Packet 2A closed with an open question its criterion cannot answer. Check 5
(accessibility) is disqualifying and scored PASS/FAIL, and the recipe pins it
per platform so it does not encode one candidate's stack — but a neutral
criterion does not make the cost neutral. Two candidates can both read PASS
having paid different prices, and the cell has nowhere to say so.
Ruled 2026-07-29: check 5 stays candidate-neutral PASS/FAIL and is not
adjusted for who had further to walk; Packet 2B measures the cost on a
separate row; the final ruling weighs that cost without retroactively
relabelling a PASS.
My first draft of this entry stated the asymmetry as "C1 inherits an
accessibility tree, C2 must build one", and that overstates both sides. C1
inherits AccessKit and its platform bridge, but NOT correct semantic nodes for
custom-rendered text — a score canvas draws glyphs egui knows nothing about,
so the nodes carrying the source string, role and bounds are C1's to create
either way. Inheriting the bridge is not inheriting the semantics. C2 inherits
no accessibility integration from vello, but is free to integrate AccessKit or
another bridge, so it does not face a from-scratch stack; what it owns is the
additional integration and wiring. The delta is real, narrower than
"has it / doesn't have it", and concentrated in wiring rather than in the
semantic node construction both candidates must do regardless.
So 2B reports observed facts at that granularity — inherited vs candidate-owned
per part of the path, dependencies added over the Round 1 baseline, which
platform adapters are actually implemented (an adapter not built is scope not
covered, and is reported as such rather than absorbed into a PASS), the
integration each candidate writes itself, and the resulting maintenance
surface. It does not presume the magnitude: writing down a guess at the gap
and then confirming it is the same failure as choosing a tolerance after
seeing a candidate's output.
The general rule, for later rungs: an eligibility gate answers "may this
candidate proceed", not "what will this candidate cost". Merging the two into
one cell loses the second, and the second is the one the project lives with
after the ruling.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
The Round 1 result and the evidence it rests on: C1 and C2 each reproduce
all 27 precommitted sample points on both required adapters, 108 samples
in total, every one exactly opaque black or opaque white. Neither
candidate is eliminated at this rung.
Anchored to three SHAs, per pin 12 -- root baseline 0a35697, oracle
0a35697, candidate harness c20bc93. The authoritative run was made from a
detached worktree at the baseline with the harness extracted into it, so
the glyph outlines came from frozen epiphany-glyphs and not from a working
tree the parallel genesis-ops track has been editing throughout.
Two findings are recorded because they matter after this round is over.
A blank target is a silent pass shape and it actually happened here: C1
failed all 15 ink points while passing all 12 background points, which is
the signature of nothing being drawn rather than of a fill bug. Had this
round tested only background points, or only "renders without erroring",
a blank target would have passed it. Every later round needs at least one
assertion that can only succeed if ink was deposited.
And nominal 8x AA is not the same mechanism on both sides. Pin 4 asks for
an identical sample count and gets one, but C1's 8x is a hardware
multisample attachment while C2's is vello's compute AA into a
single-sample texture. Round 1 is indifferent; Round 4 is not, since AA is
in the deciding latency numbers, so the report prints the mechanism beside
the number rather than leaving "8 == 8" to imply parity.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
Pin 13 makes this sequencing a hard rule -- "points that must be ink" chosen
after seeing candidate output is not a test -- so this crate draws nothing and
depends on no rendering, tessellation or windowing crate. It derives the oracle
from the typed glyph outlines and writes it out as data. Candidates render
against it in a later packet.
Twenty-seven sample points across five glyphs, all derived programmatically by
even-odd point-in-path over the flattened PathCommand outline, never chosen by
eye, each at least eight device pixels clear of any outline edge so
antialiasing cannot explain a result. Every background point is proven to lie
inside a BOUNDED HOLE -- enclosed by the outer silhouette yet unfilled -- since
a point merely outside the glyph is passed trivially by a renderer that fills
holes solid. fClef instead carries one ink point inside each of its three
filled subpaths, tagged by subpath index so the oracle proves every component
is covered rather than three points that could all land in the bowl.
The status model distinguishes a satisfied disjoint-component result from a
failed hole result: a requirement enum, per-requirement required/satisfied
pairs, and one authoritative satisfied flag.
Mutations, each with kill evidence in the test module. A perturbed ink point is
rejected outside the glyph. Shrinking the clearance floor admits strictly more
points, so the filter is not a no-op. Every hole point sits inside a naive
outer-contour-only fill but outside the real whole-outline fill -- the positive
proof that inner-subpath handling is load-bearing, which stands in for a
fill-rule flip that CANNOT reclassify anything on correctly wound contours.
And filling only fClef's largest subpath misses both dot points, which is the
disjoint-component analogue and the reason that class exists.
Two proofs about fClef's topology, because one was not enough. Vertex-level
non-nesting cannot see two subpaths whose edges cross with no vertex of either
inside the other, so it is paired with pairwise bounding-box disjointness,
which rules out crossing, touching and containment together. The grid-based
corroboration is named for what it actually checks -- one finer 0.005 grid --
rather than claiming any resolution.
The oracle's adaptive flattening is authoritative for the recorded signed
areas; an earlier coarser fixed-step measurement is marked superseded where it
appears. The first four-glyph pass is kept in DECISIONS.md under an explicit
SUPERSEDED -- NEVER COMMITTED banner, because its two findings are what caused
the contract amendment, and deleting the discovery would erase the reason.
Verified: 12/12 tests; fmt clean; cargo doc clean; regeneration byte-identical
by SHA-256 from the crate directory. All 27 coordinates were additionally
cross-validated by an independent point-in-path implementation with zero
mismatches, and the new bounding-box assertion was mutation-killed against a
nested glyph to prove it is not vacuous.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
Round 0 is the ladder's cheapest hard gate: for each candidate, a desk survey
and a demonstrated accessibility route -- a window exposing one node with a
role and a name, read back through the platform adapter. It is first precisely
so that a candidate with no accessibility story costs one round instead of
four.
C1 (egui/eframe 0.35.0) passes on a first-party route: egui-winit's accesskit
feature is literally dep:accesskit_winit, so the chain runs eframe ->
egui-winit -> accesskit_winit -> accesskit_unix and inherits that crate's
window-lifecycle handling. C2 (vello 0.9.0 + winit 0.30.13) passes on the
manual accesskit_winit route the contract names, wired into the same
ApplicationHandler that owns the vello renderer.
C3 (iced 0.14.0) FAILS, and the interesting part is that it first reported as
a pass. The probe registered a hand-built two-node tree through
accesskit_unix::Adapter, which takes no window handle at all -- only handlers
-- and registers with AT-SPI from process identity. It read back cleanly. It
also happened to label its button exactly as iced's own view() labelled a
button, so the transcript looked as though iced had produced it. Deleting iced
from that probe would produce the identical readback. Round 0 asks whether the
CANDIDATE exposes a route; a process-level side channel answers a different
question.
The verdict is recorded with dual attribution, because two distinct things
went wrong. The probe-design defect is the false positive above. The candidate
limitation -- which alone fails the round -- is that iced 0.14 ships no
accessibility integration anywhere (accesskit appears in no iced crate
manifest) and its stock runner hands application code neither the winit
ActiveEventLoop nor a pre-visibility Window, both of which every
accesskit_winit::Adapter constructor requires. That scoping matters and is
deliberate: iced_winit documents a conversion module for users implementing a
custom event loop, so a hand-built shell remains conceivable but unproven, and
would mean owning the shell. Upstream iced #552 is still open.
The evidence file keeps the verifier's factual READBACK: PASS beneath a
ROUND-0 RESULT: FAIL annotation rather than being rewritten. A corrected record
that erases the false positive teaches nobody why it was false.
Two findings carried forward. C1's frame node is unnamed -- its readback path
is application:'probe-egui' / frame:'' / button:'...' where C2 names its frame
-- which is non-disqualifying here but means a screen-reader user hears an
unnamed window, and round 3 must check it. And AT-SPI application registration
is gated behind two settings that are off by default; without both, probes
connect to the bus and enumerate zero applications, which would read as a
candidate failure rather than the environment absence it is.
The spike workspace lives outside the root workspace with its own lockfile;
the root gains one line, exclude = ["spikes"], and nothing else. Round 0's
probes depend on no epiphany crate, which is what makes this round independent
of the pinned source baseline the later rounds need.
Root gate unchanged: fmt clean, clippy -D warnings clean, 1371 tests passed 0
failed. Spike workspace gated separately: fmt clean, all probes build --locked.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
Levi Neuwirth