Packet 2A's governing artifact, under CONTRACT_EDITOR_T4_SPIKE pin 13 —
written and reviewed before any candidate can consume it, because a
tolerance chosen after seeing a candidate's output is not a tolerance.
Ruling A permits "geometry/scene equivalence plus a bounded visual
differential under a controlled backend, NOT pixel equality". That phrase
had never been given a number. Section 10 gives it four rules; section 11
lists the mutations that must kill, and every one is now executed by a
binary that exits non-zero when a required kill does not happen.
Three things here were corrected by measurement, not by review:
* The em size. Revision 1 pinned 64 px, which puts Pagella's stems at
5.4 device px — inside D1's structural blind spot of 2*EDGE_BAND_PX+1 = 5
px. D1 would have reported `pass` on every stem in the fixture set. The em
size is now derived FROM the blind spot: 128 px, stems 10.8 px.
* M4. Assigned to D4 by analogy with a dropped glyph; executing it showed
the analogy is false. An `ff` ligature and two `f` glyphs carry nearly the
same ink (0.07% of image mass, 1.20% in-region against a 2% tolerance), so
a mass rule is the wrong instrument for a shape substitution. D1 sees it
at 221 px outside the band. D4 keeps its threshold: tightening it to 1.20%
would leave 1.3x over M10's measured 0.785%, and a threshold that close to
a known-good AA variant is not a tolerance. D1 and D4 are complementary
and neither is sufficient.
* The origin. The 1/1024 invariant caught this recipe's own stated constant:
1.6 * 1024 = 1638.4 is not representable. Now 1638/1024.
Section 8 pins the check-5 accessibility oracle per platform rather than in
one toolkit's vocabulary — naming only AccessKit would have favoured C1, and
a criterion that encodes one candidate's stack is not a criterion.
Section 1.2 records the 2026-07-29 ruling: check 3 is NOT RUN (no
Arabic-capable face; pin 9), F-D is a separate Supplementary row that must
not upgrade it, and eligibility is unaffected because check 3 is not
disqualifying.
Section 12 routes six findings back to the W3 amendment, three of them found
by building against 3E rather than by reading it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
The Round 1 result and the evidence it rests on: C1 and C2 each reproduce
all 27 precommitted sample points on both required adapters, 108 samples
in total, every one exactly opaque black or opaque white. Neither
candidate is eliminated at this rung.
Anchored to three SHAs, per pin 12 -- root baseline 0a35697, oracle
0a35697, candidate harness c20bc93. The authoritative run was made from a
detached worktree at the baseline with the harness extracted into it, so
the glyph outlines came from frozen epiphany-glyphs and not from a working
tree the parallel genesis-ops track has been editing throughout.
Two findings are recorded because they matter after this round is over.
A blank target is a silent pass shape and it actually happened here: C1
failed all 15 ink points while passing all 12 background points, which is
the signature of nothing being drawn rather than of a fill bug. Had this
round tested only background points, or only "renders without erroring",
a blank target would have passed it. Every later round needs at least one
assertion that can only succeed if ink was deposited.
And nominal 8x AA is not the same mechanism on both sides. Pin 4 asks for
an identical sample count and gets one, but C1's 8x is a hardware
multisample attachment while C2's is vello's compute AA into a
single-sample texture. Round 1 is indifferent; Round 4 is not, since AA is
in the deciding latency numbers, so the report prints the mechanism beside
the number rather than leaving "8 == 8" to imply parity.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
The shared harness plus the two candidate binaries for Round 1 of the
toolkit spike. C1 tessellates each Bravura outline with lyon and draws it
through egui's own paint pipeline; C2 builds one kurbo BezPath and one
Scene::fill. Both classify their readback against the frozen oracle from
0a35697 and report per-point.
Three things this had to get right, none of which is the rendering:
A candidate must not be able to pass by drawing nothing. C1 initially
failed all fifteen ink points while passing all twelve background points,
which is the signature of a blank target, not of a fill bug: the mesh
named TextureId::default() and egui-wgpu silently skips primitives whose
texture id is unregistered. It now registers a 1x1 opaque-white texture.
The harness must not substitute for a broken readback. A short buffer
used to yield (0,0,0,0), whose luma is 0, so every ink point would pass.
Buffer length, coordinate range, and sample opacity are now hard errors
rather than clamps or defaults.
The oracle must not be editable into agreement. deny_unknown_fields
catches structural drift, but semantic drift is the dangerous kind, and
a validator that checks the oracle against its own other fields accepts
any self-consistent file. OracleFile::validate now checks against
literals restated in the harness: the exact five-glyph roster with its
requirement mapping, subpath counts and point counts, the 27-point
census, 1920x1080, the 8 px clearance floor and every sample's clearance,
and the requirement-specific status flags. Thirteen mutations were run
against it -- deleting a glyph, renaming one, duplicating one, dropping a
point, retargeting every glyph together, lowering the floor, relaxing
spacing -- and all thirteen are rejected.
AA is nominally 8x on both, as pin 4 requires, but the mechanisms differ:
C1 uses a hardware multisample attachment (which is why it must request
TEXTURE_ADAPTER_SPECIFIC_FORMAT_FEATURES, since 8x on Rgba8Unorm is off
the WebGPU baseline) while C2 uses vello's compute AA into a
sample_count:1 storage texture. The run report prints the mechanism beside
the number so no later round reads "8 == 8" as parity. Round 1 is
indifferent to the difference; Round 4's timings will not be.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
Pin 13 makes this sequencing a hard rule -- "points that must be ink" chosen
after seeing candidate output is not a test -- so this crate draws nothing and
depends on no rendering, tessellation or windowing crate. It derives the oracle
from the typed glyph outlines and writes it out as data. Candidates render
against it in a later packet.
Twenty-seven sample points across five glyphs, all derived programmatically by
even-odd point-in-path over the flattened PathCommand outline, never chosen by
eye, each at least eight device pixels clear of any outline edge so
antialiasing cannot explain a result. Every background point is proven to lie
inside a BOUNDED HOLE -- enclosed by the outer silhouette yet unfilled -- since
a point merely outside the glyph is passed trivially by a renderer that fills
holes solid. fClef instead carries one ink point inside each of its three
filled subpaths, tagged by subpath index so the oracle proves every component
is covered rather than three points that could all land in the bowl.
The status model distinguishes a satisfied disjoint-component result from a
failed hole result: a requirement enum, per-requirement required/satisfied
pairs, and one authoritative satisfied flag.
Mutations, each with kill evidence in the test module. A perturbed ink point is
rejected outside the glyph. Shrinking the clearance floor admits strictly more
points, so the filter is not a no-op. Every hole point sits inside a naive
outer-contour-only fill but outside the real whole-outline fill -- the positive
proof that inner-subpath handling is load-bearing, which stands in for a
fill-rule flip that CANNOT reclassify anything on correctly wound contours.
And filling only fClef's largest subpath misses both dot points, which is the
disjoint-component analogue and the reason that class exists.
Two proofs about fClef's topology, because one was not enough. Vertex-level
non-nesting cannot see two subpaths whose edges cross with no vertex of either
inside the other, so it is paired with pairwise bounding-box disjointness,
which rules out crossing, touching and containment together. The grid-based
corroboration is named for what it actually checks -- one finer 0.005 grid --
rather than claiming any resolution.
The oracle's adaptive flattening is authoritative for the recorded signed
areas; an earlier coarser fixed-step measurement is marked superseded where it
appears. The first four-glyph pass is kept in DECISIONS.md under an explicit
SUPERSEDED -- NEVER COMMITTED banner, because its two findings are what caused
the contract amendment, and deleting the discovery would erase the reason.
Verified: 12/12 tests; fmt clean; cargo doc clean; regeneration byte-identical
by SHA-256 from the crate directory. All 27 coordinates were additionally
cross-validated by an independent point-in-path implementation with zero
mismatches, and the new bounding-box assertion was mutation-killed against a
nested glyph to prove it is not vacuous.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
Round 0 is the ladder's cheapest hard gate: for each candidate, a desk survey
and a demonstrated accessibility route -- a window exposing one node with a
role and a name, read back through the platform adapter. It is first precisely
so that a candidate with no accessibility story costs one round instead of
four.
C1 (egui/eframe 0.35.0) passes on a first-party route: egui-winit's accesskit
feature is literally dep:accesskit_winit, so the chain runs eframe ->
egui-winit -> accesskit_winit -> accesskit_unix and inherits that crate's
window-lifecycle handling. C2 (vello 0.9.0 + winit 0.30.13) passes on the
manual accesskit_winit route the contract names, wired into the same
ApplicationHandler that owns the vello renderer.
C3 (iced 0.14.0) FAILS, and the interesting part is that it first reported as
a pass. The probe registered a hand-built two-node tree through
accesskit_unix::Adapter, which takes no window handle at all -- only handlers
-- and registers with AT-SPI from process identity. It read back cleanly. It
also happened to label its button exactly as iced's own view() labelled a
button, so the transcript looked as though iced had produced it. Deleting iced
from that probe would produce the identical readback. Round 0 asks whether the
CANDIDATE exposes a route; a process-level side channel answers a different
question.
The verdict is recorded with dual attribution, because two distinct things
went wrong. The probe-design defect is the false positive above. The candidate
limitation -- which alone fails the round -- is that iced 0.14 ships no
accessibility integration anywhere (accesskit appears in no iced crate
manifest) and its stock runner hands application code neither the winit
ActiveEventLoop nor a pre-visibility Window, both of which every
accesskit_winit::Adapter constructor requires. That scoping matters and is
deliberate: iced_winit documents a conversion module for users implementing a
custom event loop, so a hand-built shell remains conceivable but unproven, and
would mean owning the shell. Upstream iced #552 is still open.
The evidence file keeps the verifier's factual READBACK: PASS beneath a
ROUND-0 RESULT: FAIL annotation rather than being rewritten. A corrected record
that erases the false positive teaches nobody why it was false.
Two findings carried forward. C1's frame node is unnamed -- its readback path
is application:'probe-egui' / frame:'' / button:'...' where C2 names its frame
-- which is non-disqualifying here but means a screen-reader user hears an
unnamed window, and round 3 must check it. And AT-SPI application registration
is gated behind two settings that are off by default; without both, probes
connect to the bus and enumerate zero applications, which would read as a
candidate failure rather than the environment absence it is.
The spike workspace lives outside the root workspace with its own lockfile;
the root gains one line, exclude = ["spikes"], and nothing else. Round 0's
probes depend on no epiphany crate, which is what makes this round independent
of the pinned source baseline the later rounds need.
Root gate unchanged: fmt clean, clippy -D warnings clean, 1371 tests passed 0
failed. Spike workspace gated separately: fmt clean, all probes build --locked.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
Pin 7 of the spike contract holds that staff-by-measure dimensions do not pin a
workload, and the workload is what gets tessellated. This is that recipe: one
region, one staff instance per staff, a fixed seven-event bar of six eighths
plus a quarter, and integral per-measure quotas for rests, accidentals, ledger
notes and slurs. Nothing is sampled. The generator still takes a seed, but its
only role is replica minting as in the testkit fixtures -- content is fixed by
construction, which is strictly stronger than a fixed seed over a free
selection algorithm.
Three review rounds, and nearly every finding was the same mistake in a new
place: a claim about the pipeline inferred from an adjacent fact instead of
read from the code that emits.
Ties are not curves. The Curve doc says slurs engrave to one "and ties and
other span curves will follow" -- future tense; constrained.rs has a Slur arm
and no Tie arm, so ties trace as zero-extent anchors. The casting lines first
cited only transform curves produced upstream. Ties are now zero for the
primary ladder, and the decisive reason is not the miscount: every structural
anchor is emitted at the default x, which is the clef column, so casting files
all of them into the first system regardless of musical position. At the top
rung that would pile 2,400 anchors into the most likely damage target and
distort the per-system rebuild timing the whole spike turns on.
The census counts the parser's output, not the source string. H and V each
become a PathCommand::LineTo, so counting M/L/C/Z tokens undercounts exactly
the commands a tessellator consumes -- a sharp is 71, not 57. The census is now
defined as render_data(name).outline.len(), which measures the API candidates
actually see and removes the whole error class.
Ledger lines are emitted per staff step, not per off-staff note. A note one
space outside the staff emits none at all; the first ledger sits two steps out.
So off-staff pitches are pinned by absolute step rather than by "ledger
position", which would have produced about half the ledger ink it implied.
Also corrected: an all-eighths bar cannot yield a quarter rest (rest_glyph maps
value to glyph exactly), 4/4 uses timeSig4 which is single-subpath rather than
the multi-subpath coverage first claimed, barlines are glyphs and not strokes,
and the accidental cadence is one fixed cycle with bounded edge imbalance --
not equal thirds, since no rung's measure count divides by three.
Two-voice engraving is NOT unproven -- rs4_two_voice_counterpoint passes
against the real engraver. The narrower gap is collision handling, rest
displacement and deliberate stem-direction separation, and the ladder stays at
one voice as an isolation choice rather than out of doubt.
The remaining gate is separate and still open: no candidate code exists until
the generator emits its per-rung census, glyph histogram, SHA-256 of each
rung's canonical layout bytes, and the F4 engrave preflight -- and that output
is approved. Recipe approval is not generator approval.
Docs only. No Cargo manifest yet, so the root workspace is untouched; the
exclude line lands with the generator.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSX4zSLgKvtiXaPjnMqLGz
Levi Neuwirth