# Offline capability catalog

Generated from `docs/offline-capabilities.json`; do not edit by hand.
No parity score is claimed. Statuses describe evidence, not UI presence.
Baseline evidence revision: `df9f4f3cf4b49482f031ea5b890a117a31b93408`.
Baseline CI: https://github.com/rohan-patnaik/Solitaire/actions/runs/32498442489.
Pinned application-source CI: `709f93ba55680ecbafb332ee95c345d6aa8ad016` at https://github.com/rohan-patnaik/Solitaire/actions/runs/33179782126 (success).

| Status | Count |
| --- | ---: |
| Complete | 1 |
| Partial | 10 |
| Planned | 0 |
| Excluded | 3 |

| ID | Capability | Status | Known limit |
| --- | --- | --- | --- |
| `foundation.omarchy-launcher` | Detached Omarchy launcher | Complete | The supported live summon kept Quickshell responsive and the detached native process survived an Omarchy shell restart at exact published SHA f6b0cb7e55d296bdf77714efc48a1775b858c041. At exact published SHA 4b31024426b73fafe93597e4cd42312eef2b26b0, the normal native Wayland launch and isolated live missing-binary and immediate-exit-42 branches delivered their exact critical notifications, diagnostics, and statuses without altering the installed package or leaving a process/window behind. |
| `foundation.arch-package` | Exact-revision Arch package | Partial | Rust and exact-revision Arch package CI is green at published application SHA 709f93ba55680ecbafb332ee95c345d6aa8ad016, where a clean container built, ran 232 tests, installed, verified the source marker, and queried solitaire-omarchy 0.1.0.r0.g709f93b-1. The preceding published SHA 4e80b44b4ea3d4820fa5e38f1e8e71aa4e33386a independently built and installed solitaire-omarchy 0.1.0.r0.g4e80b44-1. At earlier installed SHA d20ba4111deb2e948e593fbeec4ca2c45b597bef, the installed source marker, nine package files, and binary hash were verified with no altered files. The evidence package is unsigned; reproducibility, signed checksums, SBOM, and release-upgrade evidence remain open. |
| `foundation.persistence-safety` | Bounded atomic local persistence | Partial | Timed Klondike uses the existing checked mode-0600 save and stale-writer protocol for bounded 15-second checkpoints plus final close/switch checkpoints; focused missing-location, conflict, retry, exact-reopen, counter, and profile isolation evidence passes. The shared restart workflow atomically replaces each active save only after recreating the exact seed and rules, preserves deal-counter bytes and profile state, fails closed without a save location, and recovers from a stale-writer conflict through explicit reload and retry. Real Wayland save/reopen in all five games, corrupt-profile quarantine, dirty close guarding, and two-process stale-writer recovery succeeded at published alpha SHA f6b0cb7e55d296bdf77714efc48a1775b858c041. Crash injection, cross-file transactions, power-loss acceptance, exact-package timed checkpoint/reopen, and exact-package restart input remain pending. |
| `game.klondike` | Playable Klondike | Partial | Restart deal recreates the exact active Klondike seed and draw, scoring, and redeal options without consuming the next seed; focused atomic, profile, counter, no-save, and conflict recovery evidence passes, while exact-package input remains open. The native new-deal controls expose draw-one, draw-three, Standard and Vegas scoring, plus unlimited, one, or three stock redeals. Focused controller coverage preserves exact choices through atomic save/reopen, enforces the bound, rejects an extra recycle without mutating memory or disk, reproduces the exhausted state across undo/redo, and synchronizes reopened displayed values with keyboard/popup selection indices; custom valid limits intentionally use no selected preset. Malformed and hostile option requests preserve the current game, save, counter, and pending request. A pinned normal seed-zero draw-one/Standard replay reconstructs through production code to one legal foundation move before victory. A bounded normal-process subprocess gate validates a canonical temporary root and nonce before startup, starts a fresh Controller from the reconstructed 155-action save, completes the keyboard-routable final move, preserves the one-time profile through undo/redo, exits, and proves a second fresh Controller reopens byte-identical won-game and profile files; stalled children are killed and reaped with bounded diagnostics. An installed keyboard stock draw, undo/redo, and save/reopen were accepted at exact SHA f6b0cb7e55d296bdf77714efc48a1775b858c041. The Vegas and redeal-limit UI workflows and exact installed final foundation move/process identity remain open. Timed and untimed deals now preserve the exact choice across atomic save/reopen. Timed play exposes an informational monotonic clock, pauses while inactive, pending, or won, never rewinds through undo/redo, and checkpoints through the existing checked save without changing scoring, counters, or profile bytes. Exact-package timing input, clock progression, checkpoint/reopen, and assistive-technology output remain open; no time bonuses or penalties are claimed. Right- and left-handed session layouts now mirror the top-row controls with bounded geometry while preserving pile identity and keyboard order. Exact-package layout input/visual/AT-SPI acceptance and an owner-approved persisted settings model remain open. Exposed waste and top-tableau double-click now uses bounded pointer disambiguation plus ephemeral deal-instance and captured-card validation before routing a direct foundation action; exact-package pointer timing, touch, AT-SPI, and foreground acceptance remain open. Finish safe moves clears stale selection, reports exact zero/one-move results, preserves per-card replay history, and has checked save/reopen, one-time profile, no-op, and stale-writer reload evidence. Exact-package keyboard/default-action, live-region, AT-SPI, spoken-output, visible multi-move, pointer/touch, and foreground acceptance remain open. Drag/drop and broader platform evidence also remain open. |
| `game.spider` | Playable Spider | Partial | Restart deal recreates the exact active Spider seed and suit mode without consuming the next seed; focused atomic, profile, counter, no-save, and conflict recovery evidence passes, while exact-package input remains open. At exact installed SHA d20ba4111deb2e948e593fbeec4ca2c45b597bef, keyboard selection, stock deal, undo/redo, save/reopen, and AT-SPI identity/action semantics passed in one-, two-, and four-suit modes. Focused display-independent evidence now maps every persisted mode to the correct selector value/index, keeps the active mode separate from a dirty future choice, preserves game/save/counter/pending state across malformed and 4 KiB hostile values, and commits/reopens a confirmed staged choice with mode-0600 files. Dependency-free hostile-action and fixed seed/mode action-space tests cover rejection atomicity, card conservation, exposure invariants, replay reconstruction, and undo/redo. A bounded normal-process subprocess gate validates a temporary root and nonce before startup, starts a fresh Controller from the pinned 7/8 replay, completes the keyboard-routable final move, preserves the one-time profile through undo/redo, exits, and proves a second fresh Controller reopens byte-identical 8/8 game and profile files; stalled children are killed and reaped with bounded diagnostics. Exact-package reopened selector value/index synchronization, final transition/process identity, and drag/touch remain open. |
| `game.freecell` | Playable FreeCell | Partial | Restart deal recreates the exact active FreeCell deal number without consuming or changing the independent next sequence; focused atomic, profile, counter, no-save, and conflict recovery evidence passes, while exact-package input remains open. FreeCell accepts strict decimal u64 deal numbers through a dedicated keyboard/accessibility-declared surface. Focused controller coverage rejects malformed, non-ASCII, overflowing, and oversized input atomically; exact choices including 0 and the u64 maximum survive dirty-state confirmation and save/reopen without consuming the durable next-deal sequence. A subprocess Controller startup test proves that reopening the maximum exact deal preserves and can advance the separately persisted next sequence, while the displayed string preserves the full range. These numbers reproduce this repository's generator and do not claim interoperability with another product's numbering. A pinned normal seed-zero replay reconstructs through production code to one legal foundation move before victory; controller coverage proves the keyboard-routable final move, exact complete status, 0600 replay/profile saves, one-time played/won accounting, undo/redo idempotence, and loader-level reopen. A bounded normal-process gate validates an owned temporary root and nonce, starts a fresh Controller from the 105-action save, performs the final move, verifies profile undo/redo, exits, then proves a second fresh Controller reopens byte-identical 106-action and profile files. Each child is killed and reaped at a shared deadline with bounded diagnostics, hostile ambient-environment protection, and scoped root cleanup on success or unwind. A background source launch preserved the foreground and an isolated headless compositor started the source UI, but its missing virtual-keyboard protocol prevented safe interaction. An installed deterministic hint, illegal move, legal keyboard move, and save/reopen were accepted at exact SHA f6b0cb7e55d296bdf77714efc48a1775b858c041. The numbered-entry gate, exact installed final foundation move/process identity, solver-grade hints, drag/touch, and broader platform evidence remain open. |
| `game.pyramid` | Playable Pyramid | Partial | Restart deal recreates the exact active Pyramid seed and redeal bound without consuming the next seed; focused atomic, profile, counter, no-save, and conflict recovery evidence passes, while exact-package input remains open. Pyramid is playable with deterministic sequential deals, pair-to-13 and king removal, selectable zero-, one-, or two-redeal bounds, bounded replay/history, atomic local save/recovery, and declared keyboard/accessibility semantics. Focused coverage preserves exact choices through dirty confirmation and save/reopen, enforces exhaustion without mutating rejected state or persistence, reconstructs across undo/redo, and rejects malformed and 4 KiB hostile requests atomically. Valid persisted custom u8 bounds remain loadable and render without a falsely selected preset. Published builds through b50faa5 reject and quarantine zero- or one-redeal saves while preserving source bytes and opening a fresh deal; two-redeal saves remain compatible. A pinned normal seed-zero replay reconstructs through production code to one legal pair before victory. A bounded normal-process gate validates an owned temporary root and nonce, starts a fresh Controller from the 62-action save, performs the final pair selection and removal, verifies score and profile undo/redo, exits, then proves a second fresh Controller reopens byte-identical 63-action and profile files. Each child is killed and reaped at a shared deadline with bounded diagnostics, hostile ambient-environment protection, and scoped root cleanup on success or unwind. An installed keyboard stock draw and save/reopen were accepted at exact SHA f6b0cb7e55d296bdf77714efc48a1775b858c041. Exact-package redeal selection/display and final transition/process identity, solvability metadata, other variants, drag/touch, and spoken assistive-technology acceptance remain pending. |
| `game.tripeaks` | Playable TriPeaks | Partial | Restart deal recreates the exact active TriPeaks seed and rank-wrap option without consuming the next seed; focused atomic, profile, counter, no-save, and conflict recovery evidence passes, while exact-package input remains open. Standard and optional Ace-King-wrap modes are playable with deterministic numbered deals, bounded replay/history, atomic local save/recovery, and declared keyboard/accessibility semantics. Focused coverage proves strict rule selection, checked save/reopen, undo/redo preservation, exact next-deal reservation, mode-0600 saves, and atomic rejection of malformed and 4 KiB hostile requests without changing game, save, counter, or pending state. Published builds through a72f3ce reject and quarantine wrap-enabled saves while preserving their source bytes and opening a fresh deal; Standard saves remain compatible, but wrap-enabled saves must not be opened with those older builds. A pinned normal Standard seed-zero replay reconstructs through production code to one legal move before victory; controller coverage proves the keyboard-routable final removal, visible win status, mode-0600 replay/profile saves, exact played/won accounting, undo/redo idempotence, and loader-level reopen. A bounded normal-process gate validates an owned temporary root and nonce, starts a fresh Controller from the 48-action save, performs the final removal, verifies score and profile undo/redo, exits, then proves a second fresh Controller reopens byte-identical 49-action and profile files. Each child is killed and reaped at a shared deadline with bounded diagnostics, hostile ambient-environment protection, and scoped root cleanup on success or unwind. An installed keyboard stock draw and save/reopen were accepted at exact SHA f6b0cb7e55d296bdf77714efc48a1775b858c041. The exact installed final transition/process identity and rule-selection workflow, drag/touch, and spoken assistive-technology acceptance remain pending. |
| `collection.local-profile` | Local profiles, statistics, and achievements | Partial | Timed checkpoints leave deal-counter and anonymous local-profile bytes unchanged in focused coverage. Restarting preserves the anonymous local profile byte-for-byte and does not count a repeated deal merely because it was restarted. One anonymous device-local profile exposes per-game deals played and won using idempotent numbered-deal observations, fixed-size u64 counters, bounded atomic persistence, CAS conflict handling, retry/close guards, and corrupt-source quarantine. Controller coverage proves exact Klondike, Spider, FreeCell, TriPeaks, and Pyramid played/won transitions persist once across undo, redo, repeated observation, and reopen; bounded subprocess gates additionally prove all five won games and profiles reopen byte-identically across two fresh Controllers per game. Real Wayland played/reopen in all five games plus quarantine/conflict workflows succeeded; installed won-deal transitions, named profiles, achievements, streaks, import/export, sync, multi-process merge, cross-file transactions, power-loss acceptance, and broader statistics remain pending. |
| `quality.accessibility` | Keyboard and assistive-technology acceptance | Partial | Finish safe moves is keyboard-routable and exposes its purpose through the accessibility default action, with display-independent replay-cap and recovery evidence; Exact-package keyboard/default-action, live-region, AT-SPI, spoken-output, pointer, and touch acceptance remain open. Klondike double-click is pointer-only and leaves keyboard Enter/Space plus the accessibility default action immediate; exact-package pointer timing, AT-SPI updates, touch behavior, and spoken output remain open. The session-scoped Klondike handed-layout selector declares keyboard and accessible semantics without reordering pile activation; exact-package selection, AT-SPI value/state updates, and spoken output remain open. The timed/untimed selector and active elapsed-clock summary declare keyboard and accessible names, while exact-package input, live value/state updates, and spoken output remain open. The restart control is keyboard-focusable and declares its exact same-deal semantics plus distinct pending discard/cancel names; exact-package keyboard, AT-SPI, and spoken output remain open. Real Wayland keyboard navigation/activation, visible focus, AT-SPI names/actions/states across all five games, and changing live-region names were observed at exact SHA f6b0cb7e55d296bdf77714efc48a1775b858c041. At exact installed SHA d20ba4111deb2e948e593fbeec4ca2c45b597bef, all three Spider modes and the complete wrapped long-status keyboard/AT-SPI workflow passed. All five games now have keyboard-routable normal near-win candidates, but their exact-package final actions and live-region transitions remain open. Corrected Spider reopened selector value/index synchronization, the Pyramid redeal selector's value/index behavior and AT-SPI input, TriPeaks rank-rule selector, FreeCell numbered-entry input, full keyboard-only traversal, and Orca spoken output remain pending exact-package acceptance. |
| `quality.real-omarchy` | Real Omarchy and Wayland acceptance | Partial | Finish safe moves has display-independent candidate, replay-cap, save, and recovery evidence only; no production GUI or live Omarchy shell was invoked, so Exact-package keyboard/default-action, live-region, AT-SPI, pointer/touch, visible progression, and foreground-preservation acceptance remain open. Klondike double-click has display-independent source evidence only; exact-package pointer timing, stale-card recovery, touch, and foreground preservation remain open. Klondike handed layout has display-independent geometry evidence only; exact-package input, visual mirroring, narrow-window interaction, and foreground preservation remain open. Timed Klondike has display-independent candidate evidence only; no production GUI or live Omarchy shell was invoked, so exact-package timing and foreground-preservation acceptance remain open. Restart has display-independent candidate evidence only; no production GUI or live Omarchy shell was invoked, so exact-package input and foreground-preservation acceptance remain open. At exact SHA f6b0cb7e55d296bdf77714efc48a1775b858c041, installed legal mutation/save/reopen in all five games, plugin summon, shell responsiveness, native-process survival across shell restart, quarantine, conflict recovery, and clean shutdown were observed on real Omarchy/Wayland. At exact installed SHA d20ba4111deb2e948e593fbeec4ca2c45b597bef, one-, two-, and four-suit Spider workflows and the wrapped long-status surface passed focused Wayland acceptance. At exact SHA 4b31024426b73fafe93597e4cd42312eef2b26b0, normal and both launcher-failure paths passed live acceptance. The corrected Spider reopened selector mapping, TriPeaks and Pyramid selectors, and all five normal complete-deal fixtures are automated candidate evidence only; their exact-package input/value-index and final transitions remain open. The FreeCell numbered-entry installed input gate, Orca, other complete-deal UI wins, and drag/touch remain pending. |
| `excluded.accounts` | Microsoft and Xbox accounts | Excluded | Hosted identity is outside the offline product boundary. |
| `excluded.ads` | Advertising services | Excluded | The product is intentionally offline and ad-free. |
| `excluded.vendor-content` | Microsoft-branded events and copied daily deals | Excluded | Vendor content and expressive presentation will not be copied. |

## Status definitions

- **Complete:** Workflow and required evidence are complete at a green exact revision.
- **Partial:** Some implementation exists, but workflow or acceptance evidence remains open.
- **Planned:** In scope and not implemented.
- **Excluded:** Outside the offline product boundary, with a documented reason.