (B)** (2026-10-22, theme2 10:42). How a box is positioned for layout is one accessor today: `style::top_layer::layout_position` in the kernel (`of` over rows and props), `NodeRef::layout_position` on the Rust hosts, `NodeView.layoutPosition` in Swift, with `scripts/position-reads.test.mjs` holding every layout read to it. (B) would make the rule part of the computed style instead: a structural UA default in `arena/defaults.rs` (`structural_starts`) giving a popover `position: absolute` unless its author wrote one, so `effective_style` and what the kernel publishes from it say absolute. The accessor is the seam: (B) changes its body and the allowlist, not its callers. Owed with it: the rows sent to hosts would carry the default, so the web export must skip it to keep the browser's UA `fixed`, and own-style readers (`arena.style`) need the same audit. Kernel change: 3 rounds. With it, a compile-time guard in place of `scripts/position-reads.test.mjs`'s source scan (theme2 12:59): the authored row reachable only through a named accessor, so no read of it compiles elsewhere.
- **The terminal, Linux and Windows place a popover without `position-area`'s region** (2026-10-25; LLP 1021 D2, which iOS and the Mac now follow as Chrome does: `PositionArea.place`, `Kernel::measure_block`, `BlockAxis::Region`). The terminal places a top-layer box by its insets in the viewport's block (`Kernel::top_layer_origin`, host/terminal/src/paint.rs), and Linux and Windows place a popover by its `position-area` against its invoker (`host/linux/src/presenter/top/area.rs`) but lay it out in the viewport's block, so a width-less popover there is the viewport's fit-content where the web's is its option's region's (host/web/tests/position-area-region.test.mjs has Chrome's table). To size the box as the web does, the same rule is there to take: measure each option in its region with `measure_block` (a `Region` block, fit-content with min-content winning), take the first whose margin box fits its region, and give that region as the box's block.
- **A painted popover's `flip-start` exchanges its margins, not its width and height** (2026-10-25; LLP 1021 D2, theme2's sign-off of iosfix's region sizing). CSS's `flip-start` swaps the sizing properties across the diagonal too (css-anchor-position-1, try tactics). `PositionArea.place` flips the margins the layout resolved but the kernel lays the box out with its authored width, height and margins, so under `flip-start` the border box is the one its region gives with those (an auto width fit-content in the region less its authored side margins, not the flipped ones). To close it, the told block would carry the tactic and the kernel's `apply` would exchange the sizing rows and margins for the trial and the layout alike.
- **A painted popover's options start again when its size changes** (2026-10-25; LLP 1021 D2, theme2's sign-off). `PositionArea.place`, like `origin` before it, resets the remembered option when the box's size in the whole block changes (its content or authored size), so a box that flipped while wide returns to its base once that fits. CSS keeps the last successful option across such a change; its fallback-sensitive changes are the `position` value, the `position-try` longhands, the `@position-try` rules and the box no longer generating a box (css-anchor-position-1, statefulness). To follow CSS, drop the size key and keep the option while it fits. A three-round attempt (2026-11-12) dropped size from the remembered option's key and reset it on hide and reveal instead; its reviews found two paths where the reset is missed: a manual macOS popover kept open while an ancestor is `display: none` (`MenusMac.sync`), which keeps a flip the wider viewport no longer needs; and on iOS a popover in a dialog sheet, whose ancestry walk follows UIKit's sheet hierarchy past the dialog's hidden wrapper (`MenusIOS.swift`).
- **A popover's trial measure copies the whole page's state** (2026-10-25; LLP 1021 D2, `Kernel::measure_block`; the lead and theme2). Each measure copies the arena and the engine tree, so its cost follows the page, not the popover: in a release bench one measure is 0.06 ms at 500 nodes, 0.46 ms at 3,000 (arena copy 0.15, engine copy 0.31) and 1.0 ms at 10,000 (engine copy 1.1); on Harmony's #general (about 470 nodes, iOS 27 simulator) a placement's five measures were 0.7–1.5 ms. Painted popovers keep their measures until the next batch (`PositionArea.MeasureCache`), so an open pays about one placement's. The way out: run the trial on the live state and restore the popover subtree's engine nodes (style, cache, layout) and arena columns after it, so its cost follows the subtree. Take it only if an app still spends more than 16 ms an open with the cache. Conditions (theme2): the restore runs on every exit path (drop- or guard-based, so an early return or a panic restores), the purity digest test covers a trial that exits early, and it gets 3 rounds.
- **A computed `-exact-layout-transition` on the web JS target is unset** (2026-10-21, GitHub #809). A bound row writes the kernel's value for each string its code names (`style.rs` `layout_transitions`, read from css.rs's own `layout_transition_css`), which covers a reduced-motion switch (`calm ? "none" : "260ms ease"`); lowering refuses a literal the kernel would. A string the code builds (`"${ms}ms ease"`, or a named one written another way, such as `"260ms  ease"`) is unset with a journal line saying the JS target writes only the values the code names, where the wasm host and native hosts parse it. The fix is the transition grammar in JS (`exact_motion::Transitions::parse` and `matching(Layout)`, to the presence module's `<ms> <delay> <easing>`), tested against the kernel over the cases paint_tests.rs's `bound_transition_stacking_matches_kernel` uses. A row of a list or match whose own value turns a curve on (an item's field or its index, not state outside it) in the commit that moves it jumps on this target where wasm slides it: `lt` asks the binding before the tree update, when the region's item and index signals still hold the last commit's values (`each`, `match` set them in `flush`); a gain read after them needs the row's box from before the update.
- **A Release build after a Contract edit that changes the archive's linked capabilities compiles the whole Rust world again under fat LTO** (2026-10-21, euxy port 21). A plain Contract edit's `ios --release` is ~8.5 s (the plan and bytecode are linked outside the archive, `scripts/linked-plan.mjs`). An edit that adds a capability (a gradient on a row, measured: 57 s, cargo 48.5 s; port 21's 84 s release was one) changes the bake's `linked.rs` (`EXACT_LINKED`, `host/apple/src/link.rs` `Links`), so Cargo compiles the archive crate and fat LTO runs over everything. Making it seconds means choosing the linked set at link time: the archive built once with every capability's entry exported, a per-plan object outside the LTO unit holding the table of the ones the plan uses, and the linker's dead strip removing the rest. Measure the binary, TTI and idle footprint against today's before taking it (LLP 1047.001 D2 decides what ships).
- **An `agent ios` drive still launches its app, ~0.5 s of its ~3 s** (2026-10-21). The rest is the window capture's three `simctl io` reads (~1.3 s; the touch runner's `XCUIScreen.main.screenshot()` takes ~0.12 s when it is up, measured), the app's own drawing (~0.45 s, mostly `settleMotion`'s quiet window) and the build check. A drive could find the next app already launched: once a drive's app has ended, a kept process launches another with the same environment (plan, facts, store and its fresh flag; never under `--touch platform` or platform timing), and the next drive with that environment connects to it instead. Its store's lock and the fresh store's emptying at boot have to move to that process, and a launch by any other drive on the simulator has to retire it. LLP 1012.000 proposes the resident driver this would sit beside.
- **iOS: a custom grouped row's leading symbol at accessibility sizes** (2026-10-21, the Harmony custom-row fix's round 3). A custom row's leading symbol and title follow UIKit's cell at every text size (`-exact-list-symbol-*` ramps; at the accessibility sizes `listSymbolPoints` in `Affordances.swift`, 2026-10-23). What is left: at the accessibility sizes UIKit wraps a title's later lines back under the symbol to the margin, where a slot beside the text keeps every line inset. That needs the text to flow around the symbol.
  2026-10-22 (lane q1022/c2): reproduced and parked: the retained grouped-rtl fixture shows a standard native row staying LTR beside a custom row laid out RTL (physical left padding and symbol margins from the UA sheet); the fixed symbol slot at root font-size 53 is a kernel font-size override, not Dynamic Type.
- **A popover's default surface: two cases it leaves as today** (2026-10-22, theme2 00:54). (1) A popover with no role that a node only later names as its context menu (`contextPopover`) isn't re-checked for the default surface, which shows only in the driver's painted presentation (a person sees UIKit's context menu); a re-check belongs in the presenter's batch before its flush. (2) A conditional class with a surface row on one arm only counts as authored on both arms (the class expands to a written `value`/`none` row), so the other arm gets no default surface; one plan boolean can't follow the arm, a bound prop could.
- **Web: exact2's menu rule takes a row as it is at the click** (2026-10-22, theme2 02:54, option B). `host/web/menu-rows.js` intercepts only a menu row that names a popover when it's clicked, and acts after the row's press on the popover it names then; every other row keeps HTML's own activation. So a press that retargets its row from a popover to a dialog's command still opens the popover (the click-time target), and one that retargets it from a dialog's command to a popover leaves that popover nested in the menu, closing with it. Replaying every command after the press instead (option A) would re-implement HTML's command dispatch, which its re-checks kept finding gaps in. The native hosts resolve a row when it's chosen.
- **Web: a page built ahead of time shows a pushed route's Back only once the navigation glue runs** (2026-10-21, LLP 1116.000 D4). `document.rs` mirrors the projection's route visibility but not the bar's Back, which is the header's shadow root's, nor the header-held Back control it does not show, so the Back appears, and that control goes, at hydration. A declarative shadow root (`<template shadowrootmode>`) with the Back in it, adopted by `appBarBack`, and the control's mark would show them as the glue will. A three-round attempt (2026-11-12, `host/web/src/document_back.rs`, 1,156 lines with tests) projected the Back and adopted it at hydration; its reviews left two cases where projection and live navigation still differ: a disabled Back under a `navigationBack` with an `aria-busy=true` ancestor, which `routes.js:487` exempts and projection hides; and a header Back whose label is Markdown (`text "**Done**" markup="markdown"`), projected as the literal source where hydration shows the rendered words. Seen there, older: a `fullscreen` route with a transparent background hides the route under it in projection and not live (`document_before.rs:133`).
- **A `sent` reader off screen still costs euxy 0.7-0.9% CPU while it plays** (2026-10-21, euxy port 18, iPhone 17 simulator, Release, no MIDI device; `ps` over 20 s, interleaved with builds before and after). A reader that declares `exactMIDI().sent` is answered at each message's time (LLP 1125 D6): about sixteen commits a second for the default pattern, each changing no node while the activity log is not shown. It was 2.3-2.6% before `Frames.tick` skipped their presenter pass, then 1.2-1.45%; the display link no longer runs for them (`timersQuiet`) and the host no longer lays them out (`inert_layout`). With `sent` left out of the shape, 0.05%. What is left is a timer's wake and a commit per message: the runner's settle and the host's turn. Reaching 0.1% needs fewer commits, which D6 decides: answer `sent` at most every 250 ms or so (four commits a second), or only while something mounted reads it.
- **A derive over `sent` that nothing shows costs euxy port 21 2.9% CPU while it plays** (2026-10-21, iPhone 17 simulator, Release, medians of 5; port 20, which reads `sent` only in the shown log, 0.5%). Its activity log derive (`logRows`: the 128 messages formatted and sorted) is evaluated at every message's commit though the log is not shown, about 118,000 VM instructions and 97% of the commit (985 µs in a release bench; 36 µs without it). Settlement evaluates every derive whose inputs changed, read or not, and a derive that traps refuses the commit (LLP 1005 §6; the web JS target's `settle` pulls every derive too), so evaluating only the derives something mounted reads would change what commits: Charlie's ruling. Within the semantics, what is left is the VM's own cost per instruction: `machine.rs`'s `pop_n` and `collected` build each list in a vector and copy it into its shared allocation, `first` allocates a `Some`, and the extent walk measures again each small record a body copies out of a list. `machine.rs` is extracted to Lean (`semantics/vm-extract`), so changing it needs Charon and Aeneas.
- **Text whose weight changes every frame: what painting paragraphs at once still leaves** (2026-10-24; ~/bench/weightbench, medians of three 10 s runs; mode 1 a 13-row poster of ~97 pt type, mode 2 twelve 17 px paragraphs, the weight eased 100 to 1000 and back with a 100 ms rest at each end). `TextRasterizer.ensureUrgent` paints a frame's urgent paragraphs in turn for 2 ms, then the rest at once (`DispatchQueue.concurrentPerform`), because the late frames are the ten after a rest, where the CPU's clock is low and painting in turn took 4.2 of the main thread's 5.4 ms. iPhone 17 Pro Max: body text 35 late frames to 14 (UIKit 3), CPU 546 to 629 ms/s (UIKit 430); poster 10 to 0 (UIKit 10), CPU 527 to 816 (UIKit 526). iPhone 16 Pro Max: poster 29 to 0, CPU 639 to 1,090; body text 31 to 29, CPU 566 to 673. The CPU is each thread making the new font's glyph bitmaps again. Next to measure: a budget tied to the frame's deadline rather than 2 ms, and sharing the glyph bitmaps between the threads.
- **Game pads have not met a real pad** (2026-10-18, LLP 1127.003 §4's hardware half). Every host's adapter is built (web, macOS, iOS, tvOS, Android, Linux evdev, Windows XInput) and the engine is tested, but no physical pad has been driven: none is attached to the Mac that built them. With a pad connected to each device, `bun game/dev.mjs beacons --lan` serves Beacons to a browser and prints Open in native for the Mac and for an iPad or a Pixel on the network: the left stick moves the player, `GamepadSouth` jumps, `GamepadL1` held runs, `GamepadWest` lights a beacon in reach, and the journal (`logs`) says `pad 0 connected standard` and `pad 0 disconnected` on unplugging. On the Mac, an iPad and a Pixel, check each: the delivery the driver reports as recognized, movement, both connection journal lines, focus lost while a button is held (the world releases it, and the pad reports itself when focus returns), and a disconnect while held. Linux needs an Xbox pad (xpad, letters) and a DualSense (positional) at launch: their X and Square are both `GamepadWest`.
- **Android pad readings carry no event time** (2026-10-18, LLP 1127.003's final review). `Pads.kt` sends only the reading (`:44`, `:93`), `Owner.kt` queues it (`:467`) and `canvas/keys.rs` stamps it on arrival (`:33`), so a press and release delivered late together can cross the 200 ms tap/hold boundary. Carry `KeyEvent`'s and `MotionEvent`'s `eventTime` through Kotlin, the owner's queue and JNI into the host's clock, and test a delayed delivery of 150 ms and 210 ms presses. A three-round attempt (2026-11-12) carried `eventTime` through Kotlin, JNI and the engine's queue; its reviews found the timing it has to keep: a release that arrives after a hitch must apply at once rather than at its report time's place in world time (`game/engine/src/sim/queue.rs`, a held button stayed down about 730 ms); a pad report stamped in the future must not hold back later key events (`game/engine/src/sim.rs`); and draining every pad reading in `produce()` reorders it ahead of an earlier touch that moves focus (`Owner.kt`). Report time should feed the tap/hold duration, not the delivery order.
- **`@exact/gamepad` has met no real pad** (2026-10-26). Every registry (Linux evdev `FF_RUMBLE`, XInput, GameController with Core Haptics and `GCDeviceLight`, Android's `VibratorManager` and `LightsManager`) is driven only through injected pads' recorders. Run `packages/gamepad/test/device-checklist.md` on Chrome, a Mac, an iPad, a Pixel, a Linux machine (a `uinput` pad with `FF_RUMBLE` needs no hardware) and the NucBox.
- **`@exact/gamepad`'s shared index and multi-session claims are not driven on Apple or Android** (2026-10-27, LLP 1133.022 stage 2). An injected pad reaches no canvas there (a snapshot `GCController` is never announced; Android's test pad has no `InputDevice`), so that an index names one pad to the canvas and the module is checked on Linux only; two sessions' claims in the sample host (`--host`) and an Android activity remade while the process lives ("Don't keep activities") are not driven either, nor is tvOS compiled with the module: `build.mjs --tvos --no-install beacons-apple` refuses Beacons' bake receipt ("names another target, platform or app").
- **Bluetooth (LLP 1133.022 §17) is accepted and not built** (2026-10-26). The desktop Rust route it rides on is built (D10 item 5); its stages, the Pulse drive and the heart-rate strap's checklist are in the RFC.
- **USB, HID and serial (LLP 1133.037): what is left** (2026-10-27). Android (stage 3: the host's USB broker and usbfs I/O, `SerialManager`); Windows USB over WinUSB; the Rust hosts' plug notifications and URB reaping; macOS HID's per-report blocklist and USB's bulk and interrupt transfers; the seam tests (stage 6); Bench 4 in the sample host; the Windows crates driven on the NucBox. Hardware drives are owed (LLP 1133.020 row 33).
- **The compiler's check of a bundled SVG image, and the icon reader on the parser crate** (2026-10-20, LLP 1011.001 stages 4 and 1). Every host now draws an `.svg` image source (`host/svg-file`; Apple's `RasterImage.decodeSVG`, Linux's `image/svg.rs`), and the `lower-image-svg` warning is retired, so a file the parser refuses or trims (a DOCTYPE entity, an external `image`, a `script`) is known only from the host's log at run time. Stage 4: the compiler parses a bundled `.svg` a literal source names (`contract/lower`, where `icons.rs` already reads asset SVGs) and names what the parser drops. Stage 1's leftover: `icon_svg.rs` onto the crate's tokenizer.
- **Linux and Windows do not read the neutral look's symbol scales or button image gap** (2026-10-20, LLP 1011 §3; LLP 1115.000 D17). The web draws a symbol for an SF Symbol in a 1.2em box (`symbol-scale`), and on a button's face in a 1.5em one (`button-symbol-scale`). Linux lays a symbol out in a box its font size square (`host/linux/src/host.rs:1081-1082`, and `image.rs:237-239` when it syncs an image) and paints it at that size (`paint/svg.rs:140-141`): five sixths of the web's size, and two thirds on a button's face. Nor does it read `button-image-gap`, the 8 px the web puts between a button's image and title: it puts a space in the title's type there (`paint/button.rs:308-315`, whose comment says the page does). Windows paints with Linux's painter (`host/windows/Cargo.toml`).
- **One-colour text rasters on the Mac, and wide lines' rasters** (2026-10-20, after iOS's alpha-only rasters). (1) iOS and tvOS show eligible single-colour SDR paragraphs as 8-bit alpha coverage with a separately profiled tint through a public template `UIImageView` (`TextCoverage`, LLP 1008 §3). On a 13-row poster of ~97 pt type whose weight changes every frame, painting coverage alone rather than four bytes a pixel cut main-thread samples in 10 s from 7,410 to 3,019 (UIKit: 3,045), measured while a template image showed the coverage. The Mac paints into IOSurfaces (`TextRasterMac.swift`) and still uses four bytes a pixel, on purpose (measured 2026-10-20, weight bench's poster on this Mac, Time Profiler 10 s): its rasters run on workers through Core Animation's CG queue, where the glyph copy that cost iOS's main thread 65% (`CGSColorMaskCopyARGB8888`) is 2.2% of worker samples; the main thread's raster cost is IOSurface creation and registration and the commit. AppKit's public tint (a template image in an `NSImageView` with `contentTintColor`, shown with a multiply colour and no mask, and honoured by `cacheDisplay` and `render(in:)`) works only for an image view in the view tree, never its layer alone (probe: ~/bench/weightbench/a8mac), and shows a `CGImage`: a subview per paragraph, and the main-thread copy at commit that the IOSurface path exists to avoid. Not worth it unless a Mac profile shows the glyph copy on the main thread. (2) A raster is cut to a band vertically for a tall paragraph, never horizontally: a nowrap line wider than what shows (a marquee's) is painted whole every time it changes. Cutting it to the visible width needs the visible rect under a running animation, which `Presenter.textBand` reads from the model layer, so a row a keyframe animation slides would show blank past its cut. Not built: since (1) the weight bench's poster, rows about five times the screen's width, matches UIKit (119 fps, about 10 late frames in 10 s, 4.3 against 4.2 ms of main-thread work a frame), and a `UILabel`'s backing store also covers its whole width. The rows that would gain are the ones a keyframe slides, whose cut would have to cover the range the animation sweeps.
- **Files dragged in or pasted on the hosts that take none** (2026-10-20, LLP 1069.010 "Files dropped or pasted"). Web and macOS take `drop`, `dragenter` and `dragleave`; web, macOS and iOS give a paste its `files`. Linux (GTK's `drag-data-received`, `text/uri-list`), Windows (`IDropTarget`, `CF_HDROP`) and Android (`View.OnDragListener`, `ClipData` content URIs) refuse by name and paste text only; iOS's `drop` would be `UIDropInteraction` (iPad drags from Files). Each needs its host's minting of a `doc:` handle for a URL it did not pick.
- **`radius.full` squares a terminal box, so @exact/cards' avatar corner is 999px** (2026-10-20, the stage 12 E follow-up; x2-perf4's round 2). The base scale's terminal cell for every radius is 0 (`kernel/tables/schema.json` `_scale`), and the terminal draws a rounded box only for a radius above 0 (`host/terminal/src/paint.rs`), so a pill written `radius.full` gets square corners there where a px radius got rounded ones. `cards.avatar-corner` is `999px` until the terminal draws `full` as rounded (its cell `full`, or the painter reading `RADIUS_FULL`); then it can be `radius.full`, and the clone's 999px corners too. Needs a ruling first (checked 2026-10-24 on fc4fcedd3): LLP 1121 stage 11 B's approved cell forms have `kernel/build/scale.rs` refuse `full` in the terminal column (llp/1121-tamber.rfc.md, "The cell forms"), and `scripts/scale-check.test.mjs` and `contract/cli/tests/it/tamber_serve_base.rs` hold the terminal's radius.full at 0, while LLP 1101 (accepted) draws a positive radius with rounded glyphs. If theme2 admits `full` there, the change is that build check, the schema cell and those tests; the painter needs nothing.
- **The relay in Rust, once the hosted one needs it** (2026-10-20, LLP 1121 §5 stage 10c R3; theme2's 14:34 approval; owner rt1). The relay is one Bun file (`scripts/tamber-relay-server.mjs`): one EXACT-RELAY/1 implementation shared with the connector, an I/O-bound pipe. A Rust relay behind the same protocol buys less memory per socket and no GC pauses; the trigger is measured on the hosted instance: more than a few thousand concurrent streams, or memory per idle connector connection past what the host can hold.
- **A warning when a certificate for a relay account's names appears that this server didn't ask for** (2026-10-20, LLP 1121 §5 stage 10c R2; theme2's plan change 8 and the lead's answer to Q3; owner rt1). With the relay's default domain, its operator controls DNS for the account's names and could get a certificate for them unseen; a server could watch certificate transparency for certificates under `*.<label>.<relay>` whose key isn't its own and warn. That needs a CT search service at runtime (crt.sh, or a commercial monitor), since the logs themselves only offer whole-log scans: a developer's opt-in, naming the service. `--relay-name` with `--relay-dns-hook` (names of their own), the CAA records it prints set (`issue` and `issuewild`) and the names pointed by A/AAAA (no CNAME), already removes the residual, for the CAs that honour CAA (every public one must).

- **Harmony in conform, with a backend of its own** (2026-10-21, the lead's Harmony task; skipped for now, the lane's in-memory web tests cover it). Conform compares the JS target with the wasm runner step by step on each app's own data. Harmony's data is a Snapback client: with no backend it shows only the never-synced state, and with one, sync timing makes the two runs differ. Conform also builds an app's Linux crate at `apps/<app>/linux`, where Harmony's is `apps/harmony/app/linux`. Doing it means a conform mode that starts `snapback4 dev --memory` per run (as `scripts/memory-backend-test.mjs` does, the server proven its own and the build's grants checked), seeds it with fixed times rather than `seed.mjs`'s now-relative ones, waits each step for the device's sync to settle on both targets, and finds the Linux crate beside the app.
- **The build's real first diagnostic for a write** (2026-10-23, theme2's 09:24 ruling on stage 14 E). The design server's write check judges each row lowering would, with lowering's own checks, but rows it can't type are left out, so where the build refuses one of those first, the check names the build's second refusal (QUEUE's write-check entry). Closing it: the server runs the build's lowering for the proposed write (the design as written, the Contract sources as they stand) and returns its first diagnostic as the refusal, keeping the row check as the fast path that decides whether to run it. A design-server item of its own (its cost per write against the clone's budget is the question).
- **The server's write check: what it still leaves to the build** (2026-10-20, theme2's 14:19 ruling; narrowed by LLP 1121 stage 13 D, 2026-10-21). `contract_lower::rows::check` refuses a write that breaks an element's style row that passed, in the compiler's words, at the row: literal rows and every arm of a literal choice (stage 12), `font`/`font-family`/`font-weight`/`font-style` rows with the node's fonts through `type_tokens::tokens_named` and `fonts::font_use` (D1), computed rows (a name, a template, a choice with a computed arm, a record's field) judged whole where their form gives their type (D2), in the scope of the `for`, `match` or `if` arm around them and through a `let` (stage 14 E, 2026-10-23: the frames pushed by `contract_types`' shared helpers lowering calls too, `frames.rs`), and an `svg` subtree's rows renamed and coerced as lowering does (D3). Still only at the build: a computed row whose form doesn't give its type (a call, an index, a `let` inside another form), and every computed row of a `for` or `match` whose subject is such (both arms); a row that failed before the write; a `style`'s rows wherever one element applying the style is one whose class rows lowering rewrites or judges otherwise first (an SVG element's, a box's `transform`, a grouped list's, a `button`'s, an `audio`'s, a `delete=` row's), chooses it (`class=(c ? A : B)`), or sits under a `for` or `match` the check can't type (a style all of whose users are none of these is judged at each since 2026-10-22, theme2's 02:08 ruling; a write's refusals are said as the build reaches them, but a computed shorthand or `flex`, or a `transition`/`animation` row, the build refuses before them is not among them, so the first said may then be the build's second); a computed shorthand or `flex` (a written one is judged longhand by longhand since 2026-10-22, theme2's ruling on the shorthand plan; a computed one lowering expands at run time into another row set, which the check would have to mirror); `transition`/`animation` rows (their motion tokens the loader writes in before this map is read); a state part's row; a refusal outside a style row; a write that also edits a Contract source; font rows after a font file the build read changed. **The first refusal said** (theme2's 09:24 ruling on stage 14 E): where the build would refuse one of those first (a row the check can't type, a computed shorthand, a motion row), the first refusal the check says is the build's second; every refusal said is still the build's, in its words and place, and none is false (pinned by `tamber_rows_bound::a_row_left_to_the_build_before_a_judged_one_is_the_stated_limit`). **The window before the background build's verdict**: a file whose whole build fails before the write for a reason of its own (an element lowering refuses before its rows, its children never lowered: a positional `svg`, a leaf with children, a grouped list's malformed section, an unknown tag) has its rows left to the build once the background whole build says it fails (`Checker::seen_failed`), but a write in the moments before that verdict can be refused at a row in other words than the build's first refusal. Closing it means the walk sharing every pre-style exit of `prepare_element` (dozens), or the check waiting for the verdict.
- **Fresh macOS game receipts can reject their generated declarations** (2026-10-19, LLP 1132.A-proof-fix round 1). A macOS-first cold build on parent `2fdf7e077` refuses `.shells/keys.json` and `.shells/surfaces.json` as stale against its just-built Apple receipt. The refusal persists on cached ordinary and collecting runs, including after Linux/web proofs. Retained evidence: `.lane/r1-parent-cold-macos/`, `.lane/r1-parent-matrix-macos/` and `.lane/r1-parent-collecting-macos/` in the 1132.A-first-hour worktree; `.lane/r1-parent-source-check.json` verifies unchanged parent product sources. Fresh Linux/web/macOS edit-lifetime matrices pass on both HEAD and the parent. Qualify the generated declarations before issuing a cold Apple receipt.
- **Several native copies, and `navigate` on the native hosts** (2026-10-19, LLP 1122 T7; theme2's Q4 ruling). The design tool's grid of live copies is web copies of the dev page, each pinned to one mode; a native build stays the single connected build, pinned as before. Several simulators (a boot, memory and a runner slot each) would show the native rendering of every mode at once, and need each native host to take `navigate {seq, location}` through its own router (a deep link in place) and report `location` in its status, as the web pages do (docs/tamber-protocol.md, the build channel). Until then a native build lacks the `navigate` capability, and the server answers it 409 `unsupported`.
- **iOS: a root without tabs that shows one fixed route still gets a navigation controller** (2026-10-19). A tab follows its panel's structure (LLP 1075.003 §3.7): a tab whose panel can hold more than one route, or whose route can show a header, is a navigation controller, and one that shows one fixed route with no header is a plain view controller, as UIKit allows (`Runner::panels_need_navigation`). A root without tabs is always a `UINavigationController` (`installPrimary`), whose view in a window lays out the SwiftUI floating bar host. Its cost is unsettled. In euxy port 12 (Release, a fresh iPhone 17 simulator, interleaved launches, each footprint after `simctl erase`), a barless tab measured 25,010 KB in a navigation controller against 23,986 KB in a plain container (`footprint`, medians of 5), and `EUXY_TTI` 1,234.5 against 1,223 ms (medians of 10). A UIKit-only app on iOS 27.0 (an iPhone 18 Pro simulator, six tabs each selected once, medians of 5) measures navigation controllers with their bars hidden at what plain controllers cost (24,754 against 24,770 KB), and the shown bars at about 2 MB more (26,754 KB). Measure the root case in Exact before building it. Reading the same plan fact (`panels_need_navigation`) for the root's own routes would let a root that shows one fixed route with no header be a plain controller under the primary owner (`placeOwner`, `ownerFrame`, the sheet's presenting controller).
  2026-10-22 (lane q1022/i): an attempt to hold a barless root without a navigation controller (d66c68406d) was withdrawn (8a19f144fb) as unqualified; no change landed.
- **`justify-items` for an absolutely positioned child of a block container.** In-flow sizing and alignment match Chrome (Taffy patch 66). With a positioned 100px block, `justify-items:center`, and a 20px absolute child whose insets are automatic, Chrome 151.0.7922.34 places the child at x=40; the kernel still uses x=0. Update the separate static-position path. `browser_block_justify.tsv` records the remaining mismatch.
- **Library platform inputs not checked** (2026-10-20, LLP 1139 D6, stage 12 C3; theme2's ruling (3)). `lower-library-platform` refuses a library package's `exactDelivery`/`exactSurface` resources and `exactViewport().displayMode`; two inputs D6 lists are limits: an `inject` whose provider reads the host (a provider in the package is itself held to the rule; one outside it is the app's), and a package file named as an `app.json` `host.<platform>.entry` or per-platform variants of one component (no Contract syntax names a host entry from a package). Doing it means following an inject to its provider across files, and reading app.json host entries against package roots.
- **Base names and length tokens inside a Contract literal shadow row** (2026-10-20, LLP 1121 stage 12 B3, theme2's Q1). `box-shadow="0 space.md 4px black"` written on the row, not as a token, is refused, pointing to a shadow token (`x: box-shadow = 0 space.md 4px black`), which reads it. Taking it on the row means the kernel's shadow parse reading theme lengths at run time, each read recorded, and the same per-column check at build as a shadow token's; a literal stays px until an app needs it.
- **A Dynamic Type opt-in for the base scale** (2026-10-19, LLP 1121 stage 11 ruling 6, the lead's assignment to B's first commit). The base scale (`space.*`, `radius.*`, the schema's `scale`) is px (points) in every column and never scales with Dynamic Type, as a measured UIKit inset or corner does not. An app that wants its spacing to follow the text size has no switch for it: an opt-in (a design-level flag, or `rem`-based base values under it) scaling the space steps, never the corners, with a test per host at an accessibility size.
- **A 3,000-token × 64-context design cannot import: share a context's tree** (2026-10-19, iosfix's x2/import-rest; theme2's 19:07 ruling). The budget is calibrated to the isolate (`budget.rs`: `IMPORT` 3 × 2²⁴, `REIMPORT` 3 × 2²³, about 600 and 750 MB), so a design of about 650 tokens over 64 contexts re-imports and about 880 import fresh; 3,000 × 64 is refused with the budget's message (the export inlines every token into every context: 93 MB, 3.4 GB of RSS to re-import whole). The standard route: the DTCG Resolver Module's sets and modifiers can carry a context's differences instead of inlining every token per context, so the export shrinks within the format we already write (no new wire), and re-import reads one shared tree plus each context's differences. Needs its own plan and theme2's ruling: the export's shape (a base set, each modifier context its overrides), what a client sends back, and the budget measured again.
- **Tamber importers: the super-linear paths left behind the isolation** (2026-10-19, LLP 1121 §5 stage 10b E2+E3 review round 5; owner rt1; the lead's 12:31Z ruling). Every import is now planned in a watched process of its own (`scripts/tamber-isolate.mjs`: about 1 GiB, 10 s, a 2 MiB answer, one at a time), so these cost a client its own import, not the server; `tamber/src/budget.rs` is a partial second layer (the DTCG importer and re-import; the CSS importers are bounded by their own caps, iosfix's x2/import-rest). A held re-import's marks still run in the shared serve, on operations the server built. Still to make linear, from Astra's round 5 (`llp/reviews/code-2026-10-19-s10b-e23-r5.astra.md`): generated dotted paths uncharged (`export.rs` `flatten`, `dtcg.rs` `path.join`); composite alias object keys uncharged (`kinds.rs` `inner`); resolver sibling overrides copied uncharged (`dtcg.rs` `deref`) and `deep`'s `a.clone()` charged after; `type_of` uncharged (its walk is linear now, iosfix's x2/import-linear, which also made re-import judge a proposal whole and look tokens up by name). From Grok's round 5 (`…-r5.grok.md`): `subsets` in `export.rs` materializes every subset of many one-value axes (walk combinations, cap axes); `reaches` in `dtcg.rs` per colour token; `deep`'s `token_like` clones the destination before it is charged. Left after round 9 (the lead's 14:09Z review cap; `llp/reviews/code-2026-10-19-s10b-e23-r9.*.md`): an import's per-client count is released when planning ends, not when its hold does (held proposals are capped at 64 and 32 MiB in all, a client below `write` making room only from its own); the design read's 2 s answer leaves its I/O running; the design's identity is the manifest's at the import, not the serve's own target (a rewritten app.json mid-run); the CLI's sources read synchronously before the planner (its own process, no server's); a probe in flight past the next tick could kill without waiting out `ps` (RSS overshoot during one probe); tests for slow snapshot readers, the Linux launch and a large real design, and for the design read's loop (a forced short read, a file growing mid-read, the 2 s deadline: theme2's 21:26 sign-off accepts them untested). (Done: an import stops with its request, its client's revocation or the server's close, leaving the queue at once; the design read to its end; `kept()` capped and never read through a link.)
- **`sortBy` with a computed direction** (2026-10-19, the euxy port's friction). The VM already takes the direction as a run-time bool (`Stdlib::SortBy`), so lowering could compile `dir == "desc"`; what stops it is the semantics, whose `sortDir` (`semantics/Contract/Eval.lean`, `Big.lean`'s `.sortBy` rule, `Lower.lean` and their proofs) reads a literal. Until then the refusal names `dir == "desc" ? sortBy(xs, f, "desc") : sortBy(xs, f)`.
- **Warm Beacons Rust-edit proof budgets** (LLP 1127.001, 2026-10-18): instrumented warm before/after samples were Linux 2.697 / 4.823 s and web 17.861 / 17.933 s, with maximum loads 38.18 / 39.86 and 35.93 / 37.63 respectively (sampled throughout, all below 50). The <3 s / <10 s budgets remain open; the earlier 4.362 / 25.396 s observations remain misses. Reusing the JS target's existing input-checked editor/text-flow products removes repeated Cargo/wasm-opt work: that phase fell from 1.038 to 0.170 s, without changing proof steps. There is no demonstrated full-loop speedup. Web's receipt/build span is 7.256 s (GPU 1.565, host 0.275, host wasm-opt 2.106, bindgen 0.174, input scans 0.402, shared leaves 0.170; the remaining 2.564 is tool/bake/packaging balance). Its proof is 10.518 s, including two browser opens 1.364 s (Chrome 0.846, page ready 0.149), 23 typing steps 6.868 s, 13 settles 0.274 s, other clock steps 0.158 s, taps 0.661 s and screenshots 0.564 s. Nested spans must not be added twice. Linux's receipt/build is 2.244 s (GPU 1.462, scans 0.501), proof 2.403 s; first Play varied from 0.177 to 1.805 s, with no cause established. Profile typing and first Play next; do not weaken the proof or change the budgets without Charlie's amendment.
- **App-supplied highlight ranges on LLP 1045's Markdown editor, for T3 Code's composer** (2026-10-18, LLP 1114.007 r3, Charlie's ruling). T3 Code's composer moves to `textarea markup="markdown"`, which refuses `decorations`; what it needs from app-computed ranges there (a language tag, a mention) is LLP 1045's to design, over that editor's own styling, never a second editor. Chips are LLP 1045.000's inline atoms (accepted 2026-10-23), built in its stages: 0, the TextKit 2 gate, measured 2026-10-23 (its §5.1); 1, crates, Contract, kernel and the web editor and reader, built 2026-10-25; 2, the Apple editor and reader, drawing the pill as the attachment's picture (§10 Q9, 2026-10-24), built 2026-10-25, its VoiceOver reading of atoms ruled as built and declared (§10 Q10, 2026-10-25); 3, the clone's adoption. Left: a `symbol:` icon on the web (an image URL draws) and an image icon on Apple (`symbol:sf/` draws); `atompress` from the Linux, Windows and Android readers, which show the link text; the Apple reader's atoms as elements and keyboard stops and in `state atoms`, and `rangeFrame` over a pill in a macOS region-reader paragraph (64 KB of text, or 16 KB in 256 runs or more, LLP 1072); adjacent atoms wrapping apart on Apple.
- **Paint a textarea's decorations on Android and the terminal** (2026-10-18, LLP 1114.007 r3 D5). Both keep the source and editing and paint nothing; Android as Compose `SpanStyle` colour over the field's `TextFieldValue` without changing its text, the terminal as each cell's colour and underline. Waits for a consumer on either.
- **`text-shadow` in a decoration on native hosts** (2026-10-18, LLP 1114.007 r3 D5). Only the web paints it. Check whether TextKit 2 draws a `.shadow` rendering attribute (iOS, macOS); the Linux field painter has no shadow for a run.
- D2 quiet measurement: three cold `gpu-dev` runs under load 5 with `game/bench/cold-build/probe.py`; wire `keptGameCrates` into `buildBake` if the eligible registry chain is over a quarter (LLP 1132 D2).

- **Water's shafts pass under a lid** (2026-10-19, LLP 1139.002 D4). The shafts are screen space: their source is the surface where the frame sees it, so an opaque lid above the water (hidden behind the surface from below) shades the floor and its caustics but not the shafts. Sampling the sun's shadow cascades at each march step's surface point (binding group 1 in `shafts.wgsl`, one comparison a step) would stop them; measure its cost on a phone first.
- **Game baseline release builds remain dominated by path compilation and LTO.** LLP 1132.A2 measured 902.1 s under load 71–222; the cache-eligible registry dependency chain was 62.6 s (6.9%), so release does not use the registry cache. Measure those path/LTO phases on a quiet machine before choosing the next build change. The web dev producer's profile measurement belongs with LLP 1127.001 D1.
- **Finish dev-server build cancellation.** The resident loop owns both startup build trees. The ordinary JS loop (`host/web-js/dev.mjs`) still installs signal handlers after its first build, and the resident loop's later `hostBuildChild` rebuild receives only a PID-level SIGTERM. A signal after the startup builds but before `startup.handoff(stop)` exits without `killCompiler`, so producers started by `startCompiler()` can survive. Terminate those build trees and exercise shutdown during compilation.
- **A transport-driven timeline, so a playhead needs no re-sync task** (2026-10-18, euxy playing: 9–10% CPU with a frame task, 0.1% with `docs/contract-for-agents.md`'s "Following the transport"). The guide's lights are loops on a clock timeline (LLP 1055.002) whose phase the app sets from `exactTransport()` once per anchor: a gated `task … key=anchor` reads `performanceNow()`, and each light carries a negative delay. What that leaves to the app: a pause shows the head drawn as static nodes (the loops are removed); a one-off change at a beat restarts by alternating two identical `keyframes` names. A timeline whose time is the transport's position (`animation-timeline=transport`, ms along the beat grid, holding while stopped) would remove the task, the delays and the pause path. It adds a value to `animation-timeline`, so it needs Charlie's ruling.
- **Lowering checks an attribute in an `if` arm it can prove is never taken** (2026-10-19, LLP 1121 stage 9 H, theme2 02:15). After a component is inlined with a constant prop, an element under `if symbol != ""` whose caller passes `symbol=""` is still checked, so a value only that dead arm would build (here `symbol:${symbol}` folding to `symbol:`) is refused. Stage 9 H made an empty `symbol:` name mean no symbol, as an empty `sf/` one already did, which covers that case. The general fix would skip value checks in an arm whose condition folds to false. It is broader than it looks, because it would also hide real value errors written there, so it waits for a decision on how dead arms should be reported.
- **History of a template row: a key a node keeps across versions** (2026-10-18, LLP 1121 stage 9 D2, theme2 17:18). `history` and `revert` read a `.contract` file's state rows and a style's own rows by name; a node's own attribute, which `set-row` writes at its place, has no key that survives a commit (lines move, no node id is kept), so a commit of such edits is code: left out of `history`, and `revert` can't invert it (the session's undo still gives the bytes back). A key of the component, the tag path to the node and the attribute's name, refused where ambiguous, would let both read it. A component's `params` lines (stage 9 D3's `add-param` and `remove-param`) are code in history too: their revert needs the template row that reads them, so they wait for that key, and then join by (component, name).
- **Geolocation's options composed across readers on Apple** (LLP 1133.002 D5). Each request writes its own `desiredAccuracy`, `distanceFilter` and `activityType` to the one manager; D5 asks for the finest accuracy, the smallest filter, and `geolocation-options-conflict` for two readers' different `activityType`. Wants the runner to hand the module every live reader's options.
  2026-10-23 (lane q1022/u): Parked on runner and module inputs outside the assigned scope. No source change. D5 requires the options of every live reader, their release and generation transfer. The implementation is packages/geolocation/apple/Geolocation.swift, not the Apple presenter; its request currently changes the single manager. The runner's source-reader/module boundary must deliver the whole active reader set before finest accuracy, sma
- **Weatherlight's sky leaves a frame on Android** (Pixel 10a, Android 16, 2026-10-20). The sky `canvas` has `padding=26` and `background-color="#183e56"`; on Android the surface draws inside the padding, so a 26 px band of that colour frames the sky, where on iOS the sky fills the card to its rounded edge. One host disagrees with the other about the box a canvas surface fills.
- **A package view's props and events are not checked against its declaration** (2026-10-23, LLP 1133.001 D1). The bake reads a package's `views` for its tags, its `displayed` flag and its binding props (`contract/cli/src/package_views.rs`), and passes a placed view's other attributes through as an app module's are: a prop or handler the interface does not declare reaches the view, or nothing, unrefused. Refusing it, as `lower-native-attr` refuses a known name, wants the declaration's `props` and `events` carried to lowering.
- **A data-code module call's handles and argument groups are not tracked** (2026-10-23, LLP 1133.009 D6, D10 items 10 and 12). Its reply reaches its answer outside the runner, which cannot see it dropped, and its arguments cannot be traced to the answer that read them, so a group data code asks for is released only with the whole name (`modules/handles.rs`, `modules/bound.rs`). Wants the data runtimes to report a forgotten answer's module replies.
- **The language model's web create starts a download for any origin** (2026-10-25, found reviewing LLP 1133.027 D16). `packages/language-model/web/index.js`'s `createLanguageModel` applies LLP 1133.016 D5's person's-act rule only on its agent path; in production it calls `LanguageModel.create()` whatever the call's origin and foreground, so the browser's activation check is the only guard, and the runner's admission reads no `download` (`runner/src/runner/modules/admit.rs`). A check of the availability first does not close it, since the browser reads availability again inside `create()` and may download a model evicted in between (LLP 1133.027 D16). The enforceable fix is a top-level `"origin": "app"` and `"foreground": true` on `createLanguageModel`, which narrows LLP 1133.016 D5 and so needs Charlie's ruling; then prove it in production mode over a stand-in `LanguageModel`.
- **Apple's language-model session stays fresh after an app abort** (2026-11-11, LLP 1133.016 D6). `packages/language-model/apple/LanguageModel.swift`'s `end` cancels the response without marking the platform session stale; `LanguageModelApple.swift`'s catch returns before doing so because the response has ended. Invalidate the cache before admitting the next prompt, and verify on Foundation Models that the next prompt replays the aborted input and partial reply.
- **A web language-model prompt can overtake an append** (2026-11-12, LLP 1133.016 D6). `packages/language-model/web/index.js`'s queue holds the session only for a response, so a prompt starts while `platform.append` is pending. Reproduced on main and with the abort fixes over a stand-in whose append was held: append started, prompt started, append finished. Keep the session occupied until the append finishes.
- **A language model's tool handler is not checked at bake** (2026-10-24, LLP 1133.016 D9, stage 0). Handlers are the data module's `tools` export (the stage 0 note says why), and a tool whose name `tools` lacks fails only when the model calls it (`NotFoundError`, told the model). `language-model-tool-handler` would check each literal tool's name against the module's exports, and type the handler's argument from its input shape.
- **The web's Prompt API tool loop is held only by a stand-in** (2026-10-24, LLP 1133.016 D9, stage 1). `packages/language-model/web/index.js` collects a stream's `tool-call` items as the explainer's open loop has them; no shipping browser offers it to test against, and `contextoverflow`'s eviction is not exercised. Run `test/web.mjs`'s checks against a Chrome whose availability reads `tools`.
- **Take LLP 1133.016 D7's measurement on a quiet machine** (2026-10-24, stage 2). On an iPhone simulator under load average ~700 on 10 cores, a scripted reply growing to 4,000 tokens in Agents cost the main thread tens of milliseconds an update (budget 2 ms), most of it rasterising the reply's one growing paragraph (`TextRasterizer.ensure` under `Presenter.paintChangedText`). Repeat it quiet, with the Contract `p` case the stage plan names; if it still fails, the fix is likely rasterising only what changed in a growing paragraph, not a higher poll floor. Also run LLP 1047's probe for the Apple implementation's size.
- **Finish driving @exact/language-model on Android** (2026-10-24, LLP 1133.016 stage 4). On an API 31 emulator (`-read-only -partition-size 6144`, which booted here) `test/drives.mjs android` passes drive 3 only: the others read answers one request late, the reader's 20 s clock wait above. Once that is fixed, rerun it; the fixture's drives 7 and 8 have no Android runner (`test/apple.mjs --agent` is Apple's). ML Kit itself wants a Pixel 9 or later: `test/checklist.md`'s Android part.
- **Run the recording suites' real Apple paths** (2026-10-23, LLP 1133.009 stage 2). This Mac's input answers since 2026-10-28 (a bare `AVAudioEngine` probe reads 48 kHz, and Chromium's leg of `packages/recording/test/web.mjs` runs), but `test/apple.mjs` has still run nowhere: on an iOS simulator CoreSimulator did not answer `simctl create`, and on macOS the build's signing failed (`errSecInternalComponent`) and the microphone needs a person's grant (`--ask`). Unrun with it: the hatch's mixer and `holdsCapture`, a macOS `deviceId`, `apple.formatID`'s ALAC and Opus takes, and the owner's XCTests.
- **The router sweep's wasm-target cases fail** (2026-10-23, `smoke.mjs web`, `host/web/tests/navigation.mjs` through `navigation::browser_session_history_and_published_deep_locations`): "in-document reboot retains the carried history mirror" and the runner's own Back throw `module reload requires a paired generation` (`glue.js` `reload`). Seen in the recorder's web smoke by the package-views lane and the recording lane; the recorder is not in it (the sweep builds its own plans). The same smoke's launch-facts fixture fails now and then with `ReferenceError: exact is not defined`: after a JS page's reload it evaluates `exact.ready` before the page has defined `exact` (`scripts/smoke.mjs`, after `rebooted`), a race of the fixture's own plan, not the app's.
- **Android has no session end for `destroy`** (2026-10-23, LLP 1133.009 D6, D10 item 1). The host lives with its process (`Exact.owner`), so `ExactExtension.destroy` is never called and a recorder's `MediaMuxer.stop()` cannot run at an orderly end. Apple waits a second for each adapter's `destroy` (`ExactExtensions.destroy`).
- **The camera's open ends** (2026-10-23, LLP 1133.008 §13). (1) Geolocation's and the microphone's Android permission histories move onto `ExtensionContext.permission` (D8 item 7), which the camera uses. (2) With the real Apple implementation bound, a screenshot of the viewfinder shows black: the preview layer is not in a view hierarchy's drawing, and §9 asks for a placeholder naming the camera. (3) The photo editor's `takePhoto` tool waits for LLP 1111's tool door; drive 6 is `contract/cli/tests/it/camera.rs` until then. (4) Android's agent picture is drawn in Kotlin, not the package's card, so its photo's SHA-256 differs from the other hosts'. (5) Every app importing @exact/media-capture links CameraX on Android (the recorder: about 0.9 MB of dex); splitting the camera's capture out of media-capture's Android implementation, or loading it only when `video=` is asked, would spare an audio-only app it.
- **The web JS runtime's substitute lacks `check`, `asks`, `continues` and `facts`** (2026-10-23, LLP 1133.010 §7). The Rust runner reads them from `exact.json` (`runner/src/runner/modules.rs`); `host/web-js/modules.js` reads only `web` and `unsupported`, which is all `@exact/local-auth` needs there, since the web's cell is `later` and `authenticate` refuses. A web module that holds a person's check would need the four ported, with the Rust tests' cases (`contract/cli/tests/it/local_auth.rs`) run against the JS port.
- **A store write reconnects Excord's gateway when another resource wrote** (2026-10-23, found driving LLP 1133.010). The gateway resource reads `native.available` (`hostOf`, a device read), so the runner counts it a store reader, and any store revision another commit makes asks it again; `connect` then opens a new socket. Seen when Lock Excord's move bumped the revision (now it does not, `Store::adopt_occupancy`); a rotated token does not, since the gateway's own turn writes it. A launch also asks the gateway twice (`data_ready`), and the second socket is refused `native executor admission limit reached` until the backoff's retry. Fix in Excord: read the host identity once, in `loadSession`, so the gateway reads no device fact; or a runner rule that a device fact other than the store does not make a resource a store reader.
- **Link the Apple presence backend by use** (2026-10-23, LLP 1133.010 D16). The keychain hook (`Sources/ExactKit/Presence.swift`) and the Rust vault (`host/apple/src/presence_secrets.rs`) are in every Apple host: +34,368 bytes on hello's production iOS binary, an app with no presence line. Move them behind a capability the grants name, as `auth_session` is (`runner/src/uses.rs`, `bake/src/link.rs`, `host/apple/link.mjs`, a Swift product installed by the compositions), so only an app with a presence line links them.
- **Sign a Mac build for locked secrets** (2026-10-23, LLP 1133.010 D7). `host/apple/presence.mjs` finds a macOS profile granting the app's keychain group and refuses a release without one; signing with it (`keychain-access-groups`, the application identifier, the embedded profile, as `macWidgetEntitlements` does for widgets) is not built, since no Mac it was built on had a profile. Then drive 10's Mac part (`packages/local-auth/test/device-checklist.md`).
- **A package's tests make its consumers' builds stale** (2026-10-23). An app depending on a package by `file:` copies the whole package, `test/` too, and the drivers' freshness check counts it, so editing a package's suite refuses every drive until the app is rebuilt (and its copy reinstalled). Leave `test/` out of the package's build inputs.
- **Module use found in Rust and TypeScript** (LLP 1133 D6 rule 6). The plan names a module only when the Contract calls one of its names; a data-code-only caller's Contract has to read one, or the binding is missing and the runner refuses the call.
- **A `navigationKey` + `navigationBack` pair below the app's first element compiles as a navigation root that iOS does not stack** (2026-10-24, review of `lower-header-routeless`). `NavPlace::enter` (contract/lower/src/routes.rs, the `has("navigationKey") && has("navigationBack")` arm) makes any element with both a root, wherever it sits, so `lower-route-place` does not fire behind a wrapper or after a sibling; iOS's `NavigationIOS.projection` stacks only `presenter.root.subviews.first`, and the Linux host's `stacks` only a root's (or its tab panels') direct keyed children. Read in the code by two reviewers and the orchestrator, not run on a phone. The new `lower-header-routeless` gives such a shape the benefit (any keyed element inside a keyed one counts as a route) and so is silent there; a placement-exact version (branch `q24/routeless-header-fix3`, 187ed9b2f8, via `NavPlace`) warned wrongly beside an unlinked `role="tablist"` (`holds_tabs` picks `TabbedRootChild` where iOS's `NavigationTabs.of` needs `aria-controls`), so it was not landed. Fix the root's placement in `NavPlace` first; the routeless check can then use it.
- **verify web's largest-text pass reports a header iOS draws as its navigation bar** (2026-10-18, round 22's apps). On the web a route's `header` is the author's row, so at a 53 px root its buttons spill (a sheet's Cancel and Create cut), and verify reports them; on iOS the same header is UIKit's bar, which sizes its buttons, and `verify ios` says nothing spills. (A bar's unsaid title ends in an ellipsis on the web as UIKit's does, `host/web/neutral.css`.) Builders see findings on the web that the phone does not have (book-club, expense-tracker, flashcards and notes each did) and learn to discount the pass. The web's tree names neither a node's element (`header`) nor a route's screen (`navigationKey`), so verify cannot leave those out; with both it could skip what iOS's bar draws.
- **Flex line breaking compares floats where Chrome compares 1/64px layout units** (Chrome 151.0.7922.34, 2026-10-18, after Taffy patch 47). Each case is a `display:flex;flex-wrap:wrap;align-content:flex-start` row in normal flow holding two `height:30px;flex-shrink:0` items. A `width:100px` row with `width:50.01px` items: Chrome 100×30 (one line, since 50.01 and 100 floor to 50 and 100 layout units), kernel 100×60. A `width:99.99951171875px` row with `width:50px` items: Chrome 100×60 (the width floors to 99.984375), kernel 99.9995×30; `width:99.9990234375px` likewise. With `width:50.02px` items in 100px, both give 100×60. Patch 47's fit test allows 1/1024px of excess so that decimal sizes (three `60.4px` items and a `0.1px` gap in `181.4px`, which Chrome keeps on one line) do not wrap on f32 roundoff. Comparing the line length and the limit as Chrome does, each item's outer size and the gaps floored to 1/64px before summing, would match all of these and would replace that tolerance. The same gap reaches Taffy patch 49's stretch test, which truncates the item's natural and stretched cross sizes to 1/64px but sums the natural height in f32: a normal-flow or absolute `display:flex;width:100px;max-height:110.105px` row holding a `width:100px;aspect-ratio:2` item whose children are `width:20px;height:100%` then two `width:20px;height:30.055px`. Chrome 151 gives the item 110.09375 and the percentage child 50, because Blink truncates each length (30.046875) before summing, so the cap equals the natural height. The kernel gives 110.105 and 110.105, treating the cap as a stretch; it was 50 before patch 49. Tried and parked on 2026-10-18 (branch `q24/flex-layout-units`, four commits, four review rounds): converting each item's components and the line limit to layout units inside `collect_flex_lines` fixes every case above, but Taffy only has the f32 sums, and each attempt to recover Blink's components from them regressed a case main and Chrome agree on. Measured in Chrome 151, branch against main: a `width:100px` block holding an auto-width wrapping row with `margin-left:.01px` and two `width:50px;height:30px;flex-shrink:0;margin-right:-.01px` items (Chrome and main one line, the branch two, because the parent's 99.99px arrives as an f32 border box); a `width:100px` wrapping row of two `display:block;flex-basis:50.01px;flex-shrink:0;height:30px` items each holding a `width:50.015625px;height:1px;margin:0 -.01px` child (Chrome and main two lines, the branch one, because a measured automatic minimum is f32); `aspect-ratio:0.7` items 100px high in a `139.984375px` row (an f32 ratio widened to f64 drops a unit); a flexed row whose f32 width equals its authored width by chance. Doing it right means carrying the sizes' layout-unit components from style resolution and from the parent (block layout's sums, `LayoutInput`'s known dimensions, measured content) into the flex algorithm, not reconstructing them in flexbox.rs; the branch's tests (`flex_line_*` in flexbox.rs's intrinsic_tests) and 17 Chrome rows are reusable.

- **An auto-height wrapping ratio text leaf shrinks to min-content in a flex column** (Chrome 151.0.7922.34, 2026-10-24). A `display:flex;flex-direction:column;width:300px;height:100px;align-items:flex-start` root holds a text leaf with `aspect-ratio:1;max-height:100px` and `aaaaaa aaaaaa` at 10px per letter and space. Chrome gives the item 100×100; the kernel gives 60×60 with both 644a7151e's Taffy and Patch 64. Held as owed by `Chrome 151 ratio text wrapping column height cap` in `browser_position.tsv`; a 60px cap and a definite 100px height match Chrome.
- **The reader never tells a driver it is ready when the page draws nothing** (2026-10-19, `oracle.mjs --phone`). `AgentDrive` answers `ready` after `ExactView`'s first frame with ops, so an app whose first screen is all bars (a header and a tablist the bars take, an empty page) leaves `agent.mjs android --reader` waiting 20 s and failing. The Material specimens draw a line of page text outside their crops to step round it.
- **The Material oracle's findings, and what it still owes** (2026-10-18, LLP 1115.001.001 §3; `bun host/android/reference/oracle.mjs` on `expo-build-1000`). Found and open: the navigation bar places its destinations from the left under a right-to-left direction (`Layout::bottom` is told none), and where no palette is told its indicator and container are Exact's `ButtonFace` and grouped background, not Material's baseline (review `code-2026-10-18-material-navbar-r1`); a field's label floats on a 150 ms ease where Material 3 1.4 springs it (`MotionSchemeKeyTokens.FastSpatial`); a field's texts are 0.6 to 3.6 dp narrower than Material's (its type ramp's tracking, 1115.001's reported type ramp). Fixed: a disabled field's container; the navigation bar's colours, gaps and 56 dp indicator; a field's indicator on the pixel grid; the top bar's title after the Up arrow (56 dp, not 52); the checkbox, the radio and the filled button are Material's, drawn; a checkbox and radio lay out at 24 dp and every Material control takes a touch over 48 dp, apart from layout (§5 Q5, ruled 2026-10-19); the tonal, outlined and text buttons are not yet (D9); the door names a field's painted texts; the oracle reads Robolectric's Roboto as `fonts.xml` does (the "bold" title was Medium drawn for 400). O2 calibrated on one Pixel (thresholds in `oracle.mjs`; layout and text geometry not yet measured on the phone, nor a second Pixel). Owed: O3, accessibility and motion; O4, the hourly job with its release watch.
- **Material's 48 dp touch target, what three reviews left** (2026-10-19, LLP 1115.001.001 §5 Q5, `Presenter::touch_target`; reviews `code-2026-10-19-material-q5-r1` to `-r3`). (1) The target is chosen at the release (`press_at_after_down`) while a contact keeps only the geometric hit from the down: a slide from inside a checkbox into its own margin, under touch slop, changes the hit to the parent and cancels the press, and a control a `pointerdown` handler reveals beside the finger can take the release. Compose decides the target at the down and keeps it. Keep the touch target on the contact from the down, apart from the hit that gesture discovery and press feedback use. (2) A finger on no layout box (a 24 dp checkbox that is a whole root) reaches nothing, since a contact starts only on a hit; an earlier fallback that made the control the contact's hit broke press feedback and started its ancestors' pans from outside every box. (1) is the place to answer (2).
- **Android module views: two gaps the module tap and event seam leaves** (2026-10-18, #707's review). (1) A dev reload or delivered update that gives a different control the same view id, slot, generation and module keeps the old `Natives` element and its event binding, so a popup opened before the restart sends its `change` to the new control; carrying a session epoch in the module props, the `under` words and `Native.moduleEvent` would retire them. (2) A second contact that lands before exact2 answers the first's `under` replays the first release as an ordinary one (`ExactView.forgetModuleTap`), so that tap's `performClick()` is lost; keeping each completed contact until its own answer, without forwarding the second down ahead of the first up, would keep it.
- **Linux desktop locale for dates** (LLP 1126 D6): `time` and `formatDate` format in English whatever the viewer locale.

- **`apps/llp`, `apps/exact-live` and `apps/markdown-stress` still draw a pipe table row by row** (2026-10-17). Each row is its own `row` of `view flex=1` cells, and a cell is never narrower than its longest word (CSS's `min-width: auto`), so a row whose words outgrow an equal share widens those cells and narrows the rest: columns stop lining up between rows, and a header of long words runs past the rows' rules. `apps/markdown` draws a table as one block and one grid (`markdown_parse::value::into_blocks_with_tables`, its `table` branch); these would line up the same way by reading that form, and `apps/markdown-stress` would then stress what `apps/markdown` draws.
- **What Android 10 and 11 still lack** (2026-10-17, a Galaxy Note 9 and a Pixel 5; `host/android/README.md`, "Android 10 and 11"). (1) Android 10's overscroll glow is not drawn, so a scroller's end shows nothing where a hand-built Android 10 app glows: `EdgeEffect` draws the glow below API 31, only its distance and the stretch are Android 12's (`Scrolling.STRETCH`). (2) Outline text carries 1 to 4 % more ink (by coverage) than `drawGlyphs`' atlas glyphs on the same phone, differing along glyph edges only. (3) A COLRv1 glyph is drawn from its plain outline below API 31 (swash renders COLR version 0 and bitmap strikes), which Noto Color Emoji's COLRv1 build leaves empty; Android 10 and 11's own emoji are CBDT and draw. (4) Not tried: Android 11 (no device), and a TypeScript data module, whose Android Hermes bundle is built at API 30.
- **A flex text's lines, what `Kernel::text_line_offset` leaves** (2026-10-19; the Apple hosts and the Linux painter place a flex-container text's lines as CSS's anonymous flex item now, so a grouped section's bare `text` row is centred). Left: a parent's `align-items: baseline` reads the text's baseline before the offset, so a centred flex text beside a baseline-aligned sibling sits off it; a text that is a grid container draws from its top; a flex text fragmented across columns takes no offset.
  2026-10-22 (lane q1022/k): parked after three rounds; no change.
- **What a package's design can't do yet** (2026-10-19, LLP 1121 stage 11 A1; theme2's rulings Q1, Q6 and Q7; its icon tokens landed in stage 13). (2) References across packages: a package token names its own package's tokens, roles and base names only, never another package's (`tamber-unknown-token`), even one it depends on. (3) Scoped namespaces: a package's tokens are named by the last part of its name, so two linked packages `@a/reading` and `@b/reading` that both ship a design are refused (`tamber-package-name`); if a real case appears, names could carry the scope. (4) DTCG export: `export` folds the app's design file alone, so an app whose design names a package token can't export (`tamber-unknown-token`); an app-only document needs the join with the package tokens left out.
- **A package's multicolour (non-template) SVG icon on the web** (2026-10-22, LLP 1121 stage 13; theme2's 03:22 ruling Q2 (a)). A package's icon SVG is read from `<package root>/assets/`, and in v1 it must be a one-colour template (`tamber-icon-svg` otherwise), drawn from the plan's inline path on every host. The web alone draws a non-template file as written, as `assets/<svg>` from the app's staged `assets/`, and no web build stages a package's `assets/`. When a package needs a multicolour icon: stage each package's `assets/` under `assets/packages/<ns>/` (host/web/build.mjs, dev.mjs and serve.mjs, host/web-js/build.mjs) and give the plan's `svg` field that path. On Apple a multicolour file still needs an `sf` source (the Apple entry below).
- **A package SVG read across three swaps** (2026-10-22, LLP 1121 stage 13's narrow re-check, Astra RE-3; contrived). `contract/lower/src/icons/confined.rs` opens a package's SVG, resolves its path again and compares the resolved file's device and inode with the descriptor's. An attacker who can write the package's `assets/` and swaps the path three times inside a few system calls (a link out of the package when it is opened, a file inside when it is resolved, a link out again before the resolved file's metadata is read) passes the check: the resolved path is the SVG's own, whose metadata, read after the third swap, follows the link to the file already opened, so the outside bytes are read. Binding the walk with `O_NOFOLLOW` and `openat` per component (or `lstat` of the resolved path against the descriptor) would close it, if a real case appears.
- **Package-file layouts outside the read-only guard's definition** (2026-10-19, LLP 1121 stage 11 A2 part 2; theme2's ruling 21:32 defines a package file by real path: a named package.json above it in the app's tree, a node_modules segment, or a root the app's load resolved; the server also refuses under any directory a link inside a node_modules points to, walking the app's tree and the node_modules above it, failing closed past 400,000 directories or on a directory it can't list). Not covered, by that ruling: (1) `app/node_modules` itself a link to a directory outside the app whose entries link back into it (`app/node_modules → /shared/deps`, `/shared/deps/@acme/reading → app/vendor/reading`, no manifest, app.json's "tamber" naming `vendor/reading/reading.tamber`): writable. (2) A Contract source under such a manifest-less linked directory, imported by a relative `use`: stage 8 D's `owned()` (contract/cli/src/tamber_contract.rs) checks only the app's own top-level node_modules, so `set-row`/`set-state`/`add-param` write it. (3) Journal completion after a crash renames an already-checked write without checking again, so a link made in that window isn't seen. Each needs a layout no resolver produces for the app; fix if one appears in practice.
- **Apple: what euxy's tabs still cost over its UIKit port, about 1.8 MB** (2026-10-17, iOS 27 simulator, Release; idle → every tab shown → back on the first: Exact +9.2 MB, UIKit +7.4). Per kernel node, the host's `Mirror` (`host/apple/src/host.rs`) holds its style JSON shared with every view that heard the same text (2026-10-18, `StyleTexts`; a screen whose styles differ per node still pays about 640 bytes a paragraph), and taffy's per-node layout cache is 128 bytes plus the measure slots used (448 before 2026-10-18). Per `NodeView`, its `registerForTraitChanges` costs UIKit about 0.8 KB (registry, registration, records). Measured with `heap` and `MallocStackLogging=lite` against a tour that switches tabs through `ExactTabs` (AXe's taps load UIAccessibility into the app, which then walks every view: +10–14 MB in both apps).

- **Android native fields omit tabular-digit styling.** `host/linux/src/fields.rs`'s `FieldFace` and Android's `Fields.kt` do not forward `font-variant-numeric` to hosted `EditText` measurement or drawing. Painted text applies `tnum`; native fields need the same feature carried through both paths.

- **A multicolour (non-template) SVG icon on Apple** (2026-10-18, LLP 1121 D10, stage 9 A; theme2's 17:03 (a)). Apple draws an icon's template path or its SF Symbol; a file of more than one colour still needs an `sf` source for Apple targets, because Apple has no SVG file renderer outside an asset catalog. Rasterise the file at build time into the asset catalog (each scale) so `multicolor` draws it on Apple as the web does.
  2026-10-22 (lane q1022/k): parked after three rounds; no change.
- **Every `exact.mjs ios` of an outside app replays two Cargo warnings of Exact's: 2.8 KB of a 3.3 KB warm build's output** (2026-10-17, LLP 1116.021 D3's lane; `host/apple/quiet.mjs` takes out only Exact's Swift warnings). Cargo replays a path dependency's build-script warnings on every build: ibex2's `-Wreorder-ctor` at `vendor/ibex/crates/ibex2/src/bindings/install.cc:284` (the `Integrity` initializer list is not in declaration order; reordering it changes nothing, members initialise in declaration order) and the generated `[patch.crates-io] wgpu-hal` that an app with no GPU module never uses ("was not used in the crate graph"). The bake's Cargo output is inherited (`scripts/app.mjs` `buildBake`), so neither can be filtered there without piping it.
- **A running transition is not cancelled when its `transition-property` stops covering it** (2026-10-16, CSS Transitions §3). `Engine::observe` keeps a running or played transition whose target is unchanged whatever the declaration says now. Cancelling it needs the kernel to tell `transition: none` from an unset row: both reach the engine as an empty list (`kernel/src/motion.rs`), and an unset row is CSS's `all 0s`, which still covers the property and keeps the transition. The web hosts' spring lowering (`host/web/src/motion.rs`, `host/web-js/motion/src/lib.rs`) cancels a WAAPI animation only when the value changes, so a cancellation at an unchanged target would leave the browser's animation running.
- **A Rust update that changes the Rust blanks the app's Rust-drawn canvases until the next binary** (2026-10-16, Caltrain on an iPhone through AppDrop: the line map lost its white background, stations and line while release 2 renamed a station in Rust). A replaced module is a `Swappable` with no embedded crate, and its `draw` answers "a replaced Rust module does not draw Canvas 2D yet" (stage 1 owes, (2) below). Since `d1de59c31` an update whose Rust is the binary's own runs the native crate and draws, so only an update that changes the Rust shows it. The fix: a draw operation on the logic ABI (a new ABI version; older modules keep the rest): the module records with `exact_canvas`'s recorder and returns the list, which the host replays as it replays a TypeScript draw (`exact_canvas::seam`). Then check Caltrain's line map with a Rust update on macOS (native dylib) and iOS (wasm).
  2026-10-22 (lane q1022/d2): logic ABI 4 with the draw and retirement operations, recorders owned per session kept across native promotion, and a real-cdylib native draw test are on branch `q1022/d2-151-parked` (this Mac; not landed). Through it the replaced module's draw list reaches the host (Caltrain's map: background, line, train) and replays into a zero-sized bitmap layer, so the map still shows transparent on the iOS simulator; the module seam also carries no image requests or platform text measurement yet. Land it with the layer sized from the canvas content box at replay and the environment carried through the seam.
  2026-10-23 (panel, orchestrator q1022; Charlie's veto open): until the draw ABI lands, `push.mjs` and `deploy.mjs` refuse an update that changes the Rust of an app whose Rust draws a canvas, naming the binary stream; the classifier cannot yet tell Rust-drawn canvases from the plan's other surface calls (`surfaceCalls` is the GPU roster, `dataCrate` is null whenever Rust is on), so the refusal covers every changed Rust module until the module's canvas roster is in its receipt. The ABI work on `q1022/d2-151-parked` also needs an environment protocol for image requests and platform text metrics (`logic/abi/src/draw.rs` installs an `Env` with neither).
- **A GPU module beyond the primary that owns shaders breaks the primary on Linux and Android** (2026-10-16, Astra's review of the Android shader packaging). The shader pack is the app's whole inventory (`scripts/app.mjs` `shaderFiles`), and both hosts register all of it into the primary module only: Linux's rendered path through `surfaces/shaders.rs` (`read_pack`, `artifact.is_empty()`), Android's through `surfaces/android.rs` `load`. A module refuses a name it does not reflect (`Module::set_shader`), so a shader that only an extra module owns makes the primary's registration fail, and the extra module gets none. Android also stages no extra module's library (`buildApk`). The fix needs a per-module shader roster, from the bake's compat or an ABI call.
- **A per-axis `scale` (`scale="0 1"`, CSS's x and y)** (2026-10-16, euxy's keep bar, FRICTION 9). Refused on a row (`expected number`) and in a keyframe (`lower-keyframes`, which says so): the kernel's `scale` row is one `f32` (`kernel/tables/schema.json` bit 61) and `exact_motion::Property::Scale` a scalar, so it is the row's codec (vec2), the motion value, the present op's wire, and each host's transform (`PresenterIOS`/`PresenterMac` `v.scale`, Linux `paint/presented.rs`, the web hosts), with press scale folded per axis. The workaround a porter takes is a bar translated inside a clip.
- **A hand-written swipe row in a grouped list, the forms still styled on the scroll** (2026-10-19, `contract/lower/src/swipe_rows.rs` `written`). A grouped section's `scroll swipeContent=…` whose content is a direct child with the same `id` expression is styled as `delete=`'s is: the content is the row (its inset, subtitle and accessory rules), the scroll takes its box in the card. Content inside wrappers (Messages' inbox shape) is read too, by lowering and by the kernel's `grouped/separator.rs` `swiped`. Content in an `if` or `match` arm is read too. Still styled as the row on the scroll: content produced by a `for` in the scroll (several elements of one `id`), an `id` that is another expression evaluating to the same name (known only when it runs), a scroll whose author padded its leading edge or that has a `class`, and two elements with the same `id`.
- **Android's pickers and Kotlin hatches, what LLP 1115.001.000 leaves** (2026-10-16, on a Nothing Phone (4a) Pro). (1) A Material field's press is a state layer, not the ripple (1115.001 D9's press, owed for every control). (2) A view a Kotlin hatch hosts takes no touches (as a native module's view on this host). (3) Where Compose is not linked, the framework's dialogs ignore `accent-color`. (4) Not measured on a Pixel, nor with a date control on an app's first screen. (5) `contract verify apps/native-fixture/app.contract` diverges at boot on main too (the `tabs` element: runner `tabs`, Lean `route-second`).
- **LLP 1125 stage 3 (MIDI), what was not run** (2026-10-16): nothing was sent to a real device or the macOS IAC bus (none present), Chrome's Web MIDI was not tried by hand, and the Apple arm's 3 s watchdog and iOS foreground re-enumeration have no test. Two edge cases the last review confirmation left (LLP 1125 As built, stage 3): the Apple arm and `midi-glue.js` forget handed note-on ids after about a second, so a retraction delayed past that (a stop begun while the main thread stalls) retracts a note-off whose note-on already sounded — keep ids until their paired note-off is sent; and an edit at exactly the beat where a full queue parked the fill keeps that beat's skip (`transport.rs` `fill`, `transport.js` `fill`), so a note the edit retracted there is not re-issued — reset the skip when the edit retracts at that beat.
- **The data module's Hermes heap: what is left after boot's collections and the between-calls cap** (2026-10-17, `js/src/shim.cc`, `Adapter::harden`). Hades keeps every young-generation page it has touched and no `GCConfig` field bounds it, so the shim collects before the freeze, between its guard and `harden.js` (vendor/ibex/EXACT-PATCHES.md), after it, and between calls once the module has allocated at least 512 KB and as much as it holds live. At idle after launch the young generation keeps 528 KB in the template and in euxy (Release, iPhone 17 simulator), about 80 KB of it the segment's own mark bits and cards, the rest the guard's and `harden.js`'s 0.45 MB each; a session of dice rolls in euxy holds it near 720 KB where it reached 3.6 MB. A collection right after the runtime is created saves nothing (measured): the runtime's own 0.26 MB is mostly old generation. Left: (1) the render host's fresh realm per page pays the boot collections (made while a worker is idle) and, for a page whose module allocates past 512 KB, one collection on the request path, with no memory to save since the realm is dropped; measure RealWorld's CPU a page and skip them there if it shows. (2) An answer's reply is serialized with the capture replacer (`ok` in `js/src/prelude.js`), which makes a key string per array element and an ancestor record per object: euxy's seeded library (22 KB as the runner keeps it) allocates 151 KB to settle. A plain `JSON.stringify` first, falling back to the replacer only when the text is 64 Ki characters or longer, would avoid that, but runs getters and `toJSON` twice for such replies. (3) Below 528 KB idle needs a smaller guard or `harden.js` allocation, or a lean VM built with a smaller `HERMESVM_LOG_HEAP_SEGMENT_SIZE` (a CMake cache variable, default 22; objects past a segment go to jumbo segments). Measured 2026-10-18 on euxy (Release, iPhone 17 simulator, the iOS-simulator lean VM rebuilt from the pinned receipt's flags plus that option, linked through `HERMES_LEAN_SYS_DIR_aarch64_apple_ios_sim`): the heap's two segments 1120 KB dirty at 22, 928 KB at 20, 864 KB at 19, and `EUXY_TTI` unchanged (five interleaved launches each, medians 1284, 1285, 1288 ms). Shipping it is a release outside this repo: in expo/ibex, add `-DHERMESVM_LOG_HEAP_SEGMENT_SIZE=20` to the common CMake arguments of `scripts/build-hermes-vanilla-release.sh` and `scripts/build-hermes-windows-vanilla-release.ps1` (it is one option for both VMs), move `RELEASE_TAG` in `.github/workflows/hermes-vanilla-publish.yml` to `-v6`, dispatch `hermes-vanilla-build.yml` on main and let the publisher (environment `hermes-vanilla-release`) attest and publish; then here, the new tag and eleven digests in `vendor/ibex/crates/hermes-lean-sys/build_support.rs` (`RELEASE_TAG`, `PINNED_BUNDLES`), the bundle line of `vendor/ibex/EXACT-PATCHES.md`, and the tests that name the tag. No `GCConfig` setting releases young-generation pages: `ShouldReleaseUnused` is read nowhere in `lib/VM`, and `HadesGC::youngGenCollection` resets the segment with `AdviseUnused::No`; patched to `Yes`, the dirty size did not move. (4) Hardening's readers are not all captured before bootstrap: `harden.js` reads `Object.getOwnPropertyDescriptor`, `getOwnPropertyNames` and the rest when it starts, and the deferred intrinsic snapshot its readers when `capture_intrinsics` runs, so a bootstrap that replaces one with a function that lies is believed (the guard's are captured when `install_with` builds `Reachability`). Capturing them at adapter construction and refusing to harden when the live ones differ would close it (Grok, review of the 2026-10-17 memory change). (5) Why `AdviseUnused::Yes` moved nothing: the lean VM's `oscompat::vm_unused` is `madvise(…, MADV_FREE)` (5, disassembled from the pinned iOS-simulator `libhermesvmlean_a.a`), which on Darwin leaves the pages in the footprint until the system needs them; `MADV_FREE_REUSABLE` (7) takes them out at once, as `releaseStackBelowCaller` does. A VM patch that advises the young generation unused with that after the shim's full collections could give back most of what it has touched at idle (euxy port 12, 2026-10-19: 53 of its segment's pages, 848 KB, about 80 KB of them its own mark bits and cards). That is a Hermes release outside this repo, as (3) is, for about three times (3)'s saving.
- **What euxy's first screen still costs on iOS that its UIKit port does not** (2026-10-16, euxy memory lane, Release, iPhone 17 simulator, idle 10 s after launch: Exact 26.7 MB, UIKit 21.1; later 2026-10-18, a box of flat boxes is one layer tree (LLP 1068 §6.3): `NodeView`s 243 → 116, 0.3 MB less; measure on a simulator no agent drive has touched since it was erased, since a drive leaves accessibility loaded in every app it launches after (about 8 MB more for each, UIKit's port included); 2026-10-18, 25.7 MB against 20.4 (medians of 10 and 5): of the 5.3 MB, malloc 2.75 MB (Rust and Hermes heap 2.85 MB more than UIKit's, NodeView 292 KB, style dictionaries and strings about 0.3 MB, against UIKit's Auto Layout), the Hermes heap 1.1 MB, thread stacks 0.4 MB (an 8 MB owner stack 176 KB dirty, two raster workers, three Rust threads), the executable's `__DATA` and `__DATA_CONST` 0.54 MB, a vImage colour-conversion cache 128 KB that a `CABackdropLayer` filter image makes at commit, and `Network` 80 KB (the app hatch's `onLine` fact starts the path monitor). Text rasters equal UIKit's label backing stores. The larger Rust items, after the 2026-10-18 cuts (the mirrors' style texts shared, 322 KB to 122 KB; the site index's constant cells kept only for the bindings evaluated, 96 KB; taffy's caches allocating measure slots as used, 137 KB to 50 KB): the plan's tables and 1,331 strings decoded from the linked plan (0.21 MB: 64, 48 and 32 KB table vectors, 40 KB of strings in 1,331 allocations under a 32 KB `Vec<String>`; a pooled `Strings` type would save about 45 KB and reading them in place from the static bytes 80 KB, across some 60 `plan.strings` sites, most in tests), the runner's site index (0.19 MB) and realized instances (0.3 MB), the kernel's 94 interned `StyleProps` at 896 bytes (82 KB), the node arena's and taffy's node vectors (0.23 MB, up to half of it growth slack); Swift's: CSS animation specs kept as `[String: Any]` per animated node (115 dictionaries, 0.1 MB, and their lowered arrays).) Beyond the Hermes heap (above; 2.4 MB dirty then, 1.4 MB since 2026-10-17, plus 0.6 MB of its malloc) and the executable's dirtied `__DATA`/`__DATA_CONST` (1.3 MB more), one smaller thing is Exact's own: each `NodeView` registers for trait changes itself (`_UITraitChangeRegistry`, about 64 KB over euxy's 134 views). Text rasters are not it: ink-cropped BGRA bitmaps (0.74 MB) against UILabel backing stores, 1.18 MB of both kinds of pixels to UIKit's 0.99 (A8 needs a mask layer, below). 2026-10-19, after the bindings' bytecode read where it is linked (91 KB), the owner's stack under the boot given back (144 KB), the plan's strings read in its bytes and the VM's string values made as read (the binary's own malloc 2.87 to 2.68 MB): 26,210 to 25,730 KB (`footprint` bytes, medians of 5 interleaved launches on a quiet machine; 26,210 to 25,874 over 10 pairs), `EUXY_TTI` 1181 to 1175 ms (medians of 10). Measured there and left: the app's own `apple/src/lib.rs` still passes `BYTECODE.to_vec()` (76 KB; an app made before 8471fb5f9 keeps copying until its entry passes `APP_BYTECODE`, and `exact.mjs update` does not rewrite it); the executable's `__DATA_CONST` (304 KB) and `__DATA` (19 of 23 pages) are dirtied by fixups and ObjC metadata, so only fewer pointer-bearing constants would cut them; the runtime `Entry` is one 48 KB allocation (`Bridge` holds `Host` and a `PreparedHost` inline); taffy's slotmaps grow by doubling in `new_leaf` (80, 20 and 14 KB buffers); the kernel's 94 interned `StyleProps` at 896 B; Hermes keeps 105 chunks of pinned JSI values (47 KB) from the boot's peak; two raster workers start with the first image source and sit on 16 KB each. 2026-10-19, later, against the SwiftUI port on one fresh simulator (`footprint`, medians of 5 launches in 5 interleaved rounds): 25.17 MiB to 24.33, SwiftUI's 24.91; `EUXY_TTI` 1153 to 1133 ms (medians of 10, three rounds); playing 0.1% CPU either way. The cuts, in `malloc_history` against SwiftUI's: CoreUI kept every symbol the kernel measured, its glyph's SVG documents about 120 KB a symbol (SwiftUI's whole CoreUI is 1.05 MB), so symbols in a box covered whole (the closed pattern menu's six) are measured when a layout places it, and the root tablist a tab bar replaces is covered from boot (`closed.rs` `cover_root_tablist`; the presenter adopts the cover or gives it back), which also ends `ButtonMeasureCache`'s tab probes; `GCMouse` and its notifications are asked only on an iPad or a Mac (GameController's keyboard and mouse service, 0.26 MB of malloc and 90 KB of `__DATA`); the raster workers and Ibex's host-task workers give their stacks back when they go idle (Ibex local patch 17); the launch image's digest is CommonCrypto's (CryptoKit's `__DATA`, 40 KB). What Exact still spends beyond SwiftUI, by `footprint` category: text rasters in `CG Raster Data` 0.62 MB, less SwiftUI's 0.48 MB more `CoreAnimation` backing stores; malloc 0.34 MB (`NodeView` 285 × 1,280 B, 365 KB, its stored properties beyond `UIView`'s; Rust 1.5 MB and Hermes 0.4 MB, of which taffy's slotmap doubling 0.16 MB, 30 hashbrown tables 0.15 MB, the kernel's interned `StyleProps` 93 KB, the runtime `Entry` 48 KB, Hermes' pinned-value and weak-slot chunks 92 KB; `Presenter.setLanguage` gives every view an `accessibilityLanguage`, an associated object each, 59 KB); stacks 0.18 MB (the owner's, the raster workers', Hades', Hermes' finalizer executor's, `exact-io-0`'s); the vImage cache 128 KB; the executable's `__DATA_CONST` 0.13 MB more. SwiftUI's own `__DATA` is 1.6 MB more than Exact's. `Network` (80 KB of `__DATA`) is the app hatch's: `appFacts` reads `onLine`, which starts the path monitor, whether or not a hatch reads it. 2026-10-19, euxy port 12 against its UIKit port on one fresh simulator (25,138 against 20,162 KB, `footprint` medians of 5): the Hermes heap 1.37 MB and its malloc 0.4 MB (its young generation's touched pages are (5) of the entry above); Rust's malloc 1.42 MB (runner 340 KB, kernel 323, taffy 208, plan 168, `exact_apple` 158, triomphe 113, `exact_num` 58, Ibex 52); the Sequencer tab's navigation controller 0.93 MB (the entry at the top); the presenter's Swift objects about 0.9 MB (`NodeView` 250 × 1,280 B, style dictionaries and their `BatchValue` arrays 186 KB, CSS animation specs 70 KB, strings 102 KB) against 0.3 MB more of UIKitCore's own in the UIKit port; Swift's runtime metadata 0.35 MB, mostly the navigation controller's SwiftUI; the executable's `__DATA` and `__DATA_CONST` 0.64 MB; stacks 0.16 MB; the keyboard machinery 0.11 to 0.22 MB (the first-responder entry below); the vImage cache 128 KB; `Network` 80 KB. Text is in Exact's favour: its `CG Raster Data` 0.4 MB more, the UIKit port's label backing stores 1.0 MB more. The UIKit port loads its audio engine at launch (about 0.2 MB) and links no GameController, whose images cost Exact nothing dirty. 2026-10-19, later (euxy port 12, Release, a fresh iPhone 17 simulator, `footprint` medians of 5 interleaved launches, each change against the one before): 25,090 to 24,626 KB in four cuts. The path monitor starts at the first read of `onLine` (the plan's, or a module's `app.onLine` through the hatch host table's `on_line`), so `Network` is no longer loaded: -161 KB (`__DATA` -109). A node answers `accessibilityLanguage` from its presenter, as UIKit stored it per view: -80 KB (20 KB of it malloc). A `NodeView` is a 768-byte block, from 1,024 (its flags together, the transform, image, paint ghosts and scroll extent in `NodeAside`, the paragraph raster in `TextSpecs`, one shared first-draw receipt): -80 KB (102 KB of malloc). A box's CSS animations are kept as `CssAnimation` structs, not the batch's dictionaries: -144 KB (70 KB of malloc). `EUXY_TTI` 1265 to 1251 ms (medians of 10), playing CPU 0.075 to 0.05 %. Tried and dropped: reserving a batch's creates in the node arena and Taffy measured 176 KB worse, since the first screen's batch is followed by smaller ones that double the exact capacity past the power of two the pushes reached; it needs the final count, which the kernel does not know at the first batch. 2026-10-20, euxy port 15 against its UIKit port on one fresh simulator (`footprint` bytes, medians of 5 interleaved launches: UIKit 21,317,936, Exact 24,643,960): only a `color-scheme` boundary overrides its appearance (the root's scheme was inherited by every node and each of 312 views carried its own trait overrides, trait collections and associated object) and `applyProps` sets accessibility properties only on change: 24,021,368, `EUXY_TTI` 1167 to 1165 ms (medians of 10), playing CPU 0.1% either way. Tried and dropped: watching a tab stack's pops at its first show and laying out only loaded stacks in `replayHatches`, so a tab not shown loads no navigation view: 166 KB less live malloc (`malloc_history`), yet the footprint median 130 KB higher over 10 interleaved pairs. What is left beyond the UIKit port, by `footprint` category: malloc 2.1 MB (Rust 1.8 MB: runner 565 KB, kernel 518, plan 208, `exact_apple` 195, taffy 177, `exact_js_value` 129; Hermes 0.4 MB; NodeView instances 312 × 768 B); the Hermes heap 1.1 MB (the entry above); the executable's dirty `__DATA` and `__DATA_CONST` 0.57 MB more than the port's (Swift type metadata about 0.3 MB; Rust's relro 144 KB, of which the kernel's generated `METRICS`, 171 rows of `&str` cells, is 34 KB: names and text cells as offsets into one string would leave it in `__TEXT`); stacks 0.26 MB (`exact.owner` 64 KB, two raster workers 32 KB each, `ibex2-host-task` 32 KB, `exact-io-0`, `exact.kept`, Hades and Hermes' finalizer executor 16 KB each, all idle after boot); the vImage cache 128 KB, which is UIKit's scroll edge effect (a 1 × 384 Generic Gray mask converted at commit) under euxy's scroller, the platform's own. The larger Rust items: the plan's 27 table vectors decoded from the linked plan (153 KB; read in place they would cost nothing), the node arena's columns and Taffy's three slotmaps grown by doubling (85 and 114 KB), the site index's `Deps` (186 KB), the data module's reply values (110 KB of triomphe arrays), the kept answer copied into `Store::values` (48 KB), the 90 interned `StyleProps` at 896 B (88 KB). Of the hashbrown tables, Taffy's `node_context_data` is the largest (48 and 12 KB: a `SparseSecondaryMap` of 72-byte `MeasureContext`s, one per measured leaf), then the theme index (24 KB) and the measurer's memo (20 KB). Text is in Exact's favour (`CG Raster Data` and `CoreAnimation` 0.9 MB against the port's 1.65 MB).
- **What euxy's playing costs on iOS that its UIKit port's does not, about 0.7 MB** (2026-10-20, port 17, Release, a fresh iPhone 17 simulator; idle → playing 10 s: Exact +1.0 MB before the 2026-10-20 cuts, +0.7 after, UIKit +0.0). Flat over 80 s of playing, so nothing accumulates: not the sampler, the MIDI queue, `sent`, Hermes or the runner's per-tick state. It is what `if live` realizes: 141 step lights (ember and lit), each a box with a `box-shadow` and its own `animation` on a clock timeline, about 7 KB of footprint each; UIKit's port draws its strip with Core Graphics. Of the malloc growth (MallocStackLogging, play − idle, 1.5 MB before the cuts): the kernel's styles 0.37 MB (each light's `animation` delay makes its whole style unique: an 896-byte `StyleProps`, a 640-byte cold group carrying the animation and the shadow, the animation's own vectors), the runner's instances 0.16 MB, the motion engine's plays 0.15 MB, shadows 0.2 MB (now a container, its mask and two path copies Core Animation makes on `setShadowPath`/`setPath`, about 0.9 KB a box), `NodeView`s and their layers 0.1 MB, taffy's per-node replay records and a table doubling 0.09 MB, UIKit rebuilding its main menu's default commands 0.13 MB, and the wake lock's scene settings 0.07 MB (UIKit's port pays that too). The next cut is the styles: the `animation` row held apart from the interned style (as `Rare` and `Cold` are, interned by itself), so lights that differ only in delay share one `StyleProps` and cold group, about 0.2 MB here.
- **Euxy port 18's non-object malloc on iOS, what is left after the 2026-10-21 cuts** (Release, a fresh iPhone 17 simulator, idle 10 s after launch; `heap -s` against the UIKit port: non-object 5.00 MB in 25,250 blocks against 2.72 MB; `MallocStackLogging=lite`, `malloc_history -allBySize` through `c++filt`). The difference is Rust (1.9 MB before the cuts) and Hermes' own malloc (about 0.4 MB: code blocks 100 KB, pinned-value and weak-slot chunks 90 KB, the identifier table 48 KB). The default zone also holds 3.2 MB free in pages it keeps against the UIKit port's 2.4 MB; `malloc_zone_pressure_relief` returns none of it (no page is wholly free), and an untouched `calloc` (the MIDI input ring, 80 KB) costs nothing. Cut: the dependency table holds each distinct read set once (194 to 78 KB), the plan's `bindings` and `nodes` are read in the linked plan's bytes (162 to 34 KB), a node's `notEnabled` trait is set only on change; footprint 24,430,968 to 24,160,608 bytes idle and 25,373,036 to 25,094,508 playing, `EUXY_TTI` 1232 to 1229 ms. Then a realized `Child` at 128 bytes: Apple's allocator rounds a request above 128 bytes up to a class (160, 192, 224, …), and about 450 one-child vectors moved down one; footprint 24,217,976 to 23,996,780 bytes idle (medians of 12) and 25,233,784 to 24,906,104 playing (9), warm `EUXY_TTI` 1227 to 1222 ms. How to measure: install each build in turn over one bundle id (one data container) and rotate the order each round. The same binary under two bundle ids read up to 350 KB apart, and the first build of a round read 50 to 200 KB high; footprint moves in 16 KB pages with a spread of about 150 KB, so a cut under about 100 KB shows only in `heap -s`. Tried and not kept: Hermes' `kReleaseUnusedYoungOnFull` (this Hades has no path that releases memory: no change); a full collection between calls after every 32 KB allocated (Hermes' dirty 1,728 to 1,504 KB, the default zone up about as much: footprint flat); every Rust allocation in a malloc zone of its own (the default zone 1.7 MB less dirty, the Rust zone 2.6 MB at 39% free: 0.9 MB worse, so the default zone's free space is mostly not Rust's); Swift's style decoder sharing nested values and long strings across styles (`BatchValue` arrays 571 to 162, string storage 1,297 to 799, live heap 77 KB less, footprint 150 KB more). 2026-10-21, later, euxy port 20 (one bundle id, rotated order; live heap by `heap -s` with no stack logging, since `MallocStackLogging` moves blocks up a size class; medians of 12): a node keeps the last values of only the bindings that can change (3,652 of euxy's 3,974 are constant and read from the site index), -45 KB idle and -98 KB playing; `aspect_ratio`, `column_width` and `placeholder_color` are rare rows (`StyleProps` 864 B, the 896-byte class), -27 and -23; a `Mirror` is 128 B with static prop names, -34 and -40; Swift's `StyleCache` keeps two hashes of a style's bytes, not the bytes, -26 and -43; Taffy's grid fields and `multicol` are allocated only when set (`Style` 256 B, EXACT PATCH 62), -20 and -28. Together -155 KB idle and -232 KB playing; `footprint` 23,832,940 to 23,398,764 bytes idle and 24,643,936 to 24,201,580 playing (spread about 150 KB); `EUXY_TTI` 1,138.5 to 1,136.5 ms (medians of 20). Tried and dropped: reserving 512 slots in the arena columns and Taffy's slotmaps at the first create measured no different (medians of 8), so the doubling slack in those large blocks is not resident: their untouched pages are never dirtied, and only the bytes written count. Left, by owner (KB): Hermes' young generation, whose pages Hades keeps at their high-water (960 dirty, set by Ibex's hardening, 966 KB allocated in two steps, and euxy's `factoryPatterns` call, 550 KB); the runner's realized children 125 (a `Child` is 128 B, the `NodeInst` inline; its rarely set `last_surface`, `collection` and `implied` behind one pointer would bring it to 104) and its constant values 39 (a `BTreeMap` of the bindings evaluated), the kernel's interned styles 82 (88 `StyleProps` of 864 B; under 752 B they would take the 768-byte class, but what is left is common or inherited, `FontVariations` 68 B inline by design), Taffy's caches 86 and replay records 48 (one hashbrown table of `Replay`s, each a whole `LayoutInput` and `LayoutOutput`), the host's mirrors 64 and their props maps 25, the host's `StyleTexts` 48 (the presenter's cache no longer copies them), the store's kept bytes 48 (two values read whole, beside their parsed copies), the data module's reply values 77, the plan's other decoded tables 34 (`LENT_TABLES` in plan/build.rs takes more), the runtime `Entry` 48, the theme index 24. Swift's typed objects are the rest of the gap: `NodeView` 256 × 768 B, style dictionaries and `BatchValue` arrays 175 KB, and the associated object table at 96 KB (UIKit associates one per first `addSubview` of a view, so it follows the view count). 2026-10-21, later still, euxy port 21 (same method, medians of 10 to 12): a realized `Child` is 112 B, its list engine, surface inputs and implied rows in one boxed `Rare` (-12 KB idle, -18 to -25 playing); a style's own arrays and objects, its keys and long ASCII strings are shared across styles by their bytes in `BatchReader`, and a style with an escape is no longer cached (-50 and -60; footprint flat within its spread, as the earlier two-bundle-id trial's 150 KB more was not); a parent whose children all paint at rank 0 keeps no `DensePaintRanks` table (115 on the first screen; -15 and -12). `footprint` 23,267,680 to 23,128,428 bytes idle and 24,643,948 to 24,291,692 playing; `EUXY_TTI` 1,234.5 to 1,229.5 ms (spread about 20). Measured and left: the kernel's interned `StyleProps` reach the 768-byte class only at 752 B or less, which no single row move gives; `Paint::Url`'s id and fallback boxed (-32 for `fill` and `stroke`), `MarkerRef` thin (-24) and `font_variation_settings` boxed in the style row (-60, though runs carry `FontVariations` by value) together make 744 B, for about 12 KB. Taffy's `Replay` table holds about 220 records of 120 B in a 256-bucket table (33 KB written): boxing the record saves under 5 KB. The runner's constants as a sorted vector would save about 15 KB at an O(n) insert per constant. `TextSpecs` is 1,280 B (25 on euxy) for its two inline `Spec`s, each with an inline strut `Run`.
- **Euxy's footprint grows 14 MB when its Patterns tab first opens** (2026-10-17, development build on an iPhone 17 simulator, driven by the agent: 26.9 MB on the Sequencer tab after playing, 40 to 45 MB once Patterns and Settings have been shown, about 42 MB after; Hermes is not it). Unmeasured on a Release build and not yet attributed: find what the list's first presentation keeps (`vmmap` by region, then `malloc_history`).
  2026-10-22 (lane q1022/d3): euxy is not on this Mac; Caltrain Release on an iPhone 18 Pro, driven by real touches, loses about 11 MB on first list presentation (CoreAnimation, CG raster and CG image allocations) and returns to 32 KB above launch; no host leak shown, so nothing changed.
- **Files in a share on Android, and what LLP 1125 D12 left unseen** (2026-10-16, stage 5): Android refuses `share(files=…)` by name (`host/linux/src/presenter/requests.rs`); carrying it needs a `FileProvider` in the Canvas host's manifest, the presenter's app roots as content URIs on an `ACTION_SEND_MULTIPLE`, and a picture from the Canvas renderer. Not seen: a real browser's `navigator.share({files})` (only a fake navigator), the outcome line of a file picked in a real Apple sheet, and Safari's activation window after the store reads. An Apple share's scratch PNG directory stays in the temporary directory when the app quits with the sheet open. Two sessions of one app in one process (the sample host, LLP 1031) share one set of pinned app roots, keyed by the roots' paths: if the app's data directory is swapped between their activations, the first session's share reads the second's pinned tree (Astra's confirmation of `46efcc152`; keep the handles per storage activation).
- **Lean navigation tabs still need reload carry** (2026-10-17, LLP 1075.003 §9.14). Model `carry_panels`: retain a built panel’s component state across reload even when that panel is not rebuilt at the reload, including successive reloads before its next selection. `runner/tests/it/tabs.rs` covers it; the semantics has no reload at all (`Contract/Runtime.lean`, `Contract/CompSem.lean`, the observation's events), so a reload comes first. Prerender's `build_every_tab` is modelled (`Oracle.everyTab`, the corpus's `(prerendered)` variants).
- **LLP 1125 D11's host wake locks** (2026-10-16, stage 1b): Android's kind-8 `setKeepScreenOn` was written and not run on a device or emulator, and neither web target's lock was seen held in a real browser's wake lock (the glue's test stands a counting `navigator.wakeLock` in). Natively an element the host shows as its own control (a header in the navigation bar, a confirmation as a native alert, a menu as a native menu) holds nothing, because a whole host cover marks both what the host hides and what it shows natively and the kernel cannot tell them apart; the web holds there.
- **The wasm page still loses a `play` or `ended` an autoplaying element fires before its data executor is ready** (2026-10-16). The media glue now attaches once `moduleReady` resolves and reports the metadata, duration, opening seek, `canplay` and an error the element already has (Video Player's lost opening duration, reproduced on main with activation delayed 1.5 s: 37 failures, 0 after). The presenter sets `autoplay` as an attribute at once, so a muted autoplaying element can start, and a short one end, before then; before this change the report callback dropped those too. Holding the attribute until attaching does not work (HTML acts on `autoplay` only on reaching HAVE_ENOUGH_DATA); reporting `play`/`ended` on attaching would.
  Tried 2026-10-16 and parked (branch `q1013/w5-wasm-autoplay-events` on the Mac Studio, four review rounds). Inferring what already happened from `paused`/`ended`/`readyState`/`played`/`seeking` at attach and suppressing the queued duplicates failed every round (a `waiting` before attach, seeks, a pause during attach, HTML's completion interval). Recording the events instead (a recorder set where `glue.js` and `host/web-js/media.js` give the element `autoplay`, replayed in order by `media-glue.js`) is small and fixes those, but replay still needs: recorded history dropped when the source changes or reloads (else an old source's `error` reaches the new one), recorded `timeupdate` not written back through a `currentTime` binding (it rewinds the playhead), the attach-time `ended` guard not consuming a `paused` true→false the app set before attach, and no `currentTime` write while `readyState` is 0 during replay. Take the recorder, with those four, as the next attempt.
  Tried again 2026-10-17 with the recorder and parked (branch `q24/wasm-media-early-play` on expo-build-450b, four commits, four review rounds). The recorder holds: a one-line `recordMedia` at the end of `host/web/navigation.js` (the only boot module with room; glue.js is at 1,499 lines), replay through `media-glue.js`'s listener path, history dropped on a `src` change, `load()` or `emptied`, a replayed `timeupdate` kept from seeking the player back, retirement during replay, the opening seek reported as main reports it; 47 media tests pass on the branch. What did not converge is replaying `play`/`playing`/`pause`/`ended` into handlers that write `paused`: the replay arrives after the app moved, so history and the app's newer request collide, and every rule tried (per-event versions, a pending-request counter) met a new case in review: a request made by a replay handler during the replay, a request the element already meets (no fresh `play()`/`pause()` event follows), a `pause`/`ended` HTML still has queued when the listeners attach. Next attempt, if any: deliver the early reports in order with the app's own inputs (the runner or glue queues them while `inputReady` is false, as one timeline) instead of replaying them at attach.

- **iOS cold start: euxy's Exact port still reaches its boot animation's end later than its SwiftUI and UIKit ports** (2026-10-16, Release, a fresh iPhone 17 simulator, 10 interleaved launches to `EUXY_TTI`: Exact 1455 ms, SwiftUI 1221, UIKit 1317; process start to `main` is not it: Exact 173 to 187 ms, UIKit 3 to 8 ms less, SwiftUI about 20 ms more, with the same 506 images loaded as UIKit's; what Exact has more is its executable's own 34,000 chained fixups against 6,600, mostly Rust and Swift pointer tables in `__DATA_CONST`, and stripping its symbols changes nothing measurable). Exact's first draw is about 195 ms after `main`, the boot animation's 900 ms follow it. On main in that first frame, by Time Profiler: (1) `UINavigationBar` loads SwiftUI on first use (30 to 60 ms in the simulator); background-loading it does not help, its image registration holding the Objective-C runtime lock while main waits. (2) After the boot's `fit`, `OwnerBlocks.publish` tells the routes' blocks as a batch of its own, whose apply forces a UIKit layout of the hierarchy (`NavigationHost.sync`, about 8 ms): they could go to the runtime with the view's change (`exact_view`). (3) euxy's module builds an `AVAudioPlayerNode` and sets the audio session's category in `init`, made with its `firstFrame` views (about 15 ms; `docs/recipes/native-views.md` now says not to).
  2026-10-22 (lane q1022/d3): euxy and its hand-built ports are not on this Mac; measured on Native Fixture instead: a route resize applies two batches (median 11.2 ms, 2 navigation syncs); skipping navigation projection during geometry-only reports did not reduce the syncs and was reverted. A fix needs the view and route blocks under one runtime layout with UIKit's containing bounds established first.
- **Exact's game holds 160 MB of graphics memory on a Pixel 5 against the WebView's 40** (2026-10-16, `game/bench/README.md`, "Memory and CPU at 60 Hz"). The direct path's 4× MSAA targets are already `TRANSIENT_ATTACHMENT`, but this driver (2020-11-30) has no lazily allocated memory type and no `VK_EXT_multisampled_render_to_single_sampled`, the Vulkan form of the GLES extension that keeps the WebView's MSAA in tile memory; a newer Adreno driver may have either, and wgpu-hal would need the second added. The hardware-buffer ring's six slots are another 60 MB: five collapse 80,000 cubes to 26 fps.
- **Exact's occlusion at 256,000 cubes on a Pixel 5: 30.6 fps exact, 35.0 with unshrunk occluders** (2026-10-16, `game/render/README.md`, "Occlusion"). Shrinking each occluder by a texel keeps the frame identical but costs a texel-wide rim of every small far cube: 42,000 cubes drawn against 18,000. Closing the gap without giving up exactness: occluders drawn from an 8-vertex mesh (the pass's 4.7 ms is vertex work), a cull that reads less than two 40-byte transform records per item (it is memory-bound: 9.1 ms), and presenting the canvas's buffers through `ASurfaceControl` rather than drawing them as a bitmap in the reader's pass (2 ms of GPU a frame, measured by not drawing it).
- **A 60 Hz tick of 256,000 moving entities takes 5–6 ms on a Pixel 5, bound by memory** (2026-10-16, the cubes bench's `tick`): 56 bytes read and 40 written per entity, and its 10 MB upload another 3 ms. Two ticks and two uploads then fill a display frame. Copying the pages into staging on another core while the next tick runs is the next lever.
- **Castle Town faults the Pixel 5's GPU, and Android does not recover a lost device** (2026-10-17, castle-fixgpu). Since round 10 the Adreno driver reports recovered GPU faults in the module's context (`IOCTL_KGSL_GPU_COMMAND ... errno 71`, the error KGSL gives a context's next submission after a fault): cold starts with `screenrecord` running, round 9's freeplay build 0 of 5 runs, round 10's 3 of 5, rounds 13–16 and this branch every run (2 to 8 a run; fewer without `screenrecord`). About one cold start in nine the device is then lost; that used to abort the process (vendored wgpu-hal patch 12 fixes the abort), and now the canvas stops, because the Android presenter never calls `gpu_recover` nor attaches its windows again. Round 10's "absent shadows on launch" and round 13's "buffered canvases stop producing frames" below may be the same faults; the round 16 SPIR-V validation errors (workgroup array strides) are a lead. Bisect round 10 (`c96ac1c9d` render scale, `15edcd90d` ground cut, or what they exposed), and give the Android presenter recovery as Apple's has (`Module::recover` reattaches Apple layers; an Android canvas would need its `ANativeWindow` attached again). Logcats: the castle-fixgpu lane's scratchpad `fixgpu-phone/`.
- **What castle-fixgpu left in the GPU module** (2026-10-17). (1) Under the agent's clock a canvas acquires on the module's thread and waits for the image, so an Android `surfaceDestroyed` arriving then waits on the compositor through `Owner.sync`; live frames no longer do (detach hangs up on the acquisition thread, a resize waits for its image to land). Attaching a window joins retired acquisition threads first (Android refuses a second swapchain on a window still connected to one), bounded by wgpu's one-second acquire timeout. (2) The cached sun-shadow copy kept for GL and WebGL2 (`shadow_cache::seeds`) is tested only by forcing it on Metal; exact2 compiles no GL backend today.
- **A GPU artifact can be unloaded while its acquisition threads still run** (2026-10-17, castle-fixgpu2; Astra's review of castle-fixgpu, finding 2). `Module::drop` joins only acquisition threads that have ended and lets the rest go (`gpu/src/release.rs`), so `gpu_unload` can return while a thread is still inside an acquisition in the artifact's code; the Linux host's `Abi` then drops its `Library` (`host/linux/src/surfaces.rs`, `dlclose`). Android keeps the primary artifact loaded for the process; a secondary artifact has no such hold. Keep an artifact loaded until its threads have ended, distinguishing a canvas's detach, which must not wait, from the module's final shutdown.
- **WebGPU canvases configure as opaque whatever they promise** (2026-10-17, castle-fixgpu2; Astra's review of castle-fixgpu, finding 4). The pinned wgpu 30.0.1 WebGPU backend lists only `Opaque` in a canvas's capabilities (`src/backend/webgpu.rs:4176`) although its `configure` maps `PreMultiplied` to the browser's premultiplied mode (`:4231`), so `target::alpha_mode` picks `Opaque` for every browser canvas and a translucent surface loses its alpha over page content. List `PreMultiplied` there (a vendored patch, as for wgpu-hal), keeping the module's choice among listed modes.
- **Castle Town 90 Hz headroom** (2026-10-17, `game/bench/README.md`, round 16). In-pass sun-cache seeding (`e922c05f7`) saves 0.184/0.182 ms in views 0/1 and preserves fixed-pose pixels. Final full-resolution 1080×2340, 24 players: view 0 is 89.39 fps with five missed slots in ten seconds, view 7 misses one, all others miss none. View 0 mean delivery is 11.187 ms, about 0.076 ms over the nominal budget before variance headroom. Omitting avatars plus hulls removes 0.772 ms of its 1.266 ms camera-cost difference against view 2; separate body and hull cost next. COLOR_ATTACHMENT_OUTPUT acquire waits leave the median ~0.23 ms GPU gap and do not improve fps; latency 3 allocates five images (default already four) and regresses. Keep the prepass, Depth32Float, 35 m shadows and full resolution. Hardware utilization and the remaining gap's cause remain unmeasured.
- **Pixel 5 Vulkan SPIR-V validation errors in the existing game shaders** (2026-10-17, Castle round 16). Khronos Android validation 1.4.363.0 reports `VUID-StandaloneSpirv-None-10684` for workgroup array strides and `VUID-VkShaderModuleCreateInfo-pCode-08737` for a vector constant with mismatched component types. Both occur with the original TOP_OF_PIPE acquire path as well as the rejected COLOR path; synchronization validation reports no SYNC hazards. Reproduce and fix the generated SPIR-V, then rerun validation. Evidence: `castle-port:game/games/castle-town/artifacts/perf/r16/validation-summary.json` and its logcats.
- **Android buffered GPU canvases sometimes stop producing frames** (2026-10-17, Castle round 13). The baseline attempt, 30 m trial at view 8 and original-assets 35 m tour at view 5 stalled while the app stayed in front and the phone awake; CPU fell to about 52 ms/s and no next tour log arrived. Relaunches run normally. No cause is established; invalid rows are excluded. Three SurfaceView tours completed in round 13; no foreground stall recurred in round 14, whose bench captures debuggerd and logcat before restarting a stalled run. Evidence: `castle-port:game/games/castle-town/artifacts/perf/r13/final-buffer-stall-logcat.txt` and the receipt.
- **Castle Town intermittent absent shadows on launch** (2026-10-17, round 10). The first 0.9-scale tour lacked shadows; the identical APK restored them on relaunch. The forward shaders match the full-size build, and the failed launch still reports a sun pass. Its performance rows are marked visually rejected. Investigate startup/resource ordering; no cause is established. Evidence: `castle-port:game/games/castle-town/artifacts/perf/r10/{shadow-compare,shadow-repeat}.png`.
- **A GPU canvas over children draws nothing on the Android reader** (2026-10-16, Pixel 5). With Caltrain's module now packaged (`agent-android.mjs build caltrain --apk`), its sky (`glass`, a canvas whose content is its children) is blank and logs nothing, while the cubes game's world (a canvas without children) draws. Likely cause, read and not confirmed: the Linux host's presenter hands each child to `gpu_child_view` with no pixels (`host/linux/src/surfaces.rs`), and Android runs that presenter. Capture the children's pixels there, or have the reader hand the module its own layer of them.
- **Document watches still owed after LLP 1069.010.000 stage 1** (2026-10-16): iOS has none (`NSFilePresenter` on the document's URL, a vnode source for local files; `host/apple/src/doc_watch.rs` is FSEvents on macOS only); a Rust source's `doc:` watch on the web JS target announces nothing, because no Rust topic is wired there (`native.watch` from Rust is not either); the agent cannot announce a change (`changed <path>`, D2); `exactPage().canWatchFiles` is not built (see the RFC's "As built").
- **Kept documents, what stage 2 left** (2026-10-18; 2026-10-26): D4's hard rows driven by the Markdown editor with a fixture that replaces the file from another program; Clear Menu clicked in the real menu bar (the agent drives none); a Linux file chooser (the desktop portal's `FileChooser`), without which a Linux desktop session keeps nothing in practice.
- **`test-rust` on Windows sometimes fails to write or launch a test executable** (2026-10-09, the same diary): `LNK1104` while linking twice, and Windows error 32 (file in use) launching one; each passed on a retry with no change. Antivirus or the search indexer holding a new `.exe` is the usual cause, but none was seen. The same runs twice failed a render doctest with `E0463` (the logic crate not found), which a focused rebuild passed; those runs shared the SDK's `game/target`, which `test-rust` no longer defaults to. If either recurs, retry a launch-only sharing violation once, and say which file was held.

- **Diagnose a `transformDragFor` target that cannot bind** (2026-10-25, Excord's image viewer). A target without `box-sizing="border-box"` binds nothing and says nothing on any host (`docs/agent-pitfalls.md`, "A `transformDragFor` handle does nothing"; the second app this cost an hour, after the Signal clone). The compiler sees the target's rows: it could refuse a target or clip that breaks the conditions the kernel checks (`kernel/src/transform.rs`), naming the one that failed.
- **Warn about statically competing `transformDragFor` targets** (2026-10-15, from bsky5's Bluesky b45 lightbox fix). LLP 1071 allows one owner (first valid, never stolen). Add a compiler or `analyze` warning where two bindings are statically visible together, such as `transformDragFor` inside a list's row template.
- **The page's frames drop to one a second after `host/web-js/document-agent.test.mjs`'s first tap** (2026-10-15, at main `d1e73782d`; Chrome for Testing headless from Terminal, display on). The page draws at 60 fps until `tap('open-detail')`, then at one frame a second (`requestAnimationFrame` gaps of 1,016 ms) with the page visible, no view transition and no running animations, until a later resize. The agent's resize waits at most 250 ms for two frames, so the 420 px layout's media-query `change` has not fired when the test reads the tree, and the test failed 10 of 12 runs here. `--disable-backgrounding-occluded-windows`, `--disable-renderer-backgrounding` and `--disable-background-timer-throttling` do not prevent it. The glue step leaves the file out (`scripts/async.mjs`) until it passes. Find what the tap starts that slows the frames before changing the agent's resize wait.
- **iOS: what a popover over a dialog's sheet still lacks** (2026-10-18). A popover a modal `dialog` holds is drawn over that dialog's UIKit sheet, in a `PopoverLayer` in the sheet's presentation container (`host/apple/Sources/ExactKit/IOS/PopoverLayerIOS.swift`); `SurfacesIOS.swift` lists the session's surfaces and resolves a view's controller, and whatever enumerates either goes through it. Only a dialog that holds a popover hosts it, which is narrower than HTML: inertness does not decide paint order, and a popover opened later outside the modal paints above it there though inert ([whatwg/html#11195](https://github.com/whatwg/html/issues/11195)); here it stays under the sheet. A native screen in such a popover has no parent controller: UIKit raises `UIViewControllerHierarchyInconsistency` for a parent whose view does not hold the layer. the popover follows its sheet's scroll (2026-10-22) but a drag of the sheet itself only at the next batch; inertness authored around the popover inside the dialog does not cross the lift; content taller than the room above the keyboard needs its own scrolling.
- **Native point reads omit a modal dialog's backdrop** (2026-10-16, Chrome/AppKit modal-read scratch comparison). Outside the front dialog's border box, Chrome's `elementFromPoint` names that dialog through its `::backdrop`, while the runner returns none; `elementsFromPoint` likewise omits the backdrop's dialog hit below a popover outside the dialog's box. The modal boundary now prevents reads reaching the page or a lower dialog. Backdrop hits still need to follow the host's actual presentation and pointer-event behavior.
- **Finish native clear-colour projection (LLP 1115.000 D2).** Button faces select title rows by value mask, losing explicit clear-only colour intent: UIKit retains accent and AppKit retains platform ink instead of the inherited colour. Preserve genuine absence as platform-owned. Qualify navigation/window titles and Mac toolbar ink too; they retained platform ink in the clear-app captures. Evidence at `c2f5c56f1`: `~/audits/exact2-no-tells-2026-10-11/linux-neutral-chrome/integrated-clear-intent/c2f5c56f-native-source4/independent-native-review.txt` and `ordinary-visual-c2f5/independent-clear-mac-review.txt` beside it.
  2026-10-22 (lane q1022/f): button faces, UIKit titles (a transparent bar composed with its title ink) and Mac toolbar buttons (symbol and title ink resolved independently) now carry an authored colour, `transparent` included; what is left is the Mac window title's ink, withdrawn after three rounds (a436d42db7, "Withdraw the unqualified Mac window-title projection").
- **Hermetic conformance still has network TLS failures.** Paired `0d2d2e28e`/`c2f5c56f1` product steps agree, but CONNECT handshake failures vary: RealWorld appears in baseline Chrome only; Google in both WebKit runs and candidate Firefox. Identify the connecting process and verify its process-scoped trust of the generated proxy CA without bypassing certificate validation. Preserve unanswered requests and failed exits; no TLS fix is established. Reports: `~/audits/exact2-no-tells-2026-10-11/linux-neutral-chrome/integrated-clear-intent/{baseline-0d2-conformance,candidate-c2f5-conformance}/<engine>/conformance/report.json`.
- **Current cross-browser conformance findings need classification.** Firefox reports `video-player`, `styles`, `focus-bubble` and `spacing`; WebKit reports `realworld`, `startend`, `reads`, `menus`, `navroot` and `focus-bubble`. Focused runs on `8339a0057` and the web-look removal at `2e7674324` produce identical failure tuples: 158 Firefox and 75 WebKit. The original full WebKit run had 73; the two additional selection findings occur on both paired sources. Inspect the recorded deliveries before treating a difference as an engine convention. Evidence: `~/audits/exact2-no-tells-2026-10-11/web-neutral-only/paired-baseline-independent-review.txt`.
- **The optional asset-root bake fixture does not reach its asset checks** (`scripts/app-bake.test.mjs`, `EXACT_ASSET_BAKE_TEST=1`). At `178ae7237` its resolved manifest has the wrong app identity; the attempted fixture repair at `22e1a55e8` reaches generated code with a missing `exact-web-capabilities` dependency. Repairs stopped after three rounds and the fixture was restored unchanged; asset creation/rebake behavior remains unqualified. Original and attempted receipts: `~/audits/exact2-no-tells-2026-10-11/web-neutral-only/baseline-178ae7237/three-failures.log` and `runtime-round-3/browser-settings-freshness.log` beside that baseline directory.
- **`hover` and `pan` on a presented route's logical ancestor are not carried into the sheet** (2026-10-14, LLP 1123 stage 1). Pointer observers, `contextmenu` and `dblclick` on an ancestor hear a sheet's touches through its mount (`MountRelay`); `hover` does not: the ancestor's own `UIHoverGestureRecognizer` ends as an iPad pointer moves onto the sheet, and a mount-level one would race it within the same event, so the ancestor would flicker between hovered and not. Wanted: one owner of the innermost-hover decision across the document and its presentations, then the relay. A `pan` on such an ancestor would compete with the sheet's own detent drag and scrollers; it needs arbitration rules before a relay, and the agent's pan follows the real touch's physical lookup meanwhile. A `swiperight` on such an ancestor stays out: it moves the node it is on, which is behind the modal sheet.
- **LLP 1123 stage 5 owes the keyboard design review's findings** (2026-10-13, Codex's review of stage 1's keyboard handling). Stage 1 only ends a sheet's route at its keyboard layout guide; the RFC's stage 5 lists what D7's executor must answer: scroller inset versus wrapper accommodation, owner-local occupancy for reveal and the toolbar, policy precedence before a sheet's keyboard may leave the document alone, undocked and floating keyboards, reveal for every editor, and composing with `PinnedRoom` and the toolbar.
  2026-10-22 (lane q1022/g, a699805429): a native module's UIKit editor resolves to its node and reveal uses the native caret; a keyboard toolbar reads the keyboard's window position with zero overlap; hiding the keyboard removes only the toolbar's room. D7's accommodation executor, a `keyboardAvoidance` row, floating/split-keyboard avoidance and the fixed-editor owner wait on Charlie's decisions (listed in the program log of 2026-10-22).
  2026-10-23 (panel 2, Astra, Grok 4.7, Opus; `~/lanes/q1022/panel2/`): no `keyboardAvoidance` row before acceptance; the executor ships as implicit behaviour and removes `OwnersIOS.block`'s guide cut in the same change. A fixed-position editor's residual overlap shortens the innermost owner whose block is its fixed containing block, once, only under effective `resizes-content`; under `overlays-content` it stays covered, as on the web. Ruled (Charlie, 2026-10-23): an undocked, floating or split keyboard gets nothing beyond the editor's own caret scrolling (`followsUndockedKeyboard` is false by default, and no UIKit app moves content sideways); the both-axis reveal this bullet promises is withdrawn, to be revisited only if a real iPad shows a caret covered that a hand-built app would reveal.
- **The canvas through a trusted tunnel** (2026-10-19, stage 10 B2; theme2's Q3 ruling). `--trust-tunnel <port>` carries the design wire only: C's canvas gateway is TLS-only in stage 10, so a developer working through a tunnel edits the design without the canvas (LLP 1122 D12 allows it). Wanted, if asked for: a second tunnel port for the gateway (`--trust-tunnel <port>[,<canvas port>]`), with the gateway's grant and cookie rules unchanged.
- **Boxes between a placed block's parent and the view that holds it still clip it in point reads** (2026-10-14, LLP 1123 stage 1 review). A placement can be in an ancestor beyond the root's parent (`Scrolled::place`'s `within`: on iOS a tab's route is placed in the routes' owner, since UIKit's tab container holds the route beside its panel), and the runner shows the root in that ancestor directly (`shown_in`), so `frame` and the intersection observer leave the boxes between out, but `elementFromPoint`'s walk still descends through them, so a tab panel with `overflow` other than `visible` cuts its route where UIKit shows it whole (the part under a floating tab bar). Wanted: the walk enters such a root from the ancestor that holds it, past the clips of the boxes between, with a runner test of a clipping panel.

- **SVG lengths, what the viewport-unit change leaves** (2026-10-13, SVG viewport review; main already has these differences). (a) Static math and environment geometry: `host/web/src/element.rs:767` omits dimensions other than points, percent and the four admitted viewport units. A nested SVG's `height="calc(10vh + 10px)"` or `height="env(viewport-segment-height 1 0, 25%)"` uses the initial viewport on the web, including its document, while native resolves the length. `min()`/`max()`/`clamp()`, safe-area `env()` and `sv`/`lv`/`dv` units have the same gap unless the kernel simplifies them to points or percent. Dynamic JS geometry keeps main's CSS path (`host/web-js/svg-transform.js:13`): a nested SVG's CSS `height` does not size its viewport, while a `foreignObject` takes it; browser support for segment `env()` fallbacks also differs. (b) Paint-server templates: omitting an undefined dimension (`host/web/src/element.rs:767`) exposes the `href` template's value. A radial gradient with `href="#base"` and `cx="env(viewport-segment-width 1 0)"`, where `base` has `cx="20%"`, uses 20% on the web when segment (1, 0) is absent; the kernel selects the authored row and uses its initial 50% (`kernel/src/svg/server.rs:136`, `kernel/src/svg/server.rs:176`). (d) Static font-relative geometry and hairlines: the kernel converts `em`/`rem` and `-exact-hairline` to points before `host/web/src/element.rs:748`; main emits these numbers rather than omitting them. The JS template (`host/web/src/template.rs:56`) keeps the build's pixels: a nested `svg height="2em"` stays 32 when its font size changes, and a pattern's static hairline stays 1 at 2x, while native and the wasm host recompute them. Dynamic JS hairlines use main's CSS resolution steps, so 1.25x uses 1 CSS px instead of native's 0.8.

- **Chrome retains SVG viewport attribute geometry after window resize** (2026-10-13, SVG viewport verification; browser limitation reproduced without Exact). In an 800x600 window, a fixed 400x400 SVG containing `<svg width="10vw" height="10vh"><rect width="100%" height="100%"/></svg>` draws at 80x60. After resizing the window to 200x400, Chrome's length API reports 20x40 but its drawn box remains 80x60; WebKit and Firefox update it. The literal viewport attributes written by `host/web/src/element.rs:754` and `host/web-js/svg-transform.js:12` inherit this limitation. Main omitted static viewport attributes and wrote dynamic geometry as CSS, so this is a limitation of the newly admitted form, not a regression of a working main case. Native scenes resolve against the resized window.

- **Refuse dynamic SVG attribute-only lengths at runtime** (2026-10-17; LLP 1055.000 D4). Contract refuses deferred units and function text in literals, template text and conditional literals on line/linearGradient `x1`/`y1`/`x2`/`y2`, radialGradient `fx`/`fy`/`fr`, marker `markerWidth`/`markerHeight`/`refX`/`refY`, and SVG text/tspan `x`/`y`/`dx`/`dy`. Bound values, incomplete template or concatenation tokens, and expressions beyond the static check’s 4,096-visit budget can still send relative lengths to the web that native `Length::parse` ignores. The SVG scene consumers have no warning path; add validation at a shared runtime boundary with a named diagnostic. CSS geometry, `offset`, `orient` and filter primitive attributes are separate.

- **Resolved: EX3 native unbound-handle logout — one-round waiver (2026-10-12).** The coordinator acting for the repo owner granted exactly one additional round after the RULES.md three-round limit, with a stop-if-NOT-READY instruction. Logout now retires matching origin/principal partitions even when the caller has no held partition. The real-server regression covers private cached reads, authenticated and manual-headers siblings, same-account relogin, and old-handle closure. Full live suite: 24 passed / 285 assertions; dev and serve scratch browser tests passed. Both fresh confirmation reviews are READY: Codex's and Muse's (`llp/reviews/1086-wave8-ex3-waiver.codex.md`, `llp/reviews/1086-wave8-ex3-waiver.muse.md`). The P1 is closed; no further round taken. This resolved record is retained at the coordinator's explicit request. Original finding: round 3 (`llp/reviews/1086-wave8-ex3-r3.codex.md`).
- **Wave 8 E5: an online-only Snapback driver over the browser journal.** Deferred from EX3: the current shared Rust device and native module have no device-free opening. Add an explicit online mode once the journal wire/identity contract is available to all Exact executors; it needs its own design and offline semantics, rather than silently bypassing the device. The app still builds the ~2.3 MB wasm meanwhile.
- **Wave 8 E9: grouped-list columns on day-two lane 006.** Deferred from EX3: reproduce on the same native presenter and app before changing cell projection; this workstream ran on Linux/Chrome and did not have the required Apple launch. The password helpers do not resolve inherited persona-specific tests; authors must update those tests when switching identity modes.

- **No runnable Exact+Snapback app in `apps/`** (2026-10-11, the sb4 farm's wave 2: 088; 051 found `select` driving only in the guestbook). The snapback4 README's guestbook builds and passes both its tests as written (extracted into a scratch app against 0.4.17, with `Snapback.switcher`, a `missing` and a positional testId), and `scripts/snapback-handshake.test.mjs` now extracts and rechecks both complete guestbooks against the pinned public-registry package (EX8, 2026-10-16). There is still no in-repo app: an `apps/` copy needs a backend, the device's wasm built from this checkout and a running `snapback4 dev`, which neither the gate nor the async lane has, and a README-extraction test would need Chrome as well. Which, if either, is a human's call (rules: agents add no apparatus).
- **Remaining Snapback media work (EX8, 2026-10-16).** Durable upload-and-place now uses the device outbox and sync round, including lost replies and reopen. Still owed from LLP 1108: retained/purged download caching, once-assets in memory, server upload inventory UI, and chunked custody above Exact’s current 4 MiB durable-upload limit.
- **A tap on a file `input` holds no picker under the agent** (2026-10-12, sb4 farm wave 7: 006, 3 minutes; E6). Only `showPicker("<id>")` from an action holds one, so `tap "<the input>"` then `pick` answers `held: none`; the snapback4 README now says to tap the button whose action calls `showPicker`. Holding a picker for a tapped file input (the web glue, as a person's click opens the system's) would make the obvious test work; 040 also had to join four references for a PDF picker (grammar, the file-pickers corpus, Documents, test pick syntax), which one worked example would cover.
- **A named agent store reported busy after an interrupted drive** (2026-10-11, wave 4: 053, 089; 3 minutes). Not reproduced here: an interrupted drive could not be staged (a drive's virtual clock ends it in seconds). The lock is a live page's Web Lock (`host/web/storage-fs.js`), so the likely holder is a Chrome from the earlier drive still running on that store's profile; a drive could refuse up front naming that Chrome's pid, from the profile's `SingletonLock`.
- **A shell's wrong directory still costs a build a minute** (2026-10-11, wave 2: 019 048 061 093 094 096 099). `exact.mjs` resolves a named file from either directory, but the slips left are shell redirects (`cat > app/app.contract` from inside the app): bash refuses them, and the next `contract build` checks the untouched file and prints `[]`. A stderr line naming the file checked and how long ago it changed (`app.contract, changed 14 min ago`) would contradict a write the agent believes it made; not done, as it adds a line to every call.

- **The Mac's split, what is owed** (2026-10-13, LLP 1115.002 D4, stage 6b's as-built; `runner/src/runner/split.rs`, `host/apple/Sources/ExactKit/Mac/SplitMac.swift`, `SidebarViewsMac.swift`; records in `~/audits/exact2-no-tells-2026-10-11/mac-split/`). (1) **The rule cannot tell a push from a Back or a sheet** when a row's `press` is an action: the plan holds an action's write set and no more, so a list whose rows only open sheets, or go back, splits with a pane that stays empty until its author says `navigationSplit="none"`. The route table also lacks an unmounted destination's presentation, and the recursive outer-press rule has no logical row-accessory boundary. Evaluate static modal destinations and nested row accessories across all hosts before changing this shared rule. The compiler knows which verb an action calls; the table's arrow key wants the same fact (below). (2) **Shelf now splits, but selecting another book pushes its route over the previous detail.** Its library is a `list` (LLP 1115.000 D16) and its unchanged test file passes 12 of 12 in both Mac chromes, including swipe deletion. Its `follow` still uses `go`; changing the selected book should use the list-detail pattern's `replace`. (3) **The page's view is the list's column**, so `vw`, and a width an app reads, are the column's while a stack splits (LLP 1115.002 D8.2 item 7 says the window's): the kernel's viewport is the page's view, and telling it the window's needs the root's block to be its pane. Chrome an app lays out around its stack inside the navigation root (a bar under every route) stays in the list's column for the same reason. (5) **The selected row** (a table's, or a painted list's drawn by `SplitHost.mark`). (a) A route is a row's detail by a `link` or by the row's press: one that comes any other way while the rows' press is an action (a link that arrives, Excord's ⌘K switcher) has no row selected. (b) Whether a press writes the router is its action's write set, not what the press did: a row whose action navigates only sometimes takes the shown detail when it does not. The runner knows what an activation wrote. (c) The host names the row by its press's view, so a windowed list's row that unmounts and mounts again comes back unselected; LLP 1127's association, by plan site and instance path, would keep it. (d) A click on a painted row leaves the keyboard where it was (LLP 1115.000 D7.1), so after a field had it the selection is grey, where a table takes first responder. (e) A painted selection does not slide with its swipe row. (f) A person has not compared the painted selection in a key window, or inside a grouped list's card, with a hand-built screen. (6) **Dark Mode's grounds differ in a split:** AppKit tints the window's own ground with the desktop (`#2c2a29` on this Mac) and a box painted in the window's background role is flat (`#1e1e1e`), so a detail that is a grouped form is darker than the list beside it. The same was found in a sheet (LLP 1115.002 D7.4); a painted role cannot be the tinted ground. (7) **The driver:** a plain `screenshot` is the page's view, the list's column; `check`, `sample`, `hover` and `tree --ax` were not run across the two panes; the pane's routes are the pane's accessibility children, not the page's. (8) **The other reading of Q10** is `SplitHost.listOwnsWindow`: run once on a scratch app with the constant turned (pictures in the records), held by no test. (9) Needs a person at a Mac: a drag of the divider and of the window's edge, the selected row's emphasis in a key window, the bar's items moving as a detail comes, a real Command-click to take the selection off, full screen, a 2x display, VoiceOver across the panes. (10) Not built: the iPad's half (the same rule, `UISplitViewController`). The web's stage 6d move and its test boundaries are recorded in LLP 1115.002 D4; integrated browser receipts live under `~/audits/exact2-no-tells-2026-10-11/web-split-prep/`.
  2026-10-22 (lane q1022/b3, 47c581d58d, 006e16796d, 6bf174382c): the agent reads both panes (screenshot, sample, hover, AX) in the page's coordinate space; implicit split grounds are AppKit's. The rest of the list remains.


- **Two things red on main that the list-rows lane met and left** (2026-10-13, on `40c6595df` with LLP 1115.000 D16 over it; none is in what that lane changed). (1) `bun scripts/smoke.mjs ios` on a freshly made iPhone 17 Pro simulator (iOS 27.0) reports seven failures, the same seven with the lane's press-path hooks taken out: Enter's key hint at the field, the canvas 1.25% beyond its reference's band, a tap under the keyboard, and four of the retained editor's focus. Not looked into; a new simulator's keyboard setting is the first thing to rule out. (2) Shelf's own test file fails now and then with `2 requests still in flight: works, changed` at a `clock data` step: once in four runs on the Mac under the driver's chrome (`a swipe deletes`) and once in six on iOS, at a first launch (`a book: progress clamps…`), each passing when run again. `works` is Discover's fetch to Open Library, asked at launch on every tab.
- **A list's rows as cells, what is owed** (2026-10-13, LLP 1115.000 D16's as-built row; `contract/lower/src/cells.rs`, `kernel/src/rows.rs`, `host/apple/Sources/ExactKit/IOS/RowCellsIOS.swift`, `host/web/neutral.css`, `host/linux/src/paint/neutral.rs`; records in `~/audits/exact2-no-tells-2026-10-11/d16/`). (1) **The real UIKit-cell gate failed; ordinary lists remain painted.** The fixture implementation stays unlanded on `no-tells/ios-cells-gate-2026-10-13` at `f6f754da6`: the old collection survives the unchanged five-second release condition after session destruction and queued work, both in the combined 19-test run and alone with the identical binary. The feed releases; identify the collection's retaining owner before reopening the gate. Three lifetime repair rounds and seven extra are spent. **Ruled 2026-10-16** (Charlie asked for a decision; GPT-6 Astra, Grok 4.7 and Fable each recommended it): drawn rows stay, and the iOS tells on every screen go first (half-pixel edges, the status bar, the keyboard over a bar, type). Then a teardown-only investigation of three rounds names the retaining owner, starting from the grouped list's collection scroller (#502), before any adoption; drawn rows do not grow editing or multiple selection meanwhile, and VoiceOver list traits are worth a small slice if cheap. An earlier native-cell empty-editor hold also omitted AutoFill where the painted fixture and UIKit reference showed it. Latest-source delivered-touch reorder, paired release performance and the full landing matrix remain unqualified. Any later adoption must also qualify the bar/large title, `scrollIntoView`, restoration, keyboard avoidance, pull to refresh and `reachend` against the replacement scroll owner. (2) **iOS, what the drawn row does not do.** A separator starts at the row's first text; a row whose first text is not its title starts there all the same. Seen with a real touch on 2026-10-23: the pressed row's ground, the row selected under the screen it pushed, and its fade following a back swipe's finger. Not measured, so not matched: what a real touch's highlight does before it is a tap, a cancelled pop, an iPad's wider margin, 120 Hz, Increase Contrast, right to left. The driver's own `tap` presses without a touch, so it selects no row; a real touch (`--touch platform`) goes through the path that does, and its selected row was not pictured. (3) **Android.** The reader draws no divider, which is a Material 3 list item's default, read from Material's specification and not measured on a phone. A press shows nothing there, on a row as on any pressable (LLP 1115.001 D9), and a row keeps its author's height where Material's is 56, 72 or 88 dp. (4) **The web.** A box whose author wrote a top or bottom border carries `data-exact-said` whether or not it is a row, since an element's attributes are written from the node alone; telling it from what holds it would take the parent at the three places attributes are made (`document.rs`, `template.rs`, the live host). A row's line is under its children, so a child with an opaque ground at the row's bottom covers it. A child of a list that is out of the flow is still a row to the sheet and to the kernel. Not seen in Safari itself or on a phone's browser. (5) **The Linux desktop.** A row that is a link has no focus ring, as a link has none anywhere on that host. Not seen on a real display or with a real mouse; Windows compiled, never run. (6) **The rule.** A `display` or `flex-direction` that is no literal leaves a list unmarked. A list of `section`s is unmarked on every host (the grouped form's `listStyle="plain"` is the sectioned plain list). A plain list has no header or footer that is no row by the rule: Shelf's count and placeholders write an edge `none`, which is the author's "no separator here" and which only iOS needs; `header` and `footer` children of a `list` could be that. The terminal host draws nothing for the mark. (7) **Apps not converted.** Only Shelf's two were a `scroll` of hand-built rows turned into a `list`; other apps whose rows are hand-built in a `scroll` (look at `messages`, `fieldnotes`, `realworld`, `todo`) were not looked at one by one.
  2026-10-22 (lane q1022/o): Parked after qualifying the current separator lifecycle and hosted-session teardown. Commits: `d17b818840`, `0d8f00a183`, `eec51f6fda`. Separators were already row-owned on main (`891fd7749c`). The new host drag test lifts a ghost, moves it, repaints separators during displacement, drops and lands it; the line stays at the row’s window-space bottom. The lifetime test boots the grouped-list fixture in a scene-hosted ExactView and destroys its session with an animated collectio
- **The Mac's table, what is owed** (2026-10-12, LLP 1115.002 D5, stage 3b's as-built; `host/apple/Sources/ExactKit/Mac/TableHostMac.swift`, `TableFeedMac.swift`, `TableInkMac.swift`; records in `~/audits/exact2-no-tells-2026-10-11/mac-table/`). (1) **The frame budget on an idle Mac, and on a 120 Hz one.** The condition was met in thirteen runs of thirteen (the table's 95th percentile 8.9 to 11.9 ms against 13.33 at a 12,000 pt/s fling, release kernel), all in the quietest stretch a shared Mac gave (load 3.5 to 7.0), and an earlier cut went over in runs made while the load climbed to 9 and 20, where today's list did not; `sh ~/audits/exact2-no-tells-2026-10-11/mac-table/scripts/rerun.sh <checkout>` measures it again. Against a 120 Hz frame (8.33 ms) neither the table nor today's list holds its 95th percentile at that fling. (2) **What the compiler must say:** whether a row's `press` action writes the router. An arrow key that reaches a navigation row presses it (SwiftUI's list of navigation links, measured); the host knows a `link` to a route and nothing else, so a row whose action pushes is only selected. `Lowerer::unsplit` already works it out for the split, and stage 6b needs the same fact on the node. (3) **What the runner must still give the table:** a row's text when it is not mounted, for type-select (a stock table finds any row, this one mounted rows). The table now uses the runner's existing item index by key so an unmounted selection follows its item while the table does not have the keyboard; disappearance ends the selection. (4) **Kept painted, each said once in the log:** a list whose rows are in `section`s (AppKit's group rows), a list inside another list's row, a list with `reorderdrop` (the lift of a reordered row should be the table's own drag, D9), and a list that is no scroller of its own was written for and never run. (5) Items coming and going reload the table (`reloadData`): its row views are made again and a row's exit animation is cut, where `insertRows` and `removeRows` would keep them. (6) A row's chevron is not drawn but its box is still laid out, so a row's text ends that much earlier than a hand-built list's. (7) Not built: an inline run's own context menu in a row, `magnify` and a drop over a row (the table is what AppKit finds under the pointer), a native control's look in a selected row, an `svg`'s role paints in a selected row, and a swipe as a Mac user expects it (Delete, or the context menu) and multiple selection, which are vocabulary (LLP 1115.002 section 4). (8) Under load the table's tail has less room than a painted list's: its row views are made in the slice that builds rows, and the same travel back up at 5,000 pt/s was over the frame in two runs of six at the default quality of service (14.2 ms at worst).
  2026-10-22 (lane q1022/b3, 0213702734, 31f3a08259): an exiting table row stays mounted in the document through cell reload, and a nested exit stays inside its authored row. Arrow-key push and type-select over unmounted rows remain.
- **A fitted text and text flow are not measured again when a typeface arrives after the first layout** (2026-10-12, found by the web look's second pass when it tried a face with `font-display: swap`; conformance's `synthetic-fit` then disagreed between the two web targets at boot by up to 41 px). Nothing in the tree can show it: LLP 1019 D5 allows a declared face only `optional` or behind a 100 ms barrier, so no face swaps in after paint, and the look's own typeface was withdrawn before it landed. The repair exists and is not landed, since it has no user: `d42768ade` on `worktree-agent-a0d07011df9723def` (both targets fit again on `document.fonts`' `loading` then `ready`, because WebKit never fires `loadingdone` for a stylesheet's face; `fit-faces.test.mjs` holds it in three engines). Take it with whatever first lets a face arrive late.
- **TalkBack on the Android reader: heard for reading, traversal, activation and an alert; four things not yet tried** (2026-10-13, LLP 1115.001 D13; Charlie, ten minutes with a Nothing Phone on Android 16: every item read once and in order by swipes, a double tap opens a book, the Remove alert reads and holds the focus). Still to try by hand, with TalkBack on and the reader's Shelf (`bun scripts/agent-android.mjs build shelf --apk`): typing in Add Book's fields (the field's name read as a hint, typed characters echoed); a checkbox or a switch saying its state when toggled; scrolling the library by two fingers and by the scroll action; the row menu. The phone used was his own, plugged into the black MacBook Pro; `com.exact.shelf.integ` was left installed on it (it was unplugged before it could be removed).
- **The not-found screen the compiler writes, what is owed** (2026-10-12, LLP 1116.009 D2; `contract/syntax/src/notfound.rs`). (1) Its words ("Not Found", "Page not found", "There is no page at", "Go Home") are English literals, outside LLP 1060's tables. (2) It is written only where the root view itself holds an `each` over a stack under the navigation root; one reached through a `use`d component gets no `notfound` row and no screen, and keeps the launch fallback to `/`. (3) The render host (`host/render/src/serve.rs`) now sees a `notfound` row for every such app, so a client-rendered app's unknown location is answered with the rendered screen and a 404 where it was the shell and a 200: check that is what a deploy wants. (4) iOS and the other native hosts were checked only through the runner's tests and the iOS simulator's `type <root> <location>`, not a cold launch at a location (no host launches a drive at one: `agent` has `--url` on the web only).
- **An app's `theme` is built on a branch and waits on one decision and one bake-off round** (2026-10-12, LLP 1095 D4 and its staging item 6, which holds what the port found; branch `worktree-agent-a3b55b60c37ad5d16`, not landed). Named colours work: Expose and the two readers ported with every compared screen identical. A role override reaches only what Exact paints from a string, so on iOS a themed app's grouped list, bar title, sheet and fields stay UIKit's (`~/audits/exact2-no-tells-2026-10-11/theme-proof/reach-shots/final-ios-light-1-grouped.png`). The decision: build LLP 1095 D1's reference table and the per-surface platform calls so an override reaches what the platform lets it, or land named colours alone and reword D4. For the round: four branded specs are drafted at `~/audits/exact2-no-tells-2026-10-11/theme-proof/branded-specs.md` (a brand as values in both schemes, a typeface, a corner shape; graded on whether it holds on every screen, sheet and bar). **Ruled 2026-10-16** (as the cells entry above): first one brand on the web alone, Exact with Tamber (LLP 1121) against React, two builds and one blinded grade, graded on whether the brand holds where its author styled; the four-brand matrix only if it does, and what the builder could not say feeds Tamber's next stage. The unsaid web look stays (LLP 1115.000 D4 part B: a more designed neutral lost blind, 147 to 41). **The probe ran 2026-10-16** (`~/audits/exact2-no-tells-2026-10-11/theme-proof/probe-20261016/`: Fern & Fig, `gpt-6.1-sol` high building each from the round's prompts, Exact at `88bf8b8a5`; a Claude grader blind to which was which, judging only the running pages). Both built every feature (Exact 9.6 min, React 7.1). React won, 8 to 6 overall and 9 to 8 on the brand. Tamber held every colour in both schemes at both widths, declared once (8 pairs and 21 role aliases in `app.tamber`); what lost points was the brand's states and shapes, which these would close before the four-brand matrix: (1) a list row's hover and press wash is the neutral grey (`#F5F3EE`), not drawn from the brand's roles; (2) a button given a face of its own has no hover; (3) a modal sheet's corners are the host's 12 px with no way to say 14; (4) the focus ring's and the selection's colours cannot be said in Contract (`outline-color` and a selection colour are refused), so the builder wrote them in a web hatch; (5) `verify`'s separate relaunch reported stored data lost while a real relaunch kept it (a different origin from the test server's, the builder suspected). Its own bugs (Enter did not submit: `submit` exists and was not used; mixed date formats; a new plant marked overdue) are not Exact's. **LLP 1129 (2026-10-18) took (2), (4) and Enter** (the starter's title saves on Enter); (3) is said where to write it, (5) was fixed already, and (1) is an author's `:hover` on the row (LLP 1121 stage 8 B), which replaces the unsaid wash. **It ran again on 2026-10-18** (`probe-20261018/`, Exact at `38d90ee5f` against the same React build, a new blind grader): **Exact won, 8 to 7 overall**, React 9 to 8 on the brand; Exact 8, 9 on platform and robustness to React's 6, 8. The builder used `AccentColor`, `Highlight`, `submit` and the sheet route's radius, wrote no hatch, and took 7.0 minutes to 9.6. What Exact lost then, since fixed: Escape closed a sheet only by a Cancel with the id `navigationBack` names (the build's had none), and a `:hover` look drew under the unsaid wash. The builder's own: a pressed colour that inverts the button, no per-field message. Seen by that lane and not fixed: on the Mac a `filled` button was not accent-coloured in the driver's pictures, with or without a theme (the driver's window is never key, which may be all it is). The research behind this is `~/audits/exact2-no-tells-2026-10-11/facet-research/facet-and-exact2.md`, which also says the looks Exact draws itself want their metrics as schema rows with a column per look: that is how LLP 1115.002's stage 4 and LLP 1115.000's D17 are to be built.
- **A warning for a field whose Enter does nothing beside its form's button** (LLP 1129 D5.2, set aside 2026-10-18 at the fix-loop limit). Built from printed expression trees, it kept misreading scope; built again on the analyzer's scoped slot reads (`contract/analyze/src/calls.rs` `slot_reads`), it names a one-line field (no `submit`, no `enterkeyhint="next"`, no key handler) when a button on the same route uses the field's value. The patch, its tests and four review rounds: `~/audits/exact2-no-tells-2026-10-11/theme-proof/llp1129-field-no-submit/`. What it found is fixed: the four apps of LLP 1129, the design tool's Rename and Add token, and RealWorld's sign-in, sign-up and settings.
- **Fewer, later steps may cost GPT builders tokens** (2026-10-13, LLP 1116.012 as built). In the A/B of D1 (`~/bakeoff/ab_report.py ab1`), paired by spec, GPT's builds took 0.80× the commands and 1.20× the tokens (1.07–1.35 at ±1 SE, six web specs); Muse's 0.79× tokens on two. If round 15 or the next A/B shows the same for GPT, restore `verify` after each feature for it (start-here's workflow line), and measure again.
- **A phone's captures lack the keyboard, and `agent check` does not model sticky boxes** (2026-10-12, found verifying LLP 1116.008 D8). (1) `withKeyboard` (host/apple/devices.mjs) puts the keyboard into a simulator's window capture; a phone's (`--device`) has none, since the phone driver captures the app's window. Xcode 27.1's `devicectl device capture` captures the device's screen, keyboard included. (2) `AgentCheckIOS.swift` reads `style["position"]` for sticky and fixed, but the key is `position_type` (which has no `fixed`), so that test never matches. Reading `position_type` instead is not the fix: whether a covered control can be scrolled clear depends on how the covering box and the covered one each move under the scroller being judged. A box declared sticky may never stick (its natural and limit boxes are equal, its insets are `auto`, or it has an inset only on the other axis); a header with 10 points of sticky travel stops sticking before what it covers scrolls out; two controls in one stuck bar, or two bars stuck at the same edge, move together; a constraint can belong to an inner scroller while the outer one is judged; and sticking clears no sideways overflow. An approach that holds: over the room the scroller has in the clearing direction, move each box inside that scroller's content by the content's offset plus the change in `StickyConstraint.offset` of the box itself and of each sticky ancestor, counting only constraints whose scroller is that one (a box outside it stays put), and count the control reachable if at some offset its middle is inside the scroller's visible port and under no cover. A stuck row is not drawn over the form when the keyboard comes up (iPhone SE simulator, iOS 27.0, platform chrome and timing, 2026-10-16): a `position="sticky" bottom=0` row at the end of a long `scroll` sits just above the keys while a field above it has the focus.
- **RealWorld's app.js: hunt for link-by-use cuts** (2026-10-12, Charlie raised its budget 38 → 45 KiB with this line): 43.45 KiB brotli-11 at fe5b26798. Find runtime code shipped to every app that only some apps use (as the file-body path and Caltrain's grant/media/event families were moved), and lower the budget when a cut lands.
- **A subtree's containing block, what is owed** (2026-10-12, LLP 1115.002 D8.2, stage 6a's proof). (1) A change inside a block is laid out from the block's root: the replay at a clipping box (`LayoutTree::prepare_boundaries`) is taken under the page's root only, because the page's pass sees every change first and a box under another engine root is none of its boundaries. The same has always held for a second arena root. A long list scrolling in a split's pane will want it. (2) The Mac reads the `block` op through the adapter path (`BatchOp.Kind.unknown`, `BlockHost.applied`), so no shared Swift moved; the iPad's half adds the kind to `Batch.swift` and takes `Runtime.blocks` out of `Mac/BlockHostMac.swift`, with the iOS tests and a tvOS build. (3) `env(safe-area-inset-*)` is one environment, the window's: an iPad sheet or column has a safe area of its own, and no block carries one. (4) A subtree in a container's view has left the page's key-view loop, its accessibility parent is the container's view, and the driver's `tap` and coordinates know one window (read, not run; the document's "As built"). Since stage 6b a split's pane is in the page's Tab order and the driver taps in it; its routes' accessibility parent is still the pane. (5) `browser_host_block.tsv` was measured by a script that is not in the repository, since an agent adds none: modelled on `fixtures/browser_paint_order.mjs`, it also reproduces `browser_containing_block.tsv`'s 155 cases. Beside the fixture it would let the cases be measured again when the rule changes. (6) A content region and a block are refused together; an exclusion shapes no text across a block's edge.
- **The Mac's text and scrolling, what is owed** (2026-10-12, LLP 1115.000 D7.7, D7.9, D8.2, D8.5). (1) Selected text's ink, the rest: an underline under a part-transparent role colour (a label tier) stays part transparent when selected, where its glyphs are solid (the recolouring keeps the line's own alpha); and a content region's role colours are its pair's, resolved in Rust, where a paragraph's are AppKit's own (before this too). (2) AppKit's own selected-text menu, the rest (`TextMenuMac.swift`): the text view it is asked of lays the selection out itself, so Look Up's highlight is on the page's glyphs only for a selection inside one paragraph (its first line exactly, later lines by the paragraph's pitch); across paragraphs, or in a giant paragraph, it is near them. Nobody has opened the menu by hand, chosen Look Up, Translate, Share or a Service from it, or seen its Writing Tools items act on read-only text. (3) The localised standard menu titles are not built, and wait on Charlie's choice (LLP 1115.000 D7.9; measured 2026-10-12 with probe bundles run in Japanese for the process only, macOS 27.0.1). AppKit localises no title an app supplies, by action or otherwise: Xcode's own Mac template is a nib with English titles (`MainMenuApp.xib`) that its developer translates. What AppKit does give in the person's language is what it builds itself: the items it adds (Writing Tools, AutoFill, Start Dictation, Emoji & Symbols, Close All) and the menus it hands out (`NSTextView.defaultMenu`: Cut, Copy, Paste, Paste and Match Style, and the Spelling and Grammar, Substitutions, Transformations and Speech submenus whole; `NSFontManager`'s Font menu), which leaves the application menu, Undo, Redo, Delete, Select All, Find, File, View, Go, Window and Help in English. SwiftUI's `App` does build every standard title localised (About, Settings…, Services, Hide, Hide Others, Show All, Quit, the whole Edit menu with `TextEditingCommands`, Minimize, Zoom, Bring All to Front, Help), so the one supported way to all of them is to let SwiftUI own the main menu: the Mac executable's entry becomes an `App` and Exact's File, Go, shortcut and Develop items become its `Commands`, which is a rewrite of `DevMenuMac` and `ShortcutsMac`'s menu half and belongs with LLP 1115.002. The other ways are the two ruled out: ship translations, or read AppKit's and SwiftUI's tables by key (`MenuCommands` has 25 of 48). Beneath all of them: an Exact app's bundle declares its localisations only when it grants a device (`usageKeys`), so every other app runs in English whatever the person's language, and then AppKit's own strings are English too (its alerts, panels, the text menu). A bundle that declares the app's `lang` and its strings tables' tags is the first step of any of these. (4) AppKit's focus ring has never been seen around an Exact field: it is drawn only in a key window of an active app, and neither the driver's picture, `cacheDisplay` nor the window's layer tree holds it (probes outside the repository, macOS 27.0.1; a screen capture needs a permission the lanes do not have). So three things rest on AppKit's contract and want one look by hand in a key window: a bare field with a border its author wrote shows AppKit's exterior ring around its box and the border under it (LLP 1115.000 D7.9, built); a bare field with no written border shows Exact's two-point ring on its box and, if AppKit draws too, a second ring outside it (the audit's MAC-31 infers it; LLP 1104 D6's note that "the masks alone never drew" was from the driver's picture, which shows no AppKit ring on a native field either); and a native textarea, whose stand-in ring may double its scroll view's. If AppKit draws them, Exact's rings go. A textarea with a written border draws Exact's ring outside its box in AppKit's colour, since its text view's own ring is cut off by its clip view, which is also inferred. (5) Under the agent a wheel is applied at once, with no momentum, and a window has no opening animation; a live gesture test passed 22 or 23 of 27 runs and is kept outside the suite. (6) The page hit test from #327 costs about 10 ms a pointer move on a 400-paragraph page in an unoptimized build. (7) `CTRunDraw` draws no underline, so a paragraph with per-run shadows or a hidden run loses its underlines. (8) By hand on a Mac, none done: a trackpad scroll's momentum and bounce in Shelf's list and a mouse wheel's step; the I-beam over prose, the hand over links, the arrow over buttons; clicking a row, a card and a button in a background window; hover in a background window and after a drag; the window's opening animation and no Show Tab Bar; spelling marks in a plain field; keys in a key window, with a custom `DefaultKeyBinding.dict`.
  2026-10-22 (lane q1022/b3, 75951c1102, b6f99c5171, be21561641, 31b12ee4ca): selected text keeps underlines and decorations on shadowed runs, propagated decorations at full ink, its measured fragments over exclusions, and flow truncation in source offsets. The rest of the list remains.
- **The Mac's grouped form, what is owed** (2026-10-12, LLP 1115.002 D6, stage 4's as-built). (1) Three controls in a row are not the reference's: a `select` is AppKit's pop-up button (its row 44 points where SwiftUI's menu-style picker makes 38), a number field keeps its field beside the stepper, and a text area keeps its bezel. A `button` row that is not `destructive` stays a row, where a Mac form draws every button as a push button: D6 ruled the destructive one only. (2) The destructive row's bezel is AppKit's push button drawn under Exact's pressable (`Mac/FormRowsMac.swift`), so the whole row takes the press where the reference takes it on the button; its key look, a real click and VoiceOver's reading were not seen by a person. (3) The `metrics` table's web column is also what Linux, Windows and Android read until LLP 1115.000 D17 gives a painted host its own: when the neutral look or one of them gets a column, the grouped sheet's surfaces, its 26-point corner and its 52-point rows change there cell by cell, and `host/web/neutral.css`'s `!important` rules on a grouped list go (the entry below, item 3). The sheet's surfaces on the web are still literal pairs for that reason. (4) No fixture lays the Mac's column out beside a browser: the JS target compiles the web's column only, so the Mac's form is held by measurements against SwiftUI's and by the kernel's own tests.
  2026-10-22 (lane q1022/b3, 544937b840, 190e45a546): a textarea inside a form loses its bezel; a destructive button's press tracking, feedback and release are bounded to its visible bezel. Number rows and ordinary button rows stay as they are (not ruled in D6).

- **The web's neutral look, what is owed now that it is every build's** (2026-10-12, LLP 1115.000 D4 part B; the default changed on Charlie's word in `3c6a16360`; the sheet is `host/web/neutral.css`; its second pass after Expo's styleguide was graded blind and not adopted). (1) **The look's `min-width` on a platform button replaces a flex item's automatic minimum**, so an unsized button squeezed in a row cuts its title at its edge where it used to spill past the row (`agent-check.test.mjs` holds `clipped` for it). A size the author writes now wins: the host names a written `width` or `height` and the floor and padding step aside on that axis, which took `synthetic-grid` out of conformance's holds. (2) The schema's neutral column holds a grouped list's two grounds and its cards' corners since D17, and both web targets read that column, so the sheet's three `!important` rules over the compiler's sheet now repeat the row and can go, with a browser test that no pixel moves; a card's own fill is still the sheet's literal pair (`#fff / #1c1c1e`, a hair from the neutral surface), and its rows are iOS's 52 points. (3) The accent the kernel resolves itself (a motion between colours) is the table's blue; what CSS draws is the browser's hue at the table's lightness. (4) A context menu opens on the release of the press that asked for it, in Chrome on a Mac too, where it used to open on the press. (5) The Back button says "Back" only on a page in English; a word in another language wants a strings key the host can read. (6) A range draws no filled part before its thumb (only Firefox has the pseudo-element); a disabled date field's ink in WebKit is the engine's. (7) The author's split placeholder starts a pixel inside the list column's line and ends a pixel short of the window: the shell places it at the column's `100%`, and the look draws the divider as a border where the old one drew a shadow (`wide.test.mjs` pins 319 and says so). (8) Two lines of WebKit's cross-browser conformance are new under the look, and neither was looked into past its captures: `synthetic-startend`'s long list mounts one row more in Chrome than in WebKit after its wheel (20 lines; the two pages' rows were already 2 px apart, and the taller header moved the edge of the mounted window between them), and in `synthetic-menus` a right click on a checkbox focuses it in Chrome and its row in WebKit (4 lines, where the old look had 16 for the checkbox's own size; `known-webkit.json` names the same convention for a button, not for a checkbox). (9) The README's web pictures (`docs/screenshots/todo-web.webp`, which is nothing but unsaid controls, and the gallery) were captured in LLP 1116 D1's look: capture them again when the second pass has landed, once. (10) Not run: Safari itself (WebKit through Playwright stood in), a phone's browser, Windows, a real contrast theme (Chrome's emulation stood in), a coarse pointer beyond Chrome's emulation.
- **The neutral look on Linux and Windows, what is owed** (2026-10-12, LLP 1115.000 D17; the look's numbers are the schema's `metrics`, its switch `show_neutral_look` in `host/linux/src/app.rs`, its shapes `host/linux/src/paint/neutral.rs`; the pictures beside Chrome's are in `~/audits/exact2-no-tells-2026-10-11/d17/`). (1) **Most chrome is still owed.** Direct route headers now get the Neutral ground, label ink and bottom border from schema-backed effective rows, and nested ordinary bordered buttons paint no edge. Neutral header padding, minimum height, sticky positioning and top now also come from schema metrics, with browser-measured geometry and CPU-painter tests on a Mac. Narrow tab bars now take the schema ground/top edge under the broad direct controlled-tab CSS predicate; ordinary bordered/gray tab faces follow selected, unselected, hovered, disabled and authored ink while retaining their boxes. Narrow native bordered/gray tabs now also use schema geometry with actual root-font context, measured against Chrome and checked by the Linux CPU painter on a Mac, including authored overrides and retained membership changes. A `radiogroup` of radios is the web's segmented control (`kernel/src/segmented.rs`, `paint/segment.rs`); a content `tablist`'s segmented control, Back presentation, sidebars, alerts, dialogs, menus and sheets remain. The kernel supplies header defaults below stored values and authored declarations, with live ancestry/prop invalidation. Other platform columns are unchanged. The tab-paint slice passed integrated Caltrain on Linux, Mac and iOS and Shelf on Mac/iOS at `5b1b2a8e5`. At `7d0be3297`, the tab-geometry slice passes the six checks, affected Linux/web-JS suites and Neutral CSS tests, ordinary Caltrain on Linux/Mac/iOS and Shelf in both Mac chromes and iOS. The four Linux fixture drives cover both widths and schemes, root-font changes and retained membership. Apple app drives use normal builds; iOS ran on an owned simulator that was deleted. Mac Caltrain still shows the previously recorded inverted text and dark-card contrast defects. A physical Linux display and Windows remain unqualified. The Linux host presents a `dialog` and a popover as the author's subtree in the window (LLP 1115.004 D10.7). The CPU painter's translucent dark separator produces RGB 57 over RGB 18 for both implied and authored identical borders; Chrome produces 56. Keep that rasterization difference separate from header-rule equivalence. (2) **The unsaid hover and press of a pressable that is no control** (a card, a custom `button`, a link: D6) are not drawn on these hosts, nor a disabled custom button's half opacity; a painted control's hover and pressed washes are. (3) **An ordinary button's title is its ancestors' size but not their family**: the kernel computes its size and weight through inheritance, and the painter still sets the host's default family, style and letter spacing, where a page's button inherits all of them. A `line-height` written on a platform button is not read either. (4) **A button whose author wrote a width narrower than its padded title** wraps the title in the padded room while it is measured, where the page drops the padding: the measure cannot tell a written width from a stretched one (the painter can, and the box is the written one). (5) The accent is the table's blue: a browser draws its own hue at the table's lightness (item 4 above), and these hosts have none to fit. A selection's highlight in a field is still the painter's own blue pair. (6) A file field always says "No file chosen": the Linux picker hands the files to the app and keeps no name. A date field draws its ISO value in the kernel's box for Chrome's date control, with no picker's icon. A `type="search"` field is as wide as any field (Chrome's is 150 px where the others are 176), and a select is as wide as its widest option in the host's font. (7) A select's open menu is the look's raised surface with rows of its own height (the text and 8 px, at least `menu-row-height`), which no page was measured against: a browser opens its own menu there. (8) **Windows was compiled for its target and never run**: nothing of it was seen on a screen. Zig is not on the dev Mac, so the second lane's two cross-target checks were run with Zig 0.15.2 unpacked in a scratch directory. (9) Not seen: a Linux desktop's real display and mouse (the host ran headless on a Mac, under the driver); a coarse pointer (the `-coarse` rows are read by the sheet alone, since the kernel is not told a pointer's kind); a 2x display; a font other than the driver's.
- **Check Neutral header defaults under the first app’s theme scope** (2026-10-14, source-review risk; `kernel/src/arena/defaults.rs`). The existing global `HEADER` initializer parses schema role strings through `set_dynamic`, while current colour parsing can resolve a bound theme role to its value. Determine whether first initialization under a theme captures that app’s concrete colours. This is unmeasured. Tab-only admission now reads only its role-valued tab defaults and does not initialize the header table; no header-theme repair is included.
- **Increase Contrast does not reach the web's canvases** (2026-10-20, LLP 1115.000 D4). The wasm page reports Apple's colours to the kernel once, at boot (`host/web/glue.js`, `src/colors.rs`), and the JS target's canvases (`host/web-js/canvas2d.js`) do not hear `prefers-contrast`: report and draw again when it changes (`glue.js` is at its line cap).
- **The palette by role, what is owed** (2026-10-11, LLP 1115.000 D3). (1) `host/web/index.html` still holds other role pairs as hex (WEB-13): D3.1's rule is not whole. (2) `scripts/agent-check.mjs` reads Apple's columns of the role table by position. (3) A block link of text on the Mac is not underlined where an inline one is. (4) Shelf's rating stars are grey on the Mac (an unsaid symbol is the secondary label colour): Shelf should say the accent if it wants it. (5) The neutral column has been drawn on no host; Increased Contrast, Firefox, WebKit and Android were not run with the new table. (6) The schema's digest moved five times in one lane; a lane that moves it should move it once.
- **iOS sheets, type and control states, what is owed** (2026-10-11, LLP 1115.000 D11.5, D12.5, D13). (1) `markdown`, `markdown-stress` and `exact-live` gained `role="heading"` with `font-size="1em" font-weight=400` on their heading blocks to keep their look, and none was run on a host. (2) A pale blob inside a sheet where the page's checked radio sits is the driver's `screenshot … window` capture (the app's own drawing), not the screen: on 2026-10-23 the display's pixels (`screenshot` without `window`) showed none under the same sheet. The capture is what is owed. (3) Not run: VoiceOver's speech, a tap on a sheet's dimmed page, a hardware Escape, an iPad, the calendar opening from an empty date. (4) tvOS has been compiled with these changes and never run: this Mac has no Apple TV simulator.
- **Conformance after the Shelf bisect, what is owed** (2026-10-12). The lines Shelf and `synthetic-failed` gave are fixed, and were three things: the wasm page had no `showModal(id)` from an action (since `b968df0d8`), a tap the page refused left its reveal's scroll on the one page that was asked (since Shelf's first commit, `cf7196c0d`; the two pages never differed), and the JS target lost a resource's failure when a commit that had cleared it was refused (since `9ad0230e5`, #380, in the lane's own set). LLP 1116.005's "0 failures across 9 targets" named neither Shelf nor the synthetic plans: both were failing on that tree (`53205e43b`). Left: (1) The per-commit lane never drives Shelf: `scripts/async.mjs` `WEB_APPS` does not name it, so its lines stood for two days until two lanes ran it by hand. Adding it is a check, so it waits for a human's word, and Shelf is not ready for one: Discover fetches openlibrary.org for real, and in 2 of 9 runs the boot compare fell between the two pages' answers (21 lines at `boot`, `state resources.works…`, none after). (2) `conform.mjs` taps the JS page only when the wasm page took the tap, so whatever a tap the wasm page refuses leaves behind shows as a difference between pages that do not differ. The cause found is fixed in `reveal` (host/web/navigation.js); a target behind a modal `dialog`, inert with no `inert` attribute, is still scrolled to before its tap is refused as covered (read, not run). Tapping both pages and comparing the refusals would end the class. (3) On the dev Mac under load, runs of the lane's set give lines the next run does not: the wasm page's video in `video-player` has no duration where the JS page's has (37 lines, `state slots.duration: wasm 0 js 10`; here, and in a lane's run the day before); `harness: Chrome <pid> did not exit` after a drive that was equal at every step (ten targets in one run, at a load average of 90); and `synthetic-resize boot`, the wasm page's first size report in before the compare and the JS page's not. (4) The first run in a fresh checkout answers `linux-open: linux build is stale` for canvas-gallery, duo-lab and messages: the JS build writes `app.contract.d.ts` into the app's folder after `--build` made the Linux binary, whose dep-info names that folder (seen twice; a second run is clean). (6) On the web Shelf's swipe action is a 16 px `symbol:delete` drawn in the accent, though its button is `destructive`: a swipe moves the row 16 px aside, on both targets. (7) `scrollBy` is still the JS target's alone on the web, as `docs/contract-grammar.md` says; nothing holds either web target's commands to `HOST_COMMANDS`, which is how `showModal` was missed.
- **The focus follows the route on the painted hosts, what is owed** (2026-10-12, LLP 1115.000 D4.2 and ruling 5, `host/linux/src/presenter/arrive.rs`). (1) A heading or a route that takes the focus after a key's press shows no ring: the painted hosts ring controls and fields only, where the web shows `:focus-visible`'s outline there. (2) The presenter is Windows's and Android's reader's too, and the rule was seen on neither: on Android a finger's press leaves no ring by the rule (LLP 1115.001 D7.6) and TalkBack's focus is the reader's own. (3) A pointer's press gives up its control's focus before its handler runs (`dispatch_press`), so that control hears no `blur` when the route's heading then takes the focus; the web fires one. (4) A commit's `focus()` command runs after its commit here, so the heading holds the focus for a moment first; where it ends is the web's.
- **The web's routes as pages, what is owed** (2026-10-11, LLP 1115.000 D4 part A). (1) A server-rendered page's `<title>` is the app's name until the runtime starts and sets the route's. (2) `tree --ax` lists a sheet's ancestors as "outside modal". (3) A menu does not take the focus when it opens; its arrows work once it has it. (4) A route that arrives without a press (a timer, Forward in the wide split) takes the focus only when nothing has it. (5) Arrows on a tab bar move the focus and do not press, since a tab's press can fetch; a tablist is one Tab stop. (6) Not run: Safari, Firefox and WebKit (`conform-firefox`, `conform-webkit` included), a screen reader's speech, a real finger; the focus ring's behaviour in Firefox and Safari is from HTML's rule for `:focus-visible`, not a run.
- **The filesystem helper's callers go one at a time, and a cold sixth check has two hundred of them** (2026-10-12, found repairing the wait they shared, LLP 1030.002 D3). Every Bun process that uses the helper runs its own `cargo build` of it under the build claim (`scripts/filesystem.mjs`), a no-op once it is built. With every app build script due and `exact-bake`'s tests beside it, 228 callers held the claim in turn: for 32 s at a load of 20 (median 0.13 s each) and for 68 s at a load of 165 to 205 (median 0.23 s). The cold build was 1.8 and 3.6 s of those, so the line, not the cold build, is the likelier place the old 60 s went (the failing gates, at loads of 300 to 800, were not measured). Nothing fails now, however long the line: a caller waits while the claim's owner runs. But the line is the check's time under load. A caller that saw another take the claim after it began waiting could use that caller's capture without building again: the sources would still have been checked during its own life.
- **Linux's authored accent, what the painting scope does not reach** (2026-10-14, after `roles::authored_accent`, the painter's per-node scope for `AccentColor`, `LinkText` and Exact's tint roles). Not covered, each found by review and none a few lines: (1) an SVG descendant that authors its own `accent-color` paints under its `svg`'s accent (`svg_item` opens no scope); (2) a retained content region's replayed SVG and gradient stops resolve with no scope (`ink`, `Gradient::resolved` at replay), so under a region-local accent they are the app's tint; (3) a native button's face parts (title, subtitle, symbol) resolve under the button's accent, not a child's own; (4) a theme alias to a tint role (`CanvasText = "LinkText"`) with a theme `AccentColor` resolves to the theme's colour before the scope is read (`painted_override`); (5) `accent-color="AccentColor"` keeps the accent around only inside the walk, so a hosted field or a region capture under it, with a nearer accent above, reads the tint; (6) colour motion targets (`kernel/src/motion.rs` `color_targets`) still resolve with no scope, so a transition into `AccentColor` under an authored accent eases to the tint and snaps at its end (a fix must keep Apple's `@tint` set, not the web's); (7) a recorded row (Android's recording backend) under `accent-color="AccentColor"` keeps an ancestor accent that changes after it was recorded: invalidation stops at the authored row (`txn.rs`) and a recording's validity does not compare its effective accent (`paint/rows.rs`).
- **iOS after wave 2's keyboard and bars, what is owed** (2026-10-11, LLP 1115.000 D9 and D11, seen on an iPhone 17 Pro simulator, iOS 27.0). (1) A pushed route's large title arrives expanded now (`9b3e3c110`; LLP 1115.000's row for D11.1 says what UIKit needs). What is left of it: a single stack installed partway through the first batch, where a cover cannot be reported, still gets its first screen's header cover after UIKit's first layout; UIKit opens a stack's first title all the same (in UIKit alone on iOS 27, a root's scroller moved up to its controller's top a turn after the first layout), but it is the cause the pushed title had. A header's cover held back by a list's slice in flight (`Session.whenIdle`) would reach layout after the push had begun, and that push's title would arrive collapsed: read in the code, not reproduced. Under the driver's own drag (no `--touch platform`) a scroller cannot be pulled past its top, so a collapsed title does not open there; a real touch opens it. A selected tab tapped again over content at its top under a collapsed title opens it (2026-10-20); but a scroller that never saw its title open holds only the collapsed inset in `scrollOrigin`, and an inset kept from another scroller goes stale when a hatch turns large titles off or a search field leaves the bar. (2) `user-select="text"` on iOS is built for a selection inside one paragraph (2026-10-12, LLP 1115.000's row "D11.6, `user-select`", `host/apple/Sources/ExactKit/IOS/TextSelectionIOS.swift`). What it leaves: **(a) a selection across paragraphs.** UIKit's `UITextInteraction` takes a touch only when its view is the touch's hit view (measured: on a container whose text is in child views it never begins), so one selection over several paragraphs needs one view that takes every touch on their text and hands a tap on to the paragraph's own press and links; the document it would answer from is there (the Mac's order of paragraphs in `TextSelectionMac.swift`, the runner's `list_text` for a virtualized list's rows). The Markdown reader selects one block at a time until then. **(b) VoiceOver's text selection rotor**, which a `UITextView` offers because it is its own text input: the paragraph is a static text element. **(c) The highlight is over the glyphs**, a text view's under them: the container below the text is asked of the display interaction's delegate, which `UITextInteraction` owns (the reference's input was not asked for one). **(d) A triple tap** selects a paragraph in a text view; not measured here (the touch runner has no triple tap) and not seen. **(e) Linux, Windows, Android and tvOS take `text` as `auto`**, said in LLP 1001 and the guide but not by the host: one line in the Linux driver's log, as `font-stack-fallback` has, would say it where it happens. Selecting text there is the Mac's whole selection again (an anchor and a focus over the painted lines, the fill and the selected ink in the painter, a pointer drag, the clipboard), and `host/linux` has none of it. **(f) The driver's plain `tap` on text with a selection up** presses, where a finger's tap clears the selection and presses nothing; a real double tap needs the touch runner to make one (`XCUICoordinate.doubleTap`), and `tap <id> dblclick` is the recognized selection until then. **(g) Before iOS 18** nothing asks a text input whether it is editable; an empty input view is there to keep the keyboard away, on no simulator this Mac has. Not seen on a phone: the loupe under a finger, the haptic, a handle dragged, VoiceOver. (3) The page's own scroller (the viewport) takes the keyboard down with a drag as D9.1's default does (2026-10-22); no prop reaches it. (5) Under the driver's frozen clock, `tap <grouped list> drag 0 -300` on a list under a large title collapses the title and leaves the list at its top (the collection view puts its offset back over the bar's change of inset, as `KeyboardAvoidanceIOS.swift` `reveal` already works around); a real touch scrolls it. (6) `exact new`, the patterns and most recipes still write `navigationScroll` on a route with one scroller, which iOS no longer needs. D11.4 (a borderless field in a grouped row) landed as LLP 1116.005 D2 while this lane built its own, which was dropped; one thing that one had and D2 has not: `appearance="auto"` written on a field in a row does not bring the bordered field back. (7) Not tried: a real finger pulling the keyboard down in a `resizes-content` page (the driver refuses a drag that leaves the viewport, which ends at the keys), VoiceOver speaking a link, the ⌘ overlay on an iPad with a hardware keyboard, pull-to-refresh on a grouped list by a finger.
  2026-10-22 (lane q1022/g, 621d77563e, d699532ea3, 2d0eb37023, a47ee8f985, 5fa9ad1d85): title scroll positions kept and projected search fields focused; prose selected across mounted paragraphs with one text input (atomic `user-select: all` takes the outer element; a shared text touch reaches its paragraph's handlers); page drags track an interactive keyboard dismissal. Virtual-row retirement during selection remains.
- **A terminal paints a link run with no colour of its own in the link role's blue** (2026-10-11, LLP 1115 §3 meeting LLP 1101): `contract/lower/src/tags.rs` `link_color` gives a run with an `href` in its paragraph the `LinkText` role unless its own colour is written, and the terminal resolves the role's fallback (`#0088ff` in light, since LLP 1115.000 D3.2 re-measured the tint). The terminal work's test was written on a branch older than that rule and expected the parent's colour; when the two merged its expectation was moved to the role (`host/terminal/tests/it/cli.rs`, `inline_paint_carries_colours_decorations_and_links_without_crossing_siblings`). Whether a terminal should show the role, its own default ink with the underline and the OSC 8 link, or a colour from its palette is the terminal's decision, and it has not been made. Until it is, a terminal entry's block `link` of text is not given the role that LLP 1115.000 D3.5 gives one on every other host (`link_color` reads the lowering profile; `a_terminal_entrys_block_link_keeps_inheriting`).
- **The Mac after wave 1's focus and press, what is owed** (2026-10-11, LLP 1115.000 D6 and D7; seen by the lane, not all reproduced since). (1) A press on a pressable with no fill barely shows: the Mac's response is AppKit's pressed effect over the node's own ink (black 16% in light, white 18% in dark), which is what a borderless `NSButton` measures on macOS 27.0, so a card or a link outside a list moves from 0.72 to 0.64 grey on a ground that stays white. A list's row no longer shows it: it is a table's row, selected as the mouse comes up (LLP 1115.000 D16, built 2026-10-13). (2) A click on page text still takes the first responder, so clicking a field's label ends its editing. (3) A window's first field gets its `focus` handler at launch now (D7.5), which an app may not expect. (4) Space on a custom pressable shows no press on the Mac; the web shows it. (5) Messages' Add drops the composer's focus, on main before the lane too. (6) Not seen by a person: a key window, the real system setting turned on, and the wash on a physical screen (screen capture was refused, and the agent's capture reads the card at 0.834 where 0.806 is expected).
  2026-10-22 (lane q1022/b3, 32c93480dd): a plain label click keeps the active field editor. The rest of the list remains.
- **The web's press and the Linux desktop's Back, what is owed** (2026-10-11, LLP 1115.000 D6 and D5.4). (2) The dim holds and fades back as iOS's does since 2026-10-23 (`input-glue.js` `fadeDim`, a Web Animation the agent's clock skips). (3) Not run: a real finger, iOS Safari, Firefox, WebKit; headless Chrome showed only a flash after lift for an injected touch. (4) The Linux desktop's mouse back button has no test, and no real device was used. (5) `markup-editor.test.mjs` times out in its `afterAll`, on main before the lane too.
- **The README's example after it says less, what is owed** (2026-10-11, LLP 1115.000 D1.3). (3) `exact setup --check` in a nested worktree reports the Hermes bundles missing when they are present. (4) No script writes `docs/screenshots/todo-*.webp`: these were encoded with Chrome's canvas encoder through the repo's `playwright-core`, since this Mac has no WebP writer. (5) `todo-macos.webp` is from before a grouped list's text was the Mac's 13 points (D3.3), and its Add is a `filled` button now (LLP 1115.000 D15): the driver's window is never key, where AppKit draws an accent bezel white, so a retake shows the same push button and a person's Mac shows the accent.
  2026-10-23 (lane q1022/aa): Commit `578b901767`. Parked in part. `exact setup --check`: exit 0, host and simulator Hermes bundles verified; optional device/tvOS simulator bundles genuinely absent. The physically nested-checkout layout remains unqualified. The Mac WebP was inspected at 420x336; it is still the 2026-10-11 artifact. No new screenshot writer or key-window retake is added. 
- **`check`'s remedy for a graphic past the screen's side is to wrap or scroll it** (2026-10-17, guard-rail evaluation round 2, a decorative `svg` 420 wide in a 402-point viewport: with a `viewBox`, a set height and no width it takes the viewBox's ratio, on the web as on iOS). A graphic neither wraps nor scrolls; its remedies are to fit it (`width="100%"`) or clip it (`overflow="hidden"` on the box it fills). Leaving a decoration out was tried and dropped: a graphic hidden from assistive technology can still be what a person sees (an icon that is a button's only visible label), and inherited `aria-hidden` does not reach a presented route's views.
- **A grouped row's font, what its review left** (2026-10-11, LLP 1115.000 D2, Grok's code review of the bit; the font itself is said part by part since 2026-10-20). a control's text starts from the control's own style (`control_text_start`), whose bit `says` does not read; and a computed `appearance` whose arms are both `"none"` on the Markdown editor still loses its bit.
- **A wide window's sidebar and split on iPad and the Mac** (2026-10-11, LLP 1116.004 D1; built on the web, and on the Mac since by LLP 1115.002 D3 and D4, whose own entries are above: what follows is the iPad's, and its sentences about the Mac and about a runner-side width are superseded by that document's native split view and containing block): the web projection draws a root tab bar left unsaid as a sidebar and uses D4's shared list/outer-press rule for a list beside its detail (host/web/navigation.js `splitOf`, `unsaidBar`). iPad (regular width): `UITabBarController.mode = .tabSidebar` needs the iOS 18 `UITab` API in NavigationTabsIOS.swift (`tabs` from the authored tablist, `tabBarController(_:shouldSelectTab:)` pressing the authored tab as `selectTab` does), checked on an iPad simulator; the sidebar narrows the content beside it, so the runner must lay the routes out at the content's width, which it cannot learn today (the tab container's child is resized by UIKit, the routes by the kernel). The split, iPad and Mac: (1) the kernel lays a split stack's root route out at the column's width and the top at the rest (a runner-side split read from the same rule and `navigationSplit`, not a host override the layout never sees), (2) the presenter shows the root route's controller beside a navigation controller of the routes above it (`UISplitViewController`'s double column, `NSSplitViewController` with a source list on the Mac) and moves the controllers across a size-class change with no router change, (3) the list-detail pattern's wide test then taps a second row while the first's detail shows, which a phone cannot, (4) while nothing is selected the detail column draws the platform's placeholder, or lays out the root route's box marked `navigationSplit="placeholder"` there in place of the `display: none` the lowerer gives it (LLP 1116.006 D2; the web's: index.html `data-exact-split-empty`). Until then the pattern, which no longer has its `when wide` column, pushes on an iPad.
  2026-10-22 (lane q1022/b4): the Mac's native sidebar and split are built (SplitMacTests, SidebarMacTests 21 pass); what remains is the iPad half and whether its design follows the Mac's without a new decision.
- **The runner's `inactive` does not know a web split's list is live** (2026-10-11, LLP 1116.004 D1.2): `runner/src/head.rs` `unselected` (the wasm host's agent tree, `inactive: true`) treats a split's list route as covered, where the JS target's `unselected` (navigation.js, reading `data-exact-split`) does not; a tap still finds the row (a covered copy is the fallback). Since LLP 1115.002's stage 6b a list beside a route laid out in a pane a host reported (the Mac's) is live to the runner; the wasm web host reports no pane, so its tree still flags the list. The rule itself is the runner's now (`Runner::stack_split`).
- **Native drive stores are still the app id's alone** (2026-10-11, LLP 1116.004 D8): the web keys a development store by the app's folder (`appDigest`), but `agent-test.mjs` `storeBase` (macOS, Linux) and a simulator's container are named by the id, so two older apps of one id (`com.example.<name>`, before `exact new` wrote `-<hex>`) share a native `--storage` store. Key `EXACT_AGENT_STORAGE`'s folder by the digest too (host/apple/src/store.rs, host/linux), or leave it to the unique id.
- **Repository apps earn `lower-dialog-role`** (2026-10-24, LLP 1116.004 D4): spark's match overlay (`apps/spark/app.contract:325`) needs presentation and focus handling that preserve its entrance animation. Setting `aria-modal=true` and dropping `role="dialog"` is no repair: Chrome exposes a generic container, without modal semantics. native-fixture's root overlay (`apps/native-fixture/app.contract:832`) is a layering fixture with no `aria-modal`; consider a truthful non-dialog container, verified by `NavigationTabsIOSTests.testARootOverlayWithAZIndexIsOverTheNativeTabs` (`host/apple/tests/ExactKitTests/NavigationTabsIOSTests.swift:437`, requires iOS). examples/calendar's type picker, theme popup and event editor (`src/app.contract:1006`, `src/themes.contract:68`, `src/editor.contract:100`) need popovers for the pickers and a modal sheet route for the editor. The 58-entry apps/examples compiler sweep found no other app earning either `lower-button-unlabelled` or `lower-dialog-role` after the Messages labels.
- **Android's accessibility, what is owed** (2026-10-12, LLP 1115.001 D13, [`host/android`](host/android/README.md), "Accessibility"; seen on a Pixel 10 Pro XL with Shelf and `apps/unsaid`). (1) **TalkBack itself has not read a screen.** The reader answers accessibility services and the framework serves its nodes (checked from outside the app with `uiautomator`); TalkBack found them and focused the first node of two screens. But a touch or key from `adb shell input` goes straight to the app on that phone and never reaches TalkBack, and its speech is not logged, so its swipe through a screen, its double tap, its scroll action, and its focus in an alert and a menu are unseen. It needs a person with the phone for ten minutes, or the owner's word on a virtual input device (`adb shell uinput`: a keyboard for TalkBack's Alt keys, gone when its process ends), which is not among the things a lane may do to a shared phone. Until then D13's gate is not passed. (2) TalkBack asks for the notification permission each time it is turned on there and the prompt does not close on Back: a lane that turns TalkBack on leaves that prompt in a background task unless someone answers it, which is the owner's to do. (3) `Tab` and `link` are English role descriptions: the reader has no strings by language. (4) With a service on, a scroll states the whole tree every frame; coalesce it to the scroll's end if TalkBack's own scroll stutters. (5) A swipe row's trailing action has no accessible action of its own (the row's menu has it). (6) A polite live region that arrives with a new route is spoken once where the app has no top app bar. (7) The reader's click, long click, scroll and set-progress actions were not reached on a phone (only accessibility focus was); a hosted web view or video under the provider was not tried.
- **Shelf's test file is 11 of 12 on the Android reader about one run in six, and the test that fails is not Discover** (2026-10-12; `bun scripts/agent.mjs android --reader --app shelf --test apps/shelf/app.test.contract`, two Pixel 10 Pro XLs). This entry said "discover shows an error, then tries again" passed on a reader built from `a0600e637` and failed on one from `79d468eaf`. Run again the same day it failed on neither, nor on `c48f4e0ea`: 26 runs of the whole file over the three builds (five with `79d468eaf`'s own driver) and 15 of that test alone or by hand, none failing. After `pass fetch` that test's retry is a live fetch of openlibrary.org from the phone (236 to 676 ms that day), so a network that stalls leaves `discover-error` in the tree as the entry described; "Android's bars" (8) below saw one such fetch time out. No commit broke it. What does fail, on all three builds (4 of the 26; 2 of 16 run alone), is "a book: progress clamps and moves the status, rating, notes" at its last step: `tap "detail-status-want"` straight after `type "notes" "Statues"` answers "view 316 is covered or not hit at its projected center". The keyboard that `type` raises is told to exact2 within about a second, between the driver's requests: the viewport goes from 443 by 896 to 443 by 548.5 and the page scrolls 137 points to keep Notes in view, so the control goes from y 212 to y 75. Of 16 drives that read the control's place and then tapped it, 12 pressed it where it was, 3 where it went, and 1 was refused. A person sees a correct screen throughout. Not found: which of the reader's turns the refused tap lands in (the window told, its paint, the scroll `reveal_owed` makes after that paint, that scroll's paint). `Presenter::boxes` does not repaint for an attached display, and the Canvas host's agent (`host/linux/src/canvas/agent.rs`) takes one display turn after a request and none before it. Find the turn, then either `type` answers only once the keyboard it raised has been told and shown, or the agent takes display turns until none is owed before it reads a request. A `CanvasHost` has no test in `exact-linux` (its boot sets the process's environment), so the fix wants a test binary of its own.
- **Android's bars, what is owed** (2026-10-12, LLP 1115.001 D11, [`host/android`](host/android/README.md), "The bars"; seen on a Pixel 10 Pro XL with Shelf). (1) What makes a `tablist` the root's is `Kernel::root_tabs` and the Linux host reads it, but iOS and the Mac still read their own (`NavigationTabs.of`: candidates from an index ordered by view id, over views UIKit has moved, so the kernel's tree order is a change to rule on), and the web host (`host/web/src/document.rs`) and the runner (`runner/src/head.rs`) each keep a copy. (2) A route's content scroller (`navigationScroll`, else the first node that scrolls up and down) is written in Swift (`contentScroller`) and again in `presenter/bars.rs`: it belongs beside the header rule. (3) `HeaderTitle.holdsHeading` stays in Swift for one test that calls it; the bar no longer does. (4) The top bar's colour on scroll changes in one frame, where Compose animates it; a destination tapped again scrolls to the top in one step. (6) A header's avatar, subtitle and tappable title are not read on Android; nor are a `tablist`'s segmented buttons, in the page or in a header. A `radiogroup`'s are built (`kernel/src/segmented.rs`) and have been seen only through the Linux presenter on a Mac: nothing of them has been seen on a phone, the Material oracle's `segmented-buttons` specimen has not been run against Compose, and Compose's motion as the choice moves is not built. A group whose author places its radios with `grid-column` or `grid-row` takes its round ends from the radios' order, not from where each is placed; where the layout is not one ordered row, the segments should each be round on both ends instead. (7) Not seen on a phone: rotation, a cutout in landscape, three-button navigation, a page under `viewport-fit="cover"` with bars. (8) A light-scheme Discover that failed to load once (`TypeError: Failed to fetch — io: Try again (os error 11)`) loaded the next time: not looked into.
- **Android's text fields, what is owed** (2026-10-11, LLP 1115.001 D8, [`host/android`](host/android/README.md), seen on a Pixel 10 Pro XL with `apps/unsaid`'s form). (1) Composing text has not been seen on a phone: Gboard there, typed on by tapping its own keys, sent `commitText` a letter and never `setComposingText` (`x_log_fields=1` logs the calls), in this host's fields; whether it composes in another app's field on that phone was not tried, and no one has composed Japanese, Chinese or Korean. What a composition does across an app's commit is held only at the Rust boundary (`presenter/hosted_tests.rs`). A value the app writes while a field composes is held until the composition ends since 2026-10-12 (LLP 1115.000 §5, ruling 6: `Native.fieldComposing`, `presenter/hosted.rs`), built without a phone: that `Fields.flush` sees a composition begin and end (the composing span on the field's text, read after each of the keyboard's calls), that nothing restarts the keyboard inside a word, and that the action key commits the word before the app's value replaces it, are unseen on a device. (2) Every field's view is made as its page appears, 0.6 to 1 ms a field on the main thread: the frame that showed the form's twenty-one fields took 26 ms where painted fields took 5 to 8 (`dumpsys gfxinfo`). Make a view only once its field is near its port, or ahead of need while the thread is idle. (3) A swipe row, a reorder grip or a `pan` under a field never gets a touch that lands on the field. (4) A field inside a layer the reader animates is drawn moving while its view waits for the next paint. (5) A font declared by its bytes sets the field in the device's default family. (6) The reader has no test of its own (no Gradle test task is built anywhere): `Fields.kt`'s rules for a told value, the caret after a rewrite and the action key are seen only by driving the phone. (7) Not seen on a phone: the light scheme, a font scale other than 1, a hardware keyboard, autofill, a field under a bar or a sheet, `setSelectionRange`, a disabled or read-only field, TalkBack.
- **Android's colours and channel, what is owed** (2026-10-11, LLP 1115.001 D4 and D5, [`host/android`](host/android/README.md), seen on a Pixel 10 Pro XL with `apps/unsaid`). (1) The channel carries no file picker yet (`showPicker`, `saveFile`, the document pickers are refused, and say so), and `@exact/notifications` has no Android implementation (LLP 1133.004 stage 3); a date or time control's picker is LLP 1115.001.000's. (2) Done 2026-10-14: the painter resolves `AccentColor`, `LinkText` and Exact's tint roles by the nearest authored `accent-color` (`roles::authored_accent`). (3) A `link` left unsaid is drawn in the text colour with no underline, where the web's is `LinkText`, underlined. (4) The painter's own colours that are not roles are still Chrome's and iOS's on Android: a field's fill and border, the bordered button, a switch's off track, a field's selection highlight (D9). (5) The palette's derivation for Android 12 and 13 ran only forced, on Android 16; and a wallpaper change reaching a running app was not tried on a device. (6) The Sharesheet's `dismissed` is inferred half a second after the activity is in front again; a device that tells its choice later than that journals `dismissed` for a share.
- **The Android reader is in the tree; the benchmark still builds its own copy** (2026-10-11, LLP 1115.001 D2, [`host/android`](host/android/README.md)). The Canvas host's Kotlin side came in from the benchmark's copy at `c30c683` (`expo-build-1000:~/bench/lists/exact-v11/android/canvas`; its history is not imported), with the benchmark's driver cut to a seam (`ExactActivity.drive`) and the package renamed to `dev.exact.canvas`. `bun scripts/agent-android.mjs build caltrain --apk` builds Caltrain on it (drawn on a Pixel 10 Pro XL that day). Owed: port every commit the benchmark's copy takes after `c30c683` (`git log c30c683.. -- android/canvas` there); move the benchmark to consuming `host/android`'s `:canvas`, its `Driver` attached at the seam, because `canvas_jni!` now defines `Java_dev_exact_canvas_Native_*` and the benchmark's own reader (`dev.exact.bench.exactcanvas.Native`) finds none of its methods in a library built from this commit on. What the import does not do is in the README's last section.
- **`agent ios` wheel on a grouped list stops short of its end** (2026-10-11, LLP 1116.003): `Agent.scroll` clamps to the collection view's `contentSize`, which a self-sizing grouped list only estimates until its cells come in, so one `tap <list> wheel 0 20000` landed rows short (row 29 of 30 under the tab bar, row 30 unseen) where drags reach the end. Clamp again until the size settles, as `TabEdgeIOSTests.scrollToEnd` does.
  2026-10-22 (lane q1022/a2): not reproduced in three drive rounds on an iPhone 17e; `Agent.place` already reclamps after layout (at most four times). A characterization test covers one wheel reaching the measured end (TabEdgeIOSTests); when the short wheel reproduces, reclamp until contentSize and the last index path stop changing.
- **A grouped list's cell kept across a batch that changed the list's height shows empty on iOS** (2026-10-11, LLP 1116.003 D2.1): the keyboard batch puts every carried row back (`prepare`), then `mount` carries rows only into `visibleCells`, judged before the new layout; a cell left out but kept (not reused) comes back into the port empty, its row hidden beneath the list, until a batch touches the list. The keyboard's reveal carries rows after it scrolls (`carryRows`, KeyboardAvoidanceIOS.swift); a finger's scroll after the keys come up does not, nor the driver's: after Return moved focus and a submit added a row, `tap` on the next exercise's field answered "… covers its middle" (on f6769a64e too). Likely the same family as round 4's blank Finish row below. Checked 2026-10-22: the stated mechanism does not occur in a bare `UICollectionView` on iOS 27.0. `visibleCells` keeps its set until UIKit lays out (14 cells before and after the frame shrank, 4 after layout), and every cell that leaves gets `didEndDisplaying` and then `willDisplay` when it returns, which carries its row. A scratch list of field rows, with the keys up, a press that changed every row and drags both ways, showed no blank cell. The cause is still open.
- **The first `contract` call on a cold checkout builds the compiler for minutes** (2026-10-11, from closing `issues/closed/20261009-agent-port-cost-vs-swiftui.md`): `scripts/exact.mjs` builds `contract` on first use, so a new app's first `contract types`/`build` waits on a cold cargo build. `host/web-js/module.mjs --prebuild` warms only the web builder; a cached or prebuilt compiler would remove the wait from an agent's first minutes.
- **iOS scrolling's leftover suggestions** (2026-10-11, from closing `issues/closed/20261002-scroll-efficiency.md` §7–§8, whose three changes landed in 7098e9537, edaaa7c90, 1ff7407af, a1cd643d2): a 120 Hz device trace first; then per-frame checks driven by what is actually owed, the macOS PressClock on Core Animation's clock, and a per-frame budget for a fling.
- **Windows app-storage removal: the progress guard and a real batch test** (2026-10-11, review of the storage-results fix): `vendor/ibex/crates/ibex2/src/stdlib/windows_fs.rs`'s recursive `remove` drains `names_batch` until it is empty or a call errors, with no `require_progress` as Unix has (`app_fs_unix.rs`), so a file held open with `FILE_SHARE_DELETE` (delete pending, still listed) fails `fs.rm` though the pass made progress. `windows_fs_tests.rs`'s `recursive_remove_drains_more_than_one_directory_batch` uses 300 short names, under the 16 MiB listing cap, so it passes without the batching. Port the guard, make the test exceed the cap, and run both on the fleet's Windows machine.
- **Surface-control overflow-child multitouch and cancellation** (2026-10-11, review of #421): two fingers on the overflow child are not tracked because the child lacks `isMultipleTouchEnabled`; a wrapper disabled mid-press can lose cancellation; a focus callback moving the label before the touch id is stored can strand a held control; a link and a blank spot lifted in one `touchesEnded` can skip the link. The round-3 per-touch child route was descoped; design and test a UIKit-delivered route before restoring it.
  2026-10-22 (lane q1022/k): parked after three rounds; no change.
- **Shared Elements web zoom can lose its Close button in captures** (2026-10-23, the Shared Elements repaint): drive the grid viewer and close it, open and close a card, finish a task, then open a Zoom photo, settling each flight and switching light/dark preferences between screens. The Close control remains tappable but can disappear from screenshots, and `check` omits its text. Reproduces with the original literal colours as well as roles; investigate the web presentation separately.
- **This repository's apps earn `lower-colour-one-scheme`** (2026-10-11, LLP 1116.002 D1): rebuilding the listed graphical entries on 2026-10-24 reports 148 warning sites outside Caltrain: examples/calendar 108, weatherlight 1, messages 33, video-player 1, carousel 2, sparkline 1, llp 1, exact-live 1. Fixtures, conformance, corpus, galleries, labs, benches and terminal entries also contain literals whose colours are what they test. Repaint the apps to roles and one accent (`apps/shelf` is the recipe); a media overlay is `color-scheme="dark"` with roles inside. Caltrain's graphical entry uses roles and a light/dark accent; its one remaining warning is the fixed sky tint that dims the artwork on TV. The sky's fallback colour also stays fixed. Its glass cards change fill with the scheme; web checks and screenshots no longer show white text on light cards. GPU material rendering still needs a machine with a graphics adapter. Video-player retains pure black for its video letterbox; its chrome uses dark-scheme roles. Weatherlight retains one literal for its blue sky fallback artwork; the overlay uses dark-scheme roles. Carousel retains two white card labels on fixed content hues; its chrome uses roles. Sparkline retains black avatar letters on fixed data hues for contrast; its chrome uses roles and its status pills use light/dark pairs. Its measured baseline was nine warning sites, not ten (SVG paint is exempt); eight were removed.
- **Realworld's and Expose's dark accent fills take Apple's white `AccentColorText`** (2026-10-23, the Fieldnotes repaint's review). `AccentColorText` is white on iOS and the Mac in both schemes (`kernel/tables/schema.json`, its row: `whiteColor`, `alternateSelectedControlTextColor`); only the web picks black or white by the fill's lightness. Realworld's root accent is `light-dark(#238136, #5fcf70)` and its filled buttons, toggles and favourite chips write `AccentColorText` on it (`apps/realworld/app.contract:95`, 439, 930, 1057): white on `#5fcf70` is 1.97:1 in dark mode on Apple. Expose's `signal` fill (`light-dark(#b83d00, #ff6a2b)`) under `AccentColorText` (home badge `apps/expose/parts.contract:167`, `app.contract:414`, 434, 558) is 2.86:1 there. Computed from the table, not seen on a device; the web is fine. Fieldnotes names its ink per scheme on its green fills (`light-dark(#ffffff, #000000)`); the same would do here, or a darker dark accent where its text use allows.
- **`-exact-fit` is not fitted inside a content region** (2026-10-11, LLP 1116.001 D1.4): the kernel's region layout (`kernel/src/region`) measures text by its own path, which `layout/fit.rs` does not reach, so a fitted text in a region keeps its size. Fit there when a consumer puts a readout in one.
- **VoiceOver on a grouped row's swipe actions is unverified** (2026-10-11, LLP 1116.001 D1): the row's actions are its list cell's (`trailingSwipeActionsConfigurationProvider`), and its controls are hidden while the list carries it. Check with VoiceOver on a device that UIKit offers them as the cell's custom actions, as a table's one-row projection relied on.
- **A new grouped row rendered blank and untappable on iOS until the screen was left** (2026-10-10, bake-off round 1, workout-log): adding a third exercise's add-set row showed an empty, untappable row until navigating away and back (grader screenshots `~/bakeoff/rounds/r1/grades/workout-log/A-06*.png`, `A-08`, `A-09`; app `~/bakeoff/rounds/r1/apps/workout-log-exact2`). The same app showed an unprompted alphabetic keyboard and trash icons not drawn red. Reproduce from the app's contract.
  2026-10-22 (lane q1022/h): the two side observations did not reproduce in synthetic fixtures (3a6c03aa77 covers the workout form's keyboards and destructive icon ink); the original app's interaction sequence was not replayed, so they stay open.
- **The web agent's screenshot painted a stale frame** (2026-10-10, bake-off round 1, focus-timer): the header missing and text shifted up while DOM geometry and scroll were right; remounting, a real wait and a resize did not reliably fix it; the builder took one screenshot per fresh session (~5 min). App `~/bakeoff/rounds/r1/apps/focus-timer-exact2`.
- **CSS values builders reach for and Contract refuses** (2026-10-10, bake-off round 1; focus-timer, recipe-finder): font-size calculations remain refused, including `clamp(14px, 16px, 20px)` as well as viewport-relative values; qualifying text sizing needs an Apple host. A unitless line-height template (``line-height=`1.5` ``) compiles without the quoted-literal diagnostic. Grid follow-ups: `grid-auto-columns`/`grid-auto-rows` need Contract rows, and calculated `fit-content()` limits need a Taffy representation beyond plain lengths and percentages.
- **Snapback 4 client bugs from the bake-off** (2026-10-10, LLP 1116 §9; the bake-off moved to a plain REST server, so these are their own track): one partition per native device against the answer model (two resources on one partition refreshed in one action → "native call outside an answer", "pending on nothing"); a cold first sync of 176–650 ms over the 100 ms source budget (fresh launches sit on "Connecting…" until the poll); on iOS every successful write hung until relaunch while the 4 s refresh stopped (team-kanban); on the web reads stayed stale after the app's own writes (event-rsvp); the README's "Synced" and "Refused: CODE" lines were copied as UI text in 4 of 5 apps. Reproductions: `~/bakeoff/rounds/r1/analysis/batch-c.md` (9 bugs), apps `~/bakeoff/rounds/r1/apps/{team-kanban,chat-rooms,event-rsvp,household-list,polls}-exact2`.
- **A prerendered web page shows a persisted state's declared value until its module boots** (2026-10-10, LLP 1116 D5). The JS target reads `localStorage` as a persisted slot is made, so a page the build renders no document for (the dev loop, an `exact new` app) is right on its first paint; one rendered at build (`--render rust|js`) paints the declared value, then the module adopts the page and shows the kept one (a structural difference abandons adoption and builds afresh, journaled), and an `activate="interaction"` page waits for a tap. Either hide the root before first paint when an `exact.state.` key exists (the capture script) and show it at boot, or render no document for an app that persists a state. Neither is done: no app that persists renders one yet.
- **The checks' workspace `cargo test` skips exact-linux** (2026-10-10, the agent-tap review): `host/linux` is a workspace member but not in `default-members`, so `cargo test --lib --bins --tests` in the gate never runs its lib or pinned tests; a stale pinned test (`host/linux/tests/pinned/host.rs`) kept passing the gate while it failed under `cargo test -p exact-linux`. Proposal for Charlie: add exact-linux to the gate as host/web and host/apple were (or to `default-members`). Cost: its build and tests add minutes to every check run (measure before deciding).
- **A handed-off module turn's outcome is not reserved** (2026-10-09, LLP 1041 §8.4 amendment, Astra's review). `next_job` charges a handed-off turn nothing more when it starts, and `complete` adds what its outcome retains without checking the ordered lane's 512 MiB, so several large outcomes can pass it. Bounded today only by the sixteen (a turn is an effect until drained). Reserve its ceiling at hand-off or backpressure the owner.
- **Storage reads at the sixteen** (2026-10-09, LLP 1041 §8.4 Q2). A TypeScript module's storage step is an opaque effect, so many answers each awaiting storage before a shared load (the Bluesky clone's `hiddenFirst`) still meet the sixteen. Classifying needs the seam to mark an identified read-only operation or batch.
- **`new Date()` works in a data module under bun tests but fails the iOS bake** (2026-10-08, the clone's group 7: muted words' expiry): the bun test environment does not match the data-module runtime. The shared prelude refuses ambient time on purpose (`js/src/prelude.js`), while a `Date` built from an explicit value works, so it is the bun tests that should refuse `new Date()` with no argument, as the bake does. The clone passes the wall time in (`noteWall`).
- **Two message rows drew on top of each other while a sheet was up over the conversation after the keyboard went down** (2026-10-08, the clone's conversation view): cleared when the sheet closed.
- **No way to read the host's root font size** (2026-10-08, the clone's font-size setting): `setRootFontSize("87.5%")`/`("125%")` now scale Dynamic Type instead of replacing it (LLP 1121 D6), so Smaller/Larger need no read; the size itself still can't be read back, if an app needs it.
- **Cross-browser conformance drives Chrome once per engine; a recorded Chrome drive could serve both** (2026-10-09). `conform.mjs --browser firefox|webkit` opens Chrome and the other engine for every target and drives them step by step together, so each async-lane commit drives Chrome three times per target: in the main run (wasm against JS) and in each cross-browser run. The main run's Chrome cannot stand in as it is: it pins only the media clock, the cross-browser runs also pin `line-height: 1.2` (`parityScript`), and it is compared against the wasm page, not recorded. The change: drive the JS page in Chrome once with the cross-browser parity, record each step's state, tree and layout, and have Firefox and WebKit each drive alone against that record. It takes Chrome out of both cross-browser runs, about half their work (Firefox 282 s and WebKit 176 s pooled). First read `drive()` for any step that depends on what Chrome shows mid-drive (an aim, a wait on its state). A smaller step: run Firefox and WebKit in one invocation sharing one Chrome per target, a third of the cross-browser drives.
- **The drift line can misname packages when two sources share a name and version** (2026-10-08, LLP 1086.000.000 §7; Astra's round-4 code review, left open by Charlie's ruling at the fix-loop cap). `lockDrift` (`game/app/shells.mjs`) matches a lock's dependency strings to packages not quite as Cargo does: an unqualified edge to a name and version both a path and a registry package hold follows both (Cargo prefers the path package), and a git-qualified edge may carry no commit fragment where the package's source does (Grok read Cargo the other way). Only the names in "exact2 moved … (added: …; updated: …)" are affected; whether the line appears, what `lock` writes and every build are not. Match Cargo's `encode.rs` lookup and add both regressions.
- **Scrolling a list to a row needs the list's id as a literal** (2026-10-08, the clone's group 3): `type-scroll-into-view` takes no computed id, so N pinned Home pages are named `p0`…`p11` and the logo's scroll-to-top is a chain of literal calls; a 13th page has none.
- **An indicator measured from a row's tabs goes stale when the tabs change and the row's box does not** (2026-10-08, the clone's Home tab row): `resize` follows the row's own box, as `ResizeObserver` does, so new labels of the same total width give no event; an app measuring its children needs to re-measure on the change itself (the clone measures again when its tabs change). A pitfalls line, if anything.
- **One SF symbol drew at two sizes across renders of one sheet** (2026-10-08, the clone's interaction-settings sheet): the same `symbol:sf/circle` with the same `width`/`height` measured differently in two captures.
- **Excord's window crosses the data seam whole on every page** (2026-10-29, measured on an iOS 27 simulator, provisional: host-dev Rust, debug Swift; ring deferred by theme2 12:00). Every page that lands refreshes `win`, so loadWindow's whole window crosses again: the prelude stringifies it and the runner decodes it. Medians of 33 pages (fixture `--history-delay 600`, #general flung to the 300-row cap): the crossing (stringify + decode) is 0.75 ms at ~50 rows held (a 57 KB reply), 1.8 ms at ~150 (153 KB), 3.5 ms at ~250 (283 KB) and 4.7 ms at ~299 (379 KB), about 12 µs a row; the page's whole fulfil is 11-20 ms, and at the cap 10 of 18 pages land in a native-scroll hitch of 19 ms (median; 27 ms max), so the crossing is about a quarter of the late frame. Against the lead's gate (≥3 ms a page or ≥1/3 of the late frame) it passes the first only at 250+ rows. The deferred design is reload1's six-chunk ring (~/x2theme/reload1-excord-window-plan.md: `win` a descriptor, six chunk resources, a page re-asking one chunk), which would take the crossing to ~0.75 ms at any size; the measurement is ~/x2theme/x2p4-excord-crossing-measure.md. Revisit it if, after the cheaper levers (loadWindow's flat 3.5-4.8 ms call, the ~8 ms of re-evaluation at the cap, a page landing outside the scroll callback), the 300-row cap still shows late frames on a device.
- **A list's data update is O(rows) in the size index** (2026-10-03, Expose's heavy list on Android; measured again 2026-10-29, parked by theme2). `SizeIndex::splice_keys` copies every row, rebuilds the `SumTree` and shifts every key's position, and `rekey_shared` walks the whole span between the shared prefix and suffix. On main 2b9447b370 (release, the live-tick heavy list, medians of 40): at 10,000 rows a splice costs 70-100 µs on an M-series Mac and 330-400 µs on an arm64 emulator (provisional; no phone was available), flat in the change's size (a 1-row top insert, a 50-row page and an append alike), about 40% of a structural commit (a top insert plus a reaction: 0.245 ms on the Mac, 1.2 ms on the emulator); at Excord's 300-row window it is 2-6 µs (23-43 µs for a 50-row page); a row's data change under the same key never splices. What else stays O(N) at 10,000 rows: `keys.splice` with the `string_keys` scan, 30-50 µs, and `compare::shared`'s prefix and suffix scan, 16-25 µs. The approved design (~/x2theme/x2p4-sizeindex-plan.md; scratch benches in ~/x2scratch/x2-perf4-si-scratch): a counted B+ tree of rows with per-node count, sum, min epoch and zeros, positions by leaf rank (a key maps to its leaf), a splice per changed run in O((changes + 64) · log rows); anchors keep today's old-neighbour fallback through a splice log kept only while an anchor is outstanding, instead of a snapshot of the whole order; `string_keys` becomes a count. Take it up when an app shows 10,000+ rows on a phone, or a phone tick measures over about 2 ms.
- **Pictures a GPU painter holds need no CPU copy** (2026-10-03, Expose on Android). A cached decoded picture is CPU pixels (`image/bitmap.rs`) and, once a GPU painter shows it, a texture too. Android's hardware bitmaps keep only the texture, so `VmRSS` (the list benchmark's peak RSS) leaves them out: Views' 164 MB of photos are graphics memory, Expose's 113 MB cache is native heap. The Canvas host's pictures already decode into `AHardwareBuffer`s its reader draws (`image::hardware_pictures`); a GPU painter could take the same buffers as textures (an `EGLImage`, a Vulkan import) instead of uploading CPU pixels.
- **Apple/Linux executor: a root swapped for a symlink between its check and its first open is pinned** (2026-10-08, review of the lazy app roots). `body::open` refuses a root that is a symbolic link, then `create_dir_all` and `AppDirectories::new` follow one put there in between (the same window existed when the roots opened at boot; storage's own `Session::configure` follows too). Closing it needs a no-follow root open (`O_DIRECTORY | O_NOFOLLOW`) in ibex2's `AppDirectories`, used by both. The first open is also outside the request's deadline and abort (three `create_dir_all` calls in the app's container).
- **Apple: images linked by use** (2026-10-08, LLP 1047.001; measured, not built). Only an `image` node loads a bitmap (its `imageSource`), so the use rule is one line (a plan with an image node uses `images`; the web links nothing for it). But the move is all or nothing: Swift in the core calls the `exact_raster_*` exports (`RasterLoader`), and the core holds image results itself (`NativeRasterLease`/`RasterImage` on every node; `RasterGeometry`'s drawing in the modal, flights and box layer; `AnimatedRasters` in the session, video, agent and box layers). Worth it for image-free apps and embeds only: ~54 KB of `exact_raster` and ~45 KB of Swift by symbol gaps, perhaps 50 KB real (speed). Split `RasterGeometry` and a lease protocol into the core, move the rest to an `ExactImages` module, and emit `raster_exports!` by use.
- **Apple: list swipe actions in every app** (2026-10-08): `SwipeActionsHost` (~34 KB by symbol gaps) is in hello, which has no list. Find its use rule (a list row's swipe actions) and move it out as `ExactDrag` was.
  2026-10-23 (lane q1022/ab): Parked: measured; no source change. `bun host/apple/build.mjs --ios hello-apple --sim "$EXACT_SIM"` passed. Hello's development executable retains 54,856 bytes (53.57 KiB) across 186 unique `SwipeActionsHost` text-symbol addresses, measured by gaps to the next text symbol. This is not a stripped binary size delta. A separate linked capability requires plan-u
- **Apple: the host's Rust drag and height sync run on every commit** (2026-10-08): `reconcile_height_handles`, `sync_height_owner`, `sync_height_transitions` and the transform drags are called from the commit path whether or not the plan has a drag; behind a const link (Drag) they would leave image-free, drag-free apps.
  2026-10-23 (lane q1022/aa): Parked. Commit `dbc0c3bc93`. Temporary runner-backed Rust probe: all four empty sync calls, 100,000 iterations, debug build: 0.361 us/commit, or 0.350 us with height targets forced dirty. Whole unseen-state commit: 30.598 us/commit, 1,000 iterations. 1 probe passed in 0.13 s; source restored afterward. The empty-path cost does not justify a const-link split 
- **Standard-library sorts copied per call site** (2026-10-08, the duplicate audit): `quicksort`/`driftsort` are instantiated ~38 times in hello (~80 KB by symbol gaps), one per `sort_by`/`sort_by_key` closure and element type. A few shared non-generic helpers (sort by a key of one type) would fold most of them.
- **Web writes lost when a tab closes mid-write, redesign** (2026-10-08; **Charlie, 2026-10-08: leave it documented for now, no redesign; the bench grader stays as is** — the pitfall covers it). A storage.fs write still in its IndexedDB transaction when the tab closes is lost (4/4 on an immediate close; bench t5 on the Android round). The first fix (da6848b8f..29efdaad6, a per-tab localStorage journal replayed at next launch) was reverted after a fresh blind review (Astra: revert; Grok: keep with fixes): a replay can write a closed tab's older value over a newer one another tab committed, a page restored from the back-forward cache was treated as gone for good, a non-permanent replay error dropped every dead tab's journal, and a failed localStorage flush could let a committed write age out of the applied set and replay. A redesign needs: a replay only if the target is still the version the write was admitted against (a durable generation per path), pageshow clearing the gone state, per-entry failure handling, and stale-snapshot removal on a failed flush; its own LLP 1097 amendment and review before landing.
- **Opening a select's menu raised the software keyboard on an EAS iOS 26.5 Simulator** (2026-10-08, seen while verifying app farm 008): a real touch (agent-device) on a `select` with options opened its menu and the system keyboard, the first time with its "slide to type" card, on main `57eeaa18` and with the fix alike. `KeyboardFocusIOSTests.testNativeSelectMenuPreservesShortcutFocusAndAllowsTextEntry` passed on that commit (with the fix, which leaves focus alone), so its zero-height `inputView` is not what the launched app showed. Not reproduced on a local iOS 27.0 Simulator with the software keyboard (2026-10-22): a real touch on a three-option `select` opened its menu and no keyboard. A phone is still to try.
- **LLP 1046.011 D4 and D3, ruled and unbuilt** (2026-10-07; D2 is built): `exact.mjs look`, an offscreen turntable of a `.glb` or `.model` through the engine's renderer as PNG, then the texture cap with the bake's per-model bill. LLP 1046.012 R5 asks that `look` also take a game-provided gallery (a roster of the game's own entities): comparing styles across Skirmish's whole roster is what made the art calls easy. `WorldSurface::settle` is the fixture loop it can use.

- **The JS edit loop exceeds its 100 ms budget on main and the merged button program** (2026-10-07, `scripts/metrics.mjs`, Mac Studio): unchanged main ca2ae9252 measured 354 ms p50 / 470 ms p95; the merged program measured 316 ms p50 / 344 ms p95 and, in a second run, 411 ms p50 / 543 ms p95. All runs took place during verification load; measure on a quiet machine and separate watcher delay, rebuild and browser reload before attributing a regression.

- **The full native-buttons fixture shrinks buttons on the web** (2026-10-07, LLP 1104 merged-tip drive): `scripts/fixtures/native-buttons.contract` at 420×900 puts its native buttons in a fixed-height scrolling flex column; their `overflow: hidden` permits `flex-shrink: 1` to collapse direct children below the title. The same heights reproduce with the pre-merge 934cfa08b stylesheet; unchanged origin/main ca2ae9252 also collapses a scrolling column of 60 native filled buttons to 14px each. The smaller conformance fixture does not cover this scroll case. Hold the intended intrinsic floor without changing CSS sizing semantics, or give the fixture nonshrinking rows.

- **iOS smoke intermittently loses the software keyboard between fixture launches** (2026-10-07, LLP 1104 merge verification; reproduced on `origin/main` at `69004a1b5`). On the lane's iOS simulator, the insets fixture gets keyboard height 0 and five failed assertions on main, while its keyboard-bar fixture gets height 328 and passes. The merged program also alternates between that failure and a missing keyboard in the keyboard-bar fixture; a cold simulator restart did not cure it, and `com.apple.keyboard.preferences AutomaticMinimizationEnabled` is unset. Both fixtures use `appearance="none"`. Investigate responder activation across the driver's separate app launches; the cause is not established.
- **canvas-gallery's 2D canvases are blank on the iOS simulator's screen** (2026-10-07, iPhone 17 Pro, iOS 27.0): launched by hand, development or production, `simctl io screenshot` shows the header and no canvas, 4 s and 14 s after launch. Yet `state` reports each canvas drawn (`draws: 1`, no error) and `agent.mjs … screenshot` shows every shape. A build of `28f29d821` (before LLP 1047.001's Surfaces move) is just as blank. Production Caltrain's GPU sky shows on the same simulator. Suspects: the replay's `layer.contents` on the on-screen path, against the agent's capture after `waitForReplays`.
  2026-10-22 (lane q1022/c2): not reproduced on an iPhone Air, iOS 27.0: `simctl io screenshot` before any agent request shows all eight canvases, as does the agent's capture.
- **Replay the garden bakeoff's exact2 lane through the look oracle** (LLP 1127.000, 2026-10-18). The in-tree garden's proof now looks with no tell on Linux, the web and macOS, but it has neither the brief's `meadow` model (the `#527b65` meadow) nor rain and snow, so RFC §4's acceptance case (the judged G4 and G9 frames failing on `particles-uncovered`, the meadow rendering green) needs the bakeoff's own lane (`game/bakeoff/garden/run.mjs`) run with the oracle. A `Material::hex("#527b65")` plane does read green in a look frame (`(124, 171, 155)` under the default sun and sky).
- **An HDR look frame with particles replaces the live frame's HDR attachments twice** (LLP 1127.000, 2026-10-18). Its count reads the scene's depth, so it needs that depth stored and sampleable; when the live frame's is transient (no depth prepass, soft particles, SSAO or final depth), `prepare_targets` makes retained ones for the look and the next live frame makes transient ones again: three textures each way at four samples, measured, with bloom's and SSAO's objects rebuilt. Neither keeps state between frames, so no picture changes; it is cost. A direct look frame already keeps attachments of its own (`look_direct`), released at the next live frame; the HDR path could do the same.
- **A look frame bypasses the static shadow cache** (LLP 1127.000, 2026-10-18). It draws every sun caster itself so that it leaves the cache as the live frames left it, so a defect only in the cache (a caster the cache dropped or kept stale) shows in live frames and escapes the oracle's `no-shadow-casters`. A look frame could read the cache's own maps as well, or count the live frame's texels.
- **`visible`'s reason names only the first non-mesh drawable that drew** (LLP 1127.000, 2026-10-18). `look.rs` `combine` answers `drawn` naming one drawable (`its sprite: …`) when a sprite and an emitter both drew; the reason could list every drawable's word.
- **No control has an emitter rescuing another drawable's rejection** (LLP 1127.000, 2026-10-18). `src/look_frame_tests.rs` covers a sprite that draws beside an empty emitter and beside a model out of view; an emitter whose particles draw beside a rejected mesh or sprite (`drawn`, naming the emitter) has no test.
- **Garden bakeoff follow-ups** (2026-10-06, historical run at `7716302242`; recheck on current main). exact2 placed third in the garden bakeoff (2026-10-06, LLP 1046.010 §8): 81 fidelity at 3× Godot's cost. Engine frictions from the builder's diary: restore refuses components setup never inserted (only a fresh process catches it); the world hash includes the host clock; a Contract `every(50)` trips `TimerFireLimit` on an hour seek. Not yet attributed (engine or game?): a meadow rendered grey and rain particles alive but invisible. Discoverability: the builder never found `exactTime().epochAtZero`, so its game has no wall-clock away growth.

- **LLP 1108.001, slice 3 (`Blob`, object URLs, `blob:` sources): NOT READY after four design rounds** (2026-10-08); r5 folds round 4 unreviewed and needs a fifth review or a ruling that narrows it. Slice 2's download landed narrower as `exactBodyTo` (LLP 1108 D6 R2, ruled 2026-10-26): a 2xx body only, no `when` headers. Open: the Snapback client's download could switch to it once slice 1 lands; LLP 1108.001's `when` (write only a reply whose headers admit it) and a writer thread for a stalled disk are not built; the asynchronous executor (`EXACT_HTTP_ASYNC`) refuses it.
- **A 2 MB `ArrayBuffer` body still runs over a source's 100 ms step** (2026-10-08, the Bluesky clone): `fetch` base64-encodes a byte body in the prelude's JS (`toBase64`), in the same step as the call (a 2,000,000-byte `uploadBlob` took 106.8 ms on the iOS simulator). An upload from a file now goes by `exactBodyFrom` (LLP 1108 D6 R2), which moves no bytes through JS; a native encode would lift the byte body too.

- **Driving apps on Android, stage 2** (2026-10-07, LLP 1107 §4). `agent.mjs android` drives an app's Linux host built for `aarch64-linux-android`, headless under adb (Caltrain's tests pass on the emulator). A TypeScript data module runs there with a locally built Hermes bundle (`bun scripts/hermes-android.mjs build`; LLP 1107 §4.1). Owed: that bundle in an Ibex release (Ibex branch `android-hermes-bundle`, local, for Charlie to send), so `exact setup` can install it as it does the others, `Intl` on Android (the bundle has Unicode through ICU but no Intl), and the bench's Android cells. An `exact new` app builds, installs, drives, tests and verifies its APK since 2026-10-30; `verify android` reads no `check` findings, largest text size or scrolling yet, because the Linux host answers no `check` observation (iOS's is `AgentCheckIOS.swift`). (The carrier for the Canvas reader landed on 2026-10-11: `agent.mjs android --reader`, [`host/android`](host/android/README.md).)
- **Android is admitted: what that owes** (2026-10-07, `rules/DEFERRED.md` §Surfaces, Charlie: "we are working on android now -- it's becoming real"). The Android host work keeps landing from `android/explore` through its owner's lane (8 commits ahead of main on 2026-10-07; the Canvas host, LLP 1076 §3.3, and the GPU painter are mostly merged already). The Minikin arm, `android/text`, is 6 commits ahead. LLP 1085.000's stage 3 ran on the Pixels on 2026-10-07 (§7: no regression beyond noise; main is the Android arm, so `text/parley-android` is not needed). The Nothing Phone (4a) Pro was not connected and is still to be run. Hosting serves `/.well-known/assetlinks.json` beside Apple's association file (LLP 1082). Android joins the sweep: which of the six checks or the async lane builds `exact-linux` for `aarch64-linux-android`, and which smoke drives it, is to be decided. `exact-linux` is not a default member, so today nothing on the gate builds it at all (fb03fd196 fixed a Linux build that had been broken on main since 1eea26bdc).
- **Pull to refresh beneath the Bluesky clone’s overlaid header** (2026-10-07, LLP 1010 §6.9). Test the clone on iOS with its header over the list padding. `RefreshInsetIOSTests` passes on the simulator; the clone still needs a manual check.
- **Press states the web's way** (2026-10-07, from the Brooks port: its buttons' face moves 4 pt down-right in 70 ms on press, which its fork bolted onto `press-scale` as a translation, a duration and an easing). The web's answer is `:active` styles with a `transition`; Contract has no state selectors, only `press-scale` and `hover-effect`. A language question for Charlie, not a port; the fork's knobs are not taken.
- **A native module reading the app's current assets** (2026-10-07, Brooks port P2): `ExactModuleContext` has data, cache, temp, clock and change, but no resolver for the active asset generation, so a module's leaf pins embedded hashes and misses an asset-only update. A small API (bounded bytes or a file, with lifetime and cancellation); write it when a second app needs it or an app updates assets without a binary.
  2026-10-23 (lane q1022/aa): Parked. Commit `8fecb94104`. The existing context still has no active-generation asset resolver. The entry explicitly waits for a second consumer or asset-only update consumer; none is supplied by this sweep. Initial macOS and assigned iOS simulator builds passed with the current interface. No API design, product change, runtime reproduction or new test is c
- **Keyboard, the rest of #140** (2026-10-07, after `keyup`, `KeyboardEvent.code` and `.repeat` landed). Two parts wait on the owner's word: a capture-phase handler and its spelling (`keycapture=…`, ancestors outermost first, `stopPropagation()` keeping the key from the target), and a reserved held-modifier fact (`exactKeyboard`, reset on window blur, beside `keyup`; the web's way, keyup plus `exactPage().hasFocus`, is documented). A ⌘ chord during a composition now commits it and reaches the `key` handlers on macOS and iOS; not yet pressed with a real Korean or Japanese input source. Composing keys still differ by host: the web host hands every key Chrome sends while composing to `key` handlers (Contract has no `isComposing`, so a composer's Enter there can send mid-syllable), the native hosts keep them for the input method. Composed text is the same on every host since 2026-10-12 (LLP 1115.000 §5, ruling 6; `host/apple/Sources/ExactKit/FieldComposition.swift`): `input` at each change with the marked text in the value, where AppKit had told it only once committed. What is left of that: (a) nobody has typed with a real Japanese, Chinese or Korean input method on macOS or iOS since (the tests drive `setMarkedText` and `insertText`); (b) an app's value never ends a composition, by Charlie's ruling of 2026-10-12 (LLP 1045 D5 stands): a different value written while text is marked is held and applied when the composition ends, since an action that rewrites what it hears would otherwise end one at its first keystroke and Contract gives it no way to know. macOS and iOS hold (`pendingValue`, `FieldComposition.swift`, each platform's `writeValue`), and so does the web's wasm target (`writeValue` in `host/web/glue.js`, `heldValues` until `compositionend`). Android and the web's JS target hold too since 2026-10-12: Android through the presenter (`Native.fieldComposing`, `presenter/hosted.rs`; not seen on a phone, which the entry on Android's text fields has), the JS target in `rt.js`'s `writeValue`, with the glue's rule and timing. Chrome does end a composition whose field's value is assigned: the marked text is replaced and the next keystroke begins another (`host/web/tests/compose-hold.test.mjs`, real compositions through CDP's `Input.imeSetComposition`, on both targets); (c) whether Chrome and UIKit fire an `input` at a commit that changes no text was not measured: macOS and iOS tell the app nothing then. Real keys (`orca computer`, events posted to the app's pid, macOS 26.6.2) gave Exact and Chrome 154 the same log: ⌘B is keydown Meta, keydown b, keyup b (with ⌘ still held), keyup Meta. A held key's auto-repeat is not yet pressed for real: the CLI cannot hold a key, and auto-repeat downs posted to a pid reached neither app; a keyboard by hand, or a HID-level post with the app frontmost, would show it. iOS reports no `repeat` (UIKit's presses carry none) and the terminal host sends no `keyup`.
- **Parley on Linux, what is left** (2026-10-07, LLP 1085.000 §7). An ltr line that starts in Hebrew keeps two visual-order inversions, as main did, under the first-strong base (LLP 1001 §1): it goes when the text-flow walker breaks an RTL run in an LTR paragraph and `shaping.rs` passes `BaseDirection::Ltr`. A Hebrew-in-ltr "…" pen sits 0.5 px off Chrome's, and emoji advances are 0.04–0.18 px narrower. The macOS and Windows fallback lists are cosmic-text's and unmeasured. Synthetic bold (fontique embolden) is not drawn. Tab stops count from the line start, not the block's start edge. Every vendored Parley patch (1–15) and fontique patch (1–3) is still to be sent upstream, and LLP 1085's questions to Nico Burns. Android: stage 3 ran on two Pixel 10 Pro XLs and a Pixel 10a (2026-10-07, §7); the Nothing Phone (4a) Pro, Expose and Windows are unmeasured. Crypto's `exact boot` slice is 1.6–2.0 ms longer with Parley on every phone (the cold start a user sees does not move); the slice has no sub-sections, so a simpleperf profile of both arms' boots is what would place it.
- **#84's journal lines, not ported** (2026-10-06; its Back and covered-edge fixes landed in 2cae1c92f and 74d782a36). A link that pops the stack, a testId repeated on covered routes, and a resource showing its answer to its previous arguments (LLP 1016 D3) were each to be said once. The testId scan read the wall clock (`performance.now()`, a 3 s window) and re-scanned `[data-testid]` on every projection in it; bound it by projection count or the agent's clock. The previous-answer line meets `rt.js`'s rewritten resource path (streams, build-time answers) at the cap.
- **Two checks red on main, seen in the PR sweep** (2026-10-06, at 856808161). On a Mac with Xcode's Metal toolchain installed (the Canvas 2D GPU module then builds), `smoke.mjs macos`'s canvas readback differs from its reference (1.33% of pixels beyond the band, mean 1.42, 840×240); and `smoke.mjs ios` on an iPhone 18 Pro Max has no reference picture (`canvas-sky.ios.1320x360.png`).
- **`overflow-anchor` and priority candidates** (2026-10-07, #138 X23d). The `overflow-anchor: none` opt-out and the priority candidates (a focused editable) are not built on any native host.
- **Linux scroll anchoring: input inside the frame that carries an anchor correction** (2026-10-19, the fourth review of the Linux anchoring lane, q24/linux-scroll-anchor). With a display attached, a correction waits for its picture's acknowledgement, and wheel, reader, command or feed input in that one frame moves only the pending model (`presenter/collection/anchoring.rs` `anchor_input`, `presenter/scroll_end.rs` `scroll_end_input`). Three edges are left: (1) the input's `scroll` handler runs at once at the old acknowledged offset, then again at the new one. In `scroll_anchor_tests/review_tests.rs` `input_that_only_moves_the_pending_model`, the wheel's order is `s648;s610;e;`, where it should be `s610;e;` (seen by asserting the whole string). (2) An input that exactly cancels the pending correction (+48 against a −48 fold) clears the model and records no `scrollend`. (3) A reader sample that moves only the model takes the host clock for its completion, not the shell's stamp, and an earlier sample's armed completion stays due, so one fling can end twice. (1) was reproduced. (2) and (3) are the reviewers' traces, not run. None of them reaches a scroller with no anchor correction pending: there `anchor_input` returns `None` and input takes main's path. Also not done: an anchor candidate whose transformed quad crosses behind the viewer (a `perspective` parent with `rotate: y 75deg`) is skipped instead of clipped to the visible half, as `placement::clipped_bounds` does.
- **`text-decoration-color` and `text-underline-offset`** (2026-10-06, the concept of #75 by Jon Samp, whose branch main outran; its third row, `cursor`, landed in c6136f39d and f7e010921). Two CSS longhands as schema rows: `text-decoration-color` not inherited, `currentcolor` by default; `text-underline-offset` inherited, `auto` by default. The `text-decoration` shorthand takes a colour, which `shorthands.rs` refuses today because native painters draw only solid `currentcolor`. Draw them natively rather than admitting web-only rows: Apple's `underlineColor`/`strikethroughColor` (an offset needs a drawn underline, or a named refusal; `Text.swift` is near the cap), Linux's `paint/text_decoration.rs`, the terminal's SGR 58. The line takes the decorating box's colour, as CSS does.
  2026-10-23 (lane q1022/t, Apple side): Parked: shared schema/compiler work is outside this lane. Running the debug compiler on `/tmp/q1022-t-396-{color,offset}.contract` exits 1 with `lower-unknown-attr` for both longhands. Apple cannot receive either row. No source commit. Fleet: declare the two schema rows, grammar, shorthand and wire values first; web and Linux need their painters and propagation too. Apple then needs explicit decoration colour on each
- **Server-render CPU per page** (2026-10-06, the concept of #81, which main outran; the web-framework-bench's weakest result, 3–21× the best competitor). Re-port on main: skip pre-compressing `dist/.gen` at bind and the number-text fast path (both cherry-pick clean from #81); one site index per plan shared across requests (`runner.rs` is at the cap); a decoded constant pool for `vm.rs`, without #81's load-and-field fusion, which changes the machine `Vm.lean` proves; re-profile the per-template style memo after StyleProps' shrink (71792e51d). Measure on a quiet machine and run the theme-flip test #81 skipped. Also seen: the render server serves `dist/.gen` (intermediates and the plan's source map) to anyone; `static_file` refuses no hidden path, and `/.exact/` must keep working.
- **web-js: 10,000-row list updates** (2026-10-06, the concept of #82, LLP 1071.000, goal approved 2026-09-30). Every commit scans the page for `[navigationBack]`, about 40% of an update's script at 10k rows; the emitter can say a plan has no navigation roots. Then: a clone cache in `h()` keyed by the whole site, text bindings writing `Text.data`, one write per `css()`, a single-element move, and the data seam's per-row conversion (re-check #82's value-to-type memo against streamed answers, `ts-stream.js`, which mutate). `rt.js` (1,499 lines) and `emit.rs` (1,495) are at the cap. #82's grid numbers: update every 10th of 10k rows 537–1,039 ms against Svelte's 442.
- **Wake-driven activation has no end-to-end test** (2026-10-06, reviews of #193). Its tests fire the wake by hand: nothing checks that a loader finishing alone wakes Linux's display loop or Apple's session and presents the activated frame. And `native::when_loaded` treats a missing digest or a poisoned lock as loaded (the retry then asks `preload` again).
- **iOS: a pressable glass button misses real touches over a transform drag's handle** (2026-10-06, the Bluesky clone's lightbox, b08 and b09). Close and menu buttons with `backgroundMaterial="glass"`, siblings painted over a full-page `transformDragFor` handle (`press=tap`, `dblclick`), took no HID tap on the iOS 27 simulator (`axe touch`): the tap toggled the handle's `press` instead. The agent's taps reached them, and with the material removed the same HID tap pressed the button. Interactive glass returns its effect's `contentView` from `hitTest` (`NodeViewIOS.swift`, "Interactive glass … answers a finger itself") and relies on the responder chain reaching the node; a recognizer on the effect or the sibling handle probably takes the touch first. Not reproduced on 2026-10-23 (iOS 27.0 simulator): a glass `button` over a full-page `transformDragFor` handle with its own `press` took the touch runner's real touch (it landed on the effect's content view, and the button's press ran, not the handle's). Still to try: `axe touch` as the entry used, and the Bluesky clone's lightbox itself.
  2026-10-22 (lane q1022/c2): not reproduced on an iPhone Air, iOS 27.0: a labelled glass button, padding taps and an empty glass pressable before a later `z-index=1` handle all take real XCTest touches; the fixture `glass-drag-touch.contract` is kept for a distinguishing reproduction.
- **A timer overdue at a gesture's event starts its transitions at the event's time** (2026-10-06, Grok's r2 review of `bsky/release-clock`). `advance_for_input` fires the timers due by a release or geometry at their own runner times, but the hold update (or geometry's `engine.advance`) has already moved the motion engine to the input's time, so a transition a timer starts begins there, not at its due time (`Engine::observe` starts at `self.now`). Only a timer the host's own wake missed is overdue at an input, so the shift is normally under a frame; committing the timers' receipts before the hold or geometry seeks the engine would remove it.
- **Linux content-region painting after hiding pending rows** (2026-10-24): `cargo test -p exact-linux --lib review_hidden_pending_content_paints -- --ignored` reproduces the CPU refusal `content text lacks final paint offer`. The ignored test in `host/linux/src/content_region/input_clock_tests.rs` boots `retained_actions::source()` with a registered content region, parks its body update at 100 ms, acknowledges the retained frame, dispatches `hide` at 150 ms, and requests another frame while the worker remains parked. Hidden text still needs a final paint offer.

- **Android start as seen: the grey wash was the platform's focus highlight; nth-C's Extra Heavy needs the phone unlocked** (2026-10-06, android/xstart; Pixel 10 Pro XL, `~/bench/android/results/video/xstart-1`, five warm launches each; reader patch `~/bench/android/results/xstart/reader-xstart.patch` against the bench reader's fce7c67). The daily app's window looked grey to the end of a recording, not for the cross-fade's last 25 ms: its view is focusable (keys), a launch by `am start` leaves the window out of touch mode, and Android draws its default focus highlight over the whole focused view (paper 223 for 254). With `defaultFocusHighlightEnabled = false` (the app draws its own focus): content visible 201-231 -> 187-195 ms (Views 183-190, Compose 180-195), settled 283-306 -> 287-301 (281-295, 288-304); xheavy unchanged, 216-224 / 306-310 (Views 210-222 / 302-314). exact2's content frame is still first (daily 78-96 ms against 107-113, xheavy 95-107 against 133-149), but what shows is the system's cross-fade from the launch, the same for every app: an earlier frame inside it shows no sooner by `am start`. Not built: the app's own task-open animation (a theme's window animations) would shorten what `am start` shows and nothing a launcher's own icon animation does. On the Nothing Phone (4a) Pro (nth-C) v8's Extra Heavy fling never ran on exact2 or Views: the phone had restarted and not been unlocked (`dumpsys user`: RUNNING_LOCKED), and MapLibre's `FileSource` reads SharedPreferences from credential-encrypted storage in an AsyncTask, which throws until the first unlock and takes the process down as the first map row is made (Compose makes its map later). Unlocking the phone once clears it; making the apps survive it means redirecting MapLibre's preferences and files to device-protected storage in each app (it resolves the application context itself).
- **Android: Extra Heavy's 24k blank, its causes, and the measurements still owed** (2026-10-06, android/xblank on android/explore 1ac9a73e3; Pixel 10 Pro XL; reader patch `~/bench/android/results/xblank/reader-xblank.patch` against the bench reader's aaf2f06, tools in `results/xblank/tools`). Measured on diagnostic builds over 9c8ccbead, one to five runs each; **the before/after tables on the final builds (xheavy, heavy, crypto; blank, fps, CPU) were not taken: the phones' host dropped off the tailnet (its node key expired)**; `results/xblank/tools/measure.sh` runs them (`*-exactxb0` before, `*-exactxb` after, APKs in `~/bench/lists/exact-wt-xblank/apk`). Found with a frame tag (`tag=1`: the reader draws each frame's number in the header and logs its feed's rows, `tagjoin.py` joins a recording's blank frames to them and to a trace): (1) `blank.py` took the launch animation for the driver's start in some runs, so their "24k" window measured 12k: every "bimodal" low reading (crypto's 0.3% baseline, xheavy's 0.5%) was that; fixed in `~/bench/android` ea94a6e. (2) `cover=1` read "covered" because a row's recorded bounds were its boxes unclipped: the list's spacer for unmounted rows is a row over a million px tall that draws nothing, and a horizontal list's content box 239,160 px wide; fixed here (each box within its clip, 1x1 for a row that recorded nothing). (3) About half of xheavy's blank at 24k (8-11% before, Views 1.3%) was the frontier: one exact-thread turn of refine, paint and pictures ran 13-35 ms (32-38 turns over 12 ms in each 2 s), no stream left meanwhile, and the view ran past its last drawn row. A fast feed's pass now builds what its measured cost per row fits in 8 ms, the rest after the queued steps (the reader re-posts a pending pass): 4.0-5.6%. (4) The other half was WebView cards: the reader made a WebView for each and destroyed it with its row, white until its page painted, where RecyclerView hands Views a recycled one still showing its last page. The reader now keeps three released WebViews (paused) for the next rows: 0.8-1.6% at 24k, 0.1% at 12k, recorded fps 110 -> 117-118 (two runs; 6.5% in the same build with `webpool=0`). Measured and not kept: a pool of threads making a stream's pictures while the stream waits for them (4.8 ms of a long turn is `HardwareBuffer.create` and the copy): no change. Left: the long turns' paint (8.7 ms) and pictures (4.8 ms) still stall the stream (pictures made where they are decoded, or drawn into their slots when they land, would take the second out); crypto and heavy with the 8 ms pass are unmeasured (crypto's rows cost under 1 ms, so its passes should stay whole). Cold start on this phone (warm shader cache, five launches each, `results/video/xbstart-base`): content visible 216-227 ms against Views 311-322 and Compose 313-318, settled 306-313 against 453-472 and 472-476; both follow the system's launch transition, which starts at the app's first frame (73-84 ms, still blank; content is in the next, 88-100 ms, before the fade shows anything), so nothing in exact2's boot (19-22 ms of CPU) moves them here. On the Nothing Phone (4a) Pro (`results/video/vwc`) the starting window stays until content, exact2's content frame (207-232 ms) is level with Views' (227-230), and that is where a shorter boot would show.
- **Android: crypto's 24k blank fixed; what the extra paints cost and what is left** (2026-10-05, android/cblank on android/explore 829cac9d1; Pixel 10 Pro XL, `~/bench/android/results/cblank-*`). Cause (Perfetto, the reader's `cover=1`): a refine (every third scroll step, ~7 ms) mounts the rows a viewport past the view; they are out of view, so the pass is quiet and frames move the last paint until the next one, which came 0-4 frames later (median 17.6 ms after the refine); at 200 dp a frame the nearest of those rows is under two frames of travel away, so the list ended at the last drawn row for 2-4 frames of every five. The exact thread was not short of time (440 ms/s, the same before and after), and the main thread took the paint within 0.6 ms (median). Fix (`host/linux/src/canvas/travel.rs`): the host measures the feed's travel per step and since the last pass, and after a quiet pass paints by the frame its rows can first show (at once at 24k; ≤6k never sooner than before). Three runs each, interleaved, 12k/24k blank: before 0.0/19.8-24.2%, after 0.0/0.0%, Views 0.0/0.0%. Traced fling (two runs each): fps and janky frames unchanged at every speed; CPU and main ms/s unchanged to 12k; at 24k CPU 1,370 -> 1,455 ms/s and main 230 -> 253: the RenderThread now draws the fifth of the view that was blank (its drawing as at 12k), and paints go 25 -> ~47/s, each ingest costing the main thread ~0.9 ms whatever it carries (Views at 24k: 862 CPU, 341 main). xheavy (paints every frame, so unaffected): 24k blank 0.5-11.3% before, 8.3-10.7% after, five runs each; fps and CPU unchanged. Left: (1) the reader's per-stream ingest cost (or rows published without a paint: exact sends a new row's recording and place, the reader adds it to the feed's group) would take back the 24k main time. (2) `cover=1`'s counters read 0 while a fifth of the view was blank: not row reuse but the spacer row's bounds; fixed on android/xblank (the entry above). (3) A shifted window (`lead()` moved toward travel instead of grown) and a pass every step (`pre=1`, reader patch `~/bench/android/results/cblank-reader-pre.patch`) each left 2.8-3.2% at 24k; not kept. (4) The once-measured 0.3% crypto baseline was `blank.py`'s onset taking the launch animation for the driver's start (the entry above).
- **Android: blank areas while flinging fast — measured, the reader's share fixed, the rest owed** (2026-10-05, android/blank on 268878a98; Pixel 10 Pro XL; the reader is `~/bench/lists/exact/android/canvas`, outside the repo, patch `~/bench/android/results/blank/reader-blank.patch`). The measure: `~/bench/android/bin/bench.py blank <app>` records a fling with screenrecord and `bin/blank.py` takes, per driver segment, the share of the list's viewport in full-width one-colour bands ≥56 dp (no row there), time-weighted, the same arithmetic for every stack. Before (two runs each, 12k/24k dp/s): xheavy 2.5–3.4% / 23.1–23.4% (16–18% of 24k frames more than half blank), heavy 0.0% / 2.7–3.8%, crypto 0.3–0.5% / 24.0–24.2%; Views xheavy 1.6% / 1.0%, Compose 0.2% / 0.1%, Views heavy and crypto 0.0% (no frame more than half blank in either). The mechanism on xheavy: rows come into view as they are first recorded (median 2 ms after the stream that defines them), and the reader recorded every row not in view at paint time on its worker, so its group drew nothing there for a frame or more. With such rows recorded on main when within 33 ms of travel of the view, and a worker-made row's group recorded again before the next frame: xheavy 0.6–0.8% / 7.0–9.3% (2–5% of 24k frames more than half blank), heavy 0.0% / 0.0–0.1%; fps, late frames, main-thread ms/s and PSS unchanged, CPU within run spread. Owed: (1) crypto at 24k: landed, android/cblank (the entry above). (2) xheavy's rest at 24k: WebView cards not drawn yet (an empty bordered box, as Views shows) and a few whole-view blank frames. (3) Measured and not kept: a velocity lead (`refine(-1, v)`; the reader passed 0) made every report dearer and blanked more (xheavy 24k 18–19% vs 12–14% without, CPU +4–12%; a lead following the measured speed mounted and retired a row every report at 1k); keeping the velocity for passes between refines (`refine_slice` resets it to 0) tripled first recordings; moving the scrolled list to the front of the report queue (each pass takes two lists and every report queues every mounted list, inner ones too) measured no change; clamping the compositor's scroll to the drawn rows (as a browser clamps async scroll) left the blank (6.5–7.7%) and moved 98–99% of the distance. (4) The feed's group keeps rows at the list's start and end mounted (the reader saw rows millions of px away in every paint): memory and walk cost, not blank.

- **`rem`/`em` the JS target still bakes, or the browser resolves elsewhere** (2026-10-06, after #136): SVG geometry written as attributes (`svg_props`: `x`, `y`, `width`, `height`, `cx`, `cy`, `r` on viewports, uses, masks, patterns, filters and gradients) still carries the kernel's 16 px resolution; and a node whose element keeps the UA's font (`button[data-button-style]`'s `font: revert`, `select`, both ~13.33 px in Chrome) resolves an `em` width or padding against that size in the browser where the kernel uses the inherited one, so the JS target and the wasm page disagree there.
- **The terminal surface's next work** (2026-10-06, LLP 1101.001 §3/§7; the terminal is admitted): P7's whitespace lint (`lint-space-collapses`) and the pitfalls' box-model candidate; P12 kitty images in the live region by id; `scripts/agent.mjs terminal` over the headless verbs and a `record` verb; the `color` fact and quantization below truecolour (D5); the profile's admission holes (the `border` shorthand, `style` blocks, non-literal lengths; both 1101.000 reviews); a non-terminal entry refusing `ch`/`lh` until a GUI host resolves font-relative units (Astra); ibex2's lossless stream mode when a consumer streams unreproducible events through the executor (P4); LLP 1101.002's deferred P5 (retirement's view half in the runner, now that `printed` is a contract) and its Q2 (start-aligned buttons, `nowrap` rows in the terminal sheet).
- **A terminal entry's `app:/` and `http(s)` images** (2026-11-12, from `issues/closed/20261110-terminal-image-src-is-read-as-a-path.md`). LLP 1101 D1 has a terminal entry share the app's files under its app id, but the terminal host knows no app id and configures no storage, so `image "app:/…"` is an `error` there (`host/terminal/src/image.rs`, `resolve`). It needs the app id in the terminal plan or its manifest and the same roots the GUI hosts use on that OS (Linux: `host/linux/src/picker.rs`, `app_dirs`). Whether the terminal downloads an `http(s)` image is LLP 1101's to decide; until then it is an `error` too.
- **The LLP terminal reader's leftovers** (2026-10-08, LLP 1101.004 §4): `scrollBy` on Apple (`IntoView.swift` beside `scrollIntoView`) and in the wasm web host (`host/web/glue.js`); find across a run boundary in `apps/llp/data/src/page.rs`; `press=` on an inline run on Linux and Apple (the terminal and `href` already follow).
- **LLP 1075.003.000.001, access hatches on every platform** (2026-10-06, accepted as a design; landing on main as it is built; its §13 is the as-built record). Done: the rename from hooks; of stage 1, on the web's JS target and on Apple, every call timed, `diagnostics` with its bounds, `state.hatches`' new shape, `perf hatches`, Save Trace's section and the web's throw rule. Also done: the per-platform `hatches` declaration with its typed keys, the plan's requirement, the cohort's capability, `classifyArtifacts`' branch, hosts that call only the words their module handles (`platform`, `unhandled`), late frames that name their hatches, the crash breadcrumb and `EXACT_HATCHES=off` on Apple. The plan's own per-platform row is built for Apple (a `hatches` table; a word not given to the platform reaches Swift unhatched). A node's calls are timed by its plan site on every host. Owed of stage 1: the wall-clock acceptance driven in a person's session (a late frame from a 30 ms hatch, read from Save Trace), and §9's cost series on a phone. Of stage 2, done on the web and Apple: the bounded act queue, `input(text)`, settle draining and naming a hatch that never stops, the app and window scopes with the embedder's two grants, the frame clock and `after` with the seek stopping at each hatch instant, and `?hatches=off` on the web. Root `data-*` words reach `app` as `app.data` on every host. Owed of stage 2: `input`'s remaining cases (a search controller keeping first responder, composition). Then: stage 3's leftovers (a part tap driven as a real touch on the simulator, and whether `owns` should take a `UIInteraction`, whose recognizers a hatch cannot declare today); Stage 4 is built on Linux (the trait, the overlay, observed input, the scopes, the frame clock, diagnostics, the breadcrumb); it builds, lints and passes the fixture smoke on a real Linux box too (x86_64, 2026-10-07); its Windows adapter is written and has never been compiled for Windows or run (a `cargo check --target x86_64-pc-windows-msvc` from Linux stops at `ring`'s C build, so it needs a Windows machine or a Windows C toolchain, and a Windows crate for the fixture), the Linux `build.rs` of each Rust-data app includes its hatches (`rust_hatch_entry`), the six that bake through `exact_js_bake` (canvas-gallery, completion-storm, duo-lab, expose, messages, weatherlight) do not yet, and an overlay draws no images or text yet. Stage 5, the `hatch` verb, the template's section and the guides, is done. Stage 6: Android runs stage 4's hatches (its in-repo host is the Linux presenter built for Android; 38 of 38 on a Pixel 10 Pro XL and a Pixel 10a); a Kotlin module and a `view` for a node that is a View wait for the Canvas reader to be in this repository, with their own RFC, and `smoke.mjs` has no `android` host. The design's r4 had no review before the ruling, so review should look first at the mid-seek act drain, each host's `input` primitive and the plan's per-platform words.
- **`cargo test -p exact-linux --lib` and `--test pinned` segfault on a Linux box with a real GPU** (2026-10-07, minisforum: x86_64, Radeon 890M, Mesa Vulkan). The crash is in `libvulkan.so.1` on a `Vello shader init` thread while dozens of test threads each start a GPU painter; it is there at aece7f3a7 too, before the Linux hatches. `-- --test-threads=1` passes all of both (623 and 76). The async lane's builders have no GPU, so nothing reports it. Fix to measure: one Vulkan instance a process for the tests, or a lock around instance creation.
- **After LLP 1047.001.000 E and F** (2026-10-15, §7.1): the media picker and sign-in sheet are linked by use, and a template's simulator first draw went from 1,287 to 339 ms. Still owed: §6's eager-permitted list (the check holds only the absent state), the launch phases on iOS's `state`, M1's warm condition on an iPhone (§8 Q9), and M5's rest (a phone, an https callback, the sample host's two sessions).
- **Snapback4's first native open runs past the step budget** (2026-10-08, LLP 1108 slice 1 drives on macOS and the iOS simulator): opening a never-synced partition natively (the device adopting the server's backend) took about 570 ms in one `people` step against the 100 ms budget, so the answer fails and the next one opens it; the drive's app raised the budget (`Module::set_budget_ms`). Split the adoption across steps, or run it as the module's long work (`NativeModule::later`).
- **A retryable `E_CONFLICT` blocks the Snapback4 client's outbox** (2026-10-08, app farm round 3, 34 GPT builds): a conditional write that lost its race comes back `failed`/`E_CONFLICT`/`retryable: true`; `round.rs` keeps it queued and stops the flush (`Stop::Retry`), so it and every write behind it retry forever. Follow Snapback's answer in `issues/20261008-snapback4-retryable-conflict-held-pending.md` (snapback repo); meanwhile bounding resends per write would unblock the outbox.
- **Live Snapback reads without a timer** (2026-10-08, LLP 1110, Draft r2): every app in the app farm's client arm refreshed on a 2–15 s Contract task, because a held `poll(20)` holds `clock settle`. r2: a TypeScript source answers with an async iterator, and `Snapback.changes()` long-polls with no server change; SSE later behind the same call. Reviewed twice (round 2: Astra NOT READY, Grok READY WITH CHANGES); round 2's points are folded as design and marked *owed*. Next: fix the owed items on lane C's local branch `lane/iterator-streams` (`~/projects/exact2-wt-laneC` on this Mac; built and driven on every executor, not landed), then review round 3.
- **A stream that can send: Supabase Realtime without polling** (2026-10-05, Depot feedback: an equipment-lending app built on Snapback4, Convex and Supabase polled on all three; Convex now has `@exact/convex`, LLP 1157). TypeScript sources send on a resource's socket from a mutation, its mapper or an answer on the web JS target, macOS, the iOS simulator and the Linux host run on a Mac (LLP 1016.000 D7; `issues/closed/20261009-runner-owned-bidirectional-streams.md`). Owed: Phoenix's join driven against Supabase as the proof; the web wasm host, whose module realm hands the mapper a handle that never opens (`open`, ordered and binary frames, `Closed`, the mutation flag and the op-14 door in `module-glue.js`); a Rust source's socket on the wasm host and on a worker (both refuse `Request::socket` by name; LLP 1016.003), and a Rust answer in flight's sends (D4); natively, a caller's abort ending the stream and mapping `Aborted` as the web JS target does (it only makes the handle stale: the prelude has no way to ask the runner to end a ticket, so it needs a door op, the runner and both native executors); a Chrome-oracle conformance case (text and binary both ways, order, close code and reason, `bufferedAmount` back to 0) and an async-lane echo test on the platform transport; and the X21 drive on a Linux machine, where the portable transport sends, and on an iPhone.
- **Backend SDKs in `app.ts`** (2026-10-05, Depot feedback: three handwritten wire adapters, Supabase's session persistence and token refresh by hand). Pure packages import today (LLP 1027 D5). What is left is the model: an SDK lives between answers (refresh timers, a socket it writes, `localStorage`), and a data module runs only inside one, refusing a `fetch` or storage call outside it. An SDK needs a client lifetime beyond one answer or a first-party adapter; Convex took the adapter (`@exact/convex`, LLP 1157, whose §1 measures what its npm client needs). An RFC with supabase-js as the case; offline (snapshot cache, purge on sign-out, the persisted half of the keep-last-value line below) follows from it.
- **A data module announces a change, and learns when nobody reads it** (2026-11-10, LLP 1157 §8 question 1: measured, and not built). `@exact/convex` passes `live.rev` to every query, so each `Transition` asks every query again, and it learns a query is abandoned only from the asks that stop coming. LLP 1016.002 built topic invalidation for native code (`native.watch`, `changed`); the same with the data module as announcer, one commit per batch of topics, and a call when a topic has no reader left would take the counter out of Contract and make `Remove` prompt. The counter costs 0.2 ms a change at ten queries of a hundred rows and 3.6 ms at thirty thousand rows (web JS, LLP 1157 §1), so it waits for a second consumer that multiplexes a socket (Supabase Realtime, Phoenix channels) or an app that holds that many rows live. Not measured natively.
- **`@exact/convex`, what is not proven or built** (2026-11-10, LLP 1157 D9 and §6): an app that signs in with `@exact/oauth` and hands its ID token to `setAuth` (each half is tested; the two were not driven together; expo/exact#54's reporter drove Better Auth's tokens on the web, macOS and the iOS simulator); a drive on Linux, Windows and a phone; a mutation sent again after a reconnect, which needs an answer that can wait across the gap (Convex answers a repeated request id once, so resending is safe on its side); a pagination helper, optimistic updates and a persisted cache. From #54: the stand-in listens where the app is built to look, so `test` cannot run while `npx convex dev` holds that port, and `test` has no way to run against a real deployment; both are the test harness's, not the module's. A mutation that must fetch and then send (an upload to a URL Convex signed) is three chained mutations until the one-turn send-or-fetch rule changes. The two asks of Convex (a client core with its transport, clock and randomness passed in; a logger that draws no `Math.random()` at construction) are Charlie's to send (LLP 1157 §8 question 4).
- **A build does not say a stream option it deferred** (2026-11-11, LLP 1016.000 D11). A stream option the host refuses (`exactTimeout` on a stream, `exactIdleTimeout` out of range) no longer fails a native build: the resource keeps its placeholder and fails at launch. The build prints nothing, so the mistake is first seen on a device. The refusal's words are in the `DeferredAtBake` the runner drops (`runner/src/runner/settlement.rs`); a bake could collect them into its warnings (`js/bake/src/lib.rs` `warnings`).
- **An idle timeout for an event stream and a byte stream** (2026-11-11, LLP 1016.000 D11, "Why only a WebSocket"). `exactIdleTimeout` is refused on them until what the native transports' own limits do to a quiet HTTP stream is driven and settled (`issues/20261111-a-native-event-stream-is-cut-by-its-transports-own-limits.md`).
- **The reference's account of a native continuation's sends predates the async helper** (2026-11-10, found in review). `docs/reference.md`, "An answer that keeps coming": "Code that resumes from an `await` runs in the next turn that drains microtasks … and sends as that turn's answer". The bundle's async helper now resumes each step of an `async` function under its own answer on every host (`js/src/prelude.js` `__exact_async_context`, LLP 1133.002 D14), so that sentence is true only of a plain `.then` callback. Drive both shapes natively, then say which is which.
- **The web JS target lets a module draw randomness as it loads** (2026-11-10, found in review of the seeded draw). `crypto.getRandomValues` and `crypto.randomUUID` there have no answer-only gate (`host/web-js/ts-fetch.js`, the `crypto` entry), where a native module's throw `unavailable during module initialization` (`js/src/prelude.js` `answerOnly`). So a top-level draw works on the web and fails natively, and under the driver it is the browser's, not the seed's: the stream is set before the first answer, after the module has loaded.
- **A standard module cannot import an npm package the app imports too** (2026-11-10, found building `@exact/convex`). The bake resolves a linked package's imports from its real place (`js/bake/src/typescript.mjs`, `capturedSources`), so `packages/convex` importing `convex/values` found this checkout's copy, the app's `convex/server` found the app's, and the build refused two copies of `convex`. The module now takes Convex's functions as arguments. A peer dependency resolved from the app would let a module import them.
- **An update store reopened while another thread spawns opens as a reader** (2026-10-05, review of the exact-update test fix): a spawned child holds a copy of `owner.lock`'s descriptor until its exec closes it, so `Store::open` on one thread while another is inside `Command::spawn` finds the lock held and opens a reader that writes nothing. The hosts open the store once at launch and hold it, so nothing in the tree does this; an embedder that reopens would need to serialize the two, as the test harness does (`open_store`, `finished`).
- **Transitions and animations of SVG `points` and `d`** (2026-10-05, the Signal clone): Chrome interpolates a polygon's `points` and a path's `d` (`path()`) between shapes with matching commands, which makes Lottie-style morphs declarative; Contract has no such transition or keyframe value, so a morph is a canvas or a stack of crossfades.
  2026-10-23 (lane q1022/t, Apple side): Parked: shared motion/plan/compiler work is outside the Apple lane. Debug compiler runs on `/tmp/q1022-t-428-{points,d}.contract` refuse both keyframe properties with `lower-keyframe-property`. `transition="d 1s"` does compile: the existing engine and Apple lowering already handle path transitions. Their existing tests pass with all 7 host::svg_tests. No source commit for this item. Fleet: add points transitions and 
- **LLP 1099's unmeasured inputs** (2026-10-05, LLP 1099 §4.6, stage 0): a device recording of one duration-form and one negative-bounce spring (tracked with the Signal clone's `motion-trace.mjs`); older iOS runtimes, with availability guards in `motion/tests/fixtures/uikit-springs/probe/`; mixed-form retargets; a dense duration-form sweep below u = 0.05 at ζ ≤ 0.1. None blocks stages 1–3; each would amend the fixtures.
- **A todo app's first native build compiles wgpu, vello, the game engine and canvas** (2026-10-04, the LLP 1086 fresh-agent trial). A fresh `exact new` app's first macOS and iOS builds took ~13 minutes each, building crates the app never uses ("GPU: no GPU crate" in the same log). The README now says ten to fifteen minutes; pay-for-what-you-use (LLP 1047) says they should not be built at all for such an app.
- **Journal a route whose overflow nothing scrolls** (2026-10-05, Exact-new iOS feedback; `lower-route-scroll` covers the static half). A runner log was built and pulled after GPT-6-Astra and Grok 4.7 reviews: it read every layout offer as the route's box, so a sheet detent or `resizes-content` keyboard flagged a covered screen and latched its key; covered retained routes, absolute and transformed descendants, and host covers (padding, which Taffy's content bottom omits) gave wrong answers; and it ran on the boot layout. A real one journals only the active top route, at the settled window offer, after first pixel, counting in-flow content against the padding edge, and clears its key when the route fits again.
- **Authoring-bench round 3 leftovers** (2026-10-05, LLP 1087, Claude and Codex builders on 15fae50b4/1811a9c98):
  `text-decoration-line: line-through` on a `textarea` draws on the web, not on iOS; a test cannot assert list order (`expect state doing.0.id` is a syntax error; builders join ids in a derive); a `pan`/`panrelease` payload has no pointer position, so a drop target is computed from frame + offset + deltas + a hard-coded inset; `outline` is not admitted (inset `box-shadow` instead); a JS drive script kept in the app folder makes the web build stale on every edit to it.
- **A test's `reload` restarts at the start URL** (2026-10-05, authoring bench round 5, t3-recipes: ~10 min): it keeps the store but boots at the drive's launch URL, not the route the test reached, so "reload on a detail screen shows that recipe" cannot be an authored test; a browser's reload keeps the URL. Either `reload` keeps the current location (as a person's reload does) or the docs say it does not.
- **Under `--touch platform`, context menus are still painted** (2026-10-16, LLP 1080.000 §13): a long press (`tap <node> contextmenu`) is recognized and opens the painted popover, and a real touch through it is refused. UIKit's context menu needs a held real touch (P3) or a `press` drag of the runner's.
- **interaction-gallery's Linux conformance comparison stops where the hosts' fonts differ** (`LINUX_APART` in `host/web-js/conform.mjs`; it needs a ruling, not a fix). It stops at `drag sheet-handle 0 -150 300`: the drag and its snap agree (both snap to the full stop), but the full stop is the sheet bay's height, under three rows of buttons with 12 px text, which Chrome sets in system-ui (San Francisco on macOS, a 29 px button) and the Linux host on macOS in Arial (`text/fonts.rs`'s sans without fontconfig, 28 px), so 518 against 521 (2026-10-16). Comparing it needs one face on both hosts.
- **The Lean `stdlib`'s equations are near their heartbeat budget** (2026-10-04, impl/1088-lists, LLP 1088 §9.1). Lean realizes `Contract.stdlib`'s equation lemmas where a proof first unfolds it, under the command line's options (a `set_option` does not reach them), and its match over the roster's string names took about 200,000 heartbeats before `concat` and needs more after, so `semantics/lakefile.toml` raises `maxHeartbeats` for the library. Each roster entry grows it (origin/main's formats and `t` add more). Matching the router's thirteen entries in a function of their own, reached from one arm, would shrink the match; `stdlib_ty`'s and `stdlib_good`'s case analysis would follow.
- **`perf frames live` on Apple** (2026-10-04, fix/game, the platformer's diary R11). The web's wasm target lends the agent's clock to the wall for a window (LLP 1079 D4); macOS and iOS answer `virtual`. `FrameSampler.swift` already builds the reply; a live branch in `Agent.swift`'s `perf` would release `session.clock` for the window, turn the GPU module's seek off (`GpuModule` takes `agentFreezes`) and let the display link fire runner timers (`Session.swift` gates them on `!agentMode`), then take the clock back at the wall.

- **`z-index` across a non-stacking parent, as CSS** (2026-10-04, fix/geometry, chess #5, kanban, kanban2, LLP 1087 t4-kanban). LLP 1083.000 §3.1 holds every host to "`z-index` stays inside its holder" because Apple nests one view per node and `zPosition` orders only one layer's sublayers. The web would follow CSS by dropping isolation rule (z) (rules a and b keep native tree order for level 0); the Linux painter could defer an escaping box to its stacking context's phase with its ancestors' clip and transform (hit testing follows its box order); Apple would have to re-parent an escaping view to the context's view with the intermediate clips and transforms rebuilt, as flights and the Arrange lift do for one view. Deciding between one order everywhere and CSS where a host can is Charlie's; the pitfall and LLP 1001 say what holds now.
- **Native `frame()` reads transforms as committed** (2026-10-04, fix/geometry, LLP 1051.000 D1). A transform in flight, a 3D one's projection and a `-exact-layout-transition`'s offset are the web's alone (its client rect); natively the runner composes the rows. Hosts noting presented transforms as they note scroll offsets (`Runner::scrolled`) would close it, for the first consumer that reads geometry mid-motion.
- **Form attributes the web has and Contract refuses** (2026-10-04, authoring bench, rounds 1–2): `autocomplete` on `input`, and `label`/`for` (builders used `aria-label` plus a visible `text`). (`aria-invalid` and CSS-wide `inherit`, also met there, landed the same day.)
- **A Lean theorem for LLP 1089 D3** (2026-10-04, LLP 1089 §7.2). If no path reads a slot another frame assigned earlier on that path, loading each slot as the last assignment on the path (or its starting value) equals the snapshot load; derives, resources, `pending` and sends lie outside the statement. That would prove `analyze-call-stale-read` sound against `exec`. No implementer yet.
- **Rewrite the diaries' copies as calls** (2026-10-04, LLP 1089 §4). Files' four opens as `arrive(path)` (F27, which also fixes `openFocused`'s missing `anchorPath = ""`), and spreadsheet's close-the-editor, `followSelection` and `clipKey` → `move` (F21), each driven on web and macOS. A scratch copy of spreadsheet with `commitEdit()` passes its web tests.
- **A scrolling `fit-content` route measures its rows as laid out in the sheet** (2026-10-07, Astra's review of `bsky/content-detent`, LLP 1075.003 §9.11). Its detent reads the scroll extent, so rows that may shrink (`flex-shrink: 1`) hold the sheet short; the non-scrolling route is measured alone (`Kernel::fit_content_height`). A second extent on the `content` op for the detent would end the `flex-shrink: 0` advice.
- **tvOS has no test target** (2026-10-04, fix/impl1088, LLP 1088 D7.3). `canBecomeFocused` is false for an explicit negative `tabindex` (`RemoteTVOS.swift`), and it compiles (`bun host/apple/build.mjs --tvos`), but nothing runs it: `KeyboardFocusIOSTests` is `#if os(iOS)` and `build.mjs --test` has no `--tvos`. The D7.3 test list's tvOS line waits on one.
- **A fragmented paragraph is one view on Apple, not one layer per fragment** (2026-10-05, LLP 1093 D8, left when the reader port landed). `Columns.swift` draws the paragraph clipped per fragment inside its union-sized view, so a paragraph across a spread's gutter backs a layer two pages wide. Hits already refuse the gap, and the reader's page clips, so nothing in the port showed it.
  2026-10-23 (lane q1022/aa): Parked. Commit `e1f9e32`. A temporary diagnostic in the existing column-selection fixture measured view/layer bounds 220x48 pt, capture 220x48 px at 1x. Fragments cover 9,600 pt²; the union covers 10,560 pt². The gutter is not a text hit, and the existing selection geometry test passed (1 test, 0.141 s). The diagnostic was removed. No visible defect reproduc
- **Content regions take no `text-indent`, `hyphens: auto` or a soft hyphen's fit** (2026-10-04, fix/typo). `host/apple/src/content_region/wire.rs` sends neither row, and `RegionWorkerLayout` breaks without the indent and without the hyphen-fit rule `TextEngine.layout` has; justification and soft-hyphen ink are there. Thread both through the region wire when a region consumer wants book text.
- **The document window, what the studio pass left** (2026-10-04, fix/macdocs; LLP 1069.010 "As built: the document window"). A ⌘Q that a window's `beforeunload` keeps open is cancelled, not resumed once the app's question is answered (NSDocument's review continues the quit); `wheel` and `drop` have no iPadOS form (a trackpad's scroll, a drag from Files) and `title` no `UIToolTipInteraction`; a command's menu is by chord only, so Zoom to Fit ⌘9 stays in File beside View's zooms; the bake does not warn when a declared extension already belongs to another app's type on the Mac (Freeform's `.board`); repeating linear gradients and px stops are admitted by Charlie’s 2026-10-12 ruling 9 (LLP 1066 amendment); the open repeating-hatch issue tracks remaining host verification and deferred `background-attachment: local`.
- **A resource whose arguments change reads its shape's zero until the new reply** (2026-10-04, fix/tooling3, workout F6). Lift's diary reports its board resource's `ready: false` unmounting the whole screen on every search or filter change, a flash on real time and a zero board under a test's still clock; the web's data stacks (SWR, React Query's `keepPreviousData`) keep the last value while a refetch is in flight. Native `clock settle` already waits for every runner request (a parked storage turn included; the macOS drive could not reproduce F6's miss on this branch), so what is left is the semantics: keep the last answer, flagged pending, until the new one lands, on every host.
- **Hear LLP 1096 on a phone** (2026-10-04, impl/1096). The sound arm's interruption handling (a call, Siri: the engine stops, voices due meanwhile are journaled `sound skipped: interrupted`, the engine restarts) and `audio_session: "playback"` against the ring/silent switch were built and run on the iOS simulator only; drums on an iPhone, and tvOS's tier-2 build, are still to do.
- **Hear issue #55 on a phone** (2026-11-10). Check `playback-mix` with the ring/silent switch set while another app's audio keeps its level; a default-ambient game leaves other audio playing at launch; raising the category while a module's RemoteIO runs does not disturb its output; and whether a muted `video` in a fresh process, before any hold and with no GPU canvas, stops another app's audio under the default category.
- **A sound holder released during a call can reset its session** (2026-11-10, found reviewing #55). `AudioSession.release`, `playerWent` and `giveUpIfIdle` have no call guard: a `playback` or `playback-mix` app releasing its last holder can set `.ambient` and deactivate, and its last player leaving can deactivate, while a call claim or the call's active session remains. LLP 1133.033 D10 reserves the session for the call; `restoreAfterCall` already restores what holders want.
- **A media-services reset leaves a canvas's audio session unrestored** (2026-11-10, found reviewing #55). `AudioSession.observe` restores only a capture's or speech's configuration, not a held app configuration. `CanvasSeams.swift` ignores `.reset` and leaves `CanvasAudio.active` true, so a canvas's next request skips activation and leaves iOS's default category in force. First check whether the module's output recovers from the reset at all.
- **The web audio-session setting depends on sound output** (2026-11-10, found reviewing #55). `sound-glue.js` sets `navigator.audioSession.type` only when sound output is installed: a declared `sound` initializes it, and sound commands or sequences can also do so. An app with only `video`, `audio` or GPU audio leaves the browser's `auto`, whatever `audio_session` says.
- **`z-index="auto"` is refused** (2026-10-04, files F14, the lists lane). `z_index` is an `i32` row defaulting to 0, so a conditional `z-index` cannot fall back to CSS's `auto`, and `auto` and `0` differ in CSS (only `0` makes a stacking context). A lifted, dragged row writes `z-index=(lifted ? 2 : 0)` for now.
- **Should `clock settle` fire a pending one-shot timer?** (2026-10-04, authoring bench, LLP 1087 t7-wizard.) A `task boot mount` with `after(1, restore)` does not fire at `clock settle` alone (it waits for requests and advances to the end of motion, LLP 1012 §2, firing a timer only if it reaches it on the way); a builder needed `clock +50`. The docs said a timer lands at `clock settle` and now say what it does. Including the earliest pending `after` (not `every`, which has no fixed point) in settle's target would match what builders expect; Charlie's call.
- **Setup and the wasm build on a fresh Linux box** (2026-10-04, the authoring bench): With a private `CARGO_HOME` the `-Zbuild-std` path failed offline on std's own crates (`rustc-demangle`) until `cargo fetch --manifest-path <sysroot>/…/library/Cargo.toml` was run by hand, though `app.mjs` means to do that itself. `host/web/build.mjs`'s non-JS path (a game, `--wasm`, `--bake`; `exact deploy` creates the parent itself) still publishes into an `EXACT_WEB_DIST` whose parent is missing with ENOENT: `replaceBuild` (`host/web/serve.mjs`) writes `<dist>.lock` before anything creates the parent, which only the JS target's path does (`mkdirSync(dirname(dist))`, 6ddd0c07f7; checked 2026-10-22 by calling `replaceBuild` into a missing directory).
- **The chooser, what is left** (2026-10-04, LLP 1021 "The chooser", "The chooser on macOS", "Placement"). Three gaps remain. The native `UIMenu`/`NSMenu` presentations are covered only by XCTest: under the agent a menu paints (D4), and a real touch into one awaits LLP 1080.000 stage 3. The iOS sheet cannot checkmark the remembered row, because `UIAlertAction` has no public checked state. `position-area` is unread by `UIMenu` and Linux.
  2026-10-23 (lane q1022/t, Apple side): Done for the remaining Mac Cancel item in `6b053daff8`; fixture follow-up `525651d592` after the full run. The changed menu regression fails before (Cancel is present), then all 17 ChooserMacTests pass (1.78 s). A Cancel row with a press handler remains an action. Caps passes. The full Mac run exposed three action fixtures with handlerless Close rows. Their action rows now have press handlers, retaining all checkmark
- **The macOS smoke's sky reference predates a text change** (2026-10-27). `smoke.mjs macos` holds the canvas fixture's readback against `scripts/fixtures/canvas-sky.macos.png` (recorded 2026-10-03) and finds 1.32% of pixels beyond the band. The sky matches and "Zoom" and "Label" are upright since `88bc755f37`, but both are drawn a little smaller than in the reference. Find the change that resized them; if it is intended, re-record with `--record-canvas`.
- **Two ordered macOS captures after LLP 1083.000 met main's capture fix** (2026-10-04). The agent's screenshot uses `Capture.picture` (`AgentMac.swift`, 4863d26d7: subviews re-sorted by `zPosition` around `cacheDisplay`, presented animation values, box fills hidden); canvas uploads use LLP 1083.000's `paintOrderBitmap` (`Mac/CaptureMac.swift`: an explicit compositor, filter pictures, model values with animated key paths overlaid). Both order by the paint rank and both pass the paint-order driver; keep one, with both sets of tests (`PaintCaptureMacTests`, the shop/spreadsheet captures).
- **CSS font generic mappings for cursive/fantasy/math/emoji/fangsong and CSS-wide font-family values** (2026-10-04, CSS lane): currently refused precisely so a generic is never silently treated as a local family.
- **CSS intrinsic flex-basis keywords (content/min-content/max-content/fit-content)** (2026-10-04, CSS lane): dimension rows need an intrinsic sizing representation; compiler now diagnoses the declared mode limit precisely.
- **`width`/`height` intrinsic keywords (`fit-content`, `min-content`, `max-content`)** (2026-10-31, Pokédex agent benchmark round 5: two of five agents wrote `width="fit-content"` on a badge or a table and were refused by `lower-attr-value`). Vendored Taffy 0.14 already holds the keywords on `Dimension` (`ExpandedDimension::FitContent`, `MinContent`, `MaxContent`) and has a shrink-to-fit helper (`compute/common::fit_content_width`); the kernel's dimension rows would need the representation, and block and flex sizing would need to honour it, with Chrome rows in `browser_position.tsv`.
- **CSS native interaction/painter gaps (diaries kanban F11, minesweeper F4, ledger F1, pomodoro F2)** (2026-10-04, CSS lane): user-select contain on every host (text since 2026-10-12 and all since 2026-10-20 are honoured on the web, macOS and iOS; Linux, Windows and Android take both as auto); dotted/dashed and other border styles; decoration color/style/thickness and Linux underline skip-ink:auto. Current compiler/driver diagnoses each declared limit.
- **Linux authored glyph fallback cascades** (kanban F8, 2026-10-04): font lists select the first available family; cosmic-text still owns glyph fallback through its single Attrs.family. Preserve the rest of the authored list per shaping run before claiming full CSS per-glyph fallback parity.
- **Layout property transitions** (kanban F15, shop F5, 2026-10-04): CSS `transition="width 200ms ease"` is valid CSS, but the native engine cannot interpolate arbitrary layout rows or lay out per frame. The diagnostic names supported paint/transform/SVG properties and the admitted height path. Add width and other layout transitions only with an approved executor/layout design; `-exact-layout-transition` projects changes to the laid-out box today.
- **Viewport units on scalar CSS lengths** (kanban F9, 2026-10-04): dimension rows retain viewport units across wire and resolve on native resize; font-size, gap, spacing and border widths still use scalar rows. Extend their retained relative lengths and web emission before admitting viewport units there.

- **Clock timelines, what the reviews left** (2026-10-04, LLP 1055.002 §5 "Known gaps"). Under the web agent clock an author's pause and resume is recorded once (`held`, as on main for every animation), so a resumed synced animation does not rejoin there, and one JS-agent seek that crosses a timer registers its joiner before older finite members are sought. `contract symbols` has no definition or reference for a `timeline`. Not yet driven after the review fixes: Lexy (its repository) on iOS and the web, macOS and Linux apps, Firefox, Core Animation across backgrounding.
  2026-10-23 (lane q1022/t, Apple side): Parked in part; no source change. Built and drove `/tmp/q1022-t-motion.plan` on iOS, macOS and the web. A second play mounted at 300 ms shares the first play's phase. Apple holds the first at 0.84 when paused at 800 ms; at 1300 ms the second is 0.76. After resume and a seek to 1800 ms, both Apple plays are 0.36 (screenshot channels `[255,163,163]` and `[163,163,255]`). Screenshots inspected; all operations succeeded.
- **`release` is every developer tool's profile too** (2026-10-04, the build-speed pass; LLP 1036.000 §5–7). The Linux host an agent drives and an app's render entry moved to `host-dev`, where a touched kernel line rebuilds in 3.6 s; at `release` (one codegen unit, thin LTO) it was 102 s on a Ryzen 3600, 58 of them the kernel on one core. So did the Contract compiler the smokes run for their fixtures. The web's tools are still `cargo run --release`: the dev loop's `exact-js-bake` (`host/web/dev.mjs`; its bake driver, an app's `-dev` bin or `exact-dev`, moved to `host-dev` on 2026-10-29), `parity.mjs`, `logic/bake` (`scripts/rust.mjs`), the `metrics` bins, and conformance's wasm side. Each rebuilds through that link after any change under it. Moving them to `host-dev` is the same one-line change each, left for the web's pass.
- **What `release` could shed: measured, not built** (2026-10-04, Hetzner Ryzen 3600, `caltrain-linux` / `caltrain-render`, stripped). Thin LTO, one codegen unit, `opt-level = 3` (today): 17.91 / 8.00 MB, 134 s from nothing. Fat LTO: 16.44 / 7.31 MB (−8%), 207 s. `opt-level = "s"`: 14.80 / 6.40 MB (−17%), 94 s. Both: 12.85 / 5.65 MB (−28%), 155 s. `opt-level = 2`: 17.15 MB (−4%). Sixteen codegen units: 19.42 MB (+8.5%), 97 s. Fat LTO costs only build time (73 s more there; run again later that day 143 → 210 s and 18.04 → 16.57 MB, boot 50.7 and 50.9 ms and layout 21.9 ms both ways over twelve alternating launches), and a Linux bake could say it as the Apple one now does, on Cargo's command line: a bake builds with `--target`, so it shares no artifact with the tools above. Sixteen codegen units under fat LTO, which on Apple build faster than today's profile, do not here: 193 s for 17.36 MB (−3.8%). `"s"` trades the hosts' speed, unmeasured there. Both are Charlie's to rule with the other platforms. An Apple production bake does not move the same way (M4, Caltrain's `ExactMac`, as built / with `strip -x`): thin LTO 11.98 / 9.06 MB; fat LTO 11.82 / 8.62 MB (−1% / −5%); `opt-level = "s"` 13.60 / 10.78 MB, larger by 14%, and its runner and layout at boot 7% slower (16.1 ms against 15.1). Fat LTO is built there (the bake says it for an Apple target, which no tool builds for; LLP 1036.000 §8); `"s"` is a loss. The Swift side has the same trade and it is also left: `-Osize` makes Sparkline's stripped binary 7.8% smaller (8.73 → 8.04 MB, 12.6% with fat LTO) and its first apply of 295 views 7% slower (17.9 ms against 16.7, sixteen alternating launches).
- **A cold bake of an app with a GPU crate is two Cargo builds end to end: measured, not built** (2026-10-04, Cargo's `--timings`, Caltrain on the ten-core M4, before the registry crates were kept; LLP 1036.000 §7). The GPU crate first, 39 s for 146 unit-seconds, because it is one chain (naga 14 s → wgpu-core 13 s → wgpu 7 s); then the app's archive, 49 s for 366, whose chain is the kernel (33 s) and the app (3.5 s). They are in sequence because the app's build script binds the GPU product (LLP 1009 D6), and nothing else can warm the app's dependencies meanwhile: asked for by another selection they are other units (`-p exact-apple` recompiles 25 crates in a warm target, the kernel among them; with the GPU crate, 32). Overlapping them needs the GPU crate in its own target directory and the app's dependencies compiled before its build script may run, which is a change to what `buildBake` promises on every platform. It is worth less than the chains suggest on ten cores, where ExactKit's compile already fills the GPU phase's idle ones (the three together are 660 CPU-seconds, 66 s at best), and more on eighteen. In a checkout that starts from the kept registry crates (§11) the two builds are 12.9 s (wgpu-hal 3 s → wgpu-core 9 s → wgpu 5 s, then ours) and 37 s (the kernel, 30 s), so overlapping them is worth at most those 13 s of a 58 s first build.
- **What a second checkout still compiles** (2026-10-04; LLP 1036.000 §7, §10, §11). The host's two Rust modules and the registry crates under an app are now kept for the machine (`~/.cache/exact/apple-modules`, `~/.cache/exact/apple-crates`): a second checkout's first build is 78 → 58 s on an M4 and 38 crates, all of them path crates or standing on one. What is left, in the order it costs: the kernel (33 s in one rustc front end, the chain every build waits on); `wgpu-core` and `wgpu`, registry crates rebuilt in every checkout because the vendored `wgpu-hal` under them is a path crate (20 s of the GPU crate's build; a patched crate consumed as a registry or git source would be kept like the rest); ExactKit (150 CPU-seconds, beside the bake, and not what the Rust waits for: at a lower priority the build is the same, 57.7–58.9 s against 57.3–58.6). The kernel alone is 12.6 s on an idle eighteen-core M5, 10 s of it rustc and 7 of those LLVM over its sixteen codegen units, so it is the cores and not the front end. sccache was tried on the Linux host and is not it (95 → 79 s): what it cannot share is the same path crates.
- **A binary that takes updates ships every loaded module** (2026-10-04; LLP 1047 D8, "after the web target"; LLP 1036.000 §8). A production Apple build at store level 0 now leaves out each of the four its plan cannot reach (the bake's `loads`: the Canvas 2D GPU module, the SVG island module, the video and web arms; Sparkline's Mac bundle 16.3 → 11.6 MB), because that plan is the only one the binary will ever run. A binary at any other level carries all four (4.7 MB on a Mac) for a later bundle that might reach one, and dropping them there needs the linked set as a compatibility input, so a bundle that reaches a module its binary lacks is refused before it is applied (D6, D8).
- **An abort a listener suppresses leaves a browser-realm fetch pending until its reply** (2026-10-04, both families' round-5 reviews of the app-diary fixes, 4a8). Hermes watches a fetch's signal through Ibex's abort hooks; the wasm target's browser module realm loads prelude.js alone, so `watchAbort` is an `addEventListener` an earlier `stopImmediatePropagation` skips, and the fetch rejects only when its reply lands (fulfill rechecks `signal.aborted`). The default web build (the JS target) uses the browser's own fetch and is unaffected.
- **A Rust source in a logic module is asked without its `Target`** (files F22, 2026-10-04, read in `logic/abi`, not reproduced). The ABI's ops 3/4 call `answer`/`parse`, whose defaults drop to `query` (the bake placeholder); in process (`Mixed`, `Storage`) the runner calls `answer_for`/`parse_for`. A source that parks a call by `Target` therefore answers its placeholder, silently, on the JS web target only. Carry the target across the ABI (both hosts' encoders, an ABI version), or refuse at load a module whose source overrides `answer_for` and not `answer`. No longer needed for `doc:` paths, which TypeScript reaches now (F2).
- **`contract types`' `Sources` demands the Rust half's sources from `app.ts`** (files F21, 2026-10-04). In a mixed app the generated `Sources` names every source, so the TypeScript half writes `Omit<Sources, …>` by hand. The composition that knows which sources are Rust's (`RUST_SOURCES`, `build_mixed_with`) is Rust code; `app.json` could name them, or the bake could emit a `TypeScriptSources` type from the composer it already runs.
- **Pointer events, what is left** (2026-10-04, LLP 1056 §8.6; the paint diary's F1). No `coalesced` list: a stroke is a polyline at the display's rate, and DOM's `getCoalescedEvents()` as a field needs a second record type (a record cannot list itself in the plan's types). An iPad's hovering pointer and pencil send no free `pointermove` (UIKit's hover recognizer). Linux delivers every move, as its `pan` does, not one a frame. The Mac agent's held drags read `pressedMouseButtons` beside the event's own button; a synthesized pen is never a tablet event, so pen pressure on macOS is untested by script. `exact new`'s template now passes the module's canvas roster; apps made before it (x2apps) have to add `.with_canvas_surfaces(CANVAS_SURFACES)` to their `apple/` and `web/` crates by hand.
- **CSS `outline`** (2026-10-04, x2apps spreadsheet F3): `outline-width/-color/-offset` are refused, and `outline`/`outline-style` take only `none`, on a text field or textarea, where it takes the field's ring off (LLP 1104 D6, #459). On the web they would be CSS (and `outline: none` takes the browser's focus ring off a focusable grid); natively nothing draws a focus ring on a box, so they need paint rows outside the border box, following `border-radius`, above the content, on Apple and Linux. Admit with the four rows and their shorthand, painted on every host, and a `:focus-visible` answer (none exists for any row yet).
- **Keys, what native hosts still lack** (2026-10-04, x2apps calc F3 / minesweeper F7; docs/contract-grammar.md#keys). `key` bubbles and `preventDefault()` claims a key on every host now, but on macOS and iOS a scroller does not scroll by arrow, Space or page keys (the web's default), and iOS carries no `aria-keyshortcuts` (`UIKeyCommand`s from the focused session's buttons, as `ShortcutsMac.swift` routes them). The iOS hardware-keyboard path (`TextField.pressesBegan`) is driven only through the agent's synthesized keys; no real keyboard has pressed it.
- **The JS target's data seam caps an answer at 16 MiB** (2026-10-04, LLP 1090 conformance). `rust-data.js` goes through the logic ABI, whose `MAX_MESSAGE` is `MAX_HOST_WORK_BYTES`; the runner's in-process data source has no cap, so an answer between 16 MiB and the runner's value bounds loads on wasm, native and Linux and fails on the JS target (docs/agent-pitfalls.md). Either bound answers alike on every host or let the JS seam carry what the runner does.
- **The JS jump lands what a timer sent at its last instant** (2026-10-04, LLP 1092 "As built"). `host/web-js/agent.js`'s `clock +N` waits for every reply after a stop and runs its `then`; the wasm glue, the Linux agent and Apple stop waiting once no timer is due by the jump's end, so a request a timer sends at exactly `to` lands there on real time and its `then` waits for the next operation. Conformance avoids it (`queue.contract`'s timer sends nothing); pick one behaviour and make the other hosts follow.
- **One-slot invariants of a queue mutation's slot** (2026-10-05, LLP 1092 D12, semantics/README.md "Queued sends and gated tasks"). `Reachable.slotIn` and its siblings are proved of slots no drain writes (`isQueue p x = false`). For a queue mutation's slot, carry the property of the answers its waiting sends will land (`∀ q ∈ c.queued, q.1 = x → ∀ v, V (.some v)`) through `runAction` and `nextCommit`. Lean's `pending(m)` of a waiting queue is false (the runner's is true): model it if a program needs it.
- **What the Lean semantics still leaves out** (2026-10-04, refreshed 2026-10-17; semantics/README.md "What the semantics leaves out"). Routes, `t(...)`, the `format*` entries, frame tasks, a mutation's `then` and form-control payloads landed. Left: geometry reads (`frame`, `measure`, `elementFromPoint`), `toLowerCase` (Unicode's case mapping, which the runner takes from Rust's `str::to_lowercase`), the host's `navigate` event, a reload, and `exactTransport`/`exactMIDI` reads. `difftest explore contract/corpus apps/*/app.contract` reports Metronome (`exactTransport`) and Shelf (`toLowerCase`) as outside it. A virtualized list's rows are left out of the observation (the runner windows them by layout), so a scripted tap on one is not compared meaningfully.
- **tvOS, what is owed** (2026-10-03, landed from Doug Lowder's `doug/tvos`; LLP 1008 §9 "tvOS"). iOS-only files that shared code names break it (twice in one landing: `PointerIOS.swift`, then `NavigationTitleIOS.swift` and `GroupedListIOS.swift`); the tier 2 async lane (`scripts/async.mjs --tier 2`, hourly) now builds tvOS and files what breaks, but nothing starts that lane on fleet hardware yet; since 2026-10-12 the per-commit lane compiles it too (`build.mjs --tvos --no-install`, which needs no simulator) for any range beyond documentation. `scripts/agent.mjs` has no tvOS target (it installs the iOS build), so `smoke.mjs` cannot drive a TV, and nothing here presses the Siri Remote by script (`simctl`/`devicectl` have no route; Doug drove it with Argent). No device builds, icons (layered brand assets) or Top Shelf. A grouped list's toggle row shows a checkmark but Select does not flip it.
- **Android TV, what is owed** (2026-10-20, LLP 1115.001.003 §4; stage 1 landed 2026-10-23: Caltrain on the `tv_api_34` emulator takes the D-pad, Select and Back). Owed: the look a hand-built Compose for TV app has (§5 Q2; on the emulator Caltrain's light cards show white text faintly, and its departure minutes are barely visible); a banner per app; `focusGuide="auto"`; play and pause; text entry with the TV's keyboard (a hosted field's D-pad goes to Android's focus search, not the presenter's); a control inside a pressable row, which no arrow reaches; a TV launcher tile checked by hand (Android lists the leanback entry; the tile was not reached on Google TV's Apps row); driving the real keys from the agent, and a TV smoke.
- **A plan decoded inside wasm at activation** (2026-10-03, LLP 1029.000's per-byte fuel). Activation hands the data module the whole encoded plan, which it decodes at about 430 wasmi instructions a byte: Caltrain's 46 KB plan is about 20 million. Unmeasured: what that costs in wall time on the native interpreted path against the 100 ms cold-start budget. If it matters, activation gives the module only the tables it reads.
- **Hosts outside the repository** (2026-10-03, Charlie: "out-of-tree is for like Amazon's new TV operating system thing"; `rules/DEFERRED.md` §Surfaces). An RFC beside LLP 1036.001 (apps outside the repository): what a host with its own UI stack consumes from exact2 (the plan and kernel wire, the runner, the agent protocol), and what exact2 would have to publish for it (a stable host ABI, `host/web-js/conform.mjs` runnable outside this repository, drivers that do not assume `host/*`). Amazon's Vega OS is the motivating case; first find out what native surface its SDK gives an app.
- **A standing web competitor bench** (2026-10-04, `~/bench/dioxus`). The perf scoreboard measures iOS against SwiftUI and UIKit and never the web or a bounded window's shift. One afternoon against Dioxus Web found the feed shipped three times (cf12cb9ae), the whole-list tap (now a development-build warning, `host/web-js/seam.js`), a lazy source's first-shift hitch, and the clamp bug that threw readers back 55–59 rows at every window shift on web, macOS and iOS (ca83e4eaa, 04c1822ec). The harness (`web/bench.mjs`: load, bytes, heap, scroll at four speeds, taps; `web/progress.mjs`: content progress by row) and the Dioxus port (`heavy-dx/`) are there: give them a run on each landing that touches the web host or collections, beside the iOS series.
- **Sub-second Rust edits without hot-patching** (2026-10-05, LLP 1029.000.001, Draft, awaiting Charlie). A one-line data-crate edit costs 2.3–3.2 s on the JS target's dev loop and 1.6–2.0 s with live replacement on native; the crate compiles in 0.13–0.55 s (LLP 1029.000.000). The RFC builds the dev module in `logic-dev`, swaps the module in the page for a Rust-only edit, and builds only the variants connected clients run, in parallel; Subsecond-style function patching was weighed and declined.
- **Grouped lists, what is left** (2026-10-03, LLP 1084 §4, §7). (The large title collapses with the collection view, and grouped rows take `delete=` and hand-written swipes: checked 2026-10-20.) The Signal Clone's `Section`/`Row`/`ActionRow` components can become a grouped list (its repository). `sidebar` styles wait for an iPad or Mac consumer.
  2026-10-23 (lane q1022/ab): Parked: the remaining conversion belongs to the external Signal Clone; sidebar styles require an iPad or Mac consumer. No source change in this lane. Existing `GroupedListIOSTests.testATapHighlightsAndPressesTheRowOnce` and `testASwipeRowTakesItsListCellsOwnActions` ran on the assigned iPhone: 2 passed, 0 failed (0.070 s); `/tmp/q1022-ab-grouped.log`. These 
- **Styleable materials** (2026-10-03, LLP 1081 Q3). A `style` class cannot carry `backgroundMaterial` or `glassGroup` because they are props; LLP 1069.011 D12 already makes `buttonStyle` a styleable prop, and these two can join it. WebKit's `-apple-visual-effect` is not a browser name under LLP 1081 D1 (it is behind `useSystemAppearance`), so there is nothing to adopt.
- **Style names and their kinds in `schema.json`** (2026-10-03, LLP 1081 Q5). LLP 1081 puts the author style names, with provenance, in Contract's `style_names.rs`. Moving them into the schema is a mapping design, not two new fields: names and rows are many to many (`gap` sets two rows, `translate` sets `Translate` and `TranslateZ`, `flex` sets three different values).
- **CamelCase for Contract's kebab-case props** (2026-10-03, LLP 1081 Q6). `scroll-start`, `scroll-restoration`, `initial-item-count` and `bitmap-width`/`bitmap-height` look like CSS properties and are props; camelCase, Contract's spelling for its own props, would make a kebab-case name always mean CSS or an HTML attribute. Ask Charlie first about `bitmap-width`/`bitmap-height`, his "for now" spelling.
- **What `tree --ax` found on macOS and iOS** (2026-10-03, LLP 1080.002 §7). AppKit exposes the accessibility fixture's `aria-hidden` decoration and the button inside its `inert` column (`exposed-hidden` ×2, LLP 1001's "AppKit/Linux subtree enforcement remains open"), and its checkbox and password field are exposed through cells that answer no name (the label is set on the control view; whether VoiceOver speaks it is unverified). (On iOS a `role="img"` column is one image, its name its label, its button hidden, as on the web: checked 2026-10-20.) Not built: a projected segment's join to its tab, and the macOS window toolbar's walk (both reported as coverage limits). On iOS the read needs UIKit's accessibility runtime: `xcrun simctl spawn <udid> defaults write com.apple.Accessibility ApplicationAccessibilityEnabled -bool true` on a simulator, then relaunch; the driver could set it for an `ax` drive.
  2026-10-22 (lane q1022/b3, 6dcf3bed91, 9cb75a97a6): hidden and inert checkbox and secure-field subtrees stay suppressed through restoration, read through the AX client; the fixture's exposed-hidden decoration and inert-column button are unverified while the desktop is locked.
- **LLP 1079 on hardware, what is unrun** (2026-10-03, `perf`'s §As built). Linux's display-loop sampler and `SIGUSR1` trace were type-checked for `aarch64-unknown-linux-gnu`, never run on a DRM display. iOS Save Trace was clicked on a simulator (2026-10-05: saved, Share… offers the file, `agent.mjs trace --phone <simulator>` copied it from the container and read it); on a phone neither the share sheet's AirDrop nor the driver's `devicectl` copy has been run, and macOS's ⌥⌘T was not clicked. The `--stress-url` p95 comparison, measuring on and off, was not run.
- **The JS target's development `perf` costs about 3.7 µs a commit** (2026-10-03, LLP 1079 §As built). 800 caltrain hover commits took 9.7 ms against 6.7 ms with `perf.js` stubbed out. Two-thirds is the mutation observer that gives `authored`/`created`/`retired`, the rest the `pf` wrappers; production carries neither. A cheaper count would need `rt.js` to stamp its own writes, which every production bundle would then carry.
- **JS-target grant parity, what is left** (2026-10-02, landed from `web/grants` (c4e02b00, 207c2c04, dcd938ed) after three review rounds; both final reviews still mark these). Unicode spellings the Rust parser accepts and the web treats differently: U+0085 in a module's grant text is refused at `host/web/module-glue.js` prepare; with a U+FEFF line a parser-accepted `auth.session` never installs on the JS target, and the wasm page's surface check admits a U+FEFF line native refuses. A `Response` with an empty URL (an opaque, `no-cors` answer) skips the final-origin check, so an ungranted redirect can succeed there. A redirect whose hop the browser itself rejects reports `Network`, not native's `Refused` (a declared deviation, LLP 1071 §7: the page cannot see the destination). A Rust-only page exposes its file commands before its grant set is installed. Two `Store` facade differences from native in `host/web-js/ts-data.js`. `apps/fieldnotes/web/tests/worker.rs` is not migrated to grant-set arguments. Out of scope by Charlie's ruling (grants on the web are parity, not a sandbox: the page's own code can always reach the browser's fetch): forged, self-sealed or accessor-backed grant objects, and app code replacing the fetch late host modules use.
- **Animated scroll to the end on send, what is left** (2026-10-02, Signal Clone; iOS, macOS and the web host built 2026-10-03, LLP 1070.000 §11). Linux lands a smooth correction at once. A plain `scroll` still jumps on a `scrollTop` write followed to the end.
- **Smooth collection jumps cross unbuilt rows** (2026-10-03, astra's review of the smooth-correction hosts, `llp/reviews/code-2026-10-03-signal-gaps.astra.md` #5; seen on an iPhone in Safari 27.3, 2026-11-04). To consider and investigate, not necessarily to change. While a smooth correction animates, each host that animates one (the web, iOS and macOS; Linux lands it at once) reports the destination: a mid-flight report told the runner that the reader had left the end, and that stopped the end-follow. So a smooth `scrollIntoView` farther than the mounted window crosses spacers no row fills, which on a fast animation, as Safari's is, reads as a jump. A short one shows its rows all the way, and a send's end-follow is within the window. Ways to weigh: the report carrying both the physical port, which is what to realize, and the destination, which is what to anchor (a wire change in `CollectionFacts`); jumping near a far target and animating the last stretch, as Compose's `animateScrollToItem` does (UIKit's `scrollToItem(animated:)` lays out rows on every frame instead); or leaving it, since an app can ask for a row near the target, then glide.
  2026-10-22 (lane q1022/q): Parked on scope. No code change. Ran SmoothCollectionIOSTests.testASmoothCorrectionAnimatesAndReportsNoTravelWhileItRuns on the assigned iPhone: one passed in 0.655 s. A temporary observation at the first smooth correction printed physical offset 0, reported offset 1700, one mounted row. Log /tmp/q-ios-522.log; method source target/q-ios-smooth-probe.swift. The temporary print was removed afterward. This reproduces t
- **LLP 1075.003 (native platform control) owes** (2026-10-02, `lane/native-control`, §9.4). Stages 0–3 are built: hatches on an app's module (`navigation`, `route`, `routeEnded`, `tabs`, `tabContainer`) over Exact's own bar and retained tabs, declared `data-*`, host covers, write-on-change controls, multi-detent sheets, and a large title collapsing with its scroller. Owed: James's two cases at a pinned revision in his app; real touches (a finger on a bar item, a finger's collapse and pull to top, a held sheet drag, a minimizing tab bar); a cold launch filmed on a phone with and without hatches, and a memory warning; Stage 4 (TypeScript by experiment), which needs NativeScript's runtime, a dependency nobody approved; web and AppKit hatches; the `element` hatch and the named action (Stage 5, on demand); `back()` and `open(url)` on `ExactTabContents`; the development ownership check on an app's tab container. On the JS target `project` runs only from the router's effect, so a navigation root with no router slot is never projected there (its stacks, and now its panels, stay as authored); it predates the plan. LLP 1075.003.000 (hatches on every host, Stages 1–4 done; a hatched node in every row of the Extra Heavy feed costs a fling about 16% CPU and, on the iPhone, 5 fps, all of it the lost row reuse: the call and an unhatched build cost nothing measurable, §7.5) built the opt-in that takes that price back (`element.reusable`, §7.6); owes a development check on macOS and the web and for a base view's owned properties; hatches on the wasm web target, if a game or a fixture ever wants them; an LLP on which AppKit containers Exact projects.
- **A module view's input, twice** (2026-10-02, astra's delta review of the hatches' fixes). On both web targets a module view hears the page's own input as any element does (glue.js `attach`; rt.js `on` since e0ee5759f) and its module's reports (`event(code)`): a module whose own button reports `event(0)` for a click the page also sees delivers one press twice, and focus, blur and keys likewise. LLP 1024 should say which one a module view hears for each kind (the module's report only for what the page cannot see, or the module's only); Apple's hosts are the third to check.
- **Smoke checks that fail on main** (2026-10-02, seen at `220c2128e` and on the native-control landing alike). `smoke.mjs macos --app native-fixture`: "Tab reaches the module's editing descendant" (the responder stays `NodeView`, `editor` null). `smoke.mjs web --app recorder` (the JS target, seen at `ef01dcadd`): "the status is coarse, and answered by native.later" counts the wasm runner's `request N (status): POST exact-native:` journal lines, which the JS runtime does not write, so it counts 0; and `conform.mjs recorder` fails `tap toggle` and the next step because Chrome leaves the toggle focused on the JS page and not on the wasm page. **2026-10-12, the same smoke now stops earlier, at a tap:** `tap #18: its middle is outside the viewport` (`compose-home` laid out at x 421.6 in the 420-wide window), 49 of 51 checks. It is not from the Mac's sidebar, header, table or sheet work of that day: the day's first commit (`a0600e637`) fails the same way. Bisected with one build and one smoke a step: 97 of 97 at `94b6d995e` (2026-10-06); from `b0d2f145e` (2026-10-07) the drive stops at `view 123 is hidden or inert` with "a dialog initially focuses the native editor" failing beside it; and the stop at a tap outside the viewport begins in the fit-content series of 2026-10-07, one of `512c01bc8`, `878e6a051`, `c78a9c06b`, `ef64465db`, `42379e21a` (three of them do not build the fixture, so the bisect could not say which). Not looked into further. The web `native-fixture` smoke stops at a control in the sheet it presents (`close-sheet`, 73 of 74 checks): its `settle` moves the agent's clock 100 ms and the sheet's slide up takes 400, so the refusal now names the slide and the time it has left; the drive should step the clock past it.
- **Kept answers: repeated activation and slow first answers** (2026-10-02, LLP 1027.005 D4/D5). Two issues reproduced during review, neither part of the `with` landing. (1) Consecutive `data_ready()` calls before an asynchronous reply issued tickets 1 and 2: a forced ask bypasses `enqueue`'s identical-request rule. No host calls it twice today (Apple and Linux guard with `data_activated`, wasm activates once per boot), so the fix is small and only for a future host. (2) Kept answers are admitted only for a source unready at boot and then remain visible while its asynchronous reply is pending: on the JS runtime, Fieldnotes's real TypeScript source showed the bake's "Opening your notebook…" until a controlled SQLite reply, and the runner does the same for any source ready at boot. The JS target also keeps nothing for a Rust module loaded after first paint. Whether a consumer needs either closed is follow-up 3 of the RFC.

- **Web motion followers** (2026-10-03). The release-follower lifecycle bug is fixed by a targeted change: post-commit reconciliation cancels a follower as soon as its consumer no longer resolves to that source. `web/motion2` (shelved on expo-build-1000) tried and abandoned compositor followers for CSS-eased sources: reproducing CSS animation semantics in retimed followers kept diverging, so main's per-frame seeking stays for that case. Still owed (the final review, codex sol): the real-plan test's later samples are corrected by the agent clock itself (each `clock` op reconciles timelines on both web targets), so it would stay green if the handed-off per-frame callback stopped running; add a check that lets the page's own `requestAnimationFrame` loop run without agent clock operations between samples.
- **Agent web drives, what the no-GPU fix left** (2026-10-02): `screenshot` settles the GPU before its two frame waits and image wait, not after; the JS target's agent settle does not await the GPU module's first import; `surfaceWork` ignores a pending `settled()`; `fallbackApplied` survives a successful module swap. None is the user-facing hang (fixed); each is a narrower race in the agent's drive.
- **JS dev reload carry, what is left** (2026-10-02): the logic revision hashes the app chunk and `app.module.wasm` only, so a native page module served at a stable URL (`./modules/index.js`) can change without dropping settled answers; a checkpoint is deleted before its page is written, so a retried GET boots fresh silently; the route-stack assertion would pass with router carry removed; a blurred autofocus field can take focus again after a carried reload (plausible); Caltrain's edit-to-frame is 273 ms p50 against the 100 ms budget (it was over before the carry).
- **Web test freshness and prerequisites from the build** (2026-10-02, `web/webtests` b8b93ed5, reverted before landing). One source of truth (`build.mjs --check` running the build's own checks; freshness roots from Cargo's dependency closure) is the right design, but that commit made the check a mandatory preflight that runs Cargo before a game's `.shells` workspace exists, breaking every clean game web build, and it still missed the render binary's and GPU crates' inputs and deleted inputs. `CHROME=''` is still taken as a browser path.
- **Firefox/WebKit carrier fidelity** (2026-10-02, the async `conform-firefox`/`conform-webkit` steps): keys go to an iframe guest before Chrome's browser-owned path and non-button keys take a different route than Chrome's; a wheel moves the pointer first (hover becomes part of the input, so the baselined RealWorld scroll gap is not a pure wheel-delta difference); a root with a `testId` double-counts document scroll; the public session advertises held contacts the carrier refuses; synthetic plans still compile after a launch failure. WebKit runs on a Mac (Linux lacks 36 system libraries and the builders have no sudo): first run 2026-10-02 on the M5 mini (WebKit 26.6, `bunx playwright@1.63.0 install webkit`, Chrome for Testing 153 as the oracle) matched Chrome's state on all six apps, 0 failures against `known-webkit.json` (a button is not focused by a click, native input widths). Real Safari through `safaridriver` stays optional: it needs `safaridriver --enable` once, by an admin.
- **CSS grid on the web, what is left** (2026-10-02, landed with the web program: every grid row lowers on both web targets, the kernel's grid grammar parses through cssparser, and `host/web-js/conformance/grid.contract` holds browser boxes to the kernel's with `--linux`). The final review's leftovers: an auto-placed named span (`auto / span 2 foo`) lays out as `span 1` natively (Taffy resolves named spans only against an explicit line — declare it in LLP 1001 or patch Taffy); grids that resolve past Taffy's 10,000 tracks (`repeat(auto-fill, 1px)` in a wide box, `10000 / span 2`) are not refused.
- **A covered route column with a width of its own runs past the screen** (2026-10-17, guard-rail evaluation round 2, a grocery app on the iPhone Duo fully open and closed). While Exact's containers take the whole view, a route's sides are covered by the safe area (`routeEdges`), and the kernel adds a cover to the route's padding (`kernel/src/kernel/cover.rs`), which under `content-box` lies outside a width the author wrote: a route column with `width="100%"` beside the Duo's 84-point side strip is 84 points wider than the viewport, and its content runs under the strip; with `.automatic` route scrollers, a grouped list's cards there run past the screen's edge. A route written with insets and no width (`inset=0`), or with its width and `box-sizing="border-box"`, is laid out right; `inset=0` beside a `width="100%"` still overflows. Taking the cover out of the authored size instead was tried and dropped: a cover deliberately grows a box so its authored content keeps its size (an authored tablist over the home indicator), and rewriting the size breaks a ratio and an explicit `flex-basis`. LLP 1123 stage 2's wrapper (D3), which shrinks the containing block and leaves the authored box alone, is the fix.
- **A route column moved down a laptop fold keeps the window's top inset** (2026-10-20, Xcode 27.1, iOS 27.1 24A94425, the Duo simulator turned and folded to 130°, under UIKit's bars). The guidance evaluation's grocery app moves its route column to the lower segment (`top="env(viewport-segment-top 0 1)"`). With `navigationBar="none"` its header paints in the column, but 82 points below the segment's top, the window's top safe area with the device turned (`smoke-duo.mjs`'s `TURNED`), and the column, with a height of its own under `content-box`, grows by those 82 points, past the screen's bottom (one placed by `top` and `bottom` keeps its box and starts its content 82 points down). The host covers a route's top with its controller's top safe area wherever the route sits (`NavigationCoversIOS.routeEdges`), its sides likewise while the containers take the whole view, and its bottom only as far as the route reaches it. Covering each edge only as far as the route reaches it, as the authored tablist's cover does, would fix it. LLP 1123 stage 2 (D3, the entry above) does not fix it as specified: a route's clearance is its controller's view's safe area, and the inset wrapper is the containing block of an absolutely positioned root too, so the column would sit 82 points below the segment it names. Stage 2 needs the same remedy, with the reach measured with no clearance, as D3 measures a scroller's, and segment positions relative to the box a pane is placed in (the wrapper's inner box): `env(viewport-segment-*)` stays the window's (D2), so a pane placed by it inside a cleared route would move down by the clearance too. Meanwhile the foldables recipe keeps scrolling content in place, as UIKit's own list does, and warns that a route moved off an edge is still padded.
- **Form controls, what is left** (2026-10-02, landed: a control in block flow is shrink-to-fit as in Chrome, 960 recorded Chrome cases; Caltrain's station Back button's tap area is its label now, as on the web). Open: a Pressable whose `href` is set or cleared after creation is restyled by the kernel as the other element while the page keeps its first tag (`<button>`/`<a>` is chosen once); an authored `box-sizing` on a checkbox or switch is ignored (forced border-box); `appearance: none` is still measured as the native widget; input types the kernel has no control for (`color`, `number`, `month`, `week`, `hidden`) still lower as text fields while the page makes the real widget; on the JS target the reset's `input[type=…] { appearance: auto }` outranks an authored `.cN { appearance: none }` (specificity), so the author's `none` loses (this predates the change). Caltrain's station search field is 20 characters wide in its card on every host (the text-field rule of 2026-09-30); if it should fill the card, its plan says `width="100%"`.
- **`smoke.mjs web` does not pass on Linux** (2026-10-02, expo-build-1000, Chrome 154 for Testing): scroll limits come from Mac fonts (expected 652, Linux 612), the canvas reference is Mac's, and Chrome there has no working WebGPU adapter even on SwiftShader. Judge the web smoke on a Mac; a Linux variant would need its own references.
- **UIKit places alerts on a fold where Apple's talk says the other side** (2026-10-18, Xcode 27.1, iOS 27.1 simulator runtime 24A94425, a left-to-right layout). Partially folded like a book, a plain UIKit app's alert moves from the centre of the 951×669 window (`[273.7,241.3 320×152.3]`) to the middle of the left segment (`[67.7,241.3 320×152.3]`), presented there at 127.8° or folded to 127.8° and 90° while showing. Apple's Tech Talk [Strike a pose with adaptive layouts on iPhone Duo](https://developer.apple.com/videos/play/tech-talks/111463/) says: "When it's partially folded, like a book, elements like alerts move to the trailing side. This keeps them closer to where they'll appear as the device closes and the experience continues on the outer display." Propped up like a laptop, the alert moves to the bottom segment (`[174.7,630 320×152.3]` in 669×951), where the talk says "The top region works well for content that benefits from visibility at a distance. The same alert can move here to remain easy to find." A page or form sheet moves from `[149,8 653×661]` to the left segment of a book fold (459.5 points wide presented there, 459.3 after folding while showing), its right edge about 12 points into the band, and keeps spanning a laptop fold. Right-to-left was not measured. Look again on a later release; `docs/recipes/foldables.md` keeps a pane on the trailing segment meanwhile.
  2026-10-23 (lane q1022/ab): no iPhone Duo simulator exists on this Mac (`xcrun simctl list devices available | grep -i duo` is empty); not attempted.
- **The Duo simulator's keyboard can crash the app on a fold** (2026-10-16, Xcode 27.1 with an earlier iOS 27.1 runtime; not seen in seven full Duo smoke runs with its current one, 24A94425, on 2026-10-19). In one of 39 attempted runs of the Duo smoke, `ab3-nosleep-4` (without the 300 and 200 ms waits the smoke then had around each `clock settle`, on a host whose `clock settle` also waited on `KeyboardMotion`, a variant that timing showed changes nothing), duo-lab ended with an uncaught `NSException` thrown in UIKit's keyboard: `-[TUIKeyplaneRow updateKeysForTransitionProgress:]` from `-[UIKeyboardLayoutStar _autoSplit:]` on a display-link callback, while the keyboard-bar leg folded from 90° to the closed panel after its keyboard had been dismissed and checked down. No Exact frame is above UIKit's in the backtrace. If it recurs, record the run here.
  2026-10-23 (lane q1022/ab): no iPhone Duo simulator exists on this Mac (`xcrun simctl list devices available | grep -i duo` is empty); not attempted.
- **Android memory after a crypto fling, where it goes** (2026-10-05, Pixel 10 Pro XL, exact2 320 vs Views 196 MB PSS: graphics 200 vs 153, native heap 76 vs 31, Java 19–21 vs 6). `dumpsys gfxinfo`: Skia's GPU cache holds 88 MB of scratch surfaces in ~12,600 entries for exact2 against 62 MB in ~5,900 for Views (37 vs 12 MB purgeable); marking single-draw animated layers non-overlapping (`setHasOverlappingRendering(false)`) did not change it, so it is not the reader's opacity layers; candidates are rounded-rect/path clips (row clips, avatars) needing mask surfaces, the dashed sparkline re-recorded each draw-in frame, and even-odd `RING` paths. Native heap (heapprofd): HWUI's Vulkan pipelines 12.6 MB and textures ~9 MB (more distinct draw kinds than Views'), exact2's own ~16 MB (settled data values 5, plan 2.75, layout leaves 1.7, rows 1.2, shaping ~1.5). The Java heap is not the stream copies (recycling them left it unchanged).
- **Android CPU after `android/cpu2`** (2026-10-05, Pixel 10a, 6 runs a variant against Views in one session; cells are process CPU ms/s, exact / Views). Landed: the text cache's per-paint trim walks only when a budget could be over; a list row holding a scroller (easy's swipe-to-delete) is a kept row while the scroller stays put (every easy paint used to record every row that showed again); symbol pictures take their em square before their commit's layout (no second layout per row built); symbol paths parsed once; a symbol's font size read as one row, not a copied style; image visibility indexes the painted boxes once a paint; the reader (bench patch `~/bench/lists/exact-wt-cpu2/cpu2-reader.patch`) draws a dashed stroke as its path's segments, and a layer's draw-in dash reads and measures its path once, not every frame (crypto's main thread −25% at 12k). easy fling 1k 499/643, 3k 783/605, 6k 636/560, 12k 683/684, 24k 754/913 (before: 562, 683, 975, 776, 986; the `exact` thread 63–274 from 91–334 ms/s; Mcycles/s now below Views at every speed but 3k). crypto fling 760/714, 836/734, 985/717, 1064/773, 1285/947; crypto rest 713/655. Left: (1) a row costs ~2.8 M instructions on crypto (a big-core probe, `~/bench/lists/exact-wt-cpu2/crypto/probe`): binding evaluation in the VM (the chart's 48-point `points`, ~8%; decode ~20% of that), Taffy flexbox over five flex containers a row and text measured twice (max-content, then the definite width) after shaping (~20%), apply and its style cascade (~9%), motion's restatement of renewed nodes (~5%), the row's recording (~15%); Views' crypto row is a hand laid-out ViewGroup. (2) RenderThread runs on the little cores for whole segments (200–390 ms/s there against ~240 on the mid cores; Views' rarely does): the main thread's frames are short, so HWUI's hints ask for less; pinning it to the mid and big cores (tried: `fast_cores` by tid) kept it there but at lower clocks, mixed in ms/s, not kept. (3) crypto rest: the tick path is ~45% of the `exact` thread (the source's list copy, the old list's drop, `update_data`'s two passes over 5,000 items, conformance); a source that names the rows it changed would remove most of it (the runner takes `Changed { list, positions }` beside a value and skips the compare and rekey for the rest).
- **Android Canvas host against Views, by thread, on Parley** (2026-10-07, Pixel 10 Pro XL, ms/s exact - Views). crypto 6k: exact thread +255, RenderThread +27..40, hwuiTask +46..80, main -27; 12k: exact +350, RenderThread +29..43, hwuiTask +27, main -74. heavy 6k: exact +174, RenderThread +25, decode level (63 vs ~70 of the Views app's dispatcher and upload threads), main -59; 12k: exact +259, RenderThread +38, main -84. The gap is the exact thread less what the main thread saves; nothing else is worth a tenth of it. Probe shares of that thread at 6k-12k dp/s on Parley: layout 18.6% (48% of it text measuring, 22% shaping new strings, which paint needs anyway), the rebind's bindings 17% (the chart's `points` in the VM 6.3%; its parse at paint is 2.3%, so a parse cache buys little), recording rows 14% (the `svg` 6.4%), apply 7%, other commit effects 11%. RenderThread's excess on crypto: text placed again each frame (drawTextBlob 2.4 times the Views app's: Skia reuses a run's glyph placement only across whole-pixel moves, and the feed moves by fractions) and more path masks made (the software path renderer strokes 1.5 times as many contours; why is not found: the pulse ring and dot as rounded rects instead of four-cubic paths changed nothing). Rows and moved groups on whole pixels in the reader (`~/bench/lists/exact-c2v11/cpu2-snap.patch`) took 9-19 ms/s off RenderThread on both lists but added ~35 ms/s to heavy's main thread at 1k-6k, unexplained, so it is not merged.
- **Android Canvas host, a list row's cost while it scrolls: what the crypto probe shows** (2026-10-07, Pixel 10 Pro XL; `~/bench/lists/exact-wt-cpu2/probe.sh`, `DP=1` for the bench driver's dp/s). After held spares and tracks with moves, at 6k-24k dp/s the exact thread is per-row work: layout 21% (the list is already the layout root and clean rows are cache hits; a rebound row is laid out whole because its five texts changed, ~7 measure callbacks a text of which ~3 reach the text engine, 45% of layout in measuring; a text whose box cannot change, nowrap in a stretched column, still dirties its ancestors), the rebind's bindings 18% (a third of it the VM building the chart's 48-point `points` string, which the kernel then parses again at paint), recording the row 14% (mostly the `svg`), apply 6.5%. Not tried: a row-local layout when a rebind changes no child order (the list's children change in the same commit, so the root is dirty); `points` as numbers end to end; recording only a rebound row's changed nodes (the recorder keeps a row whole, compared after it is walked). A report inside the window is still O(mounted rows) on both sides (the host sends every row's height each report, ~0.25 ms on a mid core, 80 a second).
- **Android Canvas host, cold start: the first frame with content is three or four Vulkan pipelines** (easy on a Pixel 10 Pro XL: RenderThread 31-46 ms in `vkCreateGraphicsPipelines`, PowerVR compiling shaders, for FillRectOp, FillRRectOp, CircularRRectOp and text; the Views app's first frame is 11 ms). The reader draws a uniform rounded rect (Skia's CircularRRectOp) and one with unequal corners (FillRRectOp) differently: one op for both would drop a pipeline. The benchmark force-stops within 3 s, before HWUI saves its pipeline cache. The engine's boot is 18 ms of which half is the list's 10,000 items (decode 21%, `rekey_full` 27%, shape check 4%), but first content waits for the frame after the boot ends, so a shorter boot moves it only by whole frames.
- **Android GPU canvas in hardware buffers: what is owed** (2026-10-07; the reader's part is `~/bench/lists/exact-wt-cpu2/cpu2-gpubuffers.patch`, against bench e6e9118). Run on PowerVR (Pixel 10 Pro XL) only. Owed: (1) a run on Mali and Adreno with a screenshot of a shader row: the buffer is rendered by wgpu's Vulkan device and sampled by HWUI's with no queue-family transfer to `VK_QUEUE_FAMILY_FOREIGN_EXT` and no fence, only wgpu's word that the submission completed, which PowerVR accepts; `gpubuf=0` is the window path. (2) The reader's fallback when buffers are refused (`canvasFrame` -2: it swaps the element's view for a TextureView) has never run. (3) A frame is published at the exact thread's next frame after its GPU work completes and drawn at the reader's next: up to a frame later than the window path showed it. (4) What it bought is small (Extra Heavy 1k 386 -> 362 mW, 3k 393 -> 379): with canvases off entirely Extra Heavy is ~340 mW at 1k, so most of a canvas's cost is its own render and `vkQueueSubmit` (a third of the exact thread while one shows; PowerVR's `RGXKickTA` and fence merges in the call). The lever left is not submitting from the exact thread at all: the shader in the reader's pass (AGSL from the same source), or a submit thread.
- **`-exact-animation-trigger` on the hosts that do not have it** (2026-10-06, LLP 1055 D13). `view` is the default on Linux and Android. Owed: run it on Apple (the held play reaches its engine through the same `motion_sync`; nobody has looked at a device); build it on the web's JS target (pause a row mounted out of the port, resume on intersection) and the wasm glue (`Kernel::animation_row`, `revealed`); a reveal with nothing else to say is a commit of its own, which crypto's probe shows (+8% of the exact thread's instructions with `view`, most of it the animations now drawn on screen): carry it on the next commit instead if a profile says the commit is the cost.
  2026-10-23 (lane q1022/t, Apple side): Done for Apple in `177a0e6d92`. A device drive reproduced held prefetched rows after they entered the port: at 500 ms, rows 5/6 remained at opacity 0.2 while a newly mounted row reached 0.6. The Rust regression fails before because no resumed animation op is sent. Marking adopted animation rows for lowering fixes both box and SVG plays. All 7 svg_tests pass, including the new test's held-to-running spec and reveal-ti
- **crypto and xheavy energy on the Pixel 10 Pro XL, what was tried** (2026-10-06, `bin/energy.py`, CPU+GPU rails). Fixed: a collection pass took the feed's whole snapshot twice to count the rows it built (+2% of crypto's probe since `android/xblank`). Not the cause or not worth it: (1) crypto's `hwuiTask` threads at 3k-24k (Skia's software path masks, ~250-340 ms/s against Views' ~150-200; ~10 at 1k) are the charts' draw-in: a new path a frame for every visible row. The animation starts at mount, a viewport ahead, so rows show the last half of it (long paths, ~625 us of masks a frame against Views' ~345, which shows the first half) and none of it at 1k. Drawing the drawn part as round-capped `drawLines` removes the masks but puts +180 ms/s on RenderThread and triples CPU power at 3k-6k (315 -> 960 mW): RenderThread time is the expensive kind. Skipping recordings under half a pixel of dash travel cut the masks 14% at 3k with nothing measurable in mW; not kept. (2) `fast=0` (the exact thread on any core) and `boost=0` (no ADPF hint) change neither mW nor frames on crypto. (3) xheavy at 1k: the shader canvas's wgpu submit and present are a third of the exact thread (~80 ms/s) and the GPU rail is ~90 mW against Views' ~58; a canvas out of view already draws nothing (skipping by viewport changed nothing). Drawing a GPU module's canvas in the reader's own pass is still the lever.
- **Android list CPU after `android/cpu2`'s structural pass** (2026-10-06, Pixel 10a; the bench reader's part is `~/bench/lists/exact-wt-cpu2/cpu2-hwpictures.patch`). Done: StyleProps' 20 rare rows behind one shared pointer (`"rare": true` in schema.json), a decode under way finishing into the cache, JPEG decoded at its shown size by the platform, and platform-decoded pictures decoded straight into the `AHardwareBuffer` the reader wraps (`hardwarePictures`/`imageBuffer`; a heavy fling run made and filled ~1,900 buffers on the exact thread for 106 decodes, because the reader's copy went ten paints after a picture left). Tried and not worth it: a memo of apply's set-style patches (−0.1% of crypto's probe), the SVG cascade's clone (~0.3%), cosmic-text's `shape-run-cache` (−0.6% of heavy's probe: its words rarely repeat within the cache's life). Left, heavy at 24k against Views (~1,150 vs ~810 ms/s): the exact thread and main together (~530 vs Views' main ~290: layout 20% of the exact thread, text measure 12% of it; paint 16%; `sync_images_moved` 11%, of which a third is its own index rebuild at every commit and a third `Images::poll` walking every view), RenderThread (~230–330 vs ~200), and the decode threads (~150–350 vs ~70: the same libjpeg work a picture, plus the bilinear scale to the shown size, 17% of them; Views' loader lets the GPU scale). PNG pictures and canvases still take the copy route. `android/xblank`'s time-budgeted refine costs crypto's and easy's probes +2% (3.462 → 3.536 G instructions on crypto); not looked into.
- **Android list rows after `android/row`, second pass: what was tried and what a rebound row still costs** (2026-10-08, Pixel 10 Pro XL; probes and tools in `~/bench/lists/exact-rowv11`: `rprobe.sh`, `istat.sh`, `batchab.sh`, `prof/shares.py`, `abtable.py`). Landed first: the row layout memo (Taffy patch 29), restated values equal to the style's presenting nothing, a picture's arrival drawing its slot and not its row, the image sync's box index built when asked. Landed second: a collection pass waits for a quarter viewport of travel (`Travel::waits`), so rows mount two or more a commit below 12,000 dp/s: the exact thread, ms/s at 1k/3k/6k/12k/24k, easy 56/98/164/237/262 to 51/88/135/236/260, heavy 63/102/162/244/360 to 59/99/157/234/351 (a waiting pass still asks for the pictures that came into view, which is most of what a heavy pass costs: without that it was 50/85/144 and its placeholders showed for three points more of the view), crypto 96/174/254/351/484 to 69/133/216/340/481. Tried and not landed, each measured on the probe at 12,000 dp/s: (1) **each flex container in a row as its own memo root** (branch `android/row-nested`, 0963be075: a style starts deep, one trace a row, and turns shallow, a trace a container, when under half its boxes replay; traces by style and input, a bound a style): crypto replays 95% of its containers and the instructions are the same (1,955 to 1,946 M), heavy the same, easy +2.5%. Crypto's and heavy's layout time is text measure (shaping 8%, line breaking 6% on crypto), not the flex algorithm (7%), and a replay a container costs about what the flex it saves does. (2) `Engine::remove` by a mask of the properties a node holds, and an allocation's pin count read without its lock (branch `android/row-micro`): 0.3% of easy's instructions, cycles the same. (3) A bump arena for the transaction's scratch: allocation inside `apply_document` is 1.4% of the thread on easy and heavy; the 16% is spread over recording 3.7, the runner 3.4, commit effects 2.5, layout 1.5, no site over 0.6. Left: (a) **recording is 20% of easy's thread** (boxes, symbols and order 16.5, text 3.2). A rebound row whose frames equal the row it was could redraw only its text and symbol leaves in slots, as pictures now are; in easy a rebind keeps its height one time in three or four, so that is about 3.5%. A template across rows, keyed by the row's geometry and styles, would reach most rebinds (8 to 10%) and is a redesign of the row walk: boxes for hit testing, paragraph leases, frames and layers all come from that walk. (b) **Easy's layout is still 16%**: the replay 6.6 (about 270 steps a row), leaf measures 6.5 (68 leaf computes a row, 38 of them two texts'), publication 2. A text's answers cached by its content would be stale after a font loads; it needs the measurer to say when its answers change. (c) **Heavy's image sync, 12.5%**: at each of three calls a pass `Images::poll` walks every view (4.3%), the box index is rebuilt after each commit (2.4%), and each request and cancel counts cold entries by reading every entry's pins (1.5%). The batching above leaves them as they were (the picture sync runs for a waiting pass too); a poll only when a decode woke or a view changed needs the waiting-for-budget retries kept, and would be worth about what the waiting passes' sync costs: heavy's exact thread at 1,000 to 6,000 dp/s was 15 to 20% lower without it. (d) Above 12,000 dp/s nothing changed: a pass every third step is already more than a quarter viewport. The Canvas recorder's tests (`canvas::slot`, `canvas::stream`) and the pass batching's host half compile only for Android and no lane runs them: `cargo test -p exact-linux --target aarch64-linux-android --lib --no-run`, push the binary, run it with `canvas::` on a phone. **Third pass** (2026-10-08, same phone and tools; `ledab.sh`, the probes take `STEPS=1` for a step a frame and `EVERY=N` for the pass cadence). Landed: a renewed node the motion engine holds only settled values for, restated bare, is not forgotten first (`Engine::at_rest`, `MotionSync::renewed`): easy 696 to 666 M instructions at 12,000 dp/s, crypto 1,953 to 1,895. What commit effects still do for an easy rebind, of the thread: the sync's rows applied a node (set transitions, layout transition, clock, animations, timeline: nine calls a node for rows that are empty), `motion_sync` building them 1.3%, paint sync 0.8%, lowering eligibility 0.7%, the two handle discoveries 0.7% when a node was created. (e) A pass every sixth step instead of every third was measured worth 18 to 25% of easy's exact thread at 12,000 and 24,000 dp/s and needed the window to lead; it landed in the fourth pass, below. Measured and not landed: (f) **The recording template across rows** was scoped, not built. What it needs: the recorder to set leaves apart inline (a hole a text or symbol leaf: the clips around it and which the row had written, the matrix forgotten after it, as a picture's slot does; SLOT, LAYER and IMAGE ops refuse a template in a first version, so heavy and crypto rows are recorded as now); the painter to keep, a recorded row, each node's type, style (the arena's shared one), frame in the row, presented values, and the props its walk reads (`Type`, `Disabled`, `Value`, `SemanticTag`, `Text`, `SwipeIndicator`, `Markup`, `Href`, `BackgroundMaterial`, `TestId`, `Placeholder`, `Checked`, `ButtonStyle`, `AccessibilityRole`, the image and SVG sources), and for a row to record, to walk its nodes against a template's (proved a node at a time, as the layout memo's visits are), copy the template's ops between holes, record each leaf again in its hole, and take boxes, frames and scrolls from the template by node index. Worth about 11% of easy's exact thread at 12,000 dp/s (recording 21.6% less text 3.6, symbols 1.6, the paint order 2.2, the dirty walk 1.2 and the walk against the template), which is 3% of the app's CPU there; nothing for crypto or heavy until slots and layers are carried. **Fourth pass** (2026-10-09, branch `android/led`, same phone; probes and tools in `~/bench/lists/exact-led`: `leadab.sh`, `thr.py`, `blanktab.py`, `gaps.py`, `midlate.py`). Landed: from 8,000 dp/s (until 4,000, a turn or 100 ms without a step) the Canvas host reports the feed with a lead of all the runner allows and a pass waits for it (`Travel::lead`, `Travel::waits_led`; `EXACT_PASS_LEAD=0`: off): a pass each sixth step at 24,000 dp/s and each fifteenth at 12,000. Three things were in its way. (1) Every report between two passes must carry the lead: the reader's ask for what a slice left, when it came 12 ms after the last step, and a frame's own report went without it, found the rows mounted ahead past their window and retired the farthest. (2) The runner: with more than a viewport of travel between passes the rows behind are all two viewports past the port when a pass sees them, so the far-row rule retires them in the first slice, which builds only its limit; the rest were past the hold's reach and destroyed, and the slices after built from nothing (easy at 24,000 dp/s: 135 builds in 661 mounts, 18 without a lead). A slice now holds as many retiring rows as its window still needs (`build_needed`'s `more`): 33 builds, the 16 more the window growing as each of the run's two leads starts. (3) The painter told its backend a rebound row was the row it had been, so the reader drew the other item's recording in its place until the next stream: at 3,000 dp/s toward the start, on main too, a wrong and shorter row for up to five frames; under the lead one frame each pass. A renewed row now drops its kept recording (`Dirty::commit`, `rows_dirty`). Exact thread, ms/s at 12,000 and 24,000 dp/s (three runs each way): easy 229/252 to 131/214, crypto 331/483 to 237/408, heavy 238/356 to 205/333; 1,000 to 6,000 as they were. The process: easy 816/853 to 712/840, crypto 1,113/1,274 to 947/1,201, heavy 991/1,204 to 924/1,212 (at 24,000 the reader records rows that mount far from the view on its worker, 45 to 70 ms/s there, where main made them in the frame). Blank area 0.0% at every speed in all three (main: easy 0.2% at 3,000, crypto 0.1 to 0.3% and heavy 0.1% at 24,000). Left: (g) **The bench reader has to make far rows over later frames for this** (`~/bench/lists/exact-led/reader-later-rows.patch`, against the bench's `exact-v11`; not in this repo). A led pass mounts some twenty crypto rows in one stream, and the reader made each row's layers (three a row, 0.07 ms each), took its tracks and copied it for its worker as the stream arrived: 7 to 10 ms of one main-thread frame (`exact ingest`), and a frame presented late about once in eight seconds at 12,000 and 24,000 dp/s (6 gaps over 12.5 ms in 24 segments; none in 40 on main). With the patch a row out of view only has what it defines made as its stream arrives; its node, layers and tracks are made in the frames after, 2 ms a frame, nearest the travel first (ingest 3 ms at most, no gap in 40 segments). A reader in this repo, when there is one, needs the same. (h) **A pass costs about 52,000 instructions a mounted row whether or not the row changed** (easy at 24,000 dp/s with the lead and no waiting: 906 to 1,056 M instructions for nine more rows mounted over 320 passes): the list's layout, publication, the paint order and the stream walk each visit every row. That is 300 M of main's 906 M at 24,000 dp/s, and why the lead gains 15% there and not 25%: half the passes, each half again as dear. A window that trimmed the side behind while it leads would take a viewport of rows off each pass; the runner's `lead` is where. (i) **A turn at speed ends the lead for eight steps**, the window goes back to a viewport each side and then leads the other way: 13 builds on easy that a lead carried through the turn would rebind. Only the bench turns at 24,000 dp/s. The kept rows of `paint/rows.rs` are tested on Linux through a backend that keeps rows and draws nothing (`presenter/kept_rows_tests.rs`). **Fifth pass** (2026-10-09, branch `android/led-mem`): what the led window cost in memory after a fling, Pixel 10 Pro XL. (1) A reader asks `owed` as its last step's frame goes out; when that frame was a paint nothing was owed yet, no timer was due, and the window stayed led at rest: `next_due` now names the pass that ends a lead (`settle_due`). (2) xheavy 565 to 699 MB: the reader gives a row's map its view a viewport ahead and keeps it half a viewport behind, and a led window names the row ahead while the last still has its view, so a second map (110 MB) was made and both were kept. The reader now lends the view of a row out of view before it makes another (`reader-memory-and-soon.patch`, against the bench's `exact-v11`; the same patch makes a waiting row the scroll is about to show at once, whatever the frame's budget: xheavy rows take more than the 2 ms to make and came into view still waiting, 5 to 7% of the view blank at 12,000 and 24,000 dp/s, 0.0 to 0.3% with it). (3) When a lead's rows have retired the system allocator gives its freed pages back (`jni::purge`, 2 MB on crypto). Left: (k) **crypto and easy rest about 5 MB higher after a fling than before the lead** (crypto 130 to 137 MB): 2 to 3 MB of this library's heap (the probe, with no reader, shows 2 MB more after a fling with the same thirty rows mounted) and 4 to 5 of the reader's, neither freed memory an allocator holds (`mi_collect` and `M_PURGE` leave them) nor a collection that grew (the reader's rows, layers and tokens count the same). A led window mounts 70 crypto rows at its peak against 45, and what is sized by the most nodes alive (the kernel's arena, layout's slabs, the reader's) keeps that size. A window that trimmed the side behind while it leads (item h) would lower the peak by a viewport of rows. **Sixth pass** (2026-10-10, branch `android/led-low`; `lowab.sh`, `cfgtab.py`, `thrfull.py` in `~/bench/lists/exact-led`). Landed: the window leads in three tiers (`TIERS` in `canvas/travel.rs`): from 2,500 dp/s half a viewport and a pass each three quarters of one, from 5,000 one viewport and a pass each one and a quarter, from 8,000 two as before; the two slower only where a pass's slice holds four rows or more (heavy and xheavy gained nothing from them, xheavy 10% more cycles at 6,000). Exact thread at 3,000 and 6,000 dp/s: easy 86/134 to 67/92, crypto 134/213 to 100/152; half a viewport and one were the least that paid (a whole one at 3,000 and two at 6,000 gave no more). A window may lean (`CollectionFill::lean`, the wire's flag bit 3: half a viewport behind its travel, not one), and this host asks for it only with `EXACT_LEAN=1`: crypto then rests 136 MB after a fling, from 140 (129 before any lead), but a turn back at 24,000 dp/s shows one to four frames with 7 to 58% of its view blank, against two frames and 8 to 35% with a viewport behind (a quarter behind: 135 MB, four frames up to 40%; none: 134 MB, the whole view for two frames). After a turn from a led travel no pass waits and one follows every step until the window leads again (`Travel::turned`). A pass that waits under the two slower tiers tells the runner where the view is each quarter viewport of travel (`Runner::collection_shown`, no report; `Travel::shows`), which is as often as a pass ran before those tiers waited longer: the runner learns that a row shows from a report, and what waits for its row to show (crypto's chart drawing in) otherwise waited for the next pass, up to 21 steps at 6,000 dp/s (crypto's flat area there 54.0% on main, 56.0 without, 54.1 with). A report limited to no rows did the same and undid the waiting: it changed the list's snapshot, so each was a commit, a layout and a paint (easy 136 to 182 at 6,000 dp/s). Under the last tier a row waits for its pass as it has since that tier landed (each sixth or fifteenth step). Tried and dropped: building what a step brings into view inside the step after a turn (the report ran before the frame that lays the list out and built nothing; with it kept on until the lead resumed, no pass ran at all). Left: (l) **xheavy against Views** (the by-thread table, 3,000 and 12,000 dp/s, ms/s): the exact thread 227 and 405 is two thirds of the gap of 336 and 601; ExoPlayer, MediaCodec and CodecLooper are 97 and 164 more than Views' (the reader makes a player for every mounted video row; Views binds one as a row comes near: the reader's lazy views cover maps and web views, not video); the reader's main thread is level with Views' (146 against 133, 197 against 213), RenderThread 14 and 48 more, picture decode 33 against Views' 118 at 12,000. What the exact thread spends on an xheavy row has not been profiled since the row passes. Seen on the way, not this branch's: heavy's exact thread at 12,000 and 24,000 dp/s is 204 and 333 ms/s on 1110709a5 against 180 and 286 on 9daf3fb64 (one build each, same phone and session), and xheavy's 416 and 583 against 399 and 542.
- **Android CPU after `android/cpu3`: what is left on heavy and xheavy** (2026-10-05, Pixel 10 Pro XL, same-session runs against Views; the bench reader's changes are `~/bench/logs-cpu3/bench-cpu3.patch`). Found and fixed: MapLibre's "Worker" threads (~1,900 ms/s at 24k against Views' ~430) were the map module's `MapLibreMap.clear()` on every rebind, which makes MapLibre lay out every loaded tile again; removing its own markers instead brings them to Views' level (bench `NativeMap.kt`). An animated GPU canvas made a `VkImageView` and `VkFramebuffer` every frame (PowerVR sets up and tears down a render target for each: `vkmem_free` ~90 ms/s), staged its uniform through a transfer job, and present submitted a PRESENT→PRESENT barrier alone (wgpu-hal EXACT-PATCHES 6–7, `FrameUniform` on Vulkan). Results: xheavy fling CPU 1k/12k/24k 1526/2664/4134 → 1317/2145/2740 ms/s (Views 797/1524/2168), rest 1278 → 984 (Views 634). Left: (1) xheavy fps at 24k is ~2 lower (110 → 108; Views 78) and 12k ~1 lower: the main thread does the same Mcycles at ~2.4 GHz instead of ~2.7 now that MapLibre's waste no longer holds the cluster's clock up (DVFS); a per-frame cut on main/RenderThread (WebView construction, native-view recording) would buy it back. (2) The shader canvas still costs the exact thread ~130–170 ms/s at 120 Hz (one wgpu submit + present a frame through PowerVR's kernel driver, the acquire thread ~30, `vk_tlsem4_bg` ~18) and RenderThread the TextureView's layer update; Views draws it as AGSL inside HWUI's pass — drawing a GPU module's canvas in the reader's RenderThread pass is the remaining lever. (3) Dashed circles (the live row's rings) are drawn as arcs by the reader now (HWUI had stroked them in software every frame, hwuiTask ~70 ms/s); other dashed or concave paths still go through Skia's software path renderer. (4) heavy: pictures are resampled to the size they show at and shared across sizes, 12 viewports kept (decodes 330 → 184 a fling; CPU at 12k/24k 1217/1576 → 1103/1344 ms/s, Views 740/900; slow speeds unchanged, 1k 668 vs Views 570; end PSS by `Debug.MemoryInfo` ~715 → ~525 MB, Views ~485); what remains is per-row construction on the exact thread (taffy layout, paint, collection feedback, `sync_images_moved` ~12% at 24k), the picture hand-off (a `HardwareBuffer` made and copied into on the exact thread, ~12% of main+exact at 24k; decoding straight into one would drop the copy and the Rust-side duplicate), and Views' main thread doing its binding alone. (5) The bench's `pss_all_mb` (compact `dumpsys meminfo` after the run) is bimodal for heavy (~270 or ~600 MB on the same build, by whether the dump lands before HWUI's graphics release); compare `driver.json`'s `pssEndMB`.
- **Android memory on the Nothing (4a) Pro after `android/mem`** (2026-10-05, `dumpsys meminfo` App Summary at the end of a fling; tools and the bench-copy patch in `~/bench/android/results/mem-patch`). Crypto 97 vs Views 55 MB before: the library's resident pages ~17 MB (Views' code is shared and counts ~1 MB), native heap + mimalloc 36 vs 15, Java 8 vs 9–17, graphics equal. Landed: the Canvas host lets go of its library's read-only pages 2 s after boot (`android::release_library_pages`): .rodata 6.6 -> 0.7 MB resident (the baked market and coins.json are read once), CPU, fps and cold start unchanged. With the bench build's order below, medians of three on 268878a98: crypto fling 96.9 -> 90.1 MB (Views 55.6), daily 0.1–8.7 MB lower per scenario but still 2–13 over Views, xheavy within its ±20 MB noise and under Views (418–428 vs 456). In the bench build only (`order-clang`, `order.txt`): lld's `--symbol-ordering-file` puts the functions a run executes first, then boot-only ones, from an instrumented (`-Cprofile-generate`) build's counters (boot and run dumped apart) plus simpleperf samples for precompiled std and C; text resident after a fling 6.0 -> 3.7 MB on crypto, ~1 MB on daily, CPU unchanged. What is left: (1) the text that stays touched (~1 MB of the 3.7 sits in 64 KB fault-around windows around rarely run, uninstrumented code: drop glue, `core::fmt`, ring); the order file goes stale as code moves and is regenerated by hand. (2) The reader's dex: Media3 ExoPlayer is in every app's reader though only xheavy plays video; moving it to xheavy (a `VideoPlayer` the app gives, `bench-slim-reader-unshipped.patch`) took crypto's classes.dex 1,074 -> 108 KB and PSS -2 to -4 MB, but most installs of that build then ran the reader's `Layers.sample` -> `Player.replay` in ART's interpreter (nterp, `ResolveFieldWithAccessChecks`): main thread +55 ms/s; the cause (verification at runtime?) is not found, so it is not shipped. (3) Rust heap ~11 MB live on crypto (the baked market's values 4.7 MB: 48 numbers a coin at 16 bytes; layout leaves, realized rows, text caches) and mimalloc ~2.6 MB over scudo for the same blocks. (4) xheavy: exact2's decoded-picture cache (8 viewports, ~107 MB at 1260x2650) is most of its 133 MB of mimalloc pages, beside the reader's GPU copies of what is drawn; `imgvp=2` took PSS 449 -> 385 but decodes again on the way back. (5) Graphics is counted in whole swapchain buffers, ~7 MB each (1260x2800x4 shared with SurfaceFlinger), and an app holds 1–4 of them depending on how its first frames queued: daily's PSS moves by 7 MB between runs of one build, so its comparisons need several rounds (the warm Starred/Settings pages cost ~3 MB of heap; the rest of their 45 -> 61 MB was buffers).
- **Android steady-state CPU, what is left after `android/cpu`** (2026-10-05, merged as 98b178bd2; Pixel 10a: the exact thread −3 to −20%, fps unchanged, still more total CPU than Views at every app and speed). (1) Done on `android/cpu2` (the text cache walks only when a budget could be over). (2)–(4): see the `android/cpu3` entry above. (5) crypto at rest: the bench's source clones the 5,000-row list each 10 Hz tick (~26 ms/s) and `update_data` diffs it (~15 ms/s); a source that says which rows changed (as the iOS crypto note above asks) removes both. (6) Per-row construction: rows are now rebound, not built, in the Canvas host (LLP 1078, `android/reuse`: the `exact` thread −17 to −28% on easy at 6k–24k, −8 to −16% on crypto, heavy and xheavy within noise). What a rebound row still costs is its content: layout of its changed text, binding evaluation (crypto's chart `points`), recording it again, and for heavy/xheavy shaping and pictures; easy's process CPU ties Views at 24k and is ~8% over at 12k, crypto's ~60% over. Rows holding a refused leaf (canvas, map, video, web view, inner list) are still built; the Apple and web hosts do not opt in yet. (7) scudo was ~60 ms/s; mimalloc 2.x is now the default (2026-10-05, dd34e6948; `EXACT_MALLOC=system` to compare).
- **Android's Canvas host on an owner thread: what is owed** (2026-10-04, LLP 1072 on Android; the reader is `~/bench/lists/exact/android/canvas/.../Owner.kt`, outside the repo; `owner=0` is the old main-thread host). exact2 runs on an `exact` HandlerThread from boot (its looper takes executor and image fds; its Choreographer the turns); each op stream is copied and published, the main thread ingests and replays it, and a scroll translates the feed's group on main at once (the group holds every mounted row, so the mounted window is the coverage). Fling fps now ties or beats Views at every speed on all four lists on a Pixel 10 Pro XL, a Pixel 10a and a Nothing Phone (4a) Pro (xheavy 24k: 101–106 vs Views 79–83 on the Pixels, 74 vs 63 on the Nothing; owner=0 60–71). Owed: (1) CPU: more ms/s than owner=0 on light lists (easy +10–25%), fewer Mcycles on the Pixel, more on the Nothing; the exact thread is not boosted as main and RenderThread are (ADPF hint sessions measured no better). (2) Input: a press waits ≤5 ms and a key ≤2 ms for the answer within the frame; a 16 ms wait held frames (9–15 janky per daily scenario); a tab switch's ~14 ms of `pointer_up` arrives a frame or two late (39 vs Views' 16 ms). (3) WebView rows: `WebViewFunctor::drawVk` costs 2.3× Views' per draw (12.7 vs 5.5 ms) inside HWUI's `flush layers`, with `initVk` and shader compiles each draw (Views pays the init too). (4) Memory after a crypto fling on the Pixel: 319 vs 197 MB (graphics 200 vs 153, native heap 76 vs 32, Java 19 vs 6); recycling the stream copies did not move the Java heap. (5) Slicing a collection pass between frames on main (GapWorker-style, `refine(limit, velocity)`) painted every frame and cost fps; the limit plumbing stays for fills.
- **Daily's first detail open, after the press is laid out ahead** (2026-10-11, Pixel 10 Pro XL, twelve interleaved runs each; `Runner::foresee`, `presenter/ahead.rs`, the reader's `reader-late4.patch`). What a later open reuses is not a cache a static warm can fill: with the detail unmounted at every close (a local variant) a second open costs layout 1.2 ms against the first's 3.3, and with its body text made different at every open 2.8, so the 2 ms is shaping these strings, and no font, style or shaper state. Shaped at the touch down (3 slices, 2.8-4.1 ms in all, done 6-8 ms after the down; 0.05 ms for a press that mounts nothing) the first open is 20.8 -> 15.6 ms (Views 13.4): layout 3.0 -> 0.7 ms, answer ready 8.7 -> 6.2, ingest 3.5 -> 2.7. What is left over a later open (11.3) is the mount itself: dispatch 1.9 against 0.6 ms (the detail's tree), ingest 2.7 against 0.8 (its rows recorded), the frame 2.6 against 1.8 and the RenderThread 4.2 against 3.2 (an icon's texture, new glyphs). Only a commit prepared at the press and adopted at the release moves those (not built: the runner would need to run a press against a checkpoint and keep its outcome, with every effect held back). The first sheet (15 ms against 10), dialog (14 against 10) and tab (12-13 against 10) mount nothing at the press and are as they were: their extra is the first paint of rows mounted earlier. A one-time run of the reader's layer and bounds paths at idle (1.9 ms) moved nothing and is not in the patch.
- **Daily's first detail open: cold state ruled out** (2026-10-11, Pixel 10 Pro XL, six runs each way). Not page faults: with the 2 s release of the library's pages off (a local `EXACT_RELEASE_PAGES=0` switch, not kept) the first open's stages are the same (dispatch 2.1 -> 2.1 ms, layout 3.0 -> 2.8, answer ready 8.9 -> 8.7, latency 18.8 -> 19.6). Not the clock or the core: the exact thread runs the first open on a mid core at 1785-3052 MHz, later opens at 1785 after a ramp. It is the new screen's own work: mounting its tree, measuring its eight paragraphs, recording their rows; in all ~19 ms of CPU across the exact thread (7.5), the main thread (ingest 4.4, its frame 2.5) and the RenderThread (4.6), against Views' ~8.7 in one frame, and two of exact's stages end before its frame can begin. Only doing the mount, layout and recording before the release closes it (at the press, 60 ms earlier: a speculative commit the runner can discard; not built). The v24 -> v25 nav reading on another phone (0 -> 3 janky, 11/14 -> 13/17 ms in two runs) did not reproduce here in six interleaved pairs: p50 11.65 vs 11.95 ms, p90 14.5 vs 14.95, janky 2 vs 1 in six runs; v25's nav creates no executor or decoder thread at all (none is asked for).
- **Daily's nav latency, by stage** (2026-10-11, Pixel 10 Pro XL, six runs each; `~/bench/lists/exact-wt-late-tools/navstages.py`, the reader's change `reader-late3.patch`). Every tap paid ~1.1 ms between the answer being ready and the main thread's ingest of it: the main thread, parked for the answer, was woken on another, idle core (a later open's answer was ready at 4.6 ms and drawn from 7.2 ms; Views' frame began at 4.9). The reader now keeps the waiter on its core for the wait (`Native.colocate` on itself, undone when the wait ends; the exact thread is answering on that core): ingest ends ~1 ms sooner, nav 11.5/13.4 -> 10.9/12.7 ms (Views 11.6/13.2), tabs 11.2/15.0 -> 10.1/12.7 (Views 13.6/18.0), no engine change. The first open is unchanged (22 ms, Views 13.5): once-only work in three places, against a later open: dispatch 2.0 vs 0.6 ms (the detail's tree mounted), layout 3.2 vs 1.1 (its eight paragraphs measured), ingest 4.4 vs 1.0 (their rows recorded), so the answer is ready at 9.0 ms and ingested by 13.8, two vsyncs after the tap; the RenderThread draw is 4.5 ms against Views' 5.4, with no pipeline compile. Memory on nav stays +2.0 MB over Views (settings +2.8, tabs +0.7 in the bench's PSS): the link order is current and covers the daily taps (2,701 functions, made 2026-10-07 from all seven scenarios), mimalloc purges at once, and Skia's 4 MB "Other" GPU cache entry comes with reader-played layers (gone with `lower=0`) without moving `GL mtrack`; unbounded layer nodes (`layerbounds=0`) read 1.2 MB less GPU memory and damage more.
- **Daily's memory against Views, and the Java garbage in a fling** (2026-10-10/11, Pixel 10 Pro XL; `~/bench/lists/exact-wt-late-tools/`: `reader-late2.patch`, `driver-alloc.patch`, `memdump.sh`/`memtab.py`). The Java heap's swing in a fling (easy 110 or 126 MB) was the bench driver's, in every stack: `File.readText()` for /proc/self/statm every fourth frame and for two files a thread at each segment boundary, ~45 MB of garbage a run (easy 63 -> 18 MB allocated a run with both read into a kept buffer; heavy 69 -> 22; crypto 111 -> 66). The reader's own: its stream copies are 2.6 MB a run; on crypto a boxed `Float?` a track a frame, `(Int) -> T` lambdas and `HashMap<Int, _>` row maps were another 17 MB (66 -> 49, fixed in the reader patch). PSS at the sample still moves by whether ART's last collection came before it (crypto 130 -> 146 MB with less garbage: two collections, not three): the harness should collect before it samples. Daily after a scenario, `dumpsys meminfo` medians of 3, exact minus Views: nav +3.5 MB, settings +0.8, tabs -0.6, idle -1.2. What exact holds that Views does not: its library's pages from the APK (+4.6 to +5.4 MB after taps, +0.8 at idle: Views' engine is the shared framework's), the Rust heap under `Unknown` (+4.7 to +5.1, against 4-6 less `Native Heap`), thread stacks (+0.33), the fonts mapped a second time (+0.3), and on nav GPU memory (+1.9; Skia's text-blob cache is at its 4 MB cap after the detail, 2.4 for Views); less Java heap (-1.5 to -2.2) and dex (-2.3). Not closed: nav and settings stay over Views. Nav's p90 over six runs each: 13.9 ms [12.4-16.6] against 12.7 [12.4-14.5]: the first open (19-24 ms, Views 11-15) is always the slowest tap, and the p90 is the next slowest open (13-17 ms).
- **Android list flings, like for like** (2026-10-10, Pixel 10 Pro XL; `~/bench/lists/exact-wt-late-tools/driver-book.patch` and `driver-book-views.patch`, the same change to each stack's bench driver: a segment's per-thread CPU snapshot is read on a thread of its own between segments, and the next segment begins eight frames on). With it in both stacks, four interleaved runs a list, janky / late-gap counts a run, exact vs Views: easy 0 / 0-1 vs 0 / 0-1; heavy 0 / 0-1 vs 1-3 / 1-2; crypto 0 / 0-1 vs 0 / 0; xheavy 4-7 / 4-6 vs 61-75 / 63-68. What the counts were made of before: the snapshot in the frame callback (the entry below); a buffer of the ended segment latched just inside the next one; the two periods the first frame after any pause takes to be shown (both stacks: a frame that draws nothing empties the queue HWUI otherwise keeps one buffer ahead in); and the one paint exact2 owes ~16 ms after a scroll stops, shown during the pause. None is a frame late in motion. CPU read in ms/s is 2-5% higher for exact with the patched driver and equal or lower in cycles (easy 669 -> 643 Mcycles/s, heavy 939 -> 906, crypto 1395 -> 1420, xheavy 2559 -> 2546): the main thread does the same work at a lower clock without the old driver's 20 ms burst at every boundary. Owed: crypto's two steady gaps in four runs (14-20 ms, not looked at); exact's own threads: `exact-io` is seven threads that each wake ~1 ms/s in a list that fetches nothing, `exact-png` two that decode nothing on easy and crypto, `exact-log` and the reader's `exact warm` idle: eleven of exact's thirteen own threads could start at first use.
- **Android list flings, janky and late frames against Views** (2026-10-10, Pixel 10 Pro XL, four runs a list and stack; the classifier is `~/bench/lists/exact-wt-late-tools/janky.py`, the reader and driver patches beside it). On easy, heavy and crypto every janky frame of exact's (6-8 a run, Views 0-4) is the last frame of a segment: the bench driver reads two /proc files a thread in its frame callback there, 18-23 ms of main thread for exact's ~35 threads against 13-15 for Views' ~27, so SurfaceFlinger's deadline (~16.6 ms) falls between them; outside those frames exact has none (Views heavy ~1 a run). With the snapshots read off the main thread (`driver-book.patch`): exact 0 janky on all three. xheavy's own: the main thread waited inside its ingest for the exact thread whenever a buffered GPU canvas's row was freed (`Exact.detachBuffers` was a `sync`: 10-24 ms behind a collection pass, the next frame that late); not waited for now (the reader, `reader-late.patch`): steady janky 6.2 -> 3.5 a run, steady late gaps 7.5 -> 3.5 (Views ~62 and ~63), blank area unchanged. Owed: what is left on xheavy is the WebView rows' functor draw on the RenderThread (9-13 ms in `flush layers`); and with the driver patched, easy and heavy show 2-3 latch gaps of two periods a run at the first frame after each change of direction, not janky by SurfaceFlinger (the frame is drawn in ~4 ms and latched a vsync later; Views' gap at the same place straddles the segment marker and is not counted): not explained.
- **Daily's first detail open, the engine options measured** (2026-10-07, Pixel 10 Pro XL, simpleperf over the first open only, four runs; nothing built). The answer must gain ~3 ms to make the vsync. (a) Laying out and painting only what the viewport shows: ~70% of the detail's body is in view at once (36 lines of 24 in ~700 of ~1,010 points), so the bound is ~30% of layout and paint, ~1.3 ms on the exact thread. (b) Sharing text work between layout and paint: there is none to share, paint reads the paragraphs layout made (`paragraph_for` 0.3% of the frame); text measure is ~9% of the touch, shaping ~6%. (c) Mounting at the press was not attempted: it needs the runner to run an action on a state it can throw away. The touch itself has no one cost: the action and the update ~21%, the commit's layout ~15%, `after_commit` ~18% (collections ~8%, requests ~7%), hit testing, allocation ~9%. Note for whoever returns to this: the detail slides in from x = W, so its first frame shows nothing of it in any pipeline; a response split into "the layer, empty" then "its content" would read ~10 ms on the bench and show the content no sooner than now (the content's frame still begins at ~+15 ms), so it was not built. The reader's half of the fourth pass's colour path is now tied with the app's cross-fade (a recoloured text layer recorded from its kept runs, not by walking its ops: tabs 304 vs 299 ms/s, medians of four).
- **Daily on Android, fourth pass: colour transitions and the first detail open on Parley** (2026-10-07, Pixel 10 Pro XL; the reader's half is `~/bench/lists/exact-wt-lat4/tools-lat/reader-lat4.patch` against the Parley-ready copy). Landed: a `color` transition of a text without inline runs, and a `background-color` transition of a box's own flat background, are played by the Canvas host's reader (`lower.rs` `LOWER_COLOR`; `EXACT_LOWER_COLOR=0` to compare): the engine presents the target, the node is a layer, and its tracks are the colour's straight channels along the engine's own interpolation in eight linear pieces; the reader records that one layer again in each frame's colour. Daily's tabs with the app's plain `color` transition: 444 -> 319 ms/s (the app's opacity cross-fade: 304; pixels at rest the same). Owed there: the 5% over the cross-fade is the layer recorded again each frame (main thread +16 ms/s for two labels: the glyph arrays and font looked up per record; RenderThread +10%); keyframe animations of colours are still sampled by the engine. The first detail open on Parley, 17-22 ms against ~10 for any other tap: on the exact thread dispatch (the action and the mount) 2.0 ms, layout 3.0 (text measure ~60% of it, shaping ~1 ms: shaping ahead would not make the vsync), paint 1.6; the answer is there at +7.5-8.5 ms, 1-3 ms after the vsync; ingest 2.4-4.7 ms (the eight paragraphs' rows 0.7 of it); the frame then 5-8 ms, with no pipeline compile and a glyph upload of 0.4 ms. Tried: the next frame's callbacks wait for the late answer and that frame draws it (first open 17.4-18.8 -> 15.1-16.8 ms, but 3-5 janky frames a run where there were none): not kept. What would close it is not doing the mount and layout inside the tap (a mounted, hidden detail, as Starred and Settings are; or layout skipped for a subtree translated out of view).
- **Daily on Android, third pass: the Pixel 10a** (2026-10-07; `~/bench/lists/exact-wt-lat/tools-lat/reader-lat3.patch` against the reader at 12b07f4, with the daily app's contract). (1) Tabs' CPU (492 vs Views 446 ms/s) was not the phone's: on every phone the tab labels' `color` transition is painted each of its 250 ms' frames (300 paints a run: the exact thread ~105 ms/s, the main thread recording the view again, the RenderThread the whole window); the 10a only showed it because Views is cheap there (446 against 530-550 on the Pro XLs). The app's labels now cross-fade by opacity, which the reader plays (the plain label stepped out once covered; at rest the pixels are the same): tabs 494 -> 286 ms/s on the 10a, 467 -> 294 on a Pro XL. Lowering `color` and `background-color` transitions in the engine (a layer recorded again with the sampled colour, as a dash phase is) would do this for every app. (2) Nav's p90 on the 10a is ordinary taps a frame late, not only the first open: the main thread wakes for the release on a little core (820 MHz), where `colocate` declines, so the exact thread starts 1.3-2.9 ms late on an idle mid core at 357 MHz, and the workload hint reaches the governor 1.4-4.3 ms on (0.5 ms on a Pro XL). The reader keeps the main thread to the fast cores while a press is held (`android_hint::fast_thread`): late taps 14 of 66 -> 7 of 66, nav 11.8/16.7 -> 10.7/15.7 ms (Views 11.5/13.3), tabs 15.5/18.0 -> 11.0/15.8. Not kept: the hint again at each warm poke (no gain); the threads' own `uclamp.min` through `sched_setattr` (refused to an app). Owed: the hint's latency on this phone (the rest of the late taps), and the first detail open (exact thread 7 ms, ingest ending at +18 ms): shaping its paragraphs ahead would save ~4 of ~12 ms, not enough alone to make the first vsync.
- **Daily on Android, second pass** (2026-10-06, Pixel 10 Pro XL; all of it is the reader's and the bench driver's, `~/bench/lists/exact-wt-lat/tools-lat/reader-lat2.patch` against the reader at aaf2f06 and `daily-driver.patch`). (1) Tabs' p90 was the first screen with a blurred rounded rect: a blur mask filter makes its mask on the GPU (offscreen blur passes, three `FillRectOp` and a `CircularRRectOp` pipeline, compiled after an install). The reader now makes each shadow's mask on the CPU once per shape (an A8 bitmap, drawn as nine pieces, the middle stretched; within 5/255 of the GPU blur): tabs 10.6/20.5 -> 10.2/12.1 ms (Views 13.4/18.1). (2) A fade exact2 began after a late frame's vsync (the main thread waited across it for the answer) was sampled at that vsync, opacity 0, so HWUI drew nothing and the dialog's first frame came a vsync later; such a frame samples at the present time: dialog p90 13.3 -> 10.6. (3) The driver dispatched keys inside its Choreographer callback, so a key's own frame began before it and input-to-frame read ~90 ms for Views and for exact's fast keys; keys are now posted after the frame, in all three stacks: type exact 13.6/15.3, Views 14.1/15.6, Compose 13.6/14.8, and CPU 204 vs Views 205 (it read 183 vs 161 before, when Views drew a key in the frame already under way). Owed: the first detail open (dispatch 1.8 + layout 4.3 + paint 1.6 ms on the exact thread at 1.8 GHz, then 2.1 ms of ingest: 17-23 ms; it sets nav's p90 only on a slower phone); a late-answer hint and `notifyWorkloadSpike` did not help (spike: nav 11.3/13.5 -> 15.0/18.2). Typing's exact thread (~33 ms/s) is 44% paint: the textarea shaped again a key (cosmic-text's `shape-run-cache` took shaping 8.8 -> 6.4% of the thread, not kept), every icon's SVG scene resolved again a paint (~9% of paint, `computed_style` clones), mimalloc's purge at delay 0 (~6%); and each key damages the whole window (RenderThread 3.7 vs Views' 3.1 ms a key).
- **Daily (the mail app) on Android's owner thread: what is owed** (2026-10-05, `android/damage`, Nothing Phone (4a) Pro; the reader's half is a bench patch, `~/bench/lists/exact-wt-damage/tools-dmg/reader-damage.patch`). Landed: a touch down that changes nothing is no frame (`canvas/stream.rs`: a stream whose drawing is the reader's and that defines nothing); a press wakes the GPU offscreen (the reader's `Warm`, a 1x1 renderer of its own), so a release's response no longer pays 7-10 ms of cold GPU; the reader retains the view's drawing when a stream's top level is the last one's (kept rows recorded again into their predecessor's node, changed groups only) and bounds each animated layer's node (clipped), so a toggle damages its row, not the window; `scroll > column > rows` keeps the column's children as rows. Janky frames, exact vs Views, 3 runs interleaved: tabs 7/6, nav 2/19, sheet 3/12, settings 14/3, dialog 3/13, type 71/99 (before: 9/6, 12/21, 12/12, 10/2, 12/8, 66/102). Owed: (1) settings: what is left is SurfaceFlinger's, not the app's: a first frame after ~200 ms idle presents a vsync late ("Display HAL", then "Unknown Jank" and "SurfaceFlinger Scheduling"), 1-5 such per run (each three janky frames) against Views' 0-1; not damage (retain=0 the same), not the release's wait (wait=0 the same), not a window frame at the press (worse). (2) Tabs p90 latency (44-61 vs Views 42) is the first visit of Starred (the runner mounts the list, 17-21 ms in `exact touch`), and in about half the runs with the press warm-up one frame after it takes 30-35 ms of GPU (never with warm=0); unexplained. (3) Colour transitions (`background-color`, `color`) are still painted every frame: the tab labels' 250 ms redraw the window (the top level changes); lowering them, or a top level split into nodes, would make those frames partial. (4) The type scenario's ~95 ms for Views is the metric's (the driver dispatches keys inside a Choreographer callback).
- **Glass morph, parked** (2026-10-02, Charlie: revisit after native buttons; LLP 1053.000.000.001). A ghost glass on the motion engine's clock, springing from a leaving glass's box to an entering one's within a glass group (SwiftUI's `glassEffectID`). Its status line lists what the two reviews require: glass separated from content on both platforms, per-commit trees in the Rust host's commit loop, timestamped curve starts, presented geometry, source isolation, cancellation shared by both hosts.
- **Native buttons, what is owed** (2026-10-02, LLP 1069.011 §7; its contexts and row reuse are LLP 1069.011.000). Raster images and subtitles in a face. A real-touch drive of Messages' native swipe actions on a simulator (a swipe that reveals UIKit's actions, then a tap on each; a swipe and a scroll starting on a native body button), owed by D10: at landing the Mac's screen was locked and the agent's held contact reached no window; XCTests cover the actions' faces, colours, presses and the body button's touch cancel.
  2026-10-22 (lane q1022/c3, 37aaf8ba86, 4aaf727046, 682dc471df): iOS body buttons paint raster faces through the native button pipeline, decoded at the face's displayed size, and swipe actions have real-touch drives; the compiler refuses a raster `image` on a native button until every graphical host paints it (the lowerer cannot tell iOS from the Mac and Linux), so the iOS path is unreachable by authors until the Mac and Linux paint `face.image`. Bar and menu projections remain.
- **Contract after the apps, what is left** (2026-10-02, LLP 1035.005.000 §3 "As built"). Stages 1–3 landed (`then` on the JavaScript target's clock, RealWorld's redirects as `then`, `contract` blocks refused, Caltrain's formatters as its own `fn`s, inferred `writes`, `provide` sections, records and action `let`, Fieldnotes on records). Left: Messages adopts `then` for a new conversation (the chat-demo Messages, on main since 8c1a551be, took the D1 and D9 rewrites in the merge that brought it); D6's `asks`/`rows` and its exemplar fixes (Messages' per-frame `time` argument first); D10 after a recount; stage 4 (D7b, D4a, D11, D5), each with its consumer. Outside the repo, Interview, Weird Castle and the Bluesky copy need the D1 command and the D9 script (each in its commit's message) before they build against main; so does any Contract source written before today.
- **Conformance after the Messages migration and SF Symbols** (2026-10-02, found landing LLP 1035.005.000). Messages' `swiped` now agrees on all three (fix/health6: the boot's own scroll offsets fire no `scroll` on Linux, as on the page), and `messages --build --linux --strict` compared 4/4 on 2026-10-04 with no local AI service running. Left: `synthetic-symbols`' screenshots differed in 5.53% of pixels.
- **Canonical Messages chat-demo fidelity** (2026-09-30). `apps/messages` now ports Expo's `chat-demo`. Remaining source-measured differences are recorded in `apps/messages/README.md`: longest-line balloon fitting, independent-axis send deformation and tail retraction, UIKit's keyboard-overlapping Add popover, and long-history virtualization. A side-by-side Expo recording and physical keyboard/gesture drive are still needed to establish pixel and motion parity.
- **Glass groups, what is owed** (2026-10-02, LLP 1053.000.000 §5, built on `lane/glass-group`). (1) The press: interactive glass swelling across the spacing into a neighbour (Messages' inbox bar is grouped at `glassGroup=8` for it), seen on a phone or with the driver's held contact, which moves the Mac's pointer. (2) From James's prototype: `auto` spacing from the row's `gap`, and a morph when a member is replaced. (3) Whether a `style` class may carry host-policy props (`backgroundMaterial`, `glassGroup`): today "a style holds style rows only", where James's style-row spelling could be put in a class. (4) A UIKit glass made another way (a stock glass button) must register with `GlassGroups` to be isolated.
- **A folded text's element is still styled: two more styled elements a grid row than Solid's** (2026-10-02, LLP 1007.001 §5). A lone plain text is its box's content now (`display: contents`, the box a block), so the grid's layout tree is Solid's size (create 10,000: 220,022 against 220,033 layout nodes), but its element stays and is style-recalculated: 170,003 against 150,003 elements. Dropping the element too means the JS runtime writes a folded text's string into its parent, the agent's tree reads the node from the plan rather than an element, and the region anchors around it move; measure what the 20,000 recalculations cost first (create 10,000, mobile: style 354 against Solid's 289 ms).
- **A GPU canvas's drawables after its layer dies** (2026-09-30, the rest lane). The Extra Heavy shader rows' purgeable GPU memory grew with the rows passed because Core Animation lets a dead `CAMetalLayer`'s drawables go late: an iPad's 19-kind fling made 37–38 layers with at most two or three alive, and the purgeable ledger held 100–121 MB at the peak. Pooling the layers (LLP 1068 §0.4: 12 made, three spares kept) took the peak 322 → 288 MB (medians of three rounds; SwiftUI's 319 is the bar). What is left: the spares' count against rows turning over faster than the pool refills (six spares measured next), and a canvas that leaves the screen still holds its layer and its three drawables until its row is retired — a target lent only while on screen (`Module::attach`/`detach`, kept on `perf/canvas-pool`) would take the shader-only feed's 12–14 alive layers down to the four on screen.
- **The crypto list at rest, after the app's fix** (2026-09-30, iPhone 13 Pro Max, `~/bench/cryptobench/results/rest-trace/iphone-{svgi,uikit}`). The SVG port formatted every changed coin's 48-point `points` string in its data source each tick, off-screen coins included: 54 of 117 ms/s at rest (`Coin::value` -> `points`, Rust float formatting). SwiftUI and UIKit build a row's path when it shows, so this was the app, not exact2. `exact-svgi` keeps `series: list<number>` and maps it in the view (LLP 1017.003): rest 92 -> 65 ms/s over three rounds (UIKit 22), footprint 27.2 -> 23.5 MB (UIKit 29.4). The traced 63 ms/s that remains (UIKit 27) breaks down as: the port's source 7 (cloning the 5,000-row list and formatting the price); per-tick work proportional to the list, about 10 (the runner's `update_data` 3.7, dropping the replaced rows 3.0, the clone, `compare::same`); layout 3; commit 4; the host's apply and collection flush about 16 (`Frames.tick` outside the runner); UIKit and Core Animation 18. A source that could say which rows changed would take away the per-list part.
- **Signposts cost nothing measurable unless something records them** (2026-09-30). An `OSSignposter` begin/end pair costs about 0.4 us with nothing recording, well under 1 ms/s at our rates. Under Time Profiler, whose kdebug session makes each emit expensive, exact2's own intervals (`scrolled`, `pump-*`, `apply`, `text-raster-*`) cost 17-29 ms/s on the iPhone. So traces overstate exact2 by that much against SwiftUI and UIKit; subtract it when comparing. Not gated. The iPhone 13 Pro Max also logs CFPrefs lookups at debug level (about 20-50 ms/s of `os_log` in every app's traces, SwiftUI's and UIKit's included), which is where the "48 ms/s of logging on main" came from. Safe-area and layout-margin updates cost 4-5 ms/s in exact2 against 3-4 in SwiftUI and UIKit: not worth a change.
- **Agent drives, what is left** (2026-09-30, LLP 1012.001.000): stages 1 and the ruled parts of 2 landed (stale builds refused, film, 420×900 everywhere, source maps on every host, the glue tests in the async lane). Left: D1b the web build marker records its inputs, so the web's staleness warning can refuse; D7 one grammar table for the driver's CLI; D8's rows as authored + computed under the runner's names, `font_family` by name, the page's view numbering and rounding; D10 LLP 1012's crash log to `issues/`.
- **SpringBoard can lose the first turn of the iPhone Duo after it folds closed** (2026-10-19, Xcode 27.1, iOS 27.1 24A94425). `smoke.mjs duo`'s rotate leg lost its first turn after closing the Duo in 3 of 21 runs beside another simulator's drives: no app turned, though CoreDevice reported the device turned. SpringBoard sets its fold transition style to `.fade` as the Duo closes and back once its display swap ends, by itself or with the first pose that reaches it then; under load it sometimes waits for that pose, which sets the style back with no orientation update. A plain UIKit app turned in 102 of 102 turns within a second of closing, which missed the window. The leg now spends that pose on an upside-down turn made as SpringBoard's log shows the swap end (LLP 1078, "As built (rotation)"). Look again on a later release.
  2026-10-23 (lane q1022/ab): no iPhone Duo simulator exists on this Mac (`xcrun simctl list devices available | grep -i duo` is empty); not attempted.
  2026-10-24: `--only rotate,resize` again lost the scene's first turn; the existing hinge retry recovered it.
- **An absolutely positioned child of a covered route resolves its percentages against the whole box** (2026-10-20, the Duo simulator, iOS 27.1). Since 4df50fcaa9 a tab's route under UIKit's bars and `viewport-fit="cover"` ends the home indicator's inset below the tab bar's top (902 of 951 points turned, the bar at 868), and the kernel moves a child's length insets past that cover (`cover.rs`), so `bottom: 0` ends with the route, while `100%` in its `max-height` or `height` is still the whole 951. duo-lab's note sheet, capped at `calc(100% - env(viewport-segment-top 0 1))` on a laptop fold, came out 49 points too tall and put its drag handle on the band, until its screen hid the tab bar. On the web the route itself ends above the tablist, so both agree there; resolving the child's percentages against the box inside the cover too (LLP 1123 D3's inner box) would match it.
- **On the web at 900px and wider, a fold's panes miss their segments by the sidebar's width** (2026-10-20, Chrome headless under `prefer segments 2x1 gap 40`, duo-lab at 1000×700). The web's sidebar takes the tablist to the left at 240px, and the routes start beside it, so duo-lab's detail pane, placed at `env(viewport-segment-left 1 0)` (520) inside a route, sits at 760 and runs off the window's right edge. At 852 wide the tablist is a bottom bar and the panes sit on the segments. Segment positions in the route's own coordinates (LLP 1123's deferred owner-local segments) would fix it.
- **The agent's accessibility export omits Duo's native tab-rail buttons** (2026-10-24, iOS 27.1). An actual XCTest snapshot exposes a Toolbar containing `tab-fold`, `tab-images` and the other tabs, with no Tab Bar accessibility group. The in-process view walk prunes their empty native ancestor. Plain unclipped empty containers still exclude their children in XCTest, so relaxing empty-bounds pruning globally is incorrect. The walk reports incomplete coverage when it omits an otherwise accessible native bar. Exporting that missing projection remains open: public accessibility-container accessors declare no children on the empty wrapper, and walking the public `UITabBar` as another root produces a group without the real buttons. Read the native accessibility projection before claiming its elements or absence. Evidence: `/tmp/duo-reliability/ax-native-snapshots.json`, `/tmp/duo-reliability/public-ax-containers.json` and `/tmp/duo-reliability/public-ax-bar-root.json`.
- **An unanimated imperative pop in a presented navigation stack has an unexplained result** (2026-10-24, Duo iOS 27.1). A prototype opened Inline, presented Sheet, pushed Long then Edit, typed a draft, and called `popViewController(animated: false)` twice with public clock settling. After the second pop, the router selected Sheet but the expected one-controller sheet stack did not settle, and `nativeBack` remained non-null. The observation can describe either the sheet or background stack, so this does not establish which controller remained active. Animated pops and real UIKit Back taps pass the same route sequence. App mutation of Exact's `viewControllers` is outside the hatch ownership contract (LLP 1075.003 §3.5); reproduce with both container identifiers and the actual controller counts before treating this as a supported-path defect. Evidence: `/tmp/duo-reliability/secondary-settled-duo-unit.log`.
- **Native Back-history menu activation remains unqualified** (2026-10-24, Duo iOS 27.1). Animated `popToViewController` reproduces a router mismatch in both primary and presented stacks: Exact restores an intervening route after UIKit skips it. The fix and focused regressions now pass, including authored navigation; the default router path preserves exact visit identity for repeated URLs. An authored `navigate` owns URL resolution. A real XCTest long press of 0.8 seconds performed an adjacent Back in both the unfolded Duo's rail and its centered sheet; neither snapshot exposes a menu. Keep public stack-API coverage distinct from menu activation. Evidence: `/tmp/duo-reliability/back-history-base-red-valid-result.json`, `back-history-authored-duo-result.json`, `back-history-race-red-result.json`, `back-history-round2-duo-result.json`, `back-history-round2-final-uikit-result.json`, `back-history-round2-final-smoke-result.json`, `back-history-native-menu-snapshot.json` and `back-history-secondary-menu-snapshot.json`.
- **A Duo display swap can collapse native content allocation** (2026-10-25, Xcode 27.1, iOS 27.1 24A94425). In Duo Lab, after a cold handoff from the cover display to the inner display, UIKit's tab bar can fill its 951×669 container, with its content layout guide at zero height. The selected tab's controller and its `RouteController` then report a 669-point bottom safe area; the window and the tab controller's view report 34, and no controller adds insets. Exact reports that safe area as the route's cover, so both panes' scrollports are empty. The collapse persists across captures, appears before a debugger attaches, and reproduces with a reduced plan that has no resources, lists or native hooks. The bar's button still responds, so a tap does not show that the allocation is correct. Autoresizing the physical viewport does not prevent it. One full Duo smoke on `43a10ecfd1` failed its resize leg the same way (`tap #45: node #37 covers its middle`). Next: find what sets the tab bar's frame to its container after the handoff, before changing Exact's cover. Evidence: `/tmp/duo-reliability/root-reduction-assessment.json`, `root-autoresize-assessment.json`, `root-callback-file-diagnostic-mutation.json` and `main43a-full-duo.log`.
- **A `smoke.mjs duo` stalled before its first leg, once** (2026-10-20, Xcode 27.1, the Duo simulator). It printed its first line, compiled the hinge helper, and then did nothing for 12 minutes, with no child process and no network connection, two Unix sockets open. It had started as an XCTest probe was installing on another simulator. Run again it passed, and it was not seen in about 20 runs since. Where it waited is not known: with no child process alive it was not inside a launch's lock or the fold cloak's watcher, which each keep one. It ran with UIKit's bars and the agent's taps, before the smoke took real touches.
  2026-10-23 (lane q1022/ab): no iPhone Duo simulator exists on this Mac (`xcrun simctl list devices available | grep -i duo` is empty); not attempted.
- **Once, duo-lab stopped answering in a resizable session, and the Duo lost its turns until it rebooted** (2026-10-20, Xcode 27.1, iOS 27.1 24A94425). In an early form of the smoke's resize leg, after a fold inside a 669×501 window and a resize to 669×951, `layout` did not answer within 120 s while the app ran; the run ended without closing the session. From then until the simulator rebooted, no turn reached a scene before the hinge next moved. The same steps, with `tree`, `layout` and screenshots between them, did not hang in four tries since. Twice more in about ten probes a turn before a session reached no scene until the hinge moved; the leg folds and opens once when it does.
  2026-10-23 (lane q1022/ab): no iPhone Duo simulator exists on this Mac (`xcrun simctl list devices available | grep -i duo` is empty); not attempted.

- **A minimal iOS embed weighs 4.1–4.7 MB with every compiler lever pulled, not 1** (2026-09-30, measured: a one-text-node plan over `exact_apple::host!` with an empty data source, linked into a UIKit `main.swift` against a 73 KB UIKit floor, arm64 iPhone, `-dead_strip`, `strip`; harness and link maps in `~/bench/embedsize`, outside the repo). Today's shapes: the production profile (`release`: opt-level 3, thin LTO; `swift build -c release`) is 7.23 MB over the floor; a real app's `apple-dev` archive (Type Tour's) 8.45, of which wasmi 1.0 MB, linked into every app through `exact_logic::configured!` for the swappable data module (LLP 1029.000) whether or not the app swaps one, the app's data and plan 0.7, the kernel 1.33 unoptimized for size. The ladder on the probe: opt-level z + thin LTO 5.66 → fat LTO 5.42 → Swift `-Osize` 4.92 → `-Xfrontend -internalize-at-link -enforce-exclusivity=unchecked` 4.65 (the export penalty vanishes with it: ordinary exports cost 1.2 MB before, 5 KB after) → nightly `-Zbuild-std=std,panic_abort` with `optimize_for_size` 4.34 → `-Cpanic=immediate-abort` 4.22 (the backtrace machinery was 161 KB) → `-Zlocation-detail=none -Zfmt-debug=none` 4.21 → `-Xfrontend -disable-reflection-metadata` 4.09 (not free: `String(describing:)` of an enum then prints its type name, `State`, not its case, `ready`; the sample hosts and the agent print states that way). opt-level s in place of z costs +0.8–0.9 MB. What the 4.09 holds: ExactKit 1.98 MB (core presenter files ~0.8; Canvas, SVG, GPU, video, web, native modules, pickers, collections, navigation, menus, modals, swipe ~0.7; generic specializations and metadata ~0.2), Rust 1.75 (taffy 222 KB of which grid 161; runner 221; kernel 220; exact_apple 145; core, alloc and std 280; motion 30; markdown 28; plan 28; textflow and unicode-linebreak 41; url, idna and ibex2 46; route 11; raster and canvas 14), linker-synthesized stubs and unwind 0.14. The stable flags-only build (fat LTO, z, `-Osize -internalize-at-link`) boots and paints on the iPhone 17 Pro simulator; the nightly one is checked below it. Why 1 MB is out of reach without a different design: the feature code is linked by dispatch, not by use (every op handler is reachable from `Presenter.apply` and `NodeView`; every kernel row's grammar from the plan decoder), so removing it means separate artifacts a consumer links (CLAUDE.md's rule), and the core beneath — Swift ~1.0 MB, Rust ~1.3 — is still 2–3× the budget. Owed: whether `-Osize` and opt-level z cost frames on the iPad benchmarks, before either becomes the iOS production profile. Linking by use on Apple, Swift included, is LLP 1047.001 (its §6 is the order of work).
- **Considered and deferred: an edge fires only over a measured band** (2026-09-29, LLP 1010 §6.5, the lead's ruling). `reachstart`/`reachend` fire by the estimate today: a report whose window reaches the edge row by estimated heights dispatches, and only re-arming needs the overscan band measured. Requiring the band measured to fire too would stop an under-estimate from paging at load. The feed benchmark's case is closed without it (a realistic estimate plus `initial-item-count`). It costs rewriting about 20 edge tests (`contract/cli/tests/it/collection_edges.rs`, `collection_edge_async.rs`), which send estimate-only reports, and the same change in `list.js`.
- **Render host CPU a page against Solid and Svelte** (2026-09-29, the SSR-cost lane, LLP 1048.000 D10). RealWorld's `/` is ~4.3 ms of CPU a page on this Mac under load (Solid ~0.8), and the grid benchmark's 1,000-row `/` ~125 ms (Solid 24 on the same load), after this lane's commits. Measured by A/B, not by profile alone: (1) Apple's transport was ~30% of it; the render host now uses rustls on macOS too (Charlie, 2026-09-29; LLP 1048.000 D10), −17–18%. (2) The fresh Hermes realm is ~14% (`EXACT_RENDER_REALMS=warm`'s saving): Runtime creation (its internal bytecode, the global object) and teardown; this Hermes has no heap snapshot, and a realm's module state lives in closures no reflection reaches, so a proven reset needs an engine snapshot or a bake that proves a module keeps no mutable state. (3) The kernel's apply and the projection are gone for pages the plan allows (LLP 1048.004 stage 1, 2026-09-30: RealWorld −18%, grid −49%); the rest is the render itself: the tree's realization and bindings (the plan VM), the kernel's apply (style validation, inheritance, the testId index), the projection and its CSS, JSON across the Hermes boundary. Reaching Solid's cost needs a render that writes the document from the plan and the settled state without the kernel (precompiled static fragments, as Solid and Svelte do), plus (1) and (2). At concurrency 64 the server's defaults (`--renders 4 --queue 32`) answer most requests 503 at once, so a CPU-per-page number there counts cheap refusals unless statuses are checked.
- **Fieldnotes' `backupNotes` on the JS target is the TypeScript one** (2026-09-29, LLP 1071 §7 "Files and storage"). The wasm target's Rust source owns it (`RUST_SOURCES`, `build_mixed_with`); the JS build takes a Rust module only from `rust.module` or a `contract::bake` web build script, so a `build_mixed_with` app without `rust.module` gets no Rust module and its TypeScript answers. A generated module over the app's composed Rust source would carry it.
- **The wasm target on the web: what is left of LLP 1071 §7's retirement order** (2026-09-29, "Retiring the wasm target on the web"): the router sweep's in-document reboot, not run on the JS target (`exact.reload`, which the JS target, compiling one plan, has no counterpart for); and a conformance reference without the wasm page, whose first step is built (§7, "A conformance reference without the wasm page": `conform.mjs --linux` in the lane, 157 Linux steps equal; routing and pinned layout/pixel baselines wait on §8 question 7) before the wasm web host leaves everything but games and conformance. (The JS agent's gaps closed on 2026-09-29: `smoke.mjs web` passes on the JS target, fixtures as per-plan JS builds.)
- **LLP 1072 stage 5 on macOS: fills off the main thread** (2026-09-30, the mac lane; not started). After the heavy-leaf hold, what exact2 still loses to SwiftUI on the Extra Heavy feed on bones (M4, 60 Hz) is the owner thread on a synchronous host: process CPU 585 vs 549 ms/s and busy 6.94 vs 6.79 ms/frame over the fling; the owner is 29/31/46/83 ms/s at 1k/3k/6k/24k pt/s (at 1k–6k: batch decode and prepared values 10–16, the runner realizing rows 8–12, the host commit 6–9, layout 2–5, text measurement 1–2), and main is blocked for the same time, about 0.6 ms a frame at 1k–6k and 1.4 at 24k. In the inbox at 24k–48k main's own CPU is at SwiftUI's level (424–443 vs 417–441 ms/s) and busy is 8.4–9.1 vs 7.1–7.4 ms/frame: main's 7.2 plus 1.6–2 waiting for the owner's build, over a 120 Hz frame's 8.3 where SwiftUI is under it. Stage 5 takes that wait off main and no CPU. The switch is one static on macOS (`ExactSession.asyncFills`); `PresenterMac`'s pump needs the latency lead and the spent-turn deferral `ScrollPumpIOS` has; the first step is an A/B with the switch flipped, on a visible window at 120 Hz (no such Mac was usable on 2026-09-30: silver's series ran occluded, the M1's CPU speed swings); it is a threading change (PROGRAM rule 6) in shared files. The batch decode on the owner is the one CPU item in it.
- **macOS after the heavy-leaf hold** (2026-09-30, `perf/mac2`, bones M4 60 Hz, the Extra Heavy fling): exact2 against SwiftUI is fps 59.4 vs 55.6, busy 7.0 vs 6.8 ms/frame, process CPU 587–595 vs 549, main 348–354 vs 347, peak 807 vs 1043 MB, rest 166/67 vs 405/331. Measured and not built: the owner thread is +50 ms/s by itself (collection feedback 30, batch decode 10); AppKit's tracking-area and cursor-rect walk under the scroll view is 25 ms/s of main against SwiftUI's 9 (its own walk over every NSView: fewer views, not the `updateTrackingAreas` override, which measured nothing); layer display is diffuse per-view overhead (66 vs 19 ms/s) that flat leaves and view reuse (both iOS-only) would cut; the inbox's apply of message rows is 153 ms/s (children 51, style 29, props 29); small labels (under 16,384 device pixels, most one-line labels at 1x) still paint on main; peak memory's default malloc zone is +230 MB over SwiftUI's, unattributed. The 120 Hz number is unmeasured on a healthy Mac: every silver series of 09-28/29 ran occluded (`window: visible 0`), and the M1 MacBook Pro's CPU speed swings 3–5x with other jobs' bursts (`~/bench/xheavy-mac/SPEC.md`, 2026-09-30).
- **LLP 1077's visual properties grew every wasm core ~18 KiB, none of it linked by use** (2026-10-02, the M5 mini's `metrics.mjs --long` on d09bfd087 against b65f6fe6 a merge earlier: Caltrain 309 → 327, RealWorld 303 → 322, video-player 247 → 265 KiB brotli-11; code ~18–19 KiB raw in `core`, data ~13–14 KiB). The rows LLP 1077 added (`box-shadow` lists, conic gradients and layers, `mask-image`, `text-shadow`, `corner-shape`, `-webkit-text-stroke`, `rotate`'s axis, `-exact-symbol-palette`) parse through generated style code every core reaches, so an app that uses none of them carries all of their grammars. Link them by use as `gradients` (2edce3faf) and `grid` (e5d8707d, dcbfa8c0) are: the parser reached on wasm only through a registered link, set by a `host/web-capabilities` capability when the plan binds the row, a plan that binds it unlinked refused at boot. The shipped app.js barely moved (69 → 70 KiB raw), and the wasm cores are no longer gated, so this is size for games and fixtures, not for web apps.
- **Standing rule: a new optional web capability links by use** (2026-09-28, Charlie's ruling (a) on the web cores' growth). A feature an app may not use — a device request, a host command, a style or prop family — reaches the web core only through what the generated entry links (`Linked` / `HostLinks` / `RunnerLinks` / `DeviceLinks`), detected at build from the plan (`exact_runner::uses`: its rows, tags and `Command`s) or, for a data module's requests, from the bake's grant ceiling; a plan that uses it unlinked is refused at boot by name. The gate (since 2026-10-02, Charlie: gate what ships) is `metrics.mjs --long`'s app.js budgets, the JS target each app ships (Caltrain 19, RealWorld 30, video-player 9 KiB brotli-11); the wasm cores (what games, conformance and fixtures build) keep reported reference numbers (310 / 304 / 249 KiB) that print "over" and are not filed. Smaller is still better for both, so a lane measures its app cores and app.js before and after and says the difference in its commit. Precedents: Canvas 2D stage 2, `format`, `materials`, `backdrop`, `auth`, `share`, `documents`, `picker`, `text_transform`, `effects` (filter, clip-path), `animations`, `gradients`. Numbers in core crates read and print through `exact-num`, never `str::parse::<f64>` or `{}` of a float: either one brings back core's tables (~12 KiB and ~4.5 KiB).
- **Canvas 2D on the GPU owes** (2026-09-29, LLP 1056 §8.5, `land/canvas-gpu`). (1) Memory: F2 full screen ended 19 MB (iPhone) and 4–7 MB (iPad) over SwiftUI's at the landing tip (24 and 32 MB on the bake branches), within one full-screen IOSurface, the second a canvas drawn off the main thread keeps while Core Animation shows the first; a smaller-than-device backing for a canvas that animates, or one surface when the lists always cover, would close it. (2) vello's main thread was 172–191 ms/s against Skia's 118–148: traced (2026-09-30, iPhone, the same app with each module swapped in; `~/bench/canvasbake/swap`, `exp`, `ab`). It is not main's own work (main's CPU 29 against 25 ms/s) but its wait for the runtime owner's canvas draw each frame (`Runtime.advance` → `Owner.sync`): the same draw costs 2.9 ms under vello and 1.75 under Skia, slower evenly in every function, both on the performance cores, and 2.4 ms with no replay at all, so the performance cluster runs slower when vello leaves the CPU idle while the GPU works (Skia's replay burns ~5 ms of CPU a frame). Cut on `perf/canvas-gpu-main`: main's font scan reads record headers (main CPU 29 → 22 ms/s), and the recorder keeps parsed palette colours and the reply finds text by headers (owner −6 to −9 ms/s, main busy 173 → 167). The lever left is the next line. (3) The module is in every Apple app's bundle (3.98 MB on iOS), as the SVG island module is; embed it only for a plan with a 2D surface. (4) It needs Xcode's Metal toolchain to build; a Mac without it builds apps that draw animating canvases with Core Animation's recording (§8.4), which then remains only as that fallback: delete it when every build machine has the toolchain. (5) A canvas is given to the GPU at its fresh bitmap's first lists; one that starts animating later stays on Core Graphics until its next fresh bitmap (a state prologue from the tracker would move it). (6) Text on the GPU is filled glyph outlines (no colour glyphs); Skia drew glyph masks. (7) The same module could replay Linux's canvases (kernels to SPIR-V at build time), so Apple and Linux would match each other.
- **A GPU canvas that clips a different non-rectangular path every frame without `save` still adds a clip layer a frame** (2026-11-11, `canvas/vello/src/replay.rs` `clip`). The same path is skipped and rectangles fold into their intersection; other paths stack. The region shrinks every frame, as on the web, and here each frame costs a layer more: fold the stack into one mask once it passes a small count.
- **The owner measures its own rows: built, measured twice, reviewed four times, parked** (2026-09-30, cpu lane, LLP 1072 §8.7, `parked/owner-measure` 676adb620 on main 536f930e2, `~/bench/xheavy/results/cpu/ipad/ab6-measure`, `ab9-measure2`). The host's Rust measures the rows a report's commit laid out, so the batch that mounts a row carries its measurement and correction. On the iPad's 19-kind fling the rebuilt version is −11.6 ms/s CPU and −1.1 main over the run with the peak 9 MB lower, +12000 alone 751 → 643 CPU, 301 → 262 main, 115.5 → 119.9 fps — and +6000 120.0 → 116.7 fps in all three rounds. Parked on the frame loss and on four review passes each finding a new way a measuring pass disturbs report-level state (edges, limits, other lists, into-view targets, an unapplied correction). To reopen: trace the 6k pass's lost frames, and give the runner an entry of its own for measurements, the anchor's correction and the rows then owed, instead of re-running the report path.
- **The list window's lead: two shorter velocity terms measured and parked** (2026-09-30, cpu lane, LLP 1072 §8.11, iPad M1 19-kind fling, three rounds each, `~/bench/xheavy/results/cpu/ipad/ab5-lead`, `ab5b-lead-mid`). Half a viewport + 0.1 s × |v|: CPU −12.8, main −12.9 ms/s, but +12000 fps 115.3 → 111.2 and its late frames 3–4 → 4–6 a pass. One viewport + 0.1 s: CPU −14.9, main −6.3, fps unchanged at every speed, +12k 3/3/3 → 4/5/4 late frames a pass, worst frame 94 → 110 ms (65 → 72–75 outside warm-up). The mechanism: the slice a reversal needs is built a few frames later than the port reaches it. Frame drops over total CPU (2026-09-26), so parked; the lead is not the lever for the rows never shown — a reversal-aware window or a cheaper row is.
  2026-10-23 (lane q1022/ab): Parked: retain the existing hardware measurements. Half a viewport + 0.1 s velocity reduced CPU by 12.8 ms/s but lowered +12,000 pt/s from 115.3 to 111.2 fps. One viewport + 0.1 s reduced CPU by 14.9 ms/s while increasing late frames from 3/3/3 to 4/5/4 and worst frame from 94 to 110 ms. No new simulator measurement or lead change: the recorded frame regress
- **The Apple batch wire's cost** (2026-09-30, cpu lane, iPad M1, 19-kind fling, `~/bench/xheavy/results/cpu/ipad/tr1`). LLP 1044.000 §6 S8 kept the JSON wire between the owner's Rust and Swift. Its price over the fling, all threads: `Batch.decode` 21.9 ms/s on the owner (BatchReader into string-keyed dictionaries, 8 of it building them), the Rust side's write inside `commit_tree` (style JSON 1.6, the collections snapshot 6.1, the ops themselves in the rest of the ~8 ms/s of encode), and on main the dictionary lookups the apply then does per op (~7 ms/s of hashing and finds in `Presenter.apply`). A binary layout for the hot ops (create, frame, style, children, collections) would take most of the 22 + 8 and some of the 7 out of a 632 ms/s run. **Ruled (Charlie, 2026-09-30):** JSON stays the wire; first decode it straight into typed values with no intermediate dictionaries (LLP 1044.000 S13's "batches read at memory speed … over the same JSON wire"), measured; a binary layout for the hot ops only if that leaves more than about 10 ms/s.
  2026-10-22 (lane q1022/e3): measured on the entry's own workload (`bench/extra-heavy`, 19 kinds, 3,000 rows, iPad Pro 13-inch simulator, the probe's ±1k to ±24k pt/s segments): decode 9.6 to 9.8 ms/s, apply 122 to 124 ms/s per fling. A typed decode of styles (JSON wire kept, sparse typed rows) changed combined decode plus apply by +1.9% over three paired runs, so it was not landed (candidate patch in the lane's logs). The cost the ruling aimed at is in apply, not decode; the fixture generator fix that lets the 19-kind app compile again is a1cb16af7b.
  2026-10-23 (panel 2): the simulator numbers do not place the ruling's 10 ms/s line, which was drawn on an iPad M1 device, and the saved candidate still boxes every value into `BatchValue` before choosing a row, so it is not the direct typed decode the ruling asks for. Next: on an iPad M1, measure main's decode, encode and lookup separately, then a decode that writes typed rows with no intermediate, then rule on the binary layout.
- **Travel inside the built window reports nothing: built, measured, parked** (2026-09-30, `parked/travel-quiet` 256f0b694, LLP 1072 §8.6). The runner's own rule (`travel_stays`, `exact_collection_stays`) lets the host skip the report a moving list would make inside its window and leave the offset for the owner's next job instead; reports 190 → 124/s on the iPad's 19-kind fling, but process CPU only 637 → 624 ms/s and main 277 → 275 (−19 to −32 at 1k–3k, nothing from 6k up), under the program's landing threshold. The report log behind it (`~/bench/xheavy/results/cpu/ipad/diag1`, `diag2`): 92 empty reports/s cost 8 ms/s; the 98 non-empty cost 190. Take it up again when a per-report cost is worth it: the rows' boxes gathered once per batch instead of per report (its `Entry.gathered`), or a host whose reports are dear. The rows never shown are the larger waste: at 3k–6k pt/s a third of the rows built are lead rows a reversal retires unseen (12% at 12k, 5% at 24k). On macOS (bones M4, mac lane, three alternated rounds) the fling is within noise (815 vs 819 ms/s) and rest costs +14 ms/s of process CPU and main (178/81 against 164/67): a skipped report likely leaves its list dirty and the branch's `schedule()` on a non-empty `dirty` reserves a turn every turn — verify before reopening (LLP 1072 §8.6).
  2026-10-23 (lane q1022/aa): Parked. Commit `bac505e037`. Temporary bridge/runner probe with a real 1,000-row list: 10,000 unchanged reports all returned empty batches; 7.596 us/report in the debug build, 1 test passed in 0.10 s. Probe source restored. This is not a new iPad fling measurement; the queue's original device experiment missed its CPU threshold and regressed Mac rest. No sch
- **What is left of a row's mount on main, after LLP 1072** (2026-09-29, `perf/owner-thread`). The runner, kernel, layout and decode of a moving list's slice run on the owner thread. The iPhone 13 Pro Max's live fling is 114 fps and 4.7 late frames a second, against SwiftUI's 118 and 1.1; the 19-kind feed and the M1 iPad Pro beat SwiftUI. Main-thread turns over 8.33 ms are now rare (0.2 a second). A late frame is several turns together: the landed slice's presenter apply (96 ms/s over a 6k pt/s fling: SVG animations and scenes 23, flat-leaf create/frame/flush 42, node pool 20), CA commit 68 and the retire-only report's destroy apply. Next is LLP 1072 stage 4: build the SVG paths, animation values and flat-leaf geometry on the owner as values. Also still owed: macOS slices off main (stage 5), and the round trip, which costs 2–5.5 ms/s of main's blocked time over the live fling against a 3 ms/s budget.
- **CSS `filter` on a box, what is still owed** (2026-09-29, LLP 1055.000 §0 "CSS `filter` on a box"; the paint walk's part 2026-11-11, LLP 1159.000). Where the paint walk draws (Linux, Windows, Android) a filtered box is pictured and the chain runs over the picture (`host/linux/src/paint/box_filter.rs`; `fx-box-filter` and `fx-image-filter` are held to Chrome on Linux, on an Android emulator, API 36, a greyscale, a blur and a drop shadow drew as the web draws them, and nobody has looked at Windows). Owed there: on a box rotated or skewed in the plane a `drop-shadow()` falls along the screen's axes (the schema's `filter` row says so), which painting the box flat and placing it turned would cure, as a box turned in space is; the picture is a transparent frame the size of the window, made again on every paint that reaches the box, so an animation under a filter pays for it each frame; and a `url()` filter on a box is not taken. On Apple the picture is redrawn after each batch, so what changes a box without a batch (an image decode landing, a text raster painted later, a video frame) shows at the next batch; a `url()` filter on a box is not taken; the picture is drawn on the main thread at the box's full region (the live SVG path's off-main drawing would suit an animated one). On macOS the picture is `CALayer.render(in:)` of the box, which ignores `maskedCorners`: a filtered box with some corners rounded and others square (a layer-property box, `BoxLayerMac.swift`) is pictured with all its corners rounded; one radius on every corner is exact.
  2026-10-22 (lane q1022/e3): three probe rounds on macOS could not read a filtered box's picture (contents nil after a CoreFoundation cast fix and mounting under the presenter's layer-backed root); neither Apple issue was reproduced or fixed.
  2026-10-23 (lane q1022/x): Done in part; committed 3d5bb4bc07. All changed classes passed in the final suites. A real app drive reproduced all four corners rounding on the filtered copy of a box with only its top-left corner rounded. The rebuilt app shows the correct outline: only 44/6400 pixels differ from the plain box, all at the antialiased edge (mean maximum channel difference 0.206/255). Images: /tmp/q1022-x-filter-{before,after}.png; drive: /tmp/q1022-x-filter-app-after.log. Image decodes and la
- **Canvas 2D bitmaps are not pooled: measured, not built** (2026-09-29, LLP 1056 D10). On the Extra Heavy canvas feed (iPhone 13 Pro Max, fling, two rounds) exact2 leads SwiftUI on fps 119.0 (113.4), late frames 0.9 (6.5) a second, main thread 204 (323) ms/s and peak memory 75 (146) MB; it loses only the app's CPU, 410 against 352 ms/s. Replay is off the main thread, so a fresh bitmap's page faults cost no frame: a fling mounts about 25 canvas rows a second (8,167 pt/s at about 330 pt a row), and a pooled, faulted bitmap would save 0.1–0.4 ms each, 2.5–10 ms/s of that CPU, off the main thread, for D10's reset contract on the replay queue. Build it when a canvas list loses frames or memory to mounts.
  2026-10-23 (lane q1022/ab): Parked: retain the existing hardware measurement. Canvas replay is off-main; the measured possible saving is 2.5–10 ms/s CPU. Exact already led SwiftUI at 119.0 vs 113.4 fps, 0.9 vs 6.5 late frames/s, and 75 vs 146 MB peak memory. The entry’s trigger—losing frames or memory to mounts—is unmet by those results. No pool or reset design added. Commit: none (mea
- **SVG feed memory on the iPhone** (2026-09-29, BENCH_VM peaks on the Extra Heavy SVG-only feed, two rounds each): the 43 → 55 MB rise after the gradient raster cache (bbfe3b46, 11e1feaa) does not reproduce: the cache-only build 42.4–45.2 MB, cache and strips 44.8, main 40.2–45.9, SwiftUI 34.8–34.9. The cache is small (the CGImage and CG data tags under 3.3 MB). The gap to SwiftUI is malloc in use, 30 against 13 MB (nano, tiny and small: scene dictionaries and layers), as in the crypto SVG list's line.
- **What F1 and F3 still cost against SwiftUI** (2026-09-29, M1 iPad Pro, LLP 1055.000 §0 "F1 and F3, the second round"). F3: the app's CPU 413 ms/s (120) and peak memory 145 MB (24), at 120 fps and main thread 73 (84). SwiftUI's filters run in the render server; ours render the sub-scene with `CARenderer` in process (its CPU scan converter fills the shapes, ~50 ms/s), submit two command buffers a frame (~95 ms/s in the driver) and keep the target, two working textures and four surfaces (~80 MB of GPU memory). A picture drawn only when something in it moves (the orbit's rate, not the display's) or a render-server path (a `CAFilter`-free chain in a `CALayer` the server composites) would close it. F1: launch lifetime peak 121 MB (99–116) and steady 88 (49), measured while the vignette was a mask island (23 MB); it is a gradient layer now (first ink below), memory not re-measured.
- **F3's first ink after an install** (2026-09-30, iPhone 13 Pro Max, LLP 1055.000 §0 "First ink"). With the kernels compiled at build, the first launch after an install draws F3 at 280–348 ms against 124–133 warm (SwiftUI 61–68): the GPU compiler's work on each pipeline and Metal Performance Shaders' blur, inside the feature's commit. A `MTLBinaryArchive` harvested per GPU family (or pipelines made on the boot prewarm and the first picture drawn a frame later, against D1's never-without-the-effect rule) would take it out. Warm, F3's commit is ~20 ms on the phone's main thread: the GPU wait (6–7 ms; the first picture is drawn in its commit), the sub-scene's CPU gradient (3–4) and `CARenderer`'s make (2.5–3).
- **The web core's next cuts, sized and not taken** (2026-09-28, `perf/web-core-size`, at 287.5 / 281.8 / 226.8 KiB): derived `Debug` in error text is ~10 KiB of each core (`-Zfmt-debug=none` measured it), but ~40 sites put `{e:?}` into a batch's or the agent's error text, so removing it changes that text (errors as codes, LLP 1047 §6: Charlie's). More style rows' grammars could link by use as `effects` does: `transform`/`transform-origin` (~1.5–2), `box-shadow` (~0.6; its four rows also take numbers), SVG dash arrays and markers (~0.5). exact-motion's libm duplicates compiler-builtins' copy of the same kernels (~0.35; routing it through std on wasm keeps its bits but loosens the pinned-profile argument). wasm-opt `--traps-never-happen` (0.5–0.9) declined: a panic's trap would run on. Still entangled, as before: streams (~1.3), checkbox/switch (~0.6), the agent production gate (~1.4), `rem`/`em` (~2.4).
- **LLP 1051.000 D5: an estimated paragraph makes a geometry read provisional** (2026-09-28, owed by v1): on macOS a paragraph of 64 KiB or more lays out at an estimated, pending height (`RegionReaderMac.swift`), but `TextMetrics` carries no pending flag, so `frame` and `measure` over one answer as settled. The native measurer gains a way to say so; the web's signal (`document.fonts.status`) is built.
  2026-10-23 (lane q1022/t, Apple side): Parked: the shared kernel `TextMetrics` still has only width, height and baseline, and its geometry provisional flag covers unresolved image/video sizes. Apple already returns baseline -2 for pending reader geometry and refuses to memoize it; sanitize necessarily drops that sentinel before the kernel-facing metrics. A host-only change cannot mark ordinary box `frame`/`measure` reads or their ancestors provisional. No
- **Streams after LLP 1069.004 slices 1–3** (2026-09-27). Owed: worker-placed TypeScript streams and their sockets' sends (a message there is a turn, and the runner keeps one ticket per target); the rustls paths (SSE and the new WebSocket client) on a real Linux box (the Linux smoke ran on the Mac, on Darwin's transports); the public Exact Live job fixture redeployed with `/api/frames`; a Jetstream consumer app (outside the repo) — the public feed was only read by hand. Found: a build's document prerender (the render host) opens a stream answer and bakes its value after ~2 s (weatherlight probe) — decide whether a stream is ever a document's answer.
- **LLP 1069.010 slice 3's remainder** (2026-09-27): the LLP reader (`apps/llp/data`) still reads its corpus with `std::fs` and so still receives raw paths (only apps granted `fs.read doc:/` get `doc:` paths); moving its index to storage requests is owed by D1's "delete, don't deprecate". Under the App Sandbox a host route should mint the file alone, not its folder (D1 as built). A web `save-file` substitute keeps what the app wrote in memory; the driver cannot read it back.
- **LLP 1069.010 D4's cross-window notification** (2026-09-27, owed by slice 2, ruled Q3): Fieldnotes is still one window (`navigate-existing`), so a committed write announcing an LLP 1016.002 topic that the other session's readers re-ask is not built. It lands when Fieldnotes says `navigate-new`; the app owner, which holds both sessions, carries it.
  2026-10-23 (lane q1022/aa): Commit `196843c296`. Parked. The real Fieldnotes manifest resolves through the Apple builder to `navigate-existing`. The entry's new-window consumer condition remains unmet. Policy probe passed: `/tmp/q1022-aa-622-policy.log`. No broadcast API added.
- **The app's root font size, what #102 left** (2026-10-07, LLP 1069.000 D3 as built): a way to have the stored size at the first frame instead of one commit after a mount task. Wait for an app that asks. (The relative `setRootFontSize("125%")` landed with LLP 1121 stage 2's independent item.)
- **`rem`/`em` where the kernel still takes only `px`** (2026-09-27, LLP 1069.000 D3 as built): inside `calc()` and `env()`, `box-shadow`, `transform`/`translate`/`transform-origin`, `stroke-width` and the SVG number rows; `vw`/`ex`/`ch`. And a boot argument for the root font size, so a non-16 Dynamic Type costs no commit after boot. Wait for an app that writes one of them.
- **LLP 1069.007 after its first slice** (2026-09-27; the slice: the production gate, holds by ticket, `clock settle`'s `reason: "device"`, launch display preferences, the offset across DST). Owed: `--answer <capability>=<value>` fixtures (D4; an auth smoke answers with `type @t` instead); `prefer`'s `page`, `place` and `permission` groups (§5 item 5); `EXACT_DEVICE=real` (D8) beyond the Apple auth sheet and the seeded stream, where LLP 1069.006 built it, and Apple's page facts (#114). Retiring an HTTP-shaped hold with its ticket landed with the auth session. The picker (LLP 1069.002) now holds on every host; no smoke drives it yet.
- **LLP 1069.002 after its first build** (2026-09-27): a visible `input type="file"` presents only on the web (native hosts draw nothing; every consumer hides it); a video's HEVC-to-H.264 export (D6) is not built (only `preferredAssetRepresentationMode` on iOS); `video` does not take an `app:/` source (D7 is `image` only, and on the web only for this page's picks); a picked file's object URL on the web lives as long as the page; the Linux host has no HEIC decoder, so D6 there is a refusal; nothing manual yet on a phone with a real HEIC and a Cinematic video, nor a real NSOpenPanel/PHPicker pick; `apps/picker-fixture` and a `smoke.mjs` case were not added (Fieldnotes' import is the consumer).
- **LLP 1069.006 after its build** (2026-09-27): nobody has pressed the real sheet — the macOS `EXACT_DEVICE=real` drive opened an `ASWebAuthenticationSession` that no request left in 30 s, with no display to see it; a person should run `apps/auth-fixture` (`bun apps/auth-fixture/fixture.mjs`, then the app, Prepare, Sign in, Approve) on macOS and an iPhone, and once with an https callback (`.https`, `webcredentials:`, the AASA) on a signed build. Safari's popup rules are unmeasured (LLP 1069 §7 item 6). A Rust source on the web can't name its callback (`exact_data::auth::callback` needs the page's origin by import). Refresh (D6 step 8) has no consumer yet. The Bluesky port's changes are in the RFC's As built.
- **LLP 1069.005 D1b after its build** (2026-09-27): a Rust source on the web can generate and sign but not keep a key (`keep_key` refuses in the page's wasm, since a JWK in `localStorage` breaks Q3); keeping it means signing through the page's WebCrypto by import. The iOS link's size with `p256` is unmeasured. The host-held (Secure Enclave) key waits for its security review.
- **LLP 1070 stage 4 owes** (2026-09-27): F4's report order (outer owed, inner owed, then leads) and F5's report-before-commit for a newly created inner port (the runner's bootstrap covers the outer port instead); a real-trackpad check of the macOS latch; xheavy's `innerfling` scenario against stage 0, now that `~/bench/xheavy/exact` can fill its filmstrip and inbox hooks with real nested lists.
- **LLP 1070 Q4: feel-test iOS edge chaining with real fingers** (2026-09-27, ruled provisionally: "lt's try your rec and see how it feels"). On an iPhone and the iPad, a drag that starts at an inner list's edge outward under `overscroll-behavior: auto` goes to the outer list with no inner rubber band; `contain` keeps the band. Try both on a strip and an inbox in a feed; if `auto` feels wrong, Charlie reverses it.
- **LLP 1070 Q3 (b): an option to anchor every size change on a horizontal list** (2026-09-27, Charlie: "(a) is ok for now, but we might want to allow an option for (b) at some point"). Row lists anchor only an estimate's first measurement; a re-measured card left of view shifts the strip, as Chrome does on the inline axis. (b) would hold it still, a declared deviation (LLP 1001). Wait for a consumer that sees the shift.
- **After LLP 1067.000 (Accepted 2026-09-27, one native module per app)**: grnl's move to `modules/apple` (the steps are in the RFC's "Moving an app to this shape").
- **No exact2 check touches the real Keychain** (2026-09-27, apple tests). `exact-apple`'s `fresh_preparation_reads_platform_secrets…` now stands in a shared memory store for the platform's (`store::PLATFORM`), because the login keychain is locked in a non-interactive session ("User interaction is not allowed"). The Keychain itself is `vendor/ibex/crates/ibex2`'s `secrets::darwin::tests::the_keychain_round_trips`, which nothing here runs (vendor is excluded from the workspace) and which needs an unlocked login keychain too. A hermetic real-Keychain test needs the shim (`darwin_keychain.mm`) to take a keychain (`kSecUseKeychain` on a temporary one the test creates and deletes); changing the user's default keychain would reach every other process.
  2026-10-22 (lane q1022/r): Parked: the production Keychain shim returns User interaction is not allowed on this Mac. Built and ran a new XCTest through ibex2_darwin_keychain_get/set/forget with a UUID service; an independent Security read verifies real storage and cleanup checks no item remains. The first write is refused; cleanup passed. A passing hermetic test needs the temporary-keychain injection des
- **Presence parity on iOS** (2026-09-30): resize parity is fixed on web/macOS/Linux (`issues/closed/20260927-presence-resize-diverges.md`). Sweep the shared 17-step timeline on iOS when its simulator supports the resize step. Linux's immediate exit removal is the declared LLP 1063 D8 limitation.
  2026-10-22 (lane q1022/h): the iOS driver refuses the shared timeline's resize input, so the parity drive stops at that step; the driver gap comes first.
- **`backdrop-filter` owes** (2026-09-27, LLP 1053.000 §3). iOS: `.light` whatever σ (45–59/255 off on bare blurs); only a private layer does better. macOS: an authored `background-color` under a `backgroundMaterial` is hidden by the material's view.
  2026-10-22 (lane q1022/r): Parked in part. Mac fix committed as 477ab64259; iOS arbitrary-radius blur remains the documented public-API limitation. The Mac opaque-background regression failed two pixel assertions before the fix. VisibilityMacTests, BoxLayerMacTests and PreparedSvgTests: 23 tests, 1 skip, 0 failures. Authored fills now paint above the material and match the same fill without a material; c
- **Animated images: what LLP 1011.000 §4 leaves** (2026-09-27). Linux decodes no GIF or WebP at all; animated PNG, AVIF and HEICS paint their first frame on Apple; a player's frames (up to 4 MiB, else two) are outside the raster budget and never drop resolution under pressure.
- **Watch: agents writing `width`/`height` on a `canvas` meaning its bitmap** (2026-09-27, Charlie's ruling in LLP 1056 §10). Contract spells the bitmap size `bitmap-width`/`bitmap-height` because `width`/`height` are the box's CSS size. If agents or people stumble on it, make Contract name the mistake and revisit the web's spelling.
- **What perf/value16 left** (2026-09-27, the 16-byte `Value`: `Str` over arcstr, `Items` over triomphe's `ThinArc`). M1 iPad Pro, four interleaved rounds against origin/main ea4526fb (`results/v16-r1` in both benches; a few launches failed, three or four runs each). Heavy list, BENCH_REST=10: footprint at the first frame 40.5 -> 35.0 MB, fling peak 122.7 -> 111.9, fling end 93.4 -> 89.7, 10 s later 62.4 -> 52.7; ladder end 88.1 -> 80.5, 10 s later 55.5 -> 51.5; fps, busy/frame and CPU unchanged. Crypto list (`exact-cm`): rest 33.2 -> 29.8, fling peak 43.3 -> 40.5, live fling peak 42.9 -> 41.4, cold start 30.0 -> 29.6. With map/join (`exact-lmap`): rest 31.8 -> 28.2, fling peak 43.4 -> 39.7, live fling peak 43.7 -> 40.1, cold start 31.4 -> 28.2: now below exact-cm, as LLP 1017.003 predicted. Mac heap (a counting allocator over the baked value): heavy 21.1 -> 16.1 MB, lmap 8.5 -> 6.0, cm 5.4 -> 4.9; a thin `Rc` (slice-dst) came to 18.8 on the heavy list (its weak count, rounded to 16 bytes). Decode, boot, scroll and live ticks measured the same on the Mac, and so did the two crates with plain counts (atomics cost nothing measurable); the VM's map/join over 48 points is about 12% faster. Owed: (1) Caltrain's web core is 327.86 KiB brotli-11 on 23a7e269, over its 303 ceiling before this change (fix/web-core-size owns that); with this change it is 327.78 (+0.24 on ea4526fb, +0.04 on a5e74ec7: within brotli's noise). (2) Neither pointer has weak references: tests that watched a release through `Weak` now hold the value and read its count. (3) Apps outside the repo that build `Rc<[Value]>` or `Rc<str>` for a `Value` (the bench ports, Weird Castle) need `Items`/`Str` or `Value::record`/`Value::str`.
- **LLP 1056 (Canvas 2D) stage 1 owes** (2026-09-27, `feat/canvas2d-stage1`). (1) ABI 2's byte result: a TypeScript draw's lists cross the seam as JSON with base64 (`exact_canvas::seam`), and the Apple batch carries them as base64 too, where D1 and D7 ask for bytes and a typed buffer Rust owns until the batch is released; measure in stage 3 before building. (2) A worker-placed module and a replaced Rust module (`Swappable` with no embedded crate) report that they do not draw; the stale-reply path is built and tested in the runner but no host exercises it, so §4's worker sequence is not in the gallery. (3) The web module realm draws synchronously in the turn (a draw awaits nothing), not a deferred turn later as D4 expected; the first frame after activation is drawn. (4) Frames are drawn whether or not a canvas is on screen (`draw_canvases(&|_| true)` on every host); D4's on-screen rule needs each host's visibility. (5) and (6), `currentColor` and the wide colour forms, landed in stage 2. (7) The TypeScript recorder is a hand port held to the Rust one by `canvas/tests/cases.rs` (records compared to 1e-9), not generated from a rule table as D3 says. (8) landed in stage 2 (`Path2D` is built). (9) The runner's Canvas 2D code is linked into every app's wasm, not only a plan's with a 2D surface (LLP 1047); measure its bytes and move it behind a link if they count. (10) `smoke.mjs canvas` needs the gallery prebuilt natively (`cargo build --release -p canvas-gallery-linux`, `EXACT_APP_DIR=apps/canvas-gallery bun host/apple/build.mjs` and `--ios`; rebuild all three after a change to a replayer); its web builds go to `target/web-dist/<app>` and are built when missing (`EXACT_CANVAS_REBUILD=1` rebuilds). (11) `scripts/svgparity.mjs` keeps its copy of the comparator; it becomes a caller of `scripts/parity.mjs` once the SVG stages 8–10 lane lands. (12) A dev reload of a TypeScript module that draws is untested (§4's reload sequence).
- **LLP 1056 (Canvas 2D) stage 2 owes** (2026-09-27, `feat/canvas2d-stage2`, §8.2). (1) Apple text is held to a declared band (mean 8, 12%; Charlie's ruling, §8.2) because Skia's glyph masks carry less ink than a Core Graphics stroke of the same outlines; revisit if a consumer needs `strokeText` to match Chrome closer. (2) A Rust data crate drawing text on the web measures with `Estimate`: the wasm runner has no web text engine (an import calling the page's measure). (3) Canvas images use a cache of their own on every host, outside LLP 1010 §6's budget; Apple's is never evicted, Linux decodes PNG assets only and synchronously. (4) Apple ignores `fontStretch` and `textRendering` and draws oblique as italic; Linux draws colour glyphs as outlines. (5) A shadow under a clip-extent operator is not held to Chrome on Linux. (6) The `"font"` redraw is wired on the web but no fixture loads a face late. (7) `smoke.mjs canvas` captures the web at 1×, so the web's device-scale shadow path is proven only by review. (8) `EXACT_ABI_VERSION` stayed 10 though `exact_set_canvas_text` and `exact_canvas_image` were added (stage 1 added `exact_canvas_display` the same way).
- **The parity smokes need their galleries' native builds made first** (2026-09-27; the web build and the lane's Linux legs 2026-11-11). `smoke.mjs svg` and `smoke.mjs motion` build the gallery's web dist themselves, and the async lane builds the Linux host before it runs their Linux legs. By hand a smoke still stops at the first missing native build and names one command: `cargo build --profile host-dev -p svg-gallery-linux`, then `EXACT_APP_DIR=apps/svg-gallery bun host/apple/build.mjs` and `--ios`. It could build what it needs, or print them all at once. The macOS and iOS legs run in no lane: they need a window and a simulator.
- **What is left of the crypto SVG list's memory against SwiftUI on iOS** (2026-09-27, perf/crypto-mem3, M1 iPad Pro, three interleaved rounds against origin/main ef137e76 and SwiftUI, six for live fling and nine for rest, `results/cm3-r1`). perf/crypto-mem3 holds cold shaped text to two screens and keeps answers (metrics, line breaks, baselines) for what it lets go, drops a settled motion slot's presentation, moves a `NodeView`'s rarely set fields to a lazily made object, and gives the text residency's tables back at rest: fling peak 44.3 -> 40.3 MB (SwiftUI 33.0), live fling peak 44.4 -> 42.4 (33.1), rest 30.4 -> 30.9 (22.7; that is free-page noise: malloc in use at rest is 19.9 -> 19.5 MB in every run, `results/cm3-restvm`, and a four-run footprint recheck read 30.4 -> 30.35); fps, late frames, CPU at every ladder speed, jumps, blanks, cold start and pixels unchanged. What is left: (1) the port's data, about 9.3 MB at 5,000 coins (the entry below). (2) Text answers keep their `TextIdentity` alive (a `Spec` with a strut `Run`, the run array, a token: about 0.6 KB of the 1.2 KB an answer costs, Mac heap): a lean identity (the metric fields and UTF-8 only) would halve what a fling leaves; `fitShaped` is only wired on iOS (macOS has no rest trim). (3) Taffy's node store keeps its peak capacity: its slot map's keys are the kernel's node ids, so it cannot be compacted without renumbering every node, and rebuilding it drops every cached measurement; not attempted. (4) `NodeView` on macOS keeps its rarely set fields inline (the iOS split in `NodeExtrasIOS.swift` would carry over). (5) The collection index about 1.1 MB at 5,000 items: sharing the item's `Rc<str>` needs a key type of a tag plus the string through `HeightIndex`, the anchor, `mounted` and the snapshot JSON the hosts read, for about 30 bytes an item (0.15 MB here, 0.3 MB on the heavy list); not built. (6) The 16-byte `Value`: landed (perf/value16, below). Malloc's dirty-but-free pages swing 3-6 MB between runs, so rest and live-fling footprints need three or more rounds.
- **The expression VM costs about 6 ns an instruction** (2026-09-27, feat/contract-listmap). A crypto row's `points` is about 60 instructions and four string allocations a point: 23 us for 48 points, five times Rust's `format!`. Each instruction is decoded from bytes through the operand table (`vm::decode`), and a template's `+` allocates per part. A pre-decoded instruction array per code body, or an n-ary concatenation for templates, are the levers; measure on the crypto fling (row mounts) before building either.
- **Watch: `sortBy`'s two spellings** (2026-10-17, LLP 1116.016 §5). Its direction is a literal, so a direction view state picks is a ternary of two calls (the euxy port's Patterns sort); and it is a function, as `sum` is, so `xs.filter(…).sortBy(…)` is refused for `sortBy(xs.filter(…), …)` (this lane's own corpus case was written the method way first). Record whether builders hit either, and whether a `"asc" | "desc"` value for the direction is worth its rule.
- **Watch: agents writing JS list idioms in Contract** (2026-09-27, LLP 1017.003 §Diagnostics). `xs.map(f)`, `xs.length`, `reduce`/`find`/`sort`/`slice`, `Math.min(...xs)`, `toFixed`, `map` as a view line or a callback returning a node, and truthy `filter` callbacks are each refused with the spelling that works (`contract_syntax::idioms`). Record, as with the canvas bitmap-width watch, whether agents building apps trip on these, which message got them out, and any idiom the table misses.
- **Text pixels on iOS without app-side bitmaps: measured, not built** (2026-09-27, perf/crypto-mem, M1 iPad Pro, 240 crypto-row labels drawn each way by a scratch probe). No public path draws a label's glyphs in the render server: `UILabel` and `CATextLayer` paint into in-process backing stores the size of the label (footprint +3.8 and +5.4 MB, against 1.9 MB of malloc for exact2's ink-cropped CGImages); both tint a private alpha image (`CATintedImage`) for single-colour text. Glyph paths in `CAShapeLayer`s are rasterized by the render server but hold 1.8 MB of paths and differ from CoreText (mean 4.5/255). An alpha-only (A8) raster is 3.5x smaller (2.56 -> 0.73 MB of pixels) and within one level of the BGRA one, but Core Animation shows A8 `contents` as white, so any other colour needs a `mask` layer, and 960 moving masked labels cost the render server 3.3x the CPU of plain contents (+115 against +35 samples/s over idle, all-process Time Profiler): not built. What would pay without a mask: white text (the crypto list's letter and change badge, about 0.4 MB at rest) as plain A8 contents, which matched the BGRA pixels exactly; it leans on undocumented Core Animation behaviour.
  2026-10-23 (lane q1022/ab): Parked: retain the existing hardware measurement. UILabel and CATextLayer cost +3.8/+5.4 MB versus 1.9 MB malloc for the existing cropped images; glyph paths differed by 4.5/255 mean. A8 reduced pixels from 2.56 to 0.73 MB, but 960 moving masks cost 3.3× render-server CPU. The white-only A8 path depends on undocumented behavior. No text rendering change or n
- **An `svg` scene still crosses as generic JSON** (2026-09-26, perf/crypto-svg, live-fling Time Profiler on the iPad): `BatchReader.value()` plus `BatchValue.any` (every path number boxed as an NSNumber, then unboxed by `nums`) is about 5% of main-thread time while a list of sparklines scrolls. A typed scene reader goes with feat/svg-complete's scene format, not before it.
- **LLP 1057.001 (gesture precedence, pinch) owes** (2026-09-27, branch `gestures-phase-0-1`). iOS: rule 4's tie order between recognizers on one view is UIKit's; the pan + pinch pair, the failure requirement between nested drags and the press boundary are unverified with real fingers (no Simulator.app here; unit tests set recognizer phases; the agent's iOS pinch is `recognized` and the smoke's precedence case answers `unsupported`). Apple Arrange and Linux keep their own release velocity (UIKit's or a contact tracker). macOS smart-magnify and rotate are not wired. The smoke's precedence case (step 11b, `contract/corpus/precedence.contract`) was approved as apparatus by Charlie (2026-09-27).
- **120 Hz measured on hardware** (2026-09-26, LLP 1061 D4). Motion that moves things asks a ProMotion iPhone for its full rate and paint-only motion for 60 Hz, set but unmeasured on hardware (`perf frames` gives the sampler's target period and its late frames, and Save Trace keeps them, LLP 1079); the Mac's display link never asks for a frame-rate range.
- **The Bluesky port could use `contract rust`** (LLP 1054.000 R4): its `Session`, `Change` and `Loads` builders by position are what the generator replaces.

- **GPU canvases: what is left of an animated shader row's CPU** (LLP 1009 D7 and §3; re-traced 2026-09-30 with one Metal command buffer a canvas frame). At rest on an iPad Pro M1 the 19-kind feed's one animated shader row costs the main thread about 55 ms/s under the profiler (the starved pass: wgpu-core's `finish` 21, its submit 11, the render call 6; the tick 8) where UIKit's `MTKView` draw costs 35, and process CPU 245 ms/s against UIKit's 172 without the profiler (main 102 against 60). What is left is wgpu-core's bookkeeping for a pass and a submit, on the main thread, and a starved canvas's two passes a frame — D8 (the module on a thread of its own) is the design for the main thread; process CPU stays about 1.4× UIKit's for one canvas at 120 Hz with wgpu-core encoding the pass. In a fling the acquiring threads' `nextDrawable` is mostly new IOSurfaces for rows that scroll in (next line). Weird Castle's surface migrates by the patch kept with the lane (`~/bench/xheavy/gpusubmit/weird-castle-d7.patch`).
- **Upstream Naga's unnecessary f16 uniform-storage capability** (2026-10-17, `vendor/wgpu-hal/EXACT-PATCHES.md`, patch 11). Naga 30 emits both 16-bit buffer capabilities for function-local half arithmetic. Declare only capabilities the SPIR-V uses, then separate native arithmetic/storage from uniform-buffer support without weakening WebGPU's `shader-f16` guarantee. Exact's Android-only instance opt-in and uniform rejection keep Adreno usable in the meantime.
- **Upstream ibex2's queued-message count** (`vendor/ibex/EXACT-PATCHES.md`, "Socket queued-message count", 2026-10-15): `MessageSender::buffered_messages`, which LLP 1016.000 D7's publication uses to refuse a batch whole before the transport's 256-message limit; propose it to expo/ibex and drop the local patch when it lands.
- **Upstream wgpu-hal's lazy Metal command buffer** (`vendor/wgpu-hal/EXACT-PATCHES.md` patch 1, 2026-09-30): an encoding that encoded nothing makes and commits no `MTLCommandBuffer`. It changes nothing a caller can see and removes two or three committed buffers per render pass for every wgpu user on Metal; propose it to gfx-rs/wgpu against `wgpu-hal/src/metal/{command,mod}.rs`, and drop the local copy of that patch when a release carries it. Patch 2 (a frame's presentations riding its submit) would need an option on the surface configuration upstream and is not proposed yet.
- **What exact2 holds at rest on the Extra Heavy feed beyond SwiftUI** (2026-09-28, perf/xheavy-mem; iOS simulator `heap`/`malloc_history` at rest with BENCH_KINDS=video, then BENCH_VM device runs; `~/bench/xheavy/results/memory`). The gap is malloc (iPad 36 against 21.5 MB in use at the end of a fling; every other VM tag within 1 MB), and at rest it is: (1) the port's data: `xheavy-data` keeps its parsed `Raw` rows (6.7 MB) beside a `Value` for every row of the 19-kind feed (6.75 MB) and the video feed built from them (1 MB), where SwiftUI keeps two `[Row]` arrays (5.9 MB); (2) the port's first frame: it shows the baked 19-kind `initial` for 150 ms before `jump`, so the video feed mounts a shader canvas whose module keeps a 4.1 MB decoded photo and a wgpu device, and launch peaks at 81-83 MB against SwiftUI's 38 (the iPhone's footprint at the fling's start, 66-69 MB, is that launch not yet returned); SwiftUI filters before its first frame; (3) short text: built on perf/inline-str (Charlie, 2026-09-28, the safe inline variant, LLP 1017.003): video feed start/peak/end iPad 40.6/53.1/51.8 -> 35.7/48.8/47.5 MB, iPhone 71.0/76.7/46.1 -> 65.5/71.1/41.2, launch peak 86.7 -> 80.4 and 84.8 -> 74.5; (4) fonts: cut on perf/xheavy-mem (a bundled face's descriptor from its file, 1.9 MB; iPad video feed start/peak/end 40.0/52.9/51.4 -> 38.1/50.9/49.0 MB, iPhone 69.0/74.4/44.1 -> 65.6/71.3/41.3). (1) and (2) are the port's (`~/bench/xheavy/exact-kinds`), not exact2's; matching SwiftUI's app there is a port change.
- **MapKit draws each visible map on the main thread at twice SwiftUI's cost** (2026-09-27, LLP 1068 §0.3, xheavy on the M1 iPad Pro, 12k–24k pt/s): `renderSceneSync` 78–85 ms/s against SwiftUI's 42 with the same maps in view; reuse does not change it. Next: count live `MKMapView`s against SwiftUI's at the same offset (retained rows past the window may keep maps drawing) and check whether a map scrolled out of view but still mounted keeps its display link.
  2026-10-23 (lane q1022/s): Parked. No source change or commit. Prepared inputs with SKIP_LOTTIE=1 (no clones), built and launched exact-xheavy on EXACT_SIM with BENCH_KINDS=map. The held agent reports 5 made native instances and no pending leaves; that mode settles every held leaf and cannot establish live rendering cost. Current HeavyLeaves already hides views beyond 0.25 viewport and releases them beyond 1.25. Three hierarchy/profile attempt
- **LLP 1055 / 1055.000 (SVG, completed in stages) owes** (stages 1–7 on main; 8, 9, 10b and 10c built on `feat/svg-stages-8-10`, §0 of 1055.000 records each): stage 10a (`image` inside SVG: each host's image pipeline for an element with no view) and stage 11 (`textPath`, and SMIL as ruled: native on the web on the agent clock, the lowered subset on native hosts); from stages 8–10, `feImage`, `width`/`height` and `d` animation on SVG elements, an animation inside an island sampled on Apple (it shows the model value), stripping `libexact_svg.dylib` (Xcode 27's strip breaks it; unstripped it is 487 KB), snapping Apple's filter islands to device pixels, Core Animation's blend colour space on macOS, and `mix-blend-mode` on boxes; from stage 5, per-character `x`/`y`/`dx`/`dy` lists, `rotate`, `textLength`, and stroked or gradient text on Linux; from stage 6, hover and the other handlers on native hosts, `title`/`desc` and per-element accessibility, `a` inside SVG, text hit testing and a `text`'s object bounding box (both need the host's advances; meanwhile a `filter` or `mask` on a `text` takes a region that holds its glyphs, and `transform-box`, an `objectBoundingBox` clip and a group around it see no box), the non-default `pointer-events` values on Apple, and an agent address for an SVG element (its tap goes through the `svg`'s centre); from stage 7, `context-fill`/`context-stroke` and `refX`/`refY` keywords; basic shapes and `shape-rendering` on SVG elements; `reflect`/`repeat` of a radial gradient with a moving focus on Apple (it pads); a change inside a referenced definition in another `svg` (a sprite) re-renders the referencing scene on native hosts, and a reference whose target's `id` changes re-emits on the web; SVG 2's `pathLength="0"` rule (an infinite scale), pinned against Chrome; percentages on `stroke-width` and dashes; the macOS agent's default screenshot shows model layers, so a paused or running CA animation needs `screenshot … window`. The parity smoke is `bun scripts/smoke.mjs svg` over `apps/svg-gallery`.
- **`transform` on HTML boxes** (LLP 1055.000 D5, §8 ruling 3): deferred until a consumer takes it. The row-equivalent subset landed (2026-10-19, the Brooks shop-app lane's `translate(0px, 25px) scale(0.8)`): a value that is `translate`, `rotate` and `scale`, each at most once, in CSS's individual-property order, lowers to those rows wherever the compiler sees the literal (inline, a class, each arm of a choice). The rest stays deferred and refused: `matrix`, skews, a per-axis or 3D scale, 3D functions, a function repeated or out of order, a bound string. Admitting it requires composition with the individual properties, hit testing and layout overflow on every host.
- **What is left of the heavy list's off-main CPU and late frames on iOS** (2026-09-26, perf/offmain, M1 iPad Pro Time Profiler and System Trace). Off-main is image decode (about two thirds at 6k pt/s and up) and worker text; inside a decode, ImageIO's own thumbnail (hardware JPEG decode, then a high-quality resample from full size) is nearly all of it, so what is left to cut is decode count, not decode cost. Four pieces: (1) a fifth of decodes still draw into a copy because the plan rounds a side up (`RasterDecodePlan.scaled`) where ImageIO rounds down, so the thumbnail is one pixel short and gets stretched; agreeing on rounding drops the draw but moves those images' pixels by that stretch. (2) Core Animation no longer copies image or text layer contents at commit (perf/memory: every raster is Core Graphics' own image, BGRA, 64-byte rows; a device Allocations trace shows no `create_image_by_copying` left). (3) The text-pixel cache (`TextRasterizer.kept`) is iOS only; the AppKit rasterizer has the same repeated labels. (4) With off-main load lower, the main thread at ±12k/24k pt/s spends more CPU-ms for the same rows (more samples on E cores, fewer P-core cycles per ms); total CPU still falls. The one late frame left per ladder run at the +12k start is the probe's segment checkpoint (6-12 ms of JSON written on main in `-[LBProbe emit:]`) plus rows the next frame needs; the harness could write it off main.
  2026-10-22 (lane q1022/q): Done. Commit: 737e59932b. Retain opaque SDR ImageIO thumbnails up to one pixel smaller than the admitted bitmap. The reservation stays conservative; natural dimensions still determine object fit. The checkpoint writer already runs off main. Method: iPad Pro 13-inch (M5) simulator, generated Extra Heavy data, shared heavy-list probe injected with DYLD_INSERT_LIBRARIES, fling, BENCH_DELAY=2, BENCH_REST=10, no accessibi

- **What is left of the heavy list's memory on iOS** (2026-09-27, perf/floor after perf/restmem, M1 iPad Pro 12.9", three interleaved rounds against origin/main 1c1802af and SwiftUI, BENCH_REST=10). Shared decoded objects cut the baked 10,000 messages' values 23 -> 18.8 MB (193k -> 139k objects), and the rest trim now also runs after launch (freed ImageIO blocks of the first decodes return). Fling end 103.7 -> 97.1 MB (SwiftUI 83.1), 10 s later 75.1 -> 67.9 (66.1); ladder end 121.0 -> 122.5 (72.3), 10 s later 66.0 -> 62.8 (57.6); footprint at the first frame 44.4 -> 40.0; cold start unchanged (157 vs 156.5 ms, six pairs). perf/crypto-mem3 (five rounds against origin/main ef137e76): ladder end 112.4 -> 87.0 MB, 10 s later 56.0 -> 52.2; fling end 94.0 -> 88.7, 10 s later 66.7 -> 63.1; fling peak unchanged (117.9 vs 117.8), late frames and CPU unchanged at every ladder speed. The footprint at the last frame still loses: cold shaped text (now two screens plus answers), freed ImageIO blocks that `malloc_zone_pressure_relief` does not return (16-19 MB, back about ten seconds later), CG image data, and the plan's values (records 14 MB, strings 4.9 MB; the 16-byte `Value` took 5 MB of the baked values, perf/value16). Still open: purgeable backing for cold images, the same rest trim on macOS (only the iOS scroll pump arms it).
  2026-10-22 (lane q1022/q): Parked. No code change. Same probe and simulator as 670, BENCH_REST=10. Fling before/after 670: peak 134.50 → 131.84 MB, scroll end 84.54 → 83.10 MB, ten-second rest 57.02 → 67.75 MB (decimal MB). The unchanged baseline ladder ended at 109.04 MB and rested at 88.20 MB. Raw results remain under target/q-*.json. Single simulator runs do not reproduce the device's allocator attribution or prove a memory gain. The existi
  2026-10-23 (lane q1022/w): Measurement complete; purgeable backing remains parked. No image-ownership change or proven memory reduction is claimed. The authorized iPad Pro 13-inch (M5), 0B0A552D-3B11-42C4-9F8D-251805136B61, simulator ran Extra Heavy before 822 and with its final code, with VM and >=128 KiB allocation probes and BENCH_REST=10. Peak/end/rest were 132.58/87.58/72.72 MB before and 134.68/86.71/70.44 MB after. Main CPU was 187.83 -> 187.02 ms/s. These single shared-machine runs are within a
- **`adopt` covers the compiled value only** (2026-09-26, perf/adopt, LLP 1027 D11). A value carried across a reload, a kept store-reader answer or a document's seed is not adopted, and the TypeScript executor and a worker-placed source ignore it (their values cross as copies). A source that edits what it answers still rebuilds its data after a dev reload (the heavy-list port parses its JSON on first edit then). Extend it when a consumer shows the cost. The heavy-list port also still bundles its 7 MB messages.json into the device binary for the bake's sake; untouched, those pages are clean and not charged to the footprint.
- **Weird Castle does not build against exact2 main** (2026-09-26, found checking perf/adopt against it). `weird-castle-data` matches `Outcome` without `Storage` and `Surface` (data/src/lib.rs, `parse_login` and `parse_switch`), and `weird-castle`'s src/lib.rs calls `Runner::boot` with 3 arguments (it takes 5 now: the viewport and the launch URL). Neither is from `adopt`; with the two matches given a fallback in a scratch copy, the data crate checks clean.
- **What is left of a slow heavy-list scroll on iOS** (2026-09-26, perf/slow-frame, Time Profiler on the M1 iPad Pro trace and the iPad Pro 13" simulator). At 1k pt/s, after the focus-search, text-scan, timer and travel-report fixes, the main thread is mostly building rows: `Host::commit` layout and `create_row` in Rust, `Presenter.apply` in Swift, and the CA commit. Three pieces are separable. An ellipsized paragraph (`text-overflow`) never rasters on a worker, so each new row's author name is shaped and drawn on main in `NodeView.draw` (`paragraphLayout`, ~2% of main on the iPad); a worker raster that truncates would take it off. Every commit re-serializes every mounted row's snapshot (`collections_json`) and Swift re-parses it (`applySnapshots`, `CollectionSnapshot.init`), ~3%, including the measurement-only report that follows each built row. And each report still carries every mounted row's height (`CollectionHost.height` walks each row's ancestors for `hidden`), which the runner now ignores when unchanged but the host still gathers and encodes.
  2026-10-22 (lane q1022/q): Done (feedback encoding); snapshot serialization and ancestor walks remain. Commits: 58612974c3, a536f9c164. The review fix uses acknowledged snapshot sizes instead of the last sent report; see Review round 1. CollectionFillIOSTests, assigned iPhone 17 simulator: three covered scroll reports before carried [4,4,4] measurements / 540 bytes / 0.953 ms; after [0,0,0] / 300 bytes / 0.689 ms (final rerun 0.889 ms). Change
- **A hardware keyboard on a headless simulator** (2026-09-26). This Xcode has no Simulator.app, so a simulator has no hardware keyboard and UIKit's focus system never starts. One HID keyboard event from SimulatorKit's `SimDeviceLegacyHIDClient` (`IndigoHIDMessageForKeyboardArbitrary`) attaches one for the rest of the boot, which is how perf/slow-frame reproduced the iPad's focus-search cost; the keys themselves did not reach the app, so a real Tab walk still needs a device or Simulator.app.

- **What is left of a heavy-list live tick** (2026-09-26, perf/live-ticks, `sample` on the iOS simulator in live mode). Keying and type-checking now follow what changed (the runner's share fell from about 17 to 1.3 ms a tick), and the timer callback is about 2.4 ms: the runner about 1 ms, of which `SumTree::new` reallocating and zeroing its 2×16,384-slot buffers on every splice is about 0.2 ms (reuse them when the base size holds, keeping the splice transactional); the host's commit and layout about 0.3 ms; and the Swift side (`ExactSession.apply`, `Batch.decode`) about 0.8 ms. A same-length reorder still keys, by position, every row between the moved ones.

- **iOS boxes on the pixel grid, what is owed** (2026-10-17, `host/apple/Sources/ExactKit/IOS/PixelGridIOS.swift`). Every node view and flat leaf is drawn with its absolute edges rounded half up to device pixels, as Chromium's `PixelSnappedIntRect` rounds them; text wraps and native editors and collections measure at layout's size (`layoutBounds`). Typetour's first screen at 3x has 20% fewer horizontal edges blended across two pixel rows (21,118 to 16,943); Shelf's first screen was on the grid already. Owed: (1) offsets UIKit's own views take, a grouped list's `UICollectionView` and a dialog sheet's scroller, and Exact's other programmatic writers (scroll anchoring, reading-position restore, keyboard avoidance, collection anchoring and its animated offsets), which can leave content a fraction of a pixel off; `writeScrollPosition` and content sizes are on it; (2) border widths: Chromium snaps a computed border width (under one device pixel to one, else down to whole pixels), which belongs in the kernel for every host; (3) what blurs inside a box: a paragraph's lines sit at fractional baselines; (4) a carried grouped-list row keeps its children's places from its authored parent, which can differ from Chromium's by a pixel. The Mac draws on the grid since 2026-11-04 (`Mac/PixelGridMac.swift`, its own copy of the arithmetic, at a scale that is not whole under a page zoom). It owes a dialog or popover the host centres on a fractional point, and a region surface's published selection rects (`RegionWorkerLayout.swift`), whose baselines still round in their row where its pixels round on the surface.
  2026-10-22 (lane q1022/o): Parked after completing the programmatic iOS offset fixes and their regression evidence. Commits: `7c1b3bfa1b`, `56d7c7666b`, `2ecc4177dc`, `22297c52a1`, `ab2d0cd107`, `0c609e35ae`, `e4d7bd922c`, `533eb000b3`, `bd439e30a7`. Programmatic collection, reading, keyboard and page/bar offsets use inward pixel bounds at rest. Pan/fling corrections preserve UIKit’s rubber band. The selected-tab pull remains unclamped so its large title expands to 106 pt rather than staying at 54. Aut

- **`smoke.mjs web --app <name>` fails for an app with a data module** (2026-09-26, found running Messages for LLP 1047.000). The generic host fixtures reload a bare plan into the app's `EXACT_WEB_LINK=all` build, and `exact.reload` refuses with "module reload requires a paired generation" when the build carries a module. So Messages, Fieldnotes and the other TypeScript apps pass only `--app-only`. The fixtures could run on a build without the app's module, or the smoke could default to `--app-only` for such apps.

- **What LLP 1074 left** (2026-09-30, lane/taffy-css). (3) An exclusion (`wrap-flow: both`) under a static parent is placed against a box further up and wraps nothing; the compiler could say so (`wrap-flow: both` needs a positioned parent) where today the text is only refused auto height. (4) Apps outside the repo (Weird Castle, Interview) are not swept for `position: static`: the parent of each absolute box, and each box with an inset and no position, needs `position: relative`. (5) The one deviation left, that a clipping box is a containing block, goes only when native hosts paint by stacking context and re-parent a positioned view to its containing block (LLP 1074 §7); `position: fixed` waits on the same. (6) Patches 10, 11, 12, 14, 17, 18 and 20 are marked to upstream and none has been sent.

- **The rest of LLP 1050.000 stage 1** (2026-09-25, perf/fill-hosts). iOS, macOS and web collections now report `velocity` and `limit` and fill in slices; a web authored jump builds its rows before it moves (stage 2), and macOS clamps `prepareContent(in:)` to the built rows (D5). Owed: D5 with real trackpad input (responsive scrolling takes window-server events, which `tap … wheel … fling` now posts, LLP 1142 D3; checked so far only by XCTest); a macOS authored `scrollTop` still reports on the next main-queue turn, not in its batch (whether AppKit can commit a frame between is unmeasured); the anchor rule while moving; pending intervals in the reply; and the cost memo (D3). Linux stays unlimited: it has no fling and its wheel steps are small. Give it a limit when it gains a fling (LLP 1015).

- **A list benchmark row is now mostly the runner and the batch** (2026-09-25, perf/rowcost, simulator Time Profiler over the fill slices; it was mostly UIKit). The iOS presenter's share of a built listbench row fell from about 1.5 to 0.75 ms (no window layout engine, no scroll view per closed swipe row, parked row views reused by shape: `NodePoolIOS.swift`). What is left per row: the runner's commit and a Taffy layout from the root on every report (about 0.7 ms, the perf/layout lane), `Batch.decode`'s JSON (about 0.25 ms), `CollectionSnapshot` parsing the whole snapshot each batch (about 0.12 ms, `Collection.swift`), and `UIImageView` resolving a symbol it is handed anew (about 0.08 ms). Layout from the collection, a binary batch, or a snapshot that sends only what changed would each go further. View reuse is iOS-only; macOS and web could follow the same contract.

- **`timeline-scope: all` has no browser oracle** (2026-09-28, LLP 1057.003 phase 3). Chrome 154 drops the declaration (`CSS.supports('timeline-scope', 'all')` is false), so the kernel and the glue follow the specification's text, and the web's own CSS carries no `all`: phase 4's scroll timelines, which the browser resolves, would not see one. Recheck Chrome (and Safari) before phase 4, or refuse `all` until one parses it. The lookup's other 23 cases are Chrome's answers recorded in `kernel/tests/it/timeline_scope.rs` from a scratch page; `parity.html` rendering those trees with scroll timelines would make them a fixture.
- **A drag timeline's source eased by a CSS transition is sought per frame on the web** (2026-09-28, LLP 1057.003 phase 2). A spring release hands each consumer a follower animation and runs nothing per frame; a `translate` transition with a CSS easing (`0.4s ease-out`) is the browser's, so `motion-glue.js` seeks the consumers in each frame it runs (18–26 callbacks a release in the gallery). Composing it too means sampling the easing (a `KeyframeEffect` with no target answers its progress at any time) into the same `linear()` points; steps() would need its jumps.

- **A drop whose move arrives after the return spring still scrolls the List to follow the row** (2026-10-23, the reorder-anchor lane, abd0ae25ea). A committed drop now anchors the first visible row other than the dropped one, but only while the preview lives: `finish_preview` (runner/src/instance/collection/reorder.rs) and `finishPreview` (host/web-js/reorder.js) drop the preview, and its exclusion with it, so an ungrouped drop whose data write lands after the return spring ends (a slow mutation) anchors the moved row again and the List jumps by its travel. Both reviewers of that lane read it in the code; not reproduced in a test. Keeping the exclusion until the move shows, or until a bounded wait like a grouped hold's, would close it.

- **A served RealWorld article is only partly adopted** (2026-09-24, the activation lane, LLP 1048/1047). At d73af7b0, booting a served `/article/…` page keeps 82 of the document's 113 elements; the rest are rebuilt. It happens on the tip, not only in the split prototype. Adoption should keep every element when the canonical documents match. Find what diverges (the Markdown body's projection is a likely suspect) and whether the digest or the element matching is wrong.

- **Presize the transaction's per-commit sets from the batch** (2026-09-24, the size lane): `txn::apply`'s `created` set, `Staged`'s maps (`created`, `parents`, `children`, the root sets) and `Detach`'s `seen` start empty on every commit and grow as its ops arrive, about seven doublings each for a batch that moves 220 children. Under a compact id map that growth cost 55–70% more cycles on a native churn bench (500 commits, each creating 20 rows, moving 220 and destroying 20: 203M → 313–348M cycles, for 1% more instructions), which is why hashbrown stays (LLP 1047 §10). hashbrown pays for the same growth, less. Sizing each set from the batch's op count before its first insert would take that growth off the commit path, on native and the web.

- **What RealWorld found in Contract** (2026-09-23, `apps/realworld`): (1) ~~Nothing runs when a mutation answers~~: `mutation … then action` (LLP 1016.001, 2026-09-26). Mutations, resources and tasks live only in the root, so a page's form state that touches data moves up.
- **Surrogate keys that name only what shaped a page** (2026-09-23, render lane): the server keys a page by every source its render asked (LLP 1048.000 D11), so a source whose anonymous answer never changes (Interview's `loadDraft`, `accounts`) puts every page in its purge. Naming only the answers the document read needs the projection to report the resources it read; the runner doesn't track that.
- **A published web root doesn't serve its documents past `/`** (2026-09-23, render lane; a JS build's tree takes the hosting rule since LLP 1153 D3, `buildTreeFile`): `readWebRequest` (a published root's `plan.published`, and a wasm build) still answers any app path with `/index.html`, which a `render=build` home page replaces, so a published root serves a client route, or an unknown one, `/`'s page with 200; and a wasm build's `listPublicFiles` does not inventory `404.html`, `shell.html`, `sitemap.xml`, `robots.txt` or `<location>/index.html`. A 2026-10-24 lane (branch `q24/serve-pages`, parked after three fix rounds) found what that touches: (1) admit a `<location>/index.html` only when its checkpoint location matches its path and a `render=build` route, else an arbitrary directory (`posts/private/` under `/posts/:slug`) becomes public; (2) `host/web/tests/navigation.mjs` injects its fixture only into `index.html`, so shell and 404 need it too; (3) a published nested document keeps `href="./exact.json"`: relocate it in `webRelease` (scripts/deploy.mjs) before the cards, not when serving, which bumps the release id and so needs `classify` to compare the desired id or old origins stay `current`. What stopped it: telling an app document from an authenticated `.html` asset in `webRelease` (a prefix list misses a rendered `/plans/pro`; main rewrites any `.html` with `<base href="/">`, which already breaks an HTML asset's envelope card): use membership in `exact.json`'s assets instead.
- **The web core's rich style codecs, linked by use** (2026-09-27, LLP 1047.000 §9). RealWorld's core grew 70.7 KB in a day (238.9 → 309.6 KB brotli); Canvas 2D is now linked by use (`c1663d51`, −10.3 KB). What remains is style rows whose `CssValue` codecs parse CSS text (paint, marker, dash array, paint order, transform and its origin, filter, clip path, shape outside, aspect ratio, background image): the generated `StyleProps` code reaches every codec, so every app carries every parser. A throwaway build stubbing every `CssValue` parse and format call bounds the saving at **10.9 KB** (299,236 → 288,375 B), so the type-erased storage Charlie agreed to (rich rows behind a trait, parsers linked by use; `kernel/build/codec.rs`'s one template plus ~45 consumer sites across the SVG and paint lanes) waits until those lanes next reshape `StyleProps`. Also left: Canvas 2D's TypeScript draw seam and per-batch web turn (~3.5 KB), which need a registration in the generated entry. `metrics.mjs --long` reports each tracked app's core against a reference size (`WEB_CORE_KIB`), not gated since 852101fa73.
- **`app.wasm` across deploys, what is left** (2026-09-26, `6e0b8874`; LLP 1047.000 §9). A returning reader now gets the next build as a delta (9.5 KB against 238.6 after an app edit) when the render server runs with `--generations`, which only the bench passes: hosting should. A page left open across a deploy still loads the new build and can skew against its checkpoint; the server keeps the earlier builds now, so it could serve each at its own `?v=` (LLP 1048.000 D10's "kept for pages still open"). The stage files are named by content but go `no-cache`; `immutable` would drop their revalidation.
- **GPU modules, what D6 left** (2026-09-23, split lane; LLP 1009 D6): natively a module gets no runtime shader assets (the ABI names no registry's shaders; the web asks `gpu_shader_names`), so a module compiles the WGSL it carries; natively every artifact links its own wgpu, naga and Metal backend (Weird Castle: 3.34 + 3.92 MB stripped against 4.06 MB for one module), which a shared wgpu library would remove; a destroyed device with two artifacts live has been reasoned and unit-tested, not driven.

- **Contract compiler follow-ups** (2026-09-22, branch `compiler/expansion`): Lowering canonicalizes and opens a file on every compile (6–14% of lowering, `lower_with_sites`); the resident compiler could keep it. Unoptimized `infer` takes ~10 KB of stack per level, which is what holds an expression to 100 deep (release has room for ten times as much); splitting its arms would raise the bound. `change=add` for a parameterless `add` reports only the unrelated `setDraft`'s uninferable parameter, since analysis's handler arity needs types first. Weird Castle does not compile at `c3b585bf` (`app.contract:289`: `iframe` has no attribute `postMessage`).

- **Native Markdown undo boundaries** (2026-09-22; LLP 1045 D5): UIKit must retain its specialized per-editor undo manager; source undo/redo across natural run-loop turns and independent histories are verified with it. Still owed on native: a source replacement and formatting command in one automatic event group can undo together, skipping the intermediate source. Three bounded automatic-group repairs did not establish a safe boundary; the final attempt was reverted after scheduled run-loop closure exceptions on both platforms. Preserve native grouping semantics; the one-command-one-undo requirement remains incomplete. Physical phone input and intrinsic editor sizing remain unproven.

- **Markdown editor** (Charlie, 2026-09-21; LLP 1045): source-backed editing now has shared Rust formatting/selection APIs, TextKit 2 adapters on iOS/macOS, and a dependency-free `contentEditable` web editor whose rules are `exact-markdown-editor`, an on-demand wasm (Charlie, 2026-09-22: CodeMirror removed). The stress app has a formatting toolbar and link field. Interview's separate consumer branch adds composition, source-preserving publication and durable account/prompt drafts. Native syntax stays visible at full advance but for link destinations, which Apple hides by `exact-markdown-editor`'s rules (LLP 1045 D5 r6, 2026-10-20); the web hides all of it (WYSIWYG). The DEFERRED take is approved. Owed: the Apple hosts adopting the rest of `exact-markdown-editor` (the other hidden syntax, its input rules), which waits behind LLP 1045.000's inline atoms (the take for their `rules/DEFERRED.md` move, 2026-10-23); phone composition/autocorrect/dictation/VoiceOver/selection ergonomics; Safari/Firefox/mobile-web evaluation; native intrinsic editor sizing and drawn list markers; reader paragraph details and Linux markup painting; the remaining media/highlighting/reader-migration slices. LLP 1045 remains Draft; it and its accepted child LLP 1045.000 are not linked into `llp/current/` (15 of 15).

- **`press` on a container holding its own input** (2026-09-23, buttons lane): Messages' two emoji-picker columns (`apps/messages/app.contract` `column press=showEmojiPicker`, lines 817 and 837) put `press` on a container that holds the picker's full-size transparent `input`, so neither can be a `button` (an input inside a `<button>` is interactive content in interactive content). Once they are restructured — the input could take the tap itself — `press` can belong to `button` and `link` alone and be a compile error elsewhere, where today it makes a `<div>` with a click listener and no keyboard access.

- **Context menus after LLP 1021 §5.1** (2026-10-05): the Signal clone moves its chat-list preview onto `contextPopover`/`contextPreview` (its agent has the syntax). Owed: a swipe row (the Signal chat list's) never parks in the iOS node pool, menu or not (its live scroll view), and that list is not a virtualized `list` anyway; macOS's `MenuHost.context` and right-mouse path have no test (`popUp` is modal); the compiler does not refuse a literal `contextPopover` naming no popover, or two `contextPreview` rows (iOS logs both, macOS the first, the web neither); no interactive content inside a preview (UIKit takes any touch on it as the commit), so Signal's reaction bar stays authored; after a bar item's menu, `ExactView`'s focus (key commands) comes back only at the next touch on the page, not when the menu ends (UIKit says nothing then), and any touch on such a bar blurs a focused node (UIKit exposes no bar item's view to tell a menu item's touch from another); Linux shows nothing; on the web a bound `contextPopover` that the node's own action changes opens the old popover when the commit is deferred (a view transition on the JS target, presence loading on the wasm host): resolve it after the applied commit, not in a timeout.
  2026-10-22 (lane q1022/o): Parked after verifying the available Apple coverage. No menu product change. ContextMenuMacTests passed 30/30; the focused unlocked menu run passed 37/37 with MenuBarMacTests (`context-macos.log`, `mac-menu-unlocked.log`). This covers native tracking, right mouse, Control-click, keyboard invocation and item selection. The prior final iOS run passed all four hosted context-menu tests and the pool/lifetime/keyboard classes. A live swipe scroller remains excluded from pooling; S

- **Reader memory** (2026-09-24, collection-parity lane): on a 3.2 MB corpus (75 LLP docs) the macOS reader holds 73–75 MB at open where Legend Markdown holds 49–50 MB; the gap is the small malloc zone (51 MB dirty to 25). About 19 MB of it was the document as plan values — 8,862 blocks, 51,462 runs at 208 B each (records and lists are now one `Rc<[Value]>` allocation each, perf/memory, not re-measured here) — and about 19 MB is freed-but-dirty pages left by 410 MB of allocation churn during the load (890k allocations for one document). Smoothness and startup already lead Legend there.
  2026-10-22 (lane q1022/r): Parked. No product change retained. Built and drove Markdown on 75 sorted LLP documents (2,852,804 UTF-8 bytes), opened at 900x700, and inspected its screenshot. Three fresh processes after clock settlement: physical footprint 432.4, 435.0, 433.2 MiB; graphics dirty storage about 338 MiB, malloc allocated 40.5 MiB with 28.7 MiB dirty fragmentation in the first run. A layer-only


- **No drive presses a real Tab on macOS** (2026-09-23, native lane): `agent.mjs macos … "type X key Tab"` (`AgentMac`'s `NSWindow.sendEvent`), a CGEvent posted to the agent app's pid, and even `NSWindow.keyDown` in XCTest leave the first responder where it was, from a button as from a paragraph; only `selectNextKeyView` moves it. The key-view loop (buttons in tree order; paragraphs selectable but out of it, 2026-09-23) is proven at that level in `AccessibilityTests`; a real-keyboard check on an active window is owed.

- **Text performance: LLP 1044.000 is paused** (Charlie, 2026-09-21, after S14): LLP 1044.000 §11 has every slice and the final scoreboard against Legend. **Deferred by Charlie, to revisit soon** (2026-09-21): the web's giant paragraph (S7's second half listed its unsupported cases — a narrower guarantee, our own breaker, or as is); rows too costly to build in a frame (a 256-column table: never-blank and never-stall conflict); a physical 120 Hz iPhone and Mac run (real touch input needs a person or an approved XCUITest runner). Also open: S14's small-text drawing on iOS (`TextRasterIOS.canRasterText`; unmeasured there); S9.
- **Reflow follow-ups** (2026-09-20, `apps/reflow`): the dragon is a hand-placed polygon; a traced silhouette (`shape-outside: <image>`, LLP 1043.000 stage 5) would let a real illustration be the exclusion. On the web, ordinary paragraphs (magazine, cards) are broken by the browser, so a column can end one line short of the cut; only flowed text goes through the shared walker there. Web `wasm-opt` was not on PATH for the numbers in the README.
- **Bounded resource answers** (Charlie, 2026-09-18, LLP 1027.004 r2): slices 1–2 are implemented. `list virtualized=true` has `reachstart`/`reachend`, Messages stress has a bounded mode, and the Messages conversation answer is at most 200 rows around a cursor. Still owed: the Grok code review (balance exhausted), a macOS/AppKit drive of the stress bounded mode. Shared views/buffers/heap and generic whole-value reconciliation remain deferred (LLP 1027.003 §9).
  2026-10-22 (lane q1022/j): three investigation rounds found nothing to change; the owed review and the macOS drive of the stress bounded mode remain.
- **Module-wide liveness landed natively; confirm §13** (2026-10-04, hn-reader F7): an answer awaiting a promise another answer started (one memoized `fetch`, a queue behind another's storage) now waits on Hermes while the module has a fetch, storage step, stream or unbegun answer outstanding, and is asked again after each delivery (LLP 1027.003.000 §13 option 1, which QUEUE recorded as Charlie's decision). Still per-answer: the web's wasm module realm (`host/web/module-glue.js` runs one answer at a time, so the wait would block the reply it waits for; the JS target, the web build, runs real promises) and a worker-placed source (its owner runs one turn to its end).
- **Bounded application work: plan r3, reviewed by two families** (Charlie, 2026-09-20): LLP 1027.003.000 (Claude) and LLP 1027.003.001 (Astra max) answer LLP 1027.003 §11–§13 independently. They agree: Fieldnotes first (a legal 1,000-note notebook cannot be opened), then Messages changed-record writes, then native filling; no heap, deltas or new apparatus. r2 §9 recommended 1027.003.001 as the spine with four amendments; r3 is the synthesis, reviewed by Astra max and Grok 4.6 xhigh (both MATERIAL FINDINGS, six defects raised by both families, dispositions in `llp/reviews/`) — this document's summary-only Fieldnotes answer with no pager, its sibling's chunked exact search with no stored folded column, the three-second idle sync tick as its own first Messages change, and hoisting `CREATE TABLE IF NOT EXISTS` out of the per-operation path. 1027.003.001 §8 found what both repairs cannot fix: browser SQLite exports the whole database after every non-query op (`host/web/storage-worker.js:113-123,189`) and every `storage-fs` operation `getAll()`s every file with contents (`host/web/storage-fs.js:166`). A contract compiler fix landed (a bool `derive` could not be a ternary condition); Fieldnotes now fetches short prefixes for unfiltered previews, with bounded 32-row full-body fallback, and loads only the selected editor body. Exact search still scans every body. TypeScript reads and Rust backups now check the stored schema instead of issuing no-op CREATE writes; browser whole-database export on actual writes remains open. Filesystem operations now fetch their required records or subtree keys; removal reads no deleted-file contents, and rename loads only the moved subtree and records it validates. Messages idle sync now skips full-history reads/comparisons unless reconciliation is owed; reset/adoption, apply and settlement failures retain the obligation until successful read/publication. Browser idle metadata commits now skip persistence when a bounded SQLite comparison finds every final value unchanged. Unchanged reply timer ticks now skip full-model snapshot/diff work too. Durable source footprints now avoid full-history snapshot/diff and held-map copies on local edits. Receipt transitions now visit only outgoing messages still awaiting Read. Sends and contact edits now preserve existing person positions and select only affected contacts. Recovery footprints now include only selected messages and expiry candidates; due expiry metadata scans and whole-database export for actual browser writes remain.
- **Action spelling diagnostics** (LLP 1006 §3): handlers, action props and timers now use authored scopes; forwarded prop/provider errors link their supplied argument. Action-valued derived expressions and other untraceable substitution origins conservatively get no hint. Extend only with original binding provenance, never expanded-root name guesses.
- **Linux popover presentation and Messages reply input** (2026-09-20): closed popovers are hidden and inert, fixing the hidden `permanentlyDelete` interception of ordinary inbox taps, and presentation, placement and light dismissal are built (2026-10-26, LLP 1115.004 D10.7). The earlier reply drive loses its held contact, and the Linux carrier refuses context-menu input. The ordinary scroll-property path and the headless 215-send/earlier/later/latest drive are fixed. Evidence: `/tmp/exact-linux-popovers-306428c2/` and `/tmp/exact-scroll-commands-0a819c84/`.
- **Virtualize the Messages transcript** (LLP 1010 §6 consumer sweep; LLP 1027.004 D5): its horizontal timestamp-reveal wrapper is outside the collection's supported shape. Once virtualized, `reachstart`/`reachend` replace the explicit earlier/later rows with no source change.

What would make sense to do next, in rough order. This is not a spec and decides
nothing: `rules/RULES.md` §Scope says a spec without an implementer and a date isn't
written, so a line here is one to three lines — the thing, why, what it needs. When
someone picks one up it becomes an LLP with a name and a date (archive a link when
the working set is full); when it lands, delete the line. Anyone, agents
included, may add or remove a line. `rules/DEFERRED.md` still binds: an entry that
sits on that list carries the trade it would take.

## Next, in order (2026-08-29)

- **Game texture families in bundles and on the wire** (2026-09-23, textures lane; LLP 1046.003, "Compressed textures"): every baked texture ships as `x.tex` (RGBA8), `x.bc.tex` and `x.astc.tex`, and a device fetches one — on the web. Native bundles copy all three (the Fox's 5.6 MB becomes 8.4 MB); a macOS bundle needs BC plus the fallback, an iOS device ASTC plus the fallback, but the bake's compatibility inventory lists every asset, so thinning is a bake change, not a copy filter. Separately, `host/web/serve.mjs` sends `.tex`/`.model` as uncompressed `application/octet-stream`; RGBA8 payloads gzip 70× (the Fox's 5.6 MB → 80 KB) and blocks 1.2–17× — a compressible type for game assets would cut the fallback's download.
- **Game-engine comparison remaining gaps** (2026-09-17; LLP 1046.003 §7): full Lanterns games and fleet trials landed. Babylon/PlayCanvas qualify; eight external edit passes include one PlayCanvas repair-budget violation. Godot proves human win/loss but its sequential large-step adapter fails; Three.js/Cannon collision remains broken after the separately authorized extra sleep/reset round.
  Next: repair those two specific baselines before their withheld trials; measure target GPU/phone and native exports, complete adapter/setup cost, and actual vendor automation routes. Actively track Babylon + PlayCanvas; retain Godot/native and Three/renderer controls.
  Retained fixtures include a held-out change and negative controls; their repeated execution is not repeated agent success. Diagnostic only, no blocking check; LLP 1046.000 §6a remains the full-game bar.

- **List memory** (2026-09-18, Codex; LLP 1010 §6): fixed and measured-height
  runner/web windows and Apple geometry are implemented; Markdown now uses them,
  with logical selection/copy on Mac and web. Finish workspace validation after
  the macOS executable-startup block, Linux geometry, the full native interaction
  sweep, raster budget and Messages acceptance. Memory and construction cost trigger it now; further Messages
  decorative artwork/material/timing polish waits. The fixed-height web slice does not complete the native/consumer sweep.

- **Markdown performance comparison** (2026-09-18): displayed launch now favors
  Exact modestly on README and the 2.24 MB corpus; ordinary-wheel response is
  tied, and footprint settles across four repeated scrolling passes. Legend
  still has lower hitch time after the scalar-width reuse fix. Next: reduce
  native measurement/list settlement, measure already-running file switches,
  and validate partial blank/stale content during fast scrolling. Current
  identities, methods and limits are in `apps/markdown/README.md`.

- **Text around shapes** (LLP 1043.000 §8): auto-height flow is built
  (Stage 2, 2026-09-26) and accepted (Charlie, 2026-09-27, d788c0f396).
  The web breaker is `textflow.wasm`, loaded on demand (`host/web-js/flow.js`).
  Owed: Euclidean `shape-margin` for ellipse/polygon; `justify` in fragments;
  iOS fragment-aware hit-testing and the remaining scene drives (Stage 2's
  Article scene was driven on the simulator); Safari/Firefox flow drives
  beyond the line-break corpora; `shape-outside: <image>`.

- **Native verification gaps** (2026-09-15): Messages debug native tests can
  exceed their 100 ms data-call budget during workspace validation (105–241 ms
  on the Air); investigate without weakening the limit. Interview's new Mac
  materials still need Reduce Transparency/Increase Contrast and older-OS pixels.

- **Markdown scrolling with real input** (2026-09-19): the separate upstream
  `4d91f9e` build measured ahead of Legend with in-process input on an M4 Pro
  at 60 Hz and an M5 Max Retina panel at 120 Hz (`apps/markdown/README.md`:
  inputs later than 8.33 ms, of 2,400 — about 2 against 84 at 60 Hz; 1, 1, 1
  against 1, 6, 4 at 120 Hz). The 120 Hz runs had a load average of 30–67;
  an Instruments trace under that load made app updates about four times as
  long. The later integrated build still has no demonstrated Hitches advantage.
  Owed: a quiet-machine comparison with real wheel and trackpad input, which
  requires Accessibility permission for the event sender; responsive scrolling
  for a contained list, which the in-process probe cannot drive; and a repeat
  of first-content and memory measurements on the integrated build.
  2026-10-22 (lane q1022/q): Parked on scope. No code change. Temporary XCTest on the assigned iPhone: 100 distinct 300-point paragraphs, six repeated sentences each; layout in black, then in red. 100 distinct paint shapes; measurement p50 0.1574 ms, second paint shape p50 0.1192 ms, p99 0.3000 ms. Method source: target/q-ios-text-probes.swift; log /tmp/q-ios-text-probes.log (two tests passed). Probe source removed from the test target afterward
- **Rationed list reports on iOS** (2026-09-19; LLP 1010 §6): UIKit also scrolls on
  the thread that lays out; `PresenterIOS` still reports a whole window inside the
  scroll callback and paints text when first seen. The runner and host halves are
  shared (`list_viewport_within`, one-call settle); the presenter half is not made.
  2026-10-22 (lane q1022/d3, d18e5abc2d, 83dd6bbe36): the rationing is already shared; UIKit coverage added (covered scroll callbacks emit no report and reach the scheduled fill pump). Text-heavy fling hitch rates remain unqualified.
- **A jump lands on rows built synchronously** (2026-09-19): a scroller drag or a
  250,000-point jump takes one main-thread period of 31–44 ms. The rows are never
  blank; the frame is late. The first report creates 68 views for six to eight
  visible rows (13 ms in the runner and kernel, 8.6 ms in the presenter); a second
  follows when measured heights move the landing (5 ms), then visible paragraphs
  paint. Shorten the per-row work before spreading the fill across frames, which
  would expose blank rows.
  2026-10-22 (lane q1022/q): Parked. No code change. Extra Heavy's existing jump probe on the bench iPad simulator, BENCH_DELAY=2, BENCH_SAMPLE=1, BENCH_RENDER=layer, ten deterministic absolute jumps. Raw: target/q-835-jump.json. Time to a clean viewport p50 22.96 ms, max 435.97 ms; all ten completed (two slow landings at 350.76 and 435.97 ms). Layer sampling perturbs the measured turns and does not isolate synchronous row construction. The curr

- **Router and viewport follow-ups** (2026-09-15; LLP 1038/1039): core, Contract
  routes, host projections, browser history and native URL entry points are implemented.
  Owed: Interview's held-swipe/retained-data and iPad-wide sweep; iOS cover viewport
  before first settlement; Chrome's software-keyboard viewport drive. TypeScript
  route helpers remain deferred until their first data-source consumer (1038 slice 3).
  2026-10-23 (lane q1022/v): Done: cover boot fix in 2307f0b42a; test isolation in 5319668dd0; review fixes in f38c0fda4c, d9dc7bb452 and ad7ba65889. Interview and the explicit adapter path are Parked below. CoverBootIOSTests failed before with first settlement 402 × 753 instead of 402 × 874 (/tmp/v-855-before-fresh.xcresult); passed after: 1 test, 0 failures (/tmp/v-855-after.xcresult). The Rust plan-policy test passes (1/1; /tmp/v-855-rust3.lo

- **LLP 1035 follow-ups** (2026-09-09): landed the same day — inherited rows
  (1035.000 slice 1), `layout <node>` (1035.002 slice 1), a contact's phases on
  the web and macOS carriers (1035.003). Next, in the umbrella's order: the
  scripted iOS gesture path (1035.003 §3; XCTest is built under
  LLP 1080.000, Charlie's ruling of 2026-10-22), 1035.001 slice 1 (XCTest
  units for the navigation/modal rules, journal lines for
  refused intents, a session-scoped blur in the two-session host), 1035.004's
  six symbol roles, 1035.005's remaining Messages responsibility extraction and
  three-task authoring comparisons (§3). The formatter, symbols, source-aware
  diagnostics and development maps are integrated (2026-09-20);
  `dynamic` as a `layout <node>` source once a constant binding can be told
  from an expression; `metrics.mjs` printing the inherited-invalidation cost on
  Messages; the reply tags on `tap`/`type`/`clock`/`screenshot`.

- **Contract modules, after stage 2** (LLP 1091, Charlie
  2026-10-04): both stages landed and nine code-review rounds are disposed (§10–§18). Open: a
  Rust build does not see a Contract package installed nearer than the one it resolved
  (Cargo has no non-recursive directory watch; §18). Outside this repo, Lexy can drop its own
  `timeline Activity` for `use Activity from "exact:motion"`.

- **Intermittent macOS GPU smoke stall** (2026-09-07): a TS Caltrain run sampled
  in drawable acquisition, then passed in 2.1 s on rerun; final `host` smoke
  exceeded 60 s and was stopped. Investigate window/display-dependent progress.

- **iOS module measurements** (2026-09-07): physical guard execution and live URL
  replacement/refusal/recovery now pass with retained state and unchanged process
  and binary (1027 D6). Measure linked size/startup/calls systematically next.
- **Repaired iOS onboarding acceptance** (2026-09-07): Charlie accepted touches in
  regular Caltrain after moving session creation past UIKit startup (1012).
  Normal cold/warm OS URL delivery and live reload pass after the storage fix;
  Charlie also confirmed native opening from Safari. Explicit cold/warm Safari
  cases and four-finger menu recognition remain to be checked.
- **Safari initial scrolling, phone sweep** (2026-09-08): the web host now gates
  actions/editing without making the baked tree inert; Chrome verifies scrolling
  with the data module held or failed. Repeat the touch-scroll check on iPhone.
- **Dev program rebuild boundary** (2026-09-07): after the normal phone's live
  edit passed, a server rebuild reported web inputs changed / iOS inputs unchanged
  but the iPhone required a native relaunch. Check whether the shared program
  identity is invalidating unaffected native clients (1030.000).

- **External dev latency** (2026-09-05): Weird Castle's first captured edit took
  300 ms to DOM acceptance (9 ms plan), above the 100 ms budget. Use the existing
  metrics drive to separate startup/preflight work from repeated edit latency.

- **Sample-host no-op input delay** (2026-09-04): `smoke.mjs host` passed but its
  final repeated light-scheme tap after destroying session a waited 74–131 seconds.
  Trace and GPU drawable samples are in the filesystem run; reduce the carrier/frame acknowledgement path.

1. **Linux host follow-ups** (LLP 1015 landed 2026-08-29; r2 the same day: vello on
   the GPU is the main painter, tiny-skia the fallback and pixel oracle; green on
   `expo-build-1000` (CPU), the minisforum (Vulkan/llvmpipe), and headless on macOS
   (Metal)). The DRM path ran on the minisforum 2026-08-29 (LLP 1015 §6: 1920×1080 @ 60 Hz on
   RADV, boot to first flip ~160 ms), seen and driven over the host's own VNC server
   (`EXACT_VNC=1`) since the KVM was unplugged; evdev itself has still carried no real
   event. Owed, in order: **a KMS surface for the GPU**
   (`VK_KHR_display`) so the frame is presented, not read back (17–19 ms of latency
   per frame on Metal today); `canvas` on this painter's device; the Chrome
   comparison of a pixel fixture (the font is pinned since 2026-08-29 — LLP 1015
   §3 — and `smoke linux` is green on a Mac and on the builder); a font cache when a machine's scan (25 ms
   for 787 faces on a Mac) matters; lifting the shared ~120 lines of orchestration
   out of `host/apple` and `host/linux`; one wgpu when vello moves to 30.
2. **Events, the rest** (the minimal set landed 2026-08-30: `hover`, `focus`,
   `blur`, `key` on web, macOS, iOS — LLP 1005 §3). Left out on purpose: pointer
   coordinates and moves (a drag), `keyup`, double-click, wheel offsets reaching
   the runner (the windowed-List line below). The Linux carrier has `tap … hover`
   and `type … key` now (2026-09-23); `smoke.mjs` step 4a still skips them on Linux;
   `key` inside a text field on macOS/iOS sees editing commands only (LLP 1008
   §5's declared deviation); and an action cannot branch on a key or hover
   payload — actions have assignment and command statements, no `if` and no
   string `match` — so `key=` today can only record the key.
3. **Weird Castle's asks** (Charlie, 2026-08-30: the app lives in `~/projects/weird-castle`
   on exact2 by path; `scripts/app.mjs`). In order: **asynchronous data settlement** —
   LLP 1016 (RFC, **Accepted** 2026-08-30 after a three-model panel: a `mutation` slot +
   `send`, `refresh` for queries; built the same day end to end — runner, compiler, the
   browser and `ibex2::host` executors, the agent's `settle`, Weird Castle's real `loginV2`
   against api.castle.xyz on three hosts; the Linux executor followed the same day (LLP 1016 §2,
   ibex OQ2 resolved), the token across launches is LLP 1018) for the runner's reserved
   shape (LLP 1005 §7): a data source
   answers now or hands back a request, the host executes it (`ibex2::host` on native,
   the browser's `fetch` on the web), one ABI call brings the answer in, a pending
   resource is `none` meanwhile, bake tolerates it — the first out-of-process resource
   is `loginV2` at api.castle.xyz; **password masking** and **Enter to submit** landed 2026-08-30 — the
   kernel rows are the web's `type` and `inputMode` (LLP 1017 P9's sweep spells them
   literally later), honored on web/macOS/iOS; `submit` is the seventh event, the web's
   implicit submission; a session across launches is LLP 1018 (another session's lane).
4. **Markdown viewer follow-ups** (LLP 1033, macOS milestone 2026-09-05):
   iOS selection and link gestures; iOS/web file-opening adapters; heading anchors,
   tables, and syntax highlighting. macOS drag selection across paragraphs and copy
   now use CoreText's existing lines. Keyboard selection extension still needs
   dedicated fixtures. Variable-height windowing and scroll
   anchoring now run; startup against Legend is still a tie, and scrolling is
   ahead on one 60 Hz machine (see `apps/markdown/README.md` and the 120 Hz item
   above). At a 420-point
   window width, the open folder pane leaves the text cramped and clips header
   controls; the reader needs a compact layout at that width.
   During verification the macOS timer-step smoke once read width 50 at t=1250
   instead of 75, then passed on repeat; investigate the intermittent clock fixture.

- **Rust replacement follow-ups** — **LLP 1029.000**: native/browser/Wasmi replacement
  and dev/prod controls are implemented. Next: physical-phone size/latency and
  20-edit/50-replacement measurements, normalized native-baseline reuse, and
  custom out-of-tree host composition; independent multi-module routing stays later.
  Parent **LLP 1029** is superseded for development and engine choice
  (Charlie, 2026-10-22); wasmi is ratified, per-source routing deferred, and
  Q5/Q7 remain open with no work waiting. Its Summary keeps the mixed-language
  rulings. LLP 1032's engine comparisons remain research for phone measurements.
- **The compatibility executor still says `wasmtime`** (LLP 1029 §8;
  Charlie, 2026-10-22). `bake/src/compat.rs` emits that label for `Swappable`
  and reads it to admit wasm. Rename it once, deliberately, including its
  readers: the compatibility ids containing the label change. Done when receipts name
  the actual executor and classification accounts for the changed ids.

- **Delivery, unified** — LLP 1030 r2 and LLP 1030.000 r2. Landed: stage 1 (the
  asset row), stage 2 (the manifest), the compatibility id, the `delivery`
  resource, the update store, `exact deploy` (snapshot/bake/classify/publish
  through `scripts/origin.mjs`), and the macOS and Linux hosts opening the
  store. **2026-09-04 review** (LLP 1030.001): the landing is real and the
  signature seam holds; four structural properties the RFCs paid for are not
  what the code does — filesystem issues `issues/20260904-*.md` (anti-rollback
  floor is 0, stream files overwritten before the head, Linux next-launch
  ignores entry assets, snapshot is a git-status of the app dir, activation
  cannot represent two pinned session generations, and the remaining P1–P3
  findings, most on the dev loop). Owed as before: bake writing the update bundle beside the archive;
  the dev policy folded onto the store (1026 D12); iOS driven; `BGAppRefreshTask`;
  Linux font and deck overrides from an entry; the sunset card shown by the
  app; the web host, which has no store (`L = A` in its `compat.json` is a lie
  until it does, or the manifest says `0` for it); `--watch`; the object-store
  adapter; the binary lanes.

- **LLP 1031 owed after the 2026-09-03 landing** (the handle, `ExactKit`, the macOS
  sample host, the manifest stage; the iOS sample host landed 2026-09-04 — each pane its
  own navigation controller, `smoke.mjs host-ios`): **content-height containment** (D3's
  guard is written; bounded only today); **the request and store crossings** (D4's
  contract; triggered by an adopter whose client cannot be wrapped); a request in flight under a destroy (needs a fetching app — Weird Castle — as the
  fixture); and the host smoke's remount step, which took ~3 s in some runs: measured 2026-09-04 in
  isolation at 42 ms (`clock settle` after the pop) and 7 ms (a's layout) — the seconds
  appeared only while two agent lanes were compiling on the same Mac, so it reads as a
  settle bound under load, not a remount cost; watch for it on a quiet machine.
  Weird Castle is on today's exact2 (2026-09-04: the registry shape, `host!` with
  `COMPAT`, `app.json`), but its `tests/app.rs` does not compile since LLP 1027 stage 3 —
  six assertions want `Answer::Now(...)` around a `Value` — and the file carries another
  session's uncommitted edits; whoever owns them wraps them.
  2026-10-23 (lane q1022/u): Parked in part; verified existing behavior. No source change. D3 explicitly requires max-content kernel offers, cached intrinsic height, and real nested-pan qualification. The kernel request currently has definite width/height only; completing that API spans the kernel, ExactCore and the view, beyond this lane's scope. D4 explicitly requires an adopter whose request client/storage cannot be wrapped; no such adopter i

## Cheap, any time

- **Android's scroller does not report its drags** (2026-11-10): the shared presenter's `scrolldragstart` and `scrolldragend` wait on `Scrolling.kt` calling `Native.scrollDrag(id, ended, vx, vy, rest, restX, restY)` (`host/linux/src/canvas/jni.rs`): with `ended = false` when a touch becomes a scroll of scroller `id`, and at the lift, before the fling's first frame, with the scroller's velocity in px/s positive as the offset grows (Android's `VelocityTracker`, negated) and `OverScroller.getFinalX/Y` as the rest point. Check it on a phone.
- **iOS `swipeleft` and scroll drags are compiled, not run** (2026-11-10): this machine's CoreSimulator needed an authorized update, so `build.mjs --test --ios` (`SwipeScrollDragTests`) and a `--touch platform` drive did not run. Run both: a left swipe on a `swipeleft` node fires once; a flick on a scroller fires one start and one end with UIKit's velocity and target.
- **`affected.mjs --run` stops at the first failing command** (2026-11-10): `status ||= spawnSync(…)` does not call `spawnSync` once `status` is set, so a failing Cargo command skips the game workspace and every Bun file, silently. Run each command, then keep the first failure's status.

- **Android's `linear()` evaluator still has the old edge rules** (2026-10-19, the `linear()` reviews). `piecewise` in `host/android/canvas/src/main/java/dev/exact/canvas/Layers.kt` holds the outer stops and takes the earlier stop at a shared input; the engine's (`motion/src/easing.rs`, `piecewise`) answers as Chrome 155 does: at a stop's exact input, the last stop there; before the first stop or past the last, the outer segment extrapolated; before a first pair that shares an input, the second's output. Two that differ today: `linear(0 25%, 1 25%, 1)` at 0.1 (Chrome 1, Android 0) and `linear(0 25%, 1 75%)` at 0 (Chrome −0.5, Android 0). Port the rule and check it on a phone or the JVM.

- **Compiler recovery and fresh-store drives: three review leftovers** (2026-10-18): (1) `contract/cli/src/sources/refused.rs:45` `hides()` matches a refused name anywhere in a diagnostic's message, so a broken `state number =` hides an unrelated `type-operand` that mentions `number`; restrict it to missing-symbol diagnostics about that declaration. (2) An incomplete derive whose write was in a refused action is still reported as `type-derive-cycle` (`contract/types/src/component.rs:235`); drop it with `type-cannot-infer`. (3) `scripts/verify.mjs:228`: a fresh-store refusal calls `stop()`, which kills a `server-*` a crashed drive left answering; on refusal drop only this drive's lease. 2026-10-23 attempt (450a, parked after three review rounds; branch q24/recovery-leftovers on that box only, not pushed): all three reproduced on 02a382460. (3) is one line: on the refusal call `off()` and `rmSync(mine)` instead of `stop()`. (2): `type-derive-cycle` must stay for a real cycle (`state broken =` beside `derive d = d` reports both), so classify at the cause: an incomplete derive not on a cycle of `derive_reads` is `type-cannot-infer`, an untyped `[]` keeps its own `type-cannot-infer` at that span first, and `derive_reads` must skip binders (arrow params, `match` binders, expression `let`, call heads) or `derive xs = [].map(xs => xs)` reads itself. (1): a whole-word match is what main relies on to hide many consequences, so a subject match must list them all: `type-unknown-name`, `type-unknown`, the three unknown-component ids, `type-unknown-function` (incl. "declare `routes` to use `<name>`" and the `empty()` idiom), `analyze-unknown-action`, `type-unknown-command`, `type-assign-not-state`, `type-send-not-mutation`, `type-refresh(es)-not-resource`, `type-pending/failed/failure-argument`, `type-now-renamed`, and `type-refused-idiom`. The last one is where it stopped: `idioms::refusal` gives `len`, `count` and `size` one message that names none of them, so matching a refused name by its refusal text hides an unrelated `count()` beside a refused `fn len`; those messages need to name their callee (the pinned `count(xs)` text in contract/cli/tests/it/lint.rs moves with them), or a message only one name produces may be matched. A general "first backquoted word is the subject" rule is wrong: `1 - true` quotes `number` first.
- **Evaluate a component's computed prop once per instance** (2026-10-18; worth ~2 points of euxy's playing CPU): a prop read several times in a stateless one-box component is re-evaluated at every read. A memo in the inliner was tried and removed (review: it hoisted reads under `&&`/`||`, `?:`, expression `match` arms and arrow bodies, so `range(-1)` ran where the program skipped it). Redo it with the guaranteed-evaluation rule `contract/syntax/src/inline/derives.rs` `summarize` already uses, never memoize handler arguments or clock-reading props, and mirror it in `semantics/Contract/Expand.lean`; `semantics/corpus/components/prop-guarded.contract` and `prop-event-time.contract` are the cases it must keep agreeing on.
- **A large reply's owed Hermes collection can wait forever** (2026-10-17; `js/src/prelude.js:1051,1187`, `js/src/lib.rs:863,1084,1128`): the full collection a promoted large string owes runs only when no other answer is pending, so a fetch that never settles keeps a dropped 376 KB QR buffer for the life of the process; and a reply whose serialization throws (capture limit, cycle) leaves its call in `calls` as `done`, blocking every later owed collection. Run the owed collection on the reply and re-stamp pending calls' epochs; `__exact_forget` a call whose settle fails.
- **Bold Text on Material popup typography** (2026-10-24; LLP 1115.000 D12.3): `host/linux/src/presenter/top/look.rs` builds dialog and menu paragraphs at fixed weights (400 for headline/body, 500 for labels), and its popup symbols stroke at a fixed regular weight (`(1.1 + 300.0 / 400.0)`, ~line 298). Confirmed in `paragraph`: it takes neither a node nor the preference; `Inputs` carries only scheme, font scale and window size. Carry the applicable Bold Text setting into surface layout and its cache inputs, and step these host-assigned weights once for measurement and paint.
- **Two timing-budget tests fail on main on 450b** (2026-10-24, seen on 485521e590, each also alone): `cargo test -p contract --test it tamber_rows_check::a_worst_case_write_is_checked_within_the_budget` takes 13.4 ms against its 10 ms budget, and `cargo test -p exact-svg-file --lib tests::a_file_that_expands_past_a_limit_draws_nothing_and_names_it` takes 5.28 s to refuse one of its files against its 5 s bound (`host/svg-file/src/lib.rs:439`, a debug build). Both pass on other machines; find whether the budgets assume a faster box or a release build, and make them hold on a 12-thread Linux box.
- **The Apple host drops a store write that fails to persist** (2026-10-14): the runner keeps the value, but the host does not retry a failed write. Retain it for a later commit and report the failure once per name until it succeeds or is replaced. Setting an unchanged value is no write, so an identical `set` does not retry it.
- **Linux element reveals land at once** (2026-10-18; LLP 1070.000 §14, LLP 1115.000 D8.4; `host/linux/src/presenter/reveal.rs`): macOS and UIKit animate `scrollIntoView(id)` with omitted, `auto` or `smooth` behavior and hold the scroller's `scrollend` until the animation ends; the Linux host lands every element jump at once. Animate it there too, landing at once for `instant`, reduced motion and the frozen agent, a new request or `scrollTop` write replacing a running one.
- **scrollend gaps on the hosts that have it** (2026-10-13; LLP 1005):
  - Apple unbracketed moves use a 100 ms `DispatchWorkItem`; known instant commands and discrete wheel notches should complete without that quiet delay.
  - Apple visible layout clamps can arm an end through `scrollEndMoved`; classify clamps separately from scroll operations.
  - Apple hidden-scroller completion differs from Chrome: `take()` precedes `hasScrollLayoutBox`, so a hidden callback consumes an owed end, while hide/show before the callback can retain unfinished work; distinguish unfinished scrolling from an already queued end.
  - Apple settlement must include unfinished scrolling and queued completions: `Agent.nativeInFlight()` does not count `ScrollEnd.owed` or its quiet work item.
  - Web `clock settle` can return `settled: true` during smooth scrolling and before a `scrollend` handler's jump chain finishes, as measured by LLP 1005's runtime probes.
  - Verify web lifetime parity: `rt.js` suppresses `scrollend` for a disconnected element or a gone owner but still delivers `scroll`; the `glue.js` end listener has no equivalent guard.
  - Physical macOS momentum completion remains unqualified; verify one end after the coast with a real trackpad, as in the existing momentum entry below.
- **`scrollend` on the Linux and Android host: full timing and device qualification**
  (2026-10-15; LLP 1005, Scroll completion):
  the Presenter now completes moving notches and instant jumps at its next delivery
  point (deferred notches share one completion after their frame's `scroll`),
  reader samples after 100 ms quiet, and owned edge scrolling when it stops.
  Lifetime cancellation and agent settle are covered; apps without handlers retain
  main's behavior. Declared gap: viewport resize can classify end-follow layout
  movement as a new scroll. A 100 px scroller with `scrollFollowEnd`, a child of
  height `100vh`, and a viewport growing from 500 to 600 px emits a completion.
  Remaining: the full deadline-before-later-timers rule and its
  snapshot/reentry budgets, plus Android device qualification. The first step keeps
  Host's catch-up and shell call order. The earlier full implementation remains
  parked on `q1013/scrollend-impl`; use the no-handler differential harness at
  `~/lanes/q1013/wt/scrolldiff` to guard any later timing work.
- **One presenter pass for the batches a frame lands together (iOS)** (2026-10-13, from the
  Bluesky clone's quotes fling): most fling frames apply four batches: the app's `scroll=` batch
  (the clone writes state every frame), one or two list fill slices that `landFill` lands inside
  it to keep the owner's order (T4), and a clock batch. Each that reaches `Presenter.apply`'s full
  pass (not a collections-only slice `applySnapshots` takes, nor a scroll batch `applyUnlessEmpty`
  skips) pays its fixed work whatever it holds: NavigationHost `batchApplied`/`prepare`, `onlyListRows`,
  `syncAccessibility`, `ControlHost.sync`, CollectionHost begin/end, about a quarter of the main
  thread's time in that fling (Time Profiler, 1136 samples). Merging the slices landed inside one
  apply into a single pass would pay it once. It touches the T4 ordering code, so parked until a
  device shows the cost.
- **Physical iPhone HDR qualification** (2026-10-13):
  On the iOS 27 simulator (iPhone 17 Pro), independent Apple API probes
  report `RGBA8Uint` for `.RGBA16Float` and `.gray8Uint` layer format hints,
  headroom 1 instead of 4 for gain-map HDR decodes, retained PQ/HLG for SDR
  decodes, and no ISO gain map when encoding the gain-map fixtures. The
  same requests work on macOS 27.0.1. Each declined assertion group records
  its fixture and observed result; storage, headroom and neutral-pixel
  comparisons still run. See [Apple's format hint](https://developer.apple.com/documentation/quartzcore/calayer/contentsformat)
  and [headroom semantics](https://developer.apple.com/documentation/coreimage/ciimage/contentheadroom).
  Physical iOS remains unqualified: run `HDRColorTests`, `HDRImageTests`,
  `PickerColorTests` and `RasterColorTests` on a connected iPhone and require
  no declined assertion groups, skips or expected failures. Their colour
  fixtures live in `host/apple/tests/ExactKitTests/ColorFixtures` as regular
  files, copied into SwiftPM resources and loaded through `Bundle.module`.
  From the repository root, build the device archive and unsigned test bundle
  (the generic iOS build passed without a phone):

  ```sh
  export PATH=$HOME/.bun/bin:$HOME/.local/bin:$HOME/.cargo/bin:/opt/homebrew/bin:$PATH
  export DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
  SDKROOT="$(xcrun --sdk iphoneos --show-sdk-path)" \
  HOST_CXXFLAGS="-isysroot $(xcrun --sdk macosx --show-sdk-path)" \
  MACOSX_DEPLOYMENT_TARGET=14.0 IPHONEOS_DEPLOYMENT_TARGET=17.0 \
  EXACT_UPDATE_TRUST=development HERMES_LEAN_SYS_OFFLINE=1 \
    cargo rustc --crate-type staticlib --profile host-dev -p caltrain-apple --lib --target aarch64-apple-ios
  export EXACT_TESTS=1 EXACT_LIB=caltrain_apple
  export EXACT_LIB_DIR="$PWD/target/aarch64-apple-ios/host-dev"
  cd host/apple
  xcodebuild build-for-testing -scheme Exact -destination 'generic/platform=iOS' \
    -derivedDataPath ../../target/ios-hdr2/device-tests \
    CODE_SIGNING_ALLOWED=NO LIBRARY_SEARCH_PATHS="$EXACT_LIB_DIR"
  ```

  `xcodebuild test` cannot run these on a phone: a package's tests are
  tool-hosted, and Xcode refuses that on a device ("Tool-hosted testing is
  unavailable on device destinations", tried 2026-10-13 on an iPhone 17 Pro
  Max). Qualifying them needs a host app for the test bundle (as
  `host/apple/touches.mjs` makes for the UI tests), or a minimal app that runs
  the same ImageIO, Core Image and `CALayer.contentsFormat` probes and is
  launched with `xcrun devicectl device process launch --console` on an
  unlocked phone; a person at the phone is needed either way.
- **The date and place at launch on the remaining hosts** (2026-10-13): finish
  supplying launch facts before the first settle on Apple, including its content-region
  host, and in the web host's direct `Host::boot_stored` path. Linux's initial boot
  uses the display loop's clock zero; its validation, update and development candidates
  now boot with the current date and complete place, keeping the carried clock.
  The render host's date is already the Unix render timestamp passed to `boot_at`
  (LLP 1048.000 D5). It has no viewer place to supply; the page reports its own.
- **Gaps the Bluesky clone's workers hit** (bsky5, b28–b31, 2026-10-12), as reported:
  - **A JS-target refusal fails the web build only** (Linux; Charlie,
    2026-10-22, C and D). Make `bun exact.mjs contract build` run the JS
    emitter check for every app, including apps without `app.ts` + `app.json`
    and entries not named `app.contract` (`scripts/exact.mjs`, `checkTypes` /
    `typeDiagnostics`). Report emitter refusals as target refusals, not
    TypeScript errors on `app.ts`. Done when a refused row fails each of those
    build forms with a target diagnostic. Not taken: moving the `contract`
    binary to its own package (compiler dependence on the web host), or a
    refusal registry in `contract` (a second authority). 2026-10-24 (lane
    q24/dynamic-exit-js on 450b, parked after three fix rounds; the branch is
    kept there at 5664246094): `contract build` checks every plan with the
    emitter (`target-web-js` diagnostics at the row's source site via the
    map). Lessons for the next attempt: skip `--entry` widget plans (the
    emitter refuses them as WrongEntry; Shelf's widget build passes on main);
    keep the TypeScript check main's way (only `app.contract`, no `--entry`,
    compiled from source so `contract::check`'s bake refusals still fail it);
    pipe stdout only for `build` (`tamber serve --stdio` streams); run the
    emitter with `compilerCargo`'s pinned toolchain and keep kept.mjs's cache
    line off stdout under `--json`. 2026-10-27, a second
    attempt (branch q24/dynamic-exit-js2 on 450a, at 01897774af, parked after
    three more fix rounds) carries the first attempt's commits onto main.
  - **A press-scale change mid-pinch snaps the target to scale 1** (2026-10-27,
    Astra's review of the second dynamic-exit attempt; not rechecked since).
    A scale hold's mapping to `--exact-scale` is refreshed only by a gesture
    sample (`host/web/motion-glue.js` `cssProperty`), so a press-scale change
    committed mid-pinch snaps the target to scale 1 until the fingers move.
  - **Contract tests:** `back` reports "back refused" on a sheet over a sheet while the route does
    pop; a test can't fake a data source, or open a URL.
  - **Vocabulary:** no vertical scroll snap (the clone hand-built a pager); no direction hand-off
    between nested drags; no single-tap versus double-tap; no "native only" condition; a `text`
    can't hold an inline badge (already in Charlie's asks).
- **More gaps from the clone's workers** (bsky5, b32–b33, 2026-10-12), as reported:
  - Toasts have no warning style; a child component can't hold a resource; `agent` can't hold a
    fetch, so loading states can't be staged; no `exp` function; no hit slop.
- **macOS `scrollend` and trackpad momentum, unverified** (2026-10-13): `ScrollEndMac.swift` ends a
  live scroll at `NSScrollView.didEndLiveScrollNotification`, taken to come after the momentum
  (AppKit's 10.9 notes say it waits for an animation such as rubber banding, and do not name
  momentum); the tests post the notification themselves. Check with a real trackpad fling: one `scrollend`, after the coast.
- **Selected-document `readdir` and `mkdir` codes on native** (2026-10-13, from the
  compressImage review): since the Ibex refresh (f31c6e2ba), `readdir` and `mkdir` on a chosen
  *file* answer `PermissionDenied` (the prelude's `failed`) where they answered `ENOTDIR` and
  `EEXIST`, which the web still does (`vendor/ibex/crates/ibex2/src/stdlib/documents.rs`).
- **The kept-answer cap** (device; LLP 1027 D4; Charlie, 2026-10-22).
  Measure the launch read on a physical phone at the current 256 KiB per
  answer and 512 KiB total (`runner/src/runner/kept.rs`). Record the read
  time in D4. Raise the total toward 1 MiB only if a real app needs it and
  that phone's read stays about 3 ms or less. No per-resource `keep <size>`.
- **Darwin WebSocket close failures under load** (2026-10-16): ibex2's
  `the_darwin_transport_holds_the_whole_conversation`, whose body is `conversation()` in
  `vendor/ibex/crates/ibex2/src/transport/websocket_tests.rs`, failed 3/100 unmodified runs
  with 72 `nice -n 10 yes` workers. A second 100-run loop, with only the failed peer report
  printed, failed once with `/echo gone` instead of a Close report and twice with
  `Closed { code: 1006, reason: "" }` instead of the peer's 1000/`peer`. The current Darwin
  transport marks `closing` under its lock and accounts/discards the following send;
  its concurrent send/close admission-order regression passes. The earlier diagnosis of
  a message arriving before Close does not explain these failures. Investigate the missing
  Close and abnormal peer-close result before changing the assertions. Build with
  `cargo test --manifest-path vendor/ibex/crates/ibex2/Cargo.toml -p ibex2 --lib --no-run`,
  then loop the test binary with `--exact
  transport::darwin_websocket::tests::the_darwin_transport_holds_the_whole_conversation`.
  2026-10-22 (lane q1022/r): Parked pending dependency scope. Built the unmodified vendor ibex2 library tests and ran the exact Darwin conversation test 100 times: 99 passed, 1 failed at websocket_tests.rs:516 (the missing-Close peer report). No extra load workers were started and no assertion was weakened. The platform receive callback can publish an error before didClose, whose code/reason currently are 
- **Reported iOS hit-testing under a positioned sibling; repro still needed** (bsky5, Bluesky clone
  b28 on 57ab536e3, 2026-10-12): the profile avatar (`position="absolute"`, `profile.contract`
  before clone 1be739e) remained visible, but `agent ios` refused its tap with "node #983 covers
  its middle"; `z-index=1` worked around it. The reported disagreement with the web is unconfirmed.
  On 2ba30e401 (2026-10-13), a small Contract fixture's absolute avatar, exposed info column and
  child each received their taps on Chrome, macOS and iOS. Native buttons, a flat leaf and a
  clipped parent with a shadow also agreed. Adding a positioned descendant to the later column
  raised it by LLP 1083.000's isolation rule on all three hosts: a transparent column left the
  avatar visible but took the tap there, and Chrome and iOS both refused the avatar tap as covered.
  Recover the original distinguishing shape before changing UIKit's hit order.
- **The root's bottom bar during an interactive zoom dismissal** (bsky5, b28): while UIKit's zoom
  (`ModalIOS.swift`, `preferredTransition = .zoom`) is dragged back, the view underneath has no
  tab bar, and it appears when the dismissal ends. Likely the fullscreen presentation's presenting
  view without the `UITabBarController`'s bar, or the bar's visibility following the route stack,
  which still has the photo on top until UIKit finishes.
  2026-10-22 (lane q1022/c2): the retained tabbed fullscreen-zoom fixture enters a real interactive dismissal (vertical 250-pt drag) and its capture shows the presented card covering the bar's place, the bar visible after completion; this does not separate a missing bar from ordinary occlusion.
- **The web JS target's build-time answer at a store holding secrets** (LLP 1027 D4,
  approved 2026-10-10): the Rust runner shows a store reader's declared `else` placeholder
  instead of the bake's empty-store answer when the store holds a granted secret and the
  source is not ready; `rt.js` still shows the build-time answer until its Rust module
  loads. It learns a store reader only from an answer (`ans.store`), so it needs the
  plan's reader marker emitted first.
- **The sky's capture on the phone** landed at the display's rate 2026-08-30 (LLP 1008
  §9): a shadow layer tree rendered by `CARenderer`, a nested canvas's readback cached,
  the texture handed to the module as it is (`gpu_texture_metal`, `gpu_sync`) — 119 fps
  on average scrolling with the sky on, a capture 7.1 ms, from 42–64 fps and 20–25 ms.
  Left: the deck's 48 per-child textures still cross as bytes (a `gpu_child_metal`
  would spare ~30 ms when the deck opens); the macOS presenter still captures on the
  CPU (`cacheDisplay`, 5–18 ms at 2×) — the same `Shadow` would serve it; the
  cross-queue wait (`gpu_sync`, ~3 ms of the 7.1) could be a shared Metal event if
  wgpu exposed one. Tried and declined on the way: capture at 2× (slower), `CARenderer`
  on the live overlay (crashes — a layer is in one tree only), `drawHierarchy` (no gain).
  2026-10-23 (lane q1022/u): Parked outside the assigned scope; physical performance qualification also owed. No source change. GPU module binding and child capture now live in Sources/ExactSurfaces, not ExactKit. gpu_child_metal requires both that binding and a gpu/ ABI/implementation change. macOS capture replacement requires ExactSurfaces' capture executor plus an AppKit shadow implementation. The shared Metal-event wait also requires wgpu in
- **Canvas children** → LLP 1014 (RFC, Accepted) — built 2026-08-29, LLP 1014.000
  transcribes it: kernel, corpus, the web wrapper, the macOS overlay and capture with
  D4's four sources, the smoke's steps 6a, 9, and 10 with the readback fixture (native:
  `caltrain-gpu` `tests/children.rs`; per host: `scripts/fixtures/canvas-sky.*.png`,
  cross-host mean 1.48/255 as measured — a first number for 1009 §4.1); the line map's
  stations as children (the second use); the render tail measured and closed (0.5 ms
  steady; occluded windows now skip rendering); Accepted 2026-08-29, the §5 take applied
  (the three gradient rows are out — 1009's proposal for the same door). 2026-08-30:
  the app inside the sky (glass/ink/crt materials, the previous-children crossfade,
  nested canvases by readback) and D5 built — per-child textures, placements with
  depth, hit-testing and accessibility through them, the card deck (LLP 1014.000 §1a,
  §1b); two code reviews folded the same day (§1c: placements are the only place a
  placed child is; `clock`/`tap`/`type` settle the canvases before replying; a resize
  shows at once; the ABI checks its pointers). Left: Chrome's flag as the oracle for
  children *through* a surface; a hermetic test of the glass crossfade; LLP 1013 on
  this machinery. Delete this line then.

- **Menus** → LLP 1021 (RFC, Draft 2026-08-30): the Popover API by its HTML names
  (`popover`, `popovertarget`, `id`, `aria-checked`, `hr`), open state host state like
  scroll, the top layer outside every canvas capture; a menu-shaped popover may present
  as UIMenu/NSMenu with selection dispatching by view id, kernel-painted under
  `EXACT_AGENT`. First consumer: Weird Castle's account switcher (today a hand-rolled
  overlay with no light dismiss). M1 web+kernel · M2 Apple/Linux · M3 the switcher.
  Messages Add now preserves focus; its rich native attachment popover remains owed.
  Three UIKit probes stop short of keyboard-overlaid painting; matching the box
  alone passed falsely (`/tmp/messages-attachment-menu/probe/`, LLP 1021 D2).
- The untested-but-built list in LLP 1010 §5: horizontal scroll on macOS, `overflow:
  hidden` on the web, `hidden`/`visible` on a `ScrollView` on macOS — each a fixture.

## Declared gaps, by system (each spec's "Not in v1")

- **Kernel / layout** (LLP 1001, 1010): `position: fixed`; `text_align: start`;
  presentation transforms in scrollable overflow; `overscroll-behavior`;
  `scroll-snap-stop` and proximity (not admitted); AppKit and Linux desktop snapping;
  Android snapping; Linux scroll events.
- **Durable state** (LLP 1018 §5, built 2026-08-30 for Weird Castle's token): the
  `plain` tier — persisted slots, with Caltrain's "last station"; `me`; the iOS
  first-launch keychain wipe; the data-protection keychain on macOS (a bundle and a
  profile); the Linux file store when that host links ibex2.
- **Plan / runner** (LLP 1005 §8): per-instance derives or resources inside `each`.
- **Contract** (LLP 1006 §8): inlining budget; `contract` blocks as assertions;
  `cursor`; per-instance state; LSP.
- **Web host** (LLP 1007 §9): a text-measurement bridge (the kernel's layout does not
  run on the web — and only grid has a kernel-against-browser layout check,
  `host/web-js/conformance/grid.contract` with `--linux`; a general layout parity
  corpus would be the analog of `parity.mjs`); scroll position across a reload; a
  spring interrupted by an easing.
- **Apple host** (LLP 1008 §7): images; toggles; accessibility beyond `testId`,
  `accessibilityLabel` and macOS's button/link/image/heading roles (iOS has no
  image or header trait); justified text; rubber-banding on inner
  scroll nodes; a generated header. **iOS** (LLP 1008 §9): the agent API on a
  phone (`build.mjs --device --run` installs over USB or Wi-Fi, but nothing drives
  the app there); a
  synthesized touch for the agent's `tap` (UIKit's hit-test and the responder-chain
  rule today); a pan chaining out of a nested scroll view at its edge (UIKit's own;
  the agent's wheel chains).
- **The keyboard's blink on a field hand-off** (iOS): UIKit rebuilds the accessory bar
  when first responder moves between two `UITextField`s — one bar-less frame (308 →
  335), reproduced in a from-scratch two-field app with any traits and by re-traiting
  one field in place; a phone shows it faintly. Safari does not, so WebKit hides it
  somewhere below the responder (its `UITextInput`-conforming content view and its own
  input-assistant handling). Worth finding out how, if a form ever needs it gone
  (LLP 1008 §9).
- **Linux host** (LLP 1015 §7): evdev has carried no real event yet; `canvas`; libinput and
  xkbcommon (acceleration, touchpad gestures, hotplug, non-US keymaps); Wayland/X11
  windows; selection, IME, a caret blink; `text_decoration`, `font_family`, RTL;
  shadows, gradients, grid; JPEG, image URLs; accessibility; a font cache; text pixel
  fixtures against Chrome (the Linux tests pin a font, `host/linux/tests/pinned/`; Chrome draws the system's).
- **GPU** (LLP 1009 §4): readback bands for blending and MSAA; a generated module ABI
  once there is a second consumer; the `Custom(u16)` animatable-property extension
  when a surface needs it.

## Later

- **Shared elements, stage 2** (LLP 1013.000 §3; moved here 2026-10-19 as the take
  for LLP 1020 §11's iframe host updates, `rules/DEFERRED.md`; stage 1 built
  2026-10-04: the `sharedElement` attribute, live native flights on iOS/macOS, CSS
  View Transitions on the web's JS target, `apps/shared-elements`). Waits for a named
  consumer: velocity carried into a flight (a release's, an interrupted flight's: Q5),
  drag-to-dismiss handing a hold to the flight back, a name as the zoom's source
  (`navigationSource`), flights on Linux and on the wasm web target, and a prop
  changed on a live node pairing.

- **Web view rows: memory against SwiftUI** (2026-09-28, LLP 1020 §10, LLP 1068 §5.2; moved here 2026-10-23 as the take for LLP 1020.002, the browser shell, `rules/DEFERRED.md`). The feed's web view rows now tie SwiftUI on the iPhone (97.6 against 97.4 fps) and beat it on the iPad (100.5 against 95.8). Footprint is still higher: 70–76 MB against SwiftUI's 38–44 on the iPhone, 61–82 against 43–50 on the iPad. The two oddities are noise. Per-run peaks on the iPad are bimodal (about 62 or 81 MB) with and without near-only leaves, so the medians of three moved with the draw. System Trace's WebContent launch counts vary by ±100 between runs of one build (SwiftUI 290 and 479). A leaf, once made, stays until its row retires two viewports away, so it cannot churn at the quarter-viewport margin. Where the extra ~30 MB lives (the app's WebKit proxies, the text rasters, the pool) is unmeasured.

- **A followed end resolved by the host (deferred, 2026-10-05).** The
  proposal on `ide/doc/followed-end-one-target`
  (`issues/20261005-one-target-for-a-followed-end.md`): the correction names
  the end, and the host fits the extent with its own laid-out rows. LLP 1010
  §6.8's 2026-10-05 note does the cheap half instead: the measured row
  arrives 0.5 to 4 ms after the estimate, so a target before the motion's
  first frame is its one target. Take this up only if a measured report
  round trip is ever longer than a frame. Against it: a wire change on every
  host, and the extent with two sources of truth, so a later runner extent
  that disagrees (f32 rounding, a row whose measurement a cross-size check
  skipped) moves `contentSize` again at the end.

- **Chrome conformance steps for Paste and Match Style and for a clipboard event with nothing focused** (2026-10-21, PR #901; moved here 2026-10-23 as the take for LLP 1133.006's clipboard `write`, `rules/DEFERRED.md`). The driver's `type <id> paste` dispatches a synthetic `ClipboardEvent` at the focus or the target, so it never reaches `<body>`, and it has no Paste and Match Style; both were checked by hand in Chrome over CDP (`Input.dispatchKeyEvent` with `commands: ["paste"]` and `["pasteAndMatchStyle"]`). A driver operation for an edit command, sent as CDP's `commands`, would let `host/web-js/conformance` hold them.

- The serial runtime owner + env()/keyboard lane is parked on `parked/runtime-owner`
  (2583be3, base 17350d0 — pre-fonts) and the main worktree is clean of it. LLP 1022
  holds the measurements (fails the macOS smoke ~6 of 8; macOS boot +26 ms for a
  shell frame; iOS −27 ms from the prepare overlap), the four cherry-picks worth
  taking without the owner thread, and the conditions for reviving it. A revival
  rebases across 43b0c0c and lands only through a green smoke.

- LLP 1023 Stage 1 leftovers, each small: the physical-iPhone typed-URL run (the
  phone was asleep on landing day — `bun host/apple/build.mjs --device --run`, then
  4-finger tap → Open Project… → the LAN URL dev.mjs printed; ATS and signing already
  proven on the built bundle); a native pre-download `kernelSchema` compare (needs the client's own digest exported —
  the runner's boot gate catches a mismatch only after the download); `metrics.mjs`
  rows for cold URL→first-frame and hot seq→first-frame over the LAN (diagnostic,
  never a sixth check).

- LLP 1024 (native modules) landed 2026-09-27 (§9). Unverified: an iPhone device run
  of a module artifact (AMFI, team signature), a plan reload on Apple hosts, and the
  photo editor's trackpad (macOS) and UIKit (iOS) gestures, which the agent cannot
  yet deliver there (the iOS carrier's contact needs Accessibility permission).

- **A phone's dev loop beyond the LAN** (LLP 1026 §10 Q5; Charlie,
  2026-10-22). LLP 1026 is a record overtaken by LLP 1029.000 and LLP 1030;
  its trades and questions no longer wait on Charlie. Integrate the existing
  pairing model (`scripts/tamber-pairing.mjs`, `tamber-remote.mjs` and the
  canvas gateway) with phone dev-loop loading: scoped, revocable tokens over
  TLS; a QR may carry a one-time pairing grant. Nothing is built for that
  integration. Done when a paired phone loads beyond the LAN and revoked,
  expired and out-of-scope tokens are refused; no bearer capability URL.
- **The launcher's Keychain admission** (LLP 1026 §10 Q3; Charlie,
  2026-10-22). When the launcher is built (LLP 1026 §9 stage 5), refuse
  `secret.keep` unconditionally. Done when an app requesting that grant is
  refused before loading; only its own dev client and release binary may
  admit it.
  2026-10-23 (lane q1022/aa): Commit `4afc324be1`. Parked. `exact launcher` exits 2: `no verb launcher`. The stage-5 launcher prerequisite remains unmet. No launcher or change to an app binary's own Keychain admission is introduced. Log: `/tmp/q1022-aa-1336-launcher.log`.

- Messages native ownership: authored `inert` now reaches the compiler and real DOM attribute; iOS subtree input/focus/accessibility, preserved geometry/drafts and restoration pass. Native confirmation now escapes inert ancestors and survives its invoker becoming inert; iOS/browser cases and four Messages cases per host pass. The third/final browser candidate passes explicit focus and inspection inside escaped modal dialogs, single confirmation dispatch, basic/active-route input exclusion and four rebuilt Messages cases. Forty browser identity/frame observations remain unchanged. AppKit/Linux, wider VoiceOver/IME/drag cases and implicit modal-inertness reporting remain (LLP 1035.001 D3; `/tmp/messages-inert-ownership/verification.json`). Back lookup now stays within the selected route; native pop/sheet permission and browser Escape checks pass, including refusal with retained sheet editing (`/tmp/messages-back-owner/`, LLP 1035.001 D1). Completed-sheet cleanup now releases the old modal-navigation slot after UIKit returns; retained/replacement routes and mid-gesture permission changes pass six physical cases (`/tmp/messages-dismissal-owner/`). Revocation after native commitment re-presents the selected route with its keyboard closed; continuous editing through that outcome remains unestablished. Unmount/destruction during a physical sheet drag now retire native owners without cancelling retained Compose; offscreen route replacement and queued focus survive remount (`/tmp/messages-unmounted-owner/`). Moving to a different UIKit controller in the same window now passes, including transfer during a physical sheet drag and queued focus after offscreen route replacement (`/tmp/messages-reparent-owner/`). Fullscreen/source ownership is now implemented under the approved LLP 1035.001 Messages exception; exact motion matching remains. A fresh native recording shows details zooming from the contact photo; a public UIKit over-full-screen zoom plus nested page sheet reproduces bar y=88 / field y=416 and passes cancellation, permission, completion and missing-source Back (`/tmp/messages-presentation-ancestry/`). R4/R5 pass the Messages flow, ten physical ownership cases, source replacement, nested teardown/reload and browser Escape (`/tmp/messages-fullscreen/`); one authorized continuation attempt remains unused.

- Messages symbols (1035.004): twelve schema-generated roles now render through native image leaves and browser masks; Messages has 19 symbol occurrences, and Fieldnotes uses Add/Close. Copy, Select and More now use native 17/400 images matching the reference’s intrinsic sizes; six physical icon taps and six browser actions pass with unchanged action frames and retained drafts. Reference-mask overlap improves, but exact raster alignment and Reply artwork remain open (`/tmp/messages-action-symbols/verification.json`). iOS physical controls and both apps’ web controls pass; natural/fixed/live-source fixtures pass on Apple/web. Finish pinned Messages glyph sizing/weight and VoiceOver comparison, material support reporting, and AppKit pixels (its current captures are transparent). Linux symbols remain unsupported (`/tmp/messages-symbol-integration/verification.json`). A stock-glass-button prototype passes eight physical actions and supplies native foreground treatment, but its Close raster error is worse than production; three calibration rounds stopped, no projection landed. Resolve that rendering difference before extending the native control boundary (`/tmp/messages-glass-button-candidate/verification.json`).
- Messages inbox gestures: finish trailing full-swipe confirmation, recovery styling/filter coverage, exact glyph size/artwork and transition comparison. Recently Deleted now archives individual/whole-thread deletions and provides local recovery/permanent deletion through the existing menu and confirmation owners; data order/reaction/reply retention and browser/iOS activation pass, but ordinary native return to Messages fails with a loading menu after recovery (`/tmp/messages-recovery/`). The three-candidate application loop is stopped; the source remains an incomplete candidate. Recover’s native default action remains black/gray rather than the reference’s blue; the browser selection outline and agent-mode ordinary-menu presentation also remain mismatched. Native partial and full deletion both ask first and cancel on outside tap; a public UIAlertController fixture proves deferred swipe completion/cancellation but differs in anchoring. Three presentation rounds stopped (the third failed compilation; its captures ran the preceding binary), preserved at `/tmp/messages-thread-deletion/`. No confirmation change landed. Explicit UIKit swipe rows now pass leading full Read/Unread, reversal, partial actions, Mute/Unmute, Delete, row switching, first-tap dismissal, draft/history retention and parent vertical scrolling (`/tmp/messages-swipe-activation/`). Callback eligibility follows the original authored ancestors, excluding UIKit’s temporarily disabled cell. Native action inspection and agent activation pass; the browser retains its authored controls. First-child scale/rotation capture and the pinned light/dark action colors are corrected (`/tmp/messages-swipe-glyphs/`); exact symbol paths remain owed. Open actions still retain their earlier appearance: two adaptive-image attempts passed action checks but corrupted surrounding avatar lettering and were removed at the repair limit. The ordinary light-to-dark control has pixel-identical surrounding rows with and without icon scaling; that comparison clears the scale change, not the adaptive experiment. Isolate the rendering failure before another adaptive capture attempt. Named inbox controls now retain their accessibility names and activation through native swipe cells; public activation and stale filtered-cell refusal pass, alongside eight physical swipe cases (`/tmp/messages-swipe-accessibility/verification.json`). Full VoiceOver interaction remains unverified. Real iOS gesture input still uses the temporary foreground-guarded helper.

- Apple baseline precision: the kernel preserves fractional frames and `TextEngine` preserves authored fractional line heights, but intrinsic widths, normal paragraph heights and painted baselines still round to logical points. A same-font iOS 26.5 UILabel/CoreText/WebKit fixture found that removing that rounding improves some native labels but does not consistently match either UIKit or WebKit. Resolve line-box/baseline placement with a targeted comparison before changing painting globally; Removing all measurement ceilings changed Caltrain’s established scroll extent and canvas readback; investigate those intrinsic metrics separately. Authored line-height precision alone does not establish glyph fidelity.
  2026-10-22 (lane q1022/o): Parked after measuring intrinsic widths and fixing UIKit’s painted baseline precision. Commits: `2bc90338bd`, `3b329104b7`, `b21e0790e4`. Six intrinsic widths match WebKit’s fractions; Exact already preserves 1/64-point width precision and an authored 21.25-point line height. The rendered comparison found 13, 16 and 17 pt glyphs one pixel too high at 3x. Device-pixel baselines now match UILabel’s first ink row at 2x/3x and its complete tested ink spans at 3x. Two 2x descender

- **Continuous release loop: signed publication time** (LLP 1030.003 §6 Q1;
  Charlie, 2026-10-22). Keep `defaultRelease`'s `r-<iso>-<sha7>-<nonce>`.
  Add `published` to the signed head, carry it through `update/` and
  `runner/src/delivery.rs`, and show it on D3's version screen, Caltrain first.
  Done when the screen shows the verified head's time and tampering refuses
  the head. Prove one hosted Interview release on the directory origin or
  AppDrop; D6a install pages and D6b local development installs are built.
- **Continuous release loop: bundle-only deploy rows** (LLP 1030.003 §6 Q2;
  Charlie, 2026-10-22). Make `scripts/deploy.mjs` classify against a signed
  head's cohort using `push.mjs`'s path. Done when a Linux publisher updates
  an existing iOS stream without an Apple bake and reports a binary change
  as needing a binary. AppDrop is the remote tester-install lane; TestFlight
  is later. EAS Hosting is dropped; EAS as builder waits for a Mac-less publisher.

- Native development URL latency: Charlie observes about one second for Update Lab Contract edits on the physical iPhone while localhost clients update almost immediately (2026-09-14). Notification already uses SSE. `PlanURL` now fetches up to four verified payloads concurrently after the envelope; it still creates a fresh URLSession per fetch and refetches unchanged payloads. A physical-phone sample measured envelope 56.5 ms, payload fetches 1,347.8 ms, and prepare/commit 32.1 ms (`target/update-lab-phone-timing.json`). Payload fetching dominates this sample; isolate connection setup versus transfer, then consider a shared session and verified reuse by digest. Preserve byte limits, complete-generation validation and failed-candidate retention.

- Update completion event (Charlie, 2026-09-14): expose one app lifecycle notification after an admitted generation commits and its executors are ready, covering Contract, TypeScript and Rust. Include which artifact digests changed; refused/superseded candidates emit nothing, and initialization stays after first pixel. Update Lab now uses its existing 250 ms task to show executed probe versions automatically; an event would remove that sampling delay without making real apps poll. Define the shared Contract lifecycle hook before adding separate host callbacks.
  2026-10-23 (lane q1022/t, Apple side): Parked: the entry requires the shared Contract lifecycle hook before separate host callbacks. That hook belongs to Contract/plan/runner, outside this lane. No source commit and no lifecycle event claimed. Fleet must define one admitted-generation notification with changed artifact digests, no refused/superseded notifications, and initialization after first pixel; Apple, web and Linux should consume that same hook at 

- Rust replacement latency follow-up (2026-09-14, LLP 1029.000): native image preparation now runs off the UI thread and the bake helper stays resident. Six Rust edit/restore cycles reached web, macOS, simulator and iPhone with carried state; three distinct new libraries took 2.6–4.6 s save-to-observed, with macOS probe round trips ≤48 ms. First executable launches can still wait on macOS assessment (including the filesystem helper at dev-server startup). Measure the remaining compiler/producer overhead toward the subsecond warm-edit target; the 20-edit timing and 50-replacement retention probes remain owed. Evidence: `target/update-lab-distinct-repeat-result.json`, `target/update-lab-baker-reuse-check.log`. Later normal-app preparation took 17.6 s behind a ~31 s load. Isolated real-library loads reproduced 70.7 s ad-hoc and 39.1 s development-signed inside `dlopen`, versus <1 ms write/sync in the ad-hoc case. Gatekeeper assessment and concurrent 30 s `syspolicyd` QUIC timeouts are recorded in `target/native-bottleneck-security.log`; loader stage diagnostics now separate queue/write/sync/load. Signing alone is not a fix. The opt-in stateless `tiered` executor now runs the new Wasm while native mapping proceeds, then promotes without a second reload (LLP §4.1); this leaves the OS loading cause and producer timing as follow-ups. A fresh Rust save in the Launch Services app then published in 2.93 s but spent 103.9 s in `dlopen`; the main thread stayed in its event loop. Restore preparation reused the mapping in 19.8 ms, with a separate 36.2 s producer/publication delay still to attribute. The tiered live proof subsequently passed with state/TS retained: 25 ms candidate preparation on two saves, plus 36 ms preparation while a normal-app native load took 54.3 s. Web/simulator/iPhone save-and-restore also passed; the earlier JS-engine-not-loaded diagnostic did not recur in the native traces (`target/update-lab-tiered-result.json`, `target/update-lab-tiered-cross-host-result.json`). Cold helper launches and shared Cargo locks still made initial builds take minutes; this is separate from tiered activation.

- Interview router row 4 (LLP 1038 F10): seed an isolated agent-mode replica for the own-data/scroll swipe drive; first finish the static fixture’s held swipes with Simulator unobscured (other desktop apps blocked contact).
- Interview iPad-wide iOS (LLP 1038): drive the rail on a real wide simulator viewport; the iPhone agent ignores `--size` and reports 402 × 874 for both requested sizes.
  2026-10-23 (lane q1022/v): Parked: Interview's source is absent. Asked for its checkout location; no location supplied yet. Listed existing iPads read-only: 0B0A552D-3B11-42C4-9F8D-251805136B61 is the 13-inch iPad Pro (M5), currently shut down. Did not boot or alter another simulator. No wide-rail qualification or source change.
- Interview backend list arguments (LLP 1038): let `/state` accept question/person/post ID lists and return every stacked record; the pre-replica path currently sends only each list’s first ID.

- **Re-measure VideoArm's position read with many autoplaying videos** (2026-10-09; moved here 2026-10-23 as the take for LLP 1133.003's video decode, `rules/DEFERRED.md`): VideoArm reads `currentTime` from the item's timebase instead of `-[AVPlayer currentTime]`, landed unmeasured from the Bluesky clone's round-1 `sample` (main in `VideoArm.send` → `-[AVPlayerItem currentTime]` waiting on a MediaToolbox lock, about 124 ms in 3 s of a Discover fling, gone with autoplay off). Neither today's Discover nor bsky4's 48-video fixture (`measure.py --feed-fixture videos`) reproduced it: 12 ms of VideoArm work on main in 30 s, no `currentTime` samples. Re-measure on a feed where many players autoplay at once, ideally on a phone, comparing Time Profiler samples under `VideoArm.send`.
  2026-10-23 (lane q1022/s): Parked. No source change or commit. Temporary simulator apps compiled the production VideoArm and NowPlaying sources with sixteen visible looping autoplay players, changing only the position API and adding timing around its read. The initial timebase run reports 16 playing, no errors, 112 reads: 0.182 ms total, p50 1.42 us, p99 5.58 us, max 0.00567 ms. That run omitted exactListeners, so it measures startup/loop repo

# Graceful-overload consumers (2026-09-16)

LLP 1041 starts `messages-stress` and `completion-storm` as opt-in synthetic
workloads. Next: compare idle/loaded interaction samples on a real 120 Hz device,
then implement bounded completion pumping and admission/fairness where measured.
Keep module placement under LLP 1027.002; automatic windowing/image pressure and
physical-display native sweeps remain follow-ups; the first slice drives AppKit
and the Linux headless CPU renderer without claiming display frame timing.

- Linux textflow follow-up (LLP 1043.000 M3): carry resolved exclusions in immutable content-region worker requests and their accepted artifact identity. Ordinary definite-height text now flows; the opt-in content-region publication still owns its original unflowed geometry. Linux has no native text-selection UI, decoration painter or inline-link hit geometry yet; future consumers must use the accepted paragraph's fragments and original run metadata. Add discretionary-hyphen ink and clamp ellipsis to the flowed path (M3 clips at the band cap); justify currently uses start.

- Apple textflow follow-up (LLP 1043.000 M4): the shared walker now paints native paragraphs on macOS/iOS. A resolved flowed leaf retires an opt-in opaque content-region raster and returns the whole registration to native views, until a new registration. Carry exclusions and fragment geometry through the worker artifact before retaining region rastering for moving shapes; the current fallback trades that worker scheduling for correct fresh ink.
  2026-10-23 (lane q1022/u): Parked on kernel/ExactCore changes outside the assigned scope. No source change. The kernel's RegionTextRequest.with_request passes exclusions: &[] (kernel/src/region.rs); the region collector does the same in region/state.rs. Worker artifacts have no fragment origins or band geometry. Carrying only host flow ops cannot qualify a publication: the kernel must stamp exclusions into the request before the worker compute

- Web textflow size review (LLP 1043.000 §6.2, M5): optimized textflow-web grew from the observed pre-M5 834,019 bytes to 905,398 bytes (+71,379), above the approximate 64 KB revisit threshold. Caltrain is currently 1,022,149 bytes; the orchestrator has the pre-program comparison. Review code/data size while preserving the ruling that the shared crate stays linked. Evidence: `target/textflow-scratch/m5/size-baseline.json`, `wasm-probe.json`.
- Public UI coverage (LLP 1035.006): select the first settings slice (labels, buttons, switches, checkboxes, radio groups, and text entry), choose each platform's disposition, then implement and hand-check the concrete examples. The ordered catalog distinguishes accepted support from reviewed deferrals; drafting it does not admit every excluded capability.

- Markdown origin integration validation (2026-09-18): the third full Rust test
  run passed 1,555 tests, with four failures and eight ignored. Height/transform
  hand-built plan tests still treat event tag 18 as unknown, but media now uses
  it for `loadedmetadata` (three failures); the Apple ownership fixture's Cargo
  project inherited the repository workspace because the diagnostic `TMPDIR`
  was inside this worktree (one failure). A separate Messages Linux bake lost
  its filesystem-helper reply after the preceding workspace build passed.
  Full-workspace repair is stopped at the three-round rule; native reader
  verification continues separately. Evidence: `target/markdown-comparison/
  origin-integration/workspace-round3-*` in the original checkout.

- Video (LLP 1042): verify PiP/AirPlay on physical devices. Linux carries an explicitly unavailable video box.

- Linux baseline failures found during dependency verification (2026-09-19): Hermes ICU `DateTimeFormat.formatToParts` returns timestamp text (same with old 6badada and new e3371863); Ibex loader-case fixture expects a case-insensitive filesystem. Repair separately from the dependency upgrade; current Linux full-workspace checks are not green.

- Shop Exact delivery sheet: content-to-sheet handoff needs continuous input/geometry measurement. Three iOS experiments (2026-09-20) matched short expansion/collapse but did not prove transfer, reversal or inertia; repeated source endpoint drags varied. They were preserved outside the repo and reverted to the staged baseline. Do not restart the same endpoint-fitting loop. Evidence: sibling shopify-exact/.evidence/content-handoff-experiments.json. Header coalesced-input admission remains repaired; Google Maps integration is separate.

- Every deploy recompiles its app crates (2026-09-23, deploy lane): their build
  scripts write the run's receipts into a per-run `EXACT_BAKE_OUTPUT` they watch, so
  an unchanged deploy still reruns them and recompiles `caltrain-web`, both
  `caltrain-apple`s and `caltrain-linux` with LTO; nothing else rebuilds, and a warm
  Caltrain deploy took 265–450 s at load ~25. A receipt directory per Cargo cache,
  copied into the run after the build, would let an unchanged deploy reuse them. The
  `exact-filesystem` helper also rebuilds inside each deploy's capture, where its tool
  target sits.
- Default deploys republish the web root (2026-09-24, deploy lane): two cold deploys
  of unchanged Caltrain left every native stream `current` but changed the
  `.exact/install/` pages, which carry their build time, and `app.wasm` and
  `gpu_bg.wasm`, which recorded the run's target path until 113abeaa remapped it.
  Browsers fetch the new root; native clients are unaffected. The Rust module build
  remaps only its target directory: an app outside this repo with a module (none
  yet) would also need the capture root its exact2 path dependencies arrive under
  remapped, as `wasmRemapFlags` does for web builds.
- **Other `fs.watch` consumers under Bun** (2026-09-23): on this Mac, Bun 1.4.2's `fs.watch` (file and recursive directory) delivered no event in 45 s while `watchFile` polling fired in 2 ms (oven-sh/bun#43870); a Contract save reached the update-lab page 10–40 s late or never. `watchModuleSources` in `host/web/dev.mjs` now polls at 100 ms as well. Still fs.watch-only: `rustOutputWatch` (the `current` pointer; the baker's reply covers the common case), the compiler-input directory watch at `dev.mjs` line ~863 (files there already poll), and `watchStaticTrees` in `serve.mjs` (asset, deck, and shader edits). Same fix or a shared poller.

- LLP 1024 §9 guardrails (Charlie, 2026-09-27): enforce the prop update size budget (a named refusal status) and flag per-frame prop churn in the journal. Neither is enforced yet.
  2026-10-23 (lane q1022/u): Parked. Commit cd3142c3b6 was withdrawn by git revert 266a861210 at the orchestrator's instruction. LLP 1024 §9 supplies no byte limit, and the web did not share the Apple refusal. The only aggregate sizes measured before the withdrawal were synthetic regression inputs: JSON.stringify({value: "é".repeat(32761) + "aa"}) is 65,536 UTF8 bytes; replacing that value with "é".repeat(32762) + "a" is 65,537 bytes. Bun TextEn

- **Playwright WebKit cannot launch on the Linux builder** (2026-10-02, cross-browser conformance): its complete missing-library set is `libevent-2.1.so.7`, `libopus.so.0`, `libwebpmux.so.3`, `libgtk-4.so.1`, `libgraphene-1.0.so.0`, `libgstallocators-1.0.so.0`, `libgstapp-1.0.so.0`, `libgstpbutils-1.0.so.0`, `libgstaudio-1.0.so.0`, `libgsttag-1.0.so.0`, `libgstvideo-1.0.so.0`, `libgstgl-1.0.so.0`, `libgstcodecparsers-1.0.so.0`, `libgstfft-1.0.so.0`, `libflite.so.1`, `libflite_usenglish.so.1`, `libflite_cmu_grapheme_lang.so.1`, `libflite_cmu_grapheme_lex.so.1`, `libflite_cmu_indic_lang.so.1`, `libflite_cmu_indic_lex.so.1`, `libflite_cmulex.so.1`, `libflite_cmu_time_awb.so.1`, `libflite_cmu_us_awb.so.1`, `libflite_cmu_us_kal16.so.1`, `libflite_cmu_us_kal.so.1`, `libflite_cmu_us_rms.so.1`, `libflite_cmu_us_slt.so.1`, `libavif.so.16`, `libharfbuzz-icu.so.0`, `libwayland-server.so.0`, `libmanette-0.2.so.0`, `libenchant-2.so.2`, `libhyphen.so.0`, `libsecret-1.so.0`, `libGLESv2.so.2`, and `libx264.so`. Install those host packages before enabling this engine on this builder; the Mac async lane is unaffected.

- **The two kanban conversions are not in their apps yet** (2026-10-04, LLP 1094 stage 3): converted copies and patches are the lane's (`kanban-1094.patch`, `kanban2-1094.patch`); kanban's also adds the module imports LLP 1091 asks for.
- **LLP 1097's parity fixture** (2026-10-04, impl/1097, §5). `host/web-js/conformance/storage-background` (a TypeScript source driven on the wasm target, the JS target and Linux, comparing journals and `state.background`) was not built: no TypeScript app with storage grants has a Linux host for `conform.mjs --linux`, and a fixture app with web and Linux crates would be new apparatus. The same steps were driven by hand on drums (JS target, wasm target, macOS): `state.background` and the journal's storage lines matched, the messages differing by host as the codes allow. Linux runs the module's background rounds in `host/linux/src/agent/tests.rs` over a scripted source.

- **A substituted pick on the Firefox and WebKit carriers arrives empty** (2026-10-08, found driving LLP 1069.002 A1 through a scratch app): `type @1 <file>` answers the held `showPicker` (`device pick 1 answered: 1 file` in the journal), but the input's `change` hands the action `[]` on `agent firefox` and `agent webkit`, where `agent web` (Chrome) hands it the `Picked` record. The Playwright carrier's file delivery (`scripts/agent-playwright.mjs`) is the place to look.

- **An answer's storage step whose 30 s wait runs out lets the queue move on while it may still land** (2026-10-08, Astra's code review of LLP 1069.002 A1): `__exact_storage_failed` (`js/src/prelude.js`) settles the head and issues the next operation for any operation; an awaited `atomicWriteFile` stalled in `sync` past the wait can then rename over a write queued behind it. A1 made this safe for `compressImage` only (its right to write is taken away); other writes keep `origin/main`'s behaviour. The answer's remaining queued operations are also left with no owner to deliver them.
- **The Mac's sidebar does not follow a state-driven change of the tab bar's placement while it shows** (2026-10-12, LLP 1115.002 D3). Whether the author left the bar's placement unsaid is the kernel's to read (`exact_root_tabs`), since `flex_direction` does not cross to the Apple presenter. The host asks again when the root's tabs change, when the root's or the tablist's props or style are written, and when the root's level moves (a resize). A root that turns from a column to a row with nothing moving, the tablist being covered, is not seen until then. The web's `unsaidBar` is as sticky once a root is a sidebar. One way: let `flex_direction` cross for a navigation root.
  2026-10-22 (lane q1022/r): Parked. Commit 9216a4f052 withdrawn by f5412dd5e3. Without the fix the placement assertions failed before resize. The new placement-only regression passes (1 test, 0 failures). Shown-window placement changes recurse through ExactView.fit/pending geometry, including real window recomposition. Three rounds (layout waits, real recomposition, notifying owners before geometry) faile
- **The web page as the document's scroller** (2026-10-12, LLP 1116.011 D3, cut in r2; recipe-finder, rounds 7 and 13: "Content scrolls in an inner container rather than the document"). A route's page-filling scroller could be the document's, so the address bar, find, keyboard scrolling and full-page capture behave as on any website; it ships only with fixed chrome staying fixed, LLP 1038's per-route offsets kept, the content box iOS has, push-at-top and Back restoration, split panes scrolling apart and a sheet's scroll isolated (LLP 1116.005 D3 chose per-route scrollers for those reasons).

- **Wave 9 EX4 — native/media and layout remainder (E4/E8)** (2026-10-12): `device: 'web'` now selects the wasm adapter beside an unrelated camera hatch. HTML capture awaits its governing admission (LLP 1114.002); document pickers need accept plus file_handlers. Reproduce lane 097's grouped-list layout on an Apple presenter; this Linux lane cannot establish native layout parity.
  2026-10-23 (lane q1022/v): Parked: lane 097's app/Contract and exact layout observation are not identified in the entry or this repository. The 2026-10-12 EX4 commit 687810df8e records the same Apple reproduction request without a source path. PickerAcceptIOSTests and GroupedCustomRowsIOSTests pass: 5 tests, 0 failures, 0 skips (/tmp/v-1582.xcresult). These tests qualify current picker selection and custom grouped-row layout, not the missing o

- **EX5 upload progress (2026-10-13):** the Snapback adapter's upload progress is indeterminate.
  Make it determinate with `fetch`'s `exactUploadProgress` (LLP 1016.000 D10), which tells an
  upload's bytes sent as they go on every host, `exactBodyFrom` included.

- **Grey box's game proof on Windows fails 3 checks** (2026-10-16; `issues/20261006-platform-specific-lane-coverage.md`): its Linux branches (`host === 'linux'`) leave Windows on the web's path, so it taps `world:player` through the presenter and expects `platform` delivery; then the continuation save differs from the pin, and the journal lacks `loop wind on`. Its `pins.json` names linux and web only.
- **Run the Linux host on KMS** (2026-10-16; `issues/20261006-platform-specific-lane-coverage.md`): the GMKtec M8 has the groups but no monitor, and gdm's greeter holds DRM master. A dummy HDMI/DP plug and gdm stopped (or a local VT login) would let `caltrain-linux` qualify first pixel, page flips, `EXACT_VNC=1` and evdev input reaching the app.
- **Remaining Linux test font dependencies** (2026-10-18): with an empty fontconfig directory, `cargo test -p exact-linux --lib --tests --no-fail-fast` still has 52 library and 7 `it` failures across text flow, paragraph paint, retained content and native fields. The emoji, accessibility and neutral tests now pass with fixtures. With only Noto Sans installed, `a_fingers_press_leaves_no_focus_ring_and_a_mouses_does` and `a_tap_that_drifts_inside_the_systems_slop_still_presses` panic because a role resolves without a session bound while several sessions are live; both also failed before the fixture changes.

- **EX8 pre-load mutation counter (2026-10-16, Muse round 3):** the web runtime
  increments the diagnostic mutation counter before refusing a send while its
  Rust module is not ready; a refused commit does not roll that counter back.
  Authored tests wait for activation and abort on that refusal, so their clock
  path is unaffected. Count only actual source asks if this counter becomes a
  general external metric; preserve the atomic-action refusal.

- **Android GPU presentation:** use SurfaceControl transactions to move and clip a world surface through page, sheet and IME transitions, where supported, instead of switching those compositions to hardware buffers. Keep the current full-window predicate as the fallback.
- **Verification suite transients** (2026-10-16): a combined run of
  `scripts/port-lock.test.mjs` and `scripts/verify.test.mjs` failed the
  server-app drive on a page-port bind and the new-app JSON report on exit
  status. Both named tests passed alone on EX9 and plain `416e4c782`;
  investigate contention before treating either observation as a product bug.
- **Android Canvas transitions still expose partially cleared UI regions** (2026-10-17, Pixel 5). The Android host now retries only owed windows, records direct eligibility after rendering, and copies the current SurfaceView image before changing composition. Missing interior regions remain: 67/2,181 analyzed frames on `09f82dc75`, 61/2,106 after the host fixes (35-second seven-phase recordings, first five seconds excluded; this is not a meaningful improvement). The cold baseline also aborted in `vendor/wgpu-hal/src/vulkan/swapchain/native.rs:415`, destroying an acquire semaphore still held by a SurfaceTexture; the warmed baseline completed. GPU lifetime and HWUI buffer ownership remain to investigate with the GPU lane; no GPU files or detach waiting changed here. Rotation and background restoration recover; the native alert dims the world and HUD together. Local evidence: `target/castle-fixhost/{baseline-warm,seven-final}.mp4`, `*-frames-pixels.json`, `*-frames-contact.png`, `before-full-logcat.txt`, `lifecycle-result.json`, and `alert-open.png`. With the module settling a canvas before buffers replace its window (castle-fixgpu2, `2c7f7c97f`), the same recording finds 67/2,079: no change. In it and the host lane's two the bad frames fall throughout the three buffered phases (80% width, opacity 0.5, corner radius; 4 to 18 a 2.2-second phase), not at the switches between SurfaceView and buffers, and the missing regions are rectangular blocks of the page background inside the world, as if the reader drew a buffer whose frame the GPU had not finished or had begun again. A lead: patch 8 enables `VK_EXT_queue_family_foreign`, but nothing releases a buffer's image to `VK_QUEUE_FAMILY_FOREIGN_EXT` after its frame, which Vulkan's rules for external memory ask for before another API reads the image; another is a reader drawing a slot after the ring has freed it. Evidence: `target/castle-fixgpu2/` in that lane's worktree (`seven.mp4`, `seven-frames-pixels.json`, `seven-frames-contact.png`).
- **A game's web build is GPU-bound at about half its native rate on a Pixel 5** (2026-10-17, the Castle Town port). Its WebGPU timers put a frame at 17–22 ms (forward pass 15–20 ms) in Android WebView 136 and Chrome 155, where the native build presents every 11.1 ms frame; the CPU side is about 5 ms. Time the native build's passes the same way and compare pass by pass (Dawn's robust buffer access, WGSL's lack of a forced early depth test, attachments that cannot be transient where the browser lacks `TRANSIENT_ATTACHMENT`, and no `shader-f16` in WebView 136 are candidates, none measured).

- Route Apple dev-client table-only generations to running GPU canvases, preserving world and tick; current whole-generation delivery resets surfaces (1127.001 D3).
  2026-10-22 (lane q1022/q): Parked on scope. No code change. A temporary GenerationAcceptanceTests probe booted headless.plan and reapplied the identical plan at a fixed 300×500 viewport. The existing view was replaced, incarnation 10 → 23; apply 6.884 ms; one test passed. Log /tmp/q-ios-1616-final.log; source target/q-ios-generation-probe.swift. This measures whole-generation replacement, not a GPU table swap or preservation of its world tick.

- **Edit-loop acceptance still open (LLP 1127.001):** D2's two-second check figure is unqualified; D4 remains gated on the scene-language ruling; D5's SDK seed is unpublished. None is a pass.
- **`line-clamp: auto`** (2026-10-17, LLP 1126.000 WP4). A hand-built widget's `Text(...).lineLimit(4)` under a `Spacer` shows as many lines as fit the height and ellipsizes the last; Exact's `line-clamp=4` shows four and overflows the widget at XXXL (the open-question fixture's title and summary, `target/wp4/out-ios/widget-medium-answered-fullColor-light-XXXL.png` against the baseline's). CSS Overflow 4's `line-clamp: auto` (Chrome 141) is the web's answer; the kernel lacks it.

- **The activity gallery's expanded leading width can preserve a label the Island truncates** (2026-10-19, LLP 1126.001 WP14). Caltrain's departure at Mountain View reports `Mountain View` in the gallery tree but `Mountain…` in SpringBoard's expanded element label on iPhone 17 Pro / iOS 27.0. Qualify the gallery's proposal against the system's region before extending the archive comparison beyond its Palo Alto fixture.
  2026-10-23 (lane q1022/s): Parked (system archive comparison); partial fix committed as 2fb7bb7e1b. Built the gallery variant successfully. Three system-archive attempts stopped before the activity could start: touch-runner install returned Mach error -308 (server died), Caltrain install found the simulator shutting down, then the final drive did not resolve its station-mountainview target. The final drive preserved pre-existing activities and
- **Two activities of one app show one at a time on the simulator** (2026-10-18, LLP 1126.001 WP10). With Caltrain's departure and service-alert activities both active, the extension rendered both (each from its own plan, `dev.exact.widgets` lines for both kinds in one process), but SpringBoard's Island and the Notification Center stack showed only the most recent one; ending it showed the other. Whether a device shows the second as the minimal view beside the first (the double Island) is WP15's device visual.

- **Notarize the granted helper** (2026-10-18, from issues/closed/20261009-macos-release-digest-entitlements.md): run the closed ticket's 2026-10-16 proof with a Developer ID Application identity and a notary profile, so a notarized bundle's granted helper gets `MAP_JIT` and the ungranted copy is refused. Until it passes, `docs/reference.md` claims no notarized support for helper exceptions.

- `perf <target> during` must carry a world incarnation and recording generation and refuse across remount or restore with equal counters (`scripts/agent-inspect.mjs`, `scripts/agent.mjs`).

- Game baseline D2 (LLP 1139.000): use one `gpu-dev` wasm with Off, Save and FreshGame reachable and call `Sim::paranoid` before every world's first tick. Keep release elimination through `option_env!`, require reported-mode/reconstruction evidence, and retain the Off-wasm-in-Save negative control. Completed continuous reuse measured 192 s total; raw hot-swap reuse and the latency oracle remain open.
- **A Rust module's held request can't cross the module seam yet** (2026-10-23, held requests, theme2's sign-off). `logic/abi/src/lib.rs` refuses a `Request::held()` answer ("a held request cannot cross the Rust module seam yet"), as it refuses a deadline, so a Rust data module loaded as a module (the web build, native module hosts) can't mark a long poll held; an in-process Rust source can. Fix: a held mark in the seam's HTTP result kinds (an additive tag, older hosts refusing it before any effect, as tag 6 did), decoded into `Request::held`, then the source's `Answer::Later(Request::get(url).held())` works across the seam on every host. Tests: the seam round trip, and the held drive (scripts/held-fixture.mjs) with a Rust source.
- **The Android reader's display turn can fire a timer already due at the frozen clock** (2026-10-22, held requests round 2, Grok). `CanvasHost::agent` runs `frame_held` after every request (`host/linux/src/canvas/agent.rs`). With the driver owning the clock, `frame_held` calls `Presenter::advance(now)` when a runner timer, a scroll end or a hatch `after` is due at that now (`host/linux/src/canvas.rs`). So a `state` read there, and `clock held`'s polls, can fire such a timer, which Linux stdio, Apple and the web hosts never do. It's rare: a timer due at the frozen now has usually fired at the clock step that reached it. Fix: no advance on a read-only request.
- **Android's `iframe` ignores `sandbox`** (2026-10-21, LLP 1020.002 §10). `host/android/canvas/src/main/java/dev/exact/canvas/Natives.kt:513-519,693-698` makes a `WebView` with `javaScriptEnabled` and `allowFileAccess` and calls `loadUrl(src)`; nothing reads `sandbox`, so a sandboxed frame runs unsandboxed there, the fail-open class LLP 1020 §3.3 removed on the other hosts. Refuse a sandboxed `iframe` on Android by name, or serve it as Apple's wrapper does.
- **The web's wasm host has no extension modules** (2026-10-24, motion stage 0, LLP 1133.013). Games run on it, and it binds no package implementation and answers no agent `prefer extension` or `prefer permission`; `state.pending` holds no module ticket (`host/web/glue.js`'s `prefer` case). Beacons' tilt therefore works on the web neither for a person nor under the agent, and `game/games/beacons/proof.mjs` skips its tilt leg there, so the leg is unpinned (§10 drive 6). The bridge would mirror `host/apple/src/midi.rs`'s `extension`, with a JS loader for `packages/*/web/index.js` as `host/web-js/modules.js` has; `glue.js` is at its cap, so it goes in a module of its own.
- **Qualify the motion screen-frame browser oracle on hardware** (2026-10-26). Headless Chromium 156.0.8078.4 maps a virtual device gravity `[1, 2, 9]` to `[2, -1, 9]` at an emulated screen angle of 90°. Applying that inverse rotation to Safari on iPhone 16 Pro reverses the physical screen axes. The existing vector matrix remains; compare a real Generic Sensor device and the emulator before using the virtual screen-frame sensor as its oracle.
- **Motion, what the canvas seam leaves** (2026-10-24, LLP 1133.013 §13, "The canvas seam"). The Apple and Android contexts feed a canvas, and Beacons walks by tilt with the real `Motion.kt` bound on an Android emulator. The iPhone drive confirmed reversed roll; D6 now negates screen-frame x, with regression coverage for both roll directions and unchanged pitch. Owed: a physical tilt check of the corrected build (`packages/motion/test/phone-checklist.md`, item 9); ending an input when its canvas unmounts (its samples now go to no canvas, logged once); the web JS target's canvas inputs (no JS-target app has a canvas world); `headphoneMotion` with its usage key; Android's `HIGH_SAMPLING_RATE_SENSORS` derived from a grant line (without it a faster frequency is asked at 200 Hz); and D9's Android options and its status's `android` (null).
- **Wire the module seam drives into a lane** (2026-10-23, LLP 1133.004). `contract/cli/tests/bell/seams.mjs` proves the module seam with a module outside the tree, and `packages/notifications/test/drive.mjs` the notifications package, in a browser and under the agent, but no check or lane runs them; the async lane could, beside `host/web-js/conform.mjs`.
- **A heartbeat in transit can release a signalled wait in the design tool tests** (2026-10-24, dt/dtt round 2, Astra; theme2: left open). After `clock +N real until <signal>`, `clock held changes` returns on the next reply the host lands; a 204 heartbeat the server sent before the event (a write, a frame's registration) but the host landed after the signal releases it, and the event comes on the next ask (at least a second later), so the drive reads state without it. Repro (Astra): the real `readLongPoll` and `heldClock` with the heartbeat's delivery held past the signal: `settled: true`, the event unapplied. Sites: design-tool-poll, -canvas, -scrub and -kinds; each failing expect names it (`HEARTBEAT_RACE`, design-tool-harness.mjs). It can only fail a test, never pass one. Fix: one more `clock held changes` after the signal at each site (one heartbeat each, 3 to 5 s); if it fires in any gate, close it then as a main-red fix.
- **Completion Storm's web smoke fails at navigate-away on Linux** (2026-10-24, q24/count-plural on 450b). `bun apps/completion-storm/smoke.mjs web` against `bun scripts/agent.mjs web --app completion-storm`'s server stops at `smoke.mjs`'s `pendingCount === 0` after `navigate-away`: 128 lanes are still pending (a copy of origin/main b8ebd199fe's smoke, run before any change, fails the same way; a one-lane run leaves 1). Not yet known whether the unmount fails to cancel the held requests or the smoke needs the desktop fixture server (`EXACT_STORM_WEB_URL`) it was written against; the README's web smoke (`apps/completion-storm/README.md`) is the place to start.
- **An iOS textarea's placeholder follows its scroll offset; typed text does not** (2026-10-24, padded-textarea placeholder, Astra). `TextArea.draw` (`host/apple/Sources/ExactKit/IOS/TextAreaIOS.swift`) places the placeholder from `bounds`, whose origin is the text view's `contentOffset`, while typed text starts at the text container's fixed origin; an empty, heavily padded textarea scrolled off zero draws its placeholder where no first line would be. Draw from the container's origin (`textContainerInset` with no `bounds.origin`).
- **An iOS textarea lays out its whole placeholder however little shows** (2026-10-24, same review). The placeholder is drawn with unbounded height and clipped by the view, so a very long one (millions of characters; an AppKit probe took about 225 ms against 15 ms bounded) costs its full layout each draw. Bound the height at the view's height less the top inset plus one line.
- **The web JS target's module substitute lacks three of LLP 1133.030 D12's forms** (2026-10-26; 2026-10-28). `host/web-js/modules.js` mirrors the runner's declared substitute, `update` and a list's `tap` choices included, and holds a send to its `checks`' `one`, `min` and `nonEmpty`, but not a permission's `requires`, an app-scoped list's `due` time, or the check that an instant option is `after` now (its clock is not the epoch's). A module that uses them on the web needs them first, with `contract-difftest` comparing the two.

- **Ink readback RSS peaks** (LLP 1149 S0 C5). Desktop peaks rise during the CPU pixel copy, after device and glyph setup, with or without `ps` sampling. Zeroed output allocation did not remove them. Reuse the presenter's CPU pixmap and the device's staging buffer, then repeat the C4 memory protocol; see `host/ink/MEASUREMENTS.md`.

- **Ink D3D11 readback cost** (LLP 1149 S0 C6). On the NucBox, 1920×1080 C4 scrolling takes 3.920 ms with D3D11 versus 2.718 ms with wgpu DX12; readback, including completion, takes 3.238 ms versus 1.632 ms. Profile staging, completion and copying before optimizing the headless path. DirectComposition avoids that readback in the window. See `host/ink/MEASUREMENTS.md`, “NucBox”.


- **Apple frame-health qualification (LLP 1079.000, 2026-10-28).** An iPhone 15 Pro on iOS 27.0.1 is connected; the minimal development app is installed and launched, with its running process verified. The minimal frame-health fixture and signed development/core/off builds are prepared locally. Use the phone when available and identify an above-120 Hz display. Run the independent presentation and observer off/on experiments, hidden/stationary/dragging overlay pairs, and energy/thermal checks. Callback/apply proxies and the debug scroll probe currently provide no presentation or battery certification. The card's own work in the app's frames has an opt-in benchmark (`FrameHealthCardCostIOSTests`, `EXACT_FRAME_HEALTH_BENCHMARK=1`) measured only on the simulator; run it and the overlay pairs on a phone over a full-window GPU canvas, a 60 Hz iPhone included, where the card's own work was 13 to 17 ms an update before it drew in bands and tiles (expo/exact#296).
- **Apple smoke mismatches before the frame-health rebase (2026-10-28).** On the original 15e54de3e1 base and iPhone Duo/iOS 27.1, both timing arms hold the stationary row at −125 pt, then release to about −77/−79 and settle at −73; two stationary-release assertions fail. On macOS 27.2, the canvas reference differs at 1.63% of pixels beyond the band (mean 1.64). Compare against the branch baseline before assigning a cause; focused frame-health and agent UI tests pass.

- **macOS live trackpad replay (LLP 1079.000, 2026-10-28).** Add a reliable completion acknowledgement for synthetic phased wheels before admitting them under platform timing. Immediate layout reads exposed zero or partial motion; posting the later phases first did not resolve it. The carrier currently refuses with `platform-trackpad-replay-unqualified`; ordinary wheels and frozen-clock functional replay remain available.
- **A minimized frame-health card (LLP 1079.000 §7.2).** The card is opaque and takes the touches within its bounds, so on a phone it covers over a third of the app. A minimized form, resting in its corner as the card does, would leave the app usable while it watches.
- **Frame-health publication from the hook (LLP 1079.000 §5.1).** `FrameHealth.record` and `landed` call `FrameHealthPublication.request`, which at most twice a second schedules a run-loop block and wakes the loop; Core Foundation copies the block, allocates and locks. An expiring agent lease also removes observers there. Move both out of the hook onto an existing pass, leaving it a flag.
- **Late work that lands unchanged leaves no hitch (LLP 1079.000 §1).** A frame whose owner batch changes nothing is never applied, so when it finishes late it counts as a late frame but the detail ring records no apply-deadline event. Record the late frame's start, deadline and landing as an event of its own.

- **NucBox: qualify an AMD overlay diagnostic if the paint crash recurs**
  (LLP 1149.001 Stage 1w). The retained wgpu paint crash is an execution
  access violation in `amdihk64.dll_unloaded` 2.0.0.1788 at `0x648d`;
  a post-reboot module inventory finds the hook in many desktop processes.
  G7's single isolated rerun passes 56 tests with the hook loaded in the arm
  and pinned process, and captures no new fault. If it recurs, test disabling
  the overlay through [AMD Software's Preferences](https://www.amd.com/en/resources/support-articles/faqs/DH3-001.html), verify whether
  the hook leaves newly launched arms, then requalify paint. This is a
  proposed machine remedy, not a demonstrated fix. Keep the later
  sleep/wake hang separate: chunk A reached `shelf_sleep_wake` at 18:39:46,
  after the 18:32 paint crash, and the next boot's Kernel-Power 41 reports
  `SleepInProgress=5`, `BugcheckCode=0`. Retain both investigations.
- **G7c Windows displayed cadence needs a working PresentMon capture**
  (2026-11-01, LLP 1149.001). A visible PowerShell task resolves foreground
  acquisition with the unchanged driver. The post-readiness captures still
  lose ETW events and produce no CSV, on D3D11 and egui as well as Ink/wgpu.
  Establish zero-loss captures before reporting 120 Hz fling cadence,
  late intervals, p99, rest displays or bar/caret display rates. Retained
  CPU, memory, foreground and snapshot observations are in G7c's RESULTS.
  Bar also needs a quiet cohort: all three attempts fail one of 15 load
  observations, with maxima 10.9%, 10.9% and 11.0%; collection stops at three.
- **G7c observer-off cold control needs a quiet cohort** (2026-11-01,
  LLP 1149.001). All three ten-launch-per-arm cohorts pass the initial six
  idle observations but fail the complete-cohort gate: 7/34, 16/34 and
  1/34 observations reach at least 10% total CPU. Their excluded DWM
  medians remain above the prediction without PresentMon. A qualified
  control is still needed to distinguish observer cost from machine state;
  the session process files do not establish a cause.
- **G7b Windows startup PresentMon capture remains unqualified**
  (2026-11-01, LLP 1149.001). Three configurations produce no CSV and lose
  ETW events: start before launch and close at readiness, retain the process
  through capture, and PID-filter immediately after process creation.
  Repair stops at three configurations; exact archives and raw failures
  remain in `target/g7b/`. Establish a zero-loss trace with app-owned startup
  presents before claiming PresentMon corroboration. The quiet native
  DWM/DXGI endpoint comparison is recorded as such, not as a successful
  PresentMon startup capture.
- **Ink's Windows window must preserve a lone full-window game's module presentation**
  (2026-11-01, Windows default review; LLP 1149 D10/D12). Until that handoff
  exists, games must keep the CPU painter so the module owns presentation.
  Qualify the handoff against LLP 1015.001's frame p50 of 7.22 ms at
  1280×720 and 10.83 ms at 1920×1080 before changing the game path.
- **Windows modal deadline may flake** (2026-11-01, Windows default review).
  `modal::tests::native_modal_and_carrier_deadlines_cancel_rearm_and_release`
  failed in `about_to_wait_honors_retry_pending_redraw_and_earlier_timer`:
  it chose the two-second deadline instead of the half-second timer. The
  rerun passed with a different profile override; cause not established.
  Reproduce before changing the clock or assertions. Raw failure:
  `target/win-default/nucbox/checks-initial/windows.log`. At `cc9e9d0377`,
  it failed again, then passed with the same explicit package-profile
  override (`target/win-qual/nucbox/checks/{windows,windows-round-2}.log`).
- **NucBox sleep/wake is excluded from unattended runs** (2026-11-01,
  LLP 1149.001 G7 and Windows default qualification). The October 30 and
  November 1 journeys did not wake unattended. November 1 retained enabled
  wake timers and a confirmed scheduled wake, then lost SSH; neither
  device's result was collected (`host/ink/MEASUREMENTS.md`, “Windows
  default”). Any future sleep/wake qualification needs a person at the
  machine. Keep this separate from the AMD-hook crash.
- **Excord's optional RichEdit composer does not accept typing** (2026-11-01,
  Windows default qualification). With `EXACT_INK_RICHEDIT=1`, clicking the
  composer and sending Ctrl+A and text at 100% leaves its value unchanged;
  scaling to 150% preserves that value. The log reports `RichEdit UIA: device: Catastrophic
  failure (0x8000FFFF)`. The same drive edits the ordinary Ink and CPU
  composers. Reproduce with Excord's local transcript fixture; captures and
  logs are retained in `target/win-default/nucbox/richedit-*`. Investigate
  alongside chunk B's pointer and focus work below; this observation does
  not establish the cause. RichEdit remains opt-in.
- **Stage 1w chunk B: native-field pointer delivery** (Claude review 3,
  `target/review-claude-s1w.md`, `98cff0bdfa`). RichEdit's handled mouse messages
  make winit skip dispatch, so field and ancestor clicks never reach the page.
  Keep the native edit and let the pointer sequence reach the presenter.
- **Stage 1w chunk B: app keys from native fields** (Claude review 10).
  Forward a known editing set to RichEdit; let Escape, function keys and
  app chords outside that set reach winit regardless of RichEdit's answer.
- **Stage 1w chunk B: composition ownership** (Claude review 4). `SES_USECTF`
  enables TSF while the host tracks IMM messages. Drop it and qualify IMM,
  or track composition from the editor before claiming app updates cannot
  overwrite a composition.
- **Stage 1w chunk B: UIA focus and accessible name** (Sol review 7,
  `target/review-sol-s1w.md`, `98cff0bdfa`). `TxSetFocus` focuses only the
  HWND; bridge it to logical field focus. Pass the computed accessible name
  to `EM_SETUIANAME`, separately from the placeholder.
- **Stage 1w chunk B: input event causes** (Sol review 4; Claude review 15).
  Carry `deleteByCut`, `insertFromPaste`, `historyUndo` and
  `deleteContentBackward`, including composition commits, from the message
  that caused the edit. Every native edit currently becomes `insertText`.
- **Stage 1w chunk B: selection direction** (Sol review 5). `EM_EXGETSEL`
  normalizes endpoints; use TOM to retain the active end through programmatic
  backward selection and Shift+Arrow continuation.
- **Stage 1w chunk B: field message and paint churn** (Claude review 15).
  Avoid per-frame `EM_SETUIANAME` and setting `changed` on every routed
  message, including key-up and mouse movement with no edit.
- **Stage 1w chunk B: product qualification** (Sol review 7 and checked
  IME path; Claude reviews 3, 4, 10, 11). Complete Shelf's native UIA tree,
  Japanese IME placement/reconversion and Narrator journeys, then Excord's
  composer, focus traversal and growing/wrapping text. The flag stays off
  until those drives pass; Unicode insertion is not an IME drive.
- **Stage 1w chunk B: startup observer and corrected A/B** (Claude reviews
  1, 7, 8; Sol review 8). The old log and observer bracket different writes:
  2/100 logged entry-arm intervals exceed 50 ms (138.547 and 77.718 ms),
  versus 0/100 after layout, with two-sided Fisher p = 0.4975. Neither tail
  has a stack; one 2.646 ms interval has a late capture. These are not yet
  established as runner-to-layout work. A queued completion suppresses capture.
  Pre-spawn a helper blocked on an event, or capture threads and contexts
  in-process without a VA clone and symbolize offline; the measured VA clone
  pauses threads for about 6.026 ms and process spawning adds latency. Probe
  `LdrLockLoaderLock` with `TRY_ONLY` on the watchdog thread at timeout to
  test loader-lock ownership without snapshotting. Rerun the A/B on corrected
  marks only after that redesign, retaining first-pixel differences between
  arms and marking captured launches as perturbed. No startup fix is earned.
- **Stage 1w chunk B: M9 axis mapping** (Claude review 13; Sol's checked
  DirectWrite path). The candidate maps no axes. Use
  `IDWriteFontResource::CreateFontFace` with design-space values, obtained by
  un-normalizing Parley's coordinates (including `avar` and `fvar`) or carrying
  the requested values. Repeat the audit before admitting variable faces.
- The JS build should ask a `render=build` route's `pages=` source and render each page (`host/web-js/src/emit.rs` `build_pages` skips parameterised routes; only the Rust render entry asks the source). An app `exact new` made cannot pre-render `/product/:id` today (docs/agent-pitfalls.md, "Websites").

- Game audio: after a large upward pitch change on a one-shot, the web output can be stopped about 168.5 ms of source before its end (1→16, 10.53 ms of playback), and a downward change leaves silence until the simulation ends the voice.

- Changing an in-flight upload's finite `with` context makes a worker source's reply miss its original argument key (`data/src/placed.rs`, `parse_with`); the main-thread source takes the new context.