# GUI arc, Stage 1 — input foundation (framing)

**Status: revision 22 — IMPLEMENTED, IN REVIEW as PR #247. Revision
21's GPU structural-authority correction stands; the first PR review
closed one presentation gap and one incomplete disposal path without
changing a ruling.** Revision 18's §2a was measured
at `72da24a`. That
base is now **167 commits back**, and #242 and #243 landed on exactly
the pointer paths 1b builds on, so every 1b anchor is stale again —
which §2a's own history predicted would happen.

**Revision 22 closes two review findings in the implementation and in
the evidence.** First, the GPU's document-horizontal wheel changed
`code_scroll_left` but requested no redraw. The event loop returns to
`ControlFlow::Wait`, and this axis deliberately sends no viewport wire
event, so the stored origin could remain invisible until an unrelated
frame. B2 now includes a request-count witness whose origin assertion
still passes when the request is removed — the redraw is the
discriminator, not inferred from state. Second, B1's panel disposal ran
on `Absent` only. A direct accepted `Present` → `Present` replacement
could retain panel A's bank; A → B → A could later spend it. Separate
mapped and legacy rows drive the real wheel producer across a same-buffer,
new-`panel_epoch` replacement with no `Absent`. A geometry-only re-grid
is the negative control: it is still the same panel surface and keeps
the fraction. **No ruling changes; two paths that failed to implement
the existing rulings are now covered.**

**All four load-bearing claims were re-verified and all four SURVIVE:**

1. **Quantization still happens BEFORE routing.** `:3254` quantizes,
   `:3262` returns on zero, `:3270` routes to the panel. CORRECTION 5's
   central point is intact — this was checked first, because an
   inversion would have changed B1's design;
2. **`Elsewhere` still collapses four wheel targets** — its doc at
   `:2108` still reads *"Not the band: the document, the terminal, the
   minimap, or the chrome."*;
3. **the wheel's panel branch still tests `PanelCell` only** (`:3270`),
   so minimap pixels still fall through to `scroll_by_lines`. **B6's
   premise survives**;
4. **`code_scroll_residual` is still not a wheel accumulator** — it is
   the caret-follow pixel residual (`:1664`), cleared at `:6218` and
   `:8433`. Reusing it would still be a defect.

**Three base facts were wrong, and are corrected in place:**

- `pmacs-gpu/src/main.rs` is **22,502 lines**, not 21,435;
- **`PROTOCOL_VERSION = 25`**, not 24 — v25 was taken by #242's
  cell-mapping generation;
- **the panel-replay premise is stale.** §2a said a panel wheel "does
  nothing today, on either axis". **#243 landed the replay and it is in
  this base**: the dispatcher is split into `classify_panel_pointer`
  (`src/editor.rs:2985`) and `apply_panel_pointer` (`:3088`), and the
  vertical axis replays for real at `:3277`–`:3278`. **The prerequisite
  is DISCHARGED** — completely, within its scope, and it supplies the
  vertical receiver path. **It discharges none of B1's witness**: 1b
  still owes an end-to-end panel-wheel **effect** witness on **both**
  axes, because B1's fractional accumulator is NEW and no #243 test
  exercises it. Implementation already present is not evidence already
  owed.

**Citation policy, applied throughout:** a citation that makes a claim
about the tree **as it is** was re-measured and renumbered — 45 in the
first pass, plus **six the first pass got wrong**. A citation that records **what an earlier revision cited** is
left exactly as written and its block is labelled *"citations are
HISTORICAL (`72da24a`)"*. Renumbering those would have falsified
sentences whose whole point is that an earlier citation was wrong.

**The first pass verified RANGE, not IDENTITY, and that was the wrong
check.** Every citation landed inside its file, and six still pointed at
the wrong construct: B4's `UnusedButton`/`route_pointer` (`:3803`,
`:3811`, misfiled against `editor.rs` when they are `main.rs`), the
panel paint call (`src/editor.rs:2863`), `OwnCursor`'s **type doc**
(`:2448`) as against its field (`:1774`), the GPU **wrap branch**
(`:8120`) as against the `horizontal_follow` call (`:8089`), and
`scroll_top`'s zeroing (`:6217`), which sits one line before the
residual's. **Every live citation is now identity-checked against the
construct its prose names**, not merely bounds-checked.

**One contract IS sharpened, and it had to be.** Step 3's both-axis
witness said only that "a wheel" moves the panel. **A whole tick passes
straight through #243's existing vertical receiver even if B1's new
accumulator discards every sub-tick it is given** — so the witness was
satisfiable with the very mechanism it exists to protect completely
broken. It now requires **fractional input end to end, per axis**: a
first sub-threshold delta produces no effect, and accumulated
same-panel deltas produce **exactly one**. That is a strengthening of a
witness, not a change to a ruling.

**Otherwise no ruling changes in revision 20.** It is a re-measurement,
three corrections, a discharge, and one conceptual separation —
implementation already present is not evidence already owed.

**Previously, revision 19 — RECONCILES TWO LINEAGES THAT BOTH NUMBERED
THEMSELVES 13.** This document was advanced independently by two
branches, and both called their change "revision 13" — the second
block at `revision 13` below is the other lineage's, left exactly as it
was written. **Nothing is renumbered retroactively**, because rewriting
those numbers would falsify sentences like revision 15's "three defects
in 14".

| lineage | revisions | contribution | approval |
|---|---|---|---|
| `gui-stage1b-pointer-scroll` | 13 → 18 | **§2a, 503 lines** — six corrections, B1's wheel-target enumeration, Q#S1-11 ruled (B, viewport only), the five-clause lifetime contract with L1–L8 | **APPROVED at 18** |
| the panel-replay lane (`1fc3af6`, #243) | its own 13 | the enriched **B1/B2/B3 rows** and the 12-line "Panel-replay consequence" paragraph in §1b | **approved by merge** — #243 landed it on `main`; its status line was never updated and still reads "AWAITING APPROVAL" |

**Both are kept in full, and that was verified rather than assumed:**
the enriched rows, the panel-replay paragraph, `wrap pins horizontal
origin to zero`, §2a, the six-target enumeration and L1–L8 are all
present after the rebase.

**They are complementary, and the one place they could have collided is
worth naming.** The panel-replay lane's B1 row names **three** residual
owners — primary document, panel document, minimap. §2a's model is a
**superset**: R2 panel, R3 terminal, R4 document *(sharing chrome's
residual)*, R5 minimap. So §2a adds the **terminal** as an owner and
**rules that chrome shares the document's**; it does not overturn the
three the table names.

**Where the table and §2a disagree, §2a wins**, exactly as §1b's own
blockquote already says: it replaces B1's undefined "surface" with the
enumeration and B3's "content bounds" with B7's saturated upper bound.
The enriched rows stand for everything else they add — notably B2's
window-targeted `view_left` path and B3's wrap-pins-to-zero.

**Nothing in revision 19 changes a ruling.** It is a reconciliation and
a record.

**Previously, revision 18 — APPROVED (2026-08-14); its citations are HISTORICAL (`72da24a`).** §2a is the 1b ground
truth and its rulings are settled: **Q#S1-11 (B)**, the five-clause
lifetime contract with witnesses L1–L8, B1's six-target enumeration
with discriminators **R1–R5**, and B3's exact saturated bound. Revision
18 answers review of 17:

- **Identity has a second half that R2/R3 cannot reach.** A panel or
  terminal residual is keyed to a surface that *goes away*; the
  **document's and the minimap's live in the long-lived GPU `State`
  and outlive the buffer**. Their reset is a **manual list** —
  `pmacs-gpu/src/main.rs:5922` zeroes `scroll_top`,
  `code_scroll_residual` and `code_scroll_left` one line at a time — so
  a new wheel residual will not reset itself. **R4** (document plus the
  chrome residual it shares) and **R5** (the minimap's independent
  residual) add buffer A→B legs, each with its own mutation omitting
  its own reset. `code_scroll_left` had this exact defect once already.
- **U9/U10 said "the same executable"; the two artifacts differ.**
  `pmacs-9d4963…` and `pmacs-7624…`, different sizes, differing bytes.
  The supported claim is the same *target*, 1,940-test population and
  default intra-binary threading. **"Cargo runs test binaries
  sequentially" is narrowed to the observed cargo 1.95.0 sweep** rather
  than asserted universally. The concurrency conclusion is unaffected.

**§2a took six review rounds (13–18), and each one found a witness that
would have passed against a broken implementation.** Emission-only
panel rows against a receiver that discards; a GPU preservation row
driven by a paint that never calls the follow; lifetime rows whose
setup left held and released authority indistinguishable; mutation
dependents predicted rather than derived; and a residual-identity story
that stopped at the surfaces which get destroyed, missing the two that
outlive the buffer. **None was a design disagreement** — the rulings
survived from 14 and 15 untouched. That is the failure mode §6 names,
arriving once per round, and it is why the R- and L-rows specify their
*drivers* and *setups* rather than only their assertions.

**Previously, revision 17 — SUPERSEDED; its citations are HISTORICAL (`72da24a`).** Two additions and one
correction:

- **B1 gains the two separations its crossing witness could not
  reach.** "Per axis and surface" has two nouns; 16 witnessed one
  category crossing and left both of the others open. **R1** pins the
  **axes** apart (a sub-tick horizontal then a sub-tick vertical over
  one surface must reach no tick), and **R2/R3** pin **identity**
  apart — panel A→panel B and terminal A→terminal B, so "per surface"
  cannot degrade to "per surface *kind*". Each has a mutation that
  shares the store in question. The end-to-end panel row now runs
  **both axes**, the horizontal leg being the one with no handler at
  all.
- **Two mutation dependencies were assumptions and are removed.**
  "Never releases" need not bite L8 — clause 5's wrap/replacement clear
  is a separate path — and "writes point" need not bite L4, which
  concerns the vertical path. Scoped to L3 and L5. Dependents are
  recorded **only after a mutation run shows them**.
- **U10's concurrency claim was false and is withdrawn**, along with
  U9's candidate that prompted it. Detail in
  `docs/ci-red-signatures.md`; the short form is that cargo runs test
  binaries **sequentially**, so the two steps never differed in
  concurrency and no experiment reversed anything.

**Previously, revision 16 — SUPERSEDED; its citations are HISTORICAL (`72da24a`).** Four changes, three of them
corrections to 15's own reasoning:

- **The panel-replay lane becomes a HARD PREREQUISITE in §3's
  topology**, not a note. The defect is "frontend emits, receiver
  discards", so 15's emission-only witnesses would have reproduced the
  blind spot that hid it. The lane merges, **1b rebases onto it**, and
  1b carries an **end-to-end panel-wheel effect** row. 15's rationale
  *"it is not input work"* was wrong — replay includes terminal mouse
  reporting and click-to-focus. The real reason is **breadth and
  ownership**: acceptance 48 (`docs/bottom-panel-framing.md:1719`).
- **Divider and background must BANK NOTHING.** 15 gave them the panel
  cell's residual, which manufactures the surface-switch jump B1
  forbids — motion banked over an inert target, spent on entering a
  cell. They discard both axes, and a **crossing witness** pins it.
- **The discriminating setup applies to every lifetime row**, not just
  L3. With the cursor inside the manual viewport, held and released
  authority produce the **same origin**, so the rows pass either way.
  **L2 becomes a height-only GPU resize**, and **L7 gains a
  content-shrink leg** for the half viewport-widening cannot witness.
- **The mutation table follows §6's dependency-aware rule.** 15's
  heading promised "own rows and no others", which this document
  already says is false and unachievable; mutations now name the rows
  they must **bite** and the **legitimate dependents**.

**Previously, revision 15 — SUPERSEDED. Every citation and every
present-tense claim in this block is HISTORICAL, measured at
`72da24a`**; see revision 20 for the live sites, and note in particular
that "replays nothing" was true then and is **not** true on `0ec13b3`.
Answered review of 14 and
**changed two B-row contracts**, which 14 wrongly denied.

- **B1 is now fully ruled**, not half-ruled. Revision 14 left two
  "must be ruled" cells in the wheel-target table, which is a question
  wearing a table's clothes. Every cell is normative now, and the two
  gaps are closed from measurement: the **terminal** emits both axes
  (the SGR encoder already carries codes 66/67, and a non-reporting
  terminal is inert, matching the TUI), and the **panel** emits both
  axes while its missing **replay** is repaired in a **prerequisite
  lane** rather than absorbed here. Divider, background and chrome are
  ruled too.
- **Revision 14 cited a TEST FIXTURE as the panel's production
  handler** (`src/daemon.rs:6683`, inside `#[cfg(test)]`). The real
  path validates and focuses and **replays nothing** — a pre-existing
  violation of an already-ruled contract, which the wrong citation hid.
- **The GPU preservation witness 14 specified was vacuous.** "The next
  paint" is TUI-only; the GPU's `render()` never calls
  `horizontal_follow`. The lifetime rows are respecified per frontend.
- **Five clauses now have eight witnesses**, not three. 14 left point
  and selection, clamp-absorbed motion, re-clamping, and the authority
  latch under wrap unconstrained.
- **Clause 3's direction was backwards** in 14: a *wider* viewport
  lowers the maximum origin.

**What is normative here, stated plainly:** §2a **changes B1 and B3**.
B1 gains a per-target enumeration it did not have, and B3 gains B7's
exact upper bound in place of "content bounds". B2, B4, B5, B6 and B7
are unchanged.

**Previously, revision 14 — SUPERSEDED; its citations are HISTORICAL (`72da24a`).** Ruled Q#S1-11 (B) with the
five-clause lifetime contract, and gave B3 B7's exact saturated bound.
Both stand.

**Previously, revision 13 — SUPERSEDED; its citations are HISTORICAL (`72da24a`).** §2a's ground-truth
re-measurement for Stage 1b at the post-#240 tip. Every 1b anchor was
stale, as expected; what was not was that **three B-rows describe a
field as empty when it is occupied**, and that **B7 re-opens a question
another framing deliberately deferred**. Its claim that the snap-back
lands on the next *caret event* was corrected by 14 to the next
**paint**, and by 15 to *per-frontend* drivers.

**Previously, revision 13 (the PANEL-REPLAY lineage) — approved by
merge in #243; the status line it shipped with is preserved verbatim
below and was never updated.**

**Status: revision 13 — AWAITING APPROVAL with bottom-panel §5a
revision 16.** Revision 13 changes no previously ruled outcome. It
makes B1–B3's “per surface” scope explicit for the panel-document
surface, closing the ownership gap exposed by §5a's remeasurement:
panel replay is the prerequisite, while GUI 1b owns horizontal tick
production, residuals and the document-panel `view_left` effect.

**Previously, revision 12 — APPROVED.** Revision 12 is §2's ground-truth
re-measurement for Stage 1a and changes no ruling; it carries two
corrections to claims that were wrong at the original anchor too.

**Previously, revision 11 — APPROVED.** Revisions 1–8 rejected; revision 9
is the approved design. Revision 10 recorded a scope correction found
against the 1-pre implementation and **also made a claim about P2 that
review overturned; revision 11 retracts it and P2 is implemented as
written** (§6). **Q#S1-8, Q#S1-9 and Q#S1-10 are RULED.** **1-pre is
IMPLEMENTED**; 1a onward may begin from this document.

**v26, not v25 — corrected by the panel mapping-generation slice.**
That slice (`docs/bottom-panel-framing.md` §5b) **took v25** for
`PanelFramePayload::PresentMapped` / `FrontendEvent::PanelPointerMapped`,
and **it landed ahead of 1e (as #242) because panel-pointer replay
blocked 1b at the time.** Both have since landed and neither blocks
anything now; the version numbering is what survives. Protocol slices
stay serialized; one was inserted in front.
`ADVERTISED_PROTOCOL_VERSION` remains pinned at **20**.

**Verification base: `0ec13b3`** (revision 20). §2 was re-measured at
`4f77491` (2026-08-12) and §2a **originally** at `72da24a`
(2026-08-13); both are historical anchors now, kept so the
re-measurements can be checked against what they replaced.
§2 is **re-measured at `4f77491`** (2026-08-12),
the tip after 1-pre; it was originally taken at `a994f37`. **§2a is
measured at `0ec13b3`** (revision 20) — originally at `72da24a`
(2026-08-13), the tip after 1a and #240 — and it is the base for **1b
only**; it carries Q#S1-11's ruling. Sections
other than §2/§2a were written against `a994f37` and their *rulings*
are unaffected by 1-pre, which changed no behaviour — but **any line
number outside §2 and §2a
predates 1-pre and should be re-checked before it is relied on.** The
1b table's own anchors are superseded by §2a wholesale; read §2a first.

## 1. What this stage closes

Journey **step 5**. **Not step 12** (Stage 4b, P2-gated). Five of nine
§3.1 blockers die here.

## 2. Ground truth — RE-MEASURED at `4f77491` (2026-08-12)

**Originally taken at `a994f37`, before 1-pre.** 1-pre (#237) moved
almost every GPU-side coordinate below, so the section is re-measured
rather than left to rot — **a framing whose ground truth points at the
wrong lines is how an implementation ends up arguing with the tree**.
Two claims were *wrong at both anchors* and are corrected, not merely
renumbered; they are marked **CORRECTION**.

### Still true, re-checked

- **`FrontendEvent`: sixteen variants**, none carrying an open path or
  command invocation. **`PROTOCOL_VERSION = 23`.**
- **`WindowEvent::Ime` is ignored entirely** —
  `set_ime_allowed`/`WindowEvent::Ime` still **zero occurrences**, so
  `Ime::Commit(String)` produces nothing. (1d's D1.)
- **TUI wheel arms unmoved**: `EditorState::dispatch_mouse`
  (`src/editor.rs:3052`), `ScrollUp`/`ScrollDown` at **`:3203`** — 1-pre
  touched only `pmacs-gpu`.
- **The handshake precedes any window**: the client is constructed and
  the handshake done before `run_app` (connect `main.rs:702`, `run_app`
  `main.rs:733`; the old citation `:696` was the enclosing block).
- **1c is producer-side only for Focus/Detach** — those variants exist
  on the wire. **Title, Bell and `Goodbye` are GPU consumer work.**
- **`Outbox::enqueue` returns `false` once closed** and **coalesces by
  kind** (`attach.rs:415`; the old `:414` was off by one at both
  anchors).

### Moved by 1-pre

- **`App::window_event` is `main.rs:4450` and is FOUR lines**, not 655
  at `:2734`. It calls `dispatch_window_event` and performs the exit;
  **routing lives in `route_event`, and the bodies in seven `apply_*`
  methods.**
- **"Eight arms handled, the rest fall to `_`" is now three family
  decision functions** — `route_lifecycle`, `route_keyboard` (plus
  `route_key_action`), `route_pointer` — over **nine** named
  `WindowEvent` variants, with `Route::Unrouted` as the wildcard. **1a
  edits `apply_keyboard` and `translate_key`, not `window_event`.**
- **`translate_key(logical: &Key, …)` is `main.rs:12053`**, not
  `:10975`. It still reads the **logical key** and still truncates via
  `chars().next()`, and `_ => return None` is still there — so **A1's
  witness holds**.

### CORRECTION 1 — `KeyEvent.text` IS read, and always was

The original section said *"`KeyEvent.text` is never read."* **That is
false, and was false at `a994f37` too** (`:2800` there, `main.rs:3251`
now): the AltGr rule reads it, as `is_layout_text(key.text.as_deref(),
pmods)`.

The claim the section meant, and which is true: **`KeyEvent.text` is
never read as the text a keypress INSERTS.** It is consulted only as a
*discriminator* — Ctrl+Alt plus printable text means AltGr rather than a
command chord — and the inserted character always comes from
`translate_key`'s logical key, truncated to one scalar.

**This matters to A5, not just to accuracy.** §5's rule 2 exempts
"printable Ctrl+Alt recognized by the existing AltGr rule", so the
precedence table already depends on the code the section claimed did not
exist. **1a widens `text` from a discriminator to a payload**, and that
is the actual change of kind — stating it as "text is never read" hides
the one place the new payload must not disturb.

### CORRECTION 2 — A4's exit site

A4's witness cited *"exits (`main.rs:2771`)"*. 1-pre moved the mechanism
without changing the behaviour: an idle Escape still exits, but
`apply_keyboard` (`main.rs:3219`) now returns `EventOutcome::Exit` and
**`window_event` (`main.rs:4452`) performs the only executable
`event_loop.exit()` in the crate.**

**A4 therefore deletes a branch in `apply_keyboard` and changes its
return type — it does not touch `window_event`.** And **`EventOutcome`
survives A4**: a native close still returns `Exit`, and
`dispatch_window_event` must still distinguish it from `Continue`.

**Today's two failures are unchanged by any of this:** multi-scalar
keyboard input is truncated to its first scalar, and an IME commit
produces nothing.

## 2a. Ground truth for 1b — RE-MEASURED at `0ec13b3` (revision 20); originally at `72da24a` (2026-08-13)

§2 above was measured for **1a**, at `4f77491`. 1a (#239) has since
merged and #240 landed on top, so **every coordinate the 1b table cites
is stale** — `pmacs-gpu/src/main.rs` is now **22,502 lines** and 1-pre's
router extraction moved the wheel path wholesale. Renumbering alone
would have been routine. It is not what the measurement found.

**`PROTOCOL_VERSION = 25`** now (`pmacs-protocol/src/message.rs:2002`)
— **not 24**, which is what this line said until revision 20: v25 was
taken by the panel cell-mapping generation (#242). 1b remains
non-protocol-bearing either way.

### The anchors, re-measured

**Left column: HISTORICAL — what §1b's table cited, as measured at
`72da24a`. Right column: LIVE, re-measured at `0ec13b3`.**

| the table cited (historical, `72da24a`) | held what then | the real site NOW (`0ec13b3`) |
|---|---|---|
| `main.rs:2061` "minimap is `Elsewhere`" | `PanelCell(CellCoord)` | `enum PointerSurface` `:2099`; **`Elsewhere` `:2109`** |
| `main.rs:3337` wheel reads `pointer_pos` | an `attach_client` line | `apply_wheel` `:3270` and `:3293` |
| `main.rs:3373` falls to `scroll_by_lines` | a bare `}` | `apply_wheel` `:3306`; `scroll_by_lines` `:8417` |
| `editor.rs:3052` `dispatch_mouse` | — | **`:3920`** |
| `editor.rs:3203` scroll arms | a doc-comment line | `ScrollUp` `:4296`, `ScrollDown` `:4299` |

**B6's premise survives the move intact**, and is now stated by the code
itself: `Elsewhere`'s doc comment reads *"Not the band: the document,
the terminal, the minimap, or the chrome."* The wheel's panel branch
(`:3270`) tests `PanelCell` only, so minimap pixels still fall through
to `scroll_by_lines`.

**B1's defect is visible in four lines.** `apply_wheel` rounds to whole
lines and returns on zero:

```rust
let lines = match delta { LineDelta(_, y) => (-y * WHEEL_LINES_PER_TICK).round() as i64, … };
if lines == 0 { return; }
```

`:3254`–`:3262`. The `_` is the **x** delta, discarded at the same site
— so **B1 and B2's witnesses are the same four lines**, and a residual
accumulator is what both need. **There is no wheel accumulator today.**
`code_scroll_residual` (`:1664`) is *not* it: that is the caret-follow
pixel residual, buffer-scoped, cleared at `:6218`. **Reusing it would
be a defect**, not a shortcut.

### CORRECTION 5 — B1's "surface" is not enumerated, and the classifier cannot enumerate it

B1 says "residual per **axis and surface**" and the table leaves
"surface" undefined. Two facts make that a hole rather than a detail.

**Quantization happens BEFORE routing.** The rounding and the
`lines == 0` return are at `:3254`–`:3262`; the panel branch is `:3270`
and the terminal branch `:3292`. So a sub-tick delta bound for the
panel or the terminal is **discarded before anything knows where it was
going**. An accumulator added after the routing decision would fix the
document and leave the wire targets exactly as broken as they are now.

**And `PointerSurface` cannot name the surfaces B1 needs.**
`classify_pointer_surface` (`:7577`) resolves panel geometry only;
`Elsewhere` (`:2109`) is *"the document, the terminal, the minimap, or
the chrome"* — four wheel targets under one name, three of which B1 and
B6 must distinguish. **B1 needs a wheel-target enumeration; it does not
get one for free from the existing classifier.**

Note also a live consequence of `:3270` matching `PanelCell(_)` alone:
**a wheel over the panel DIVIDER or the band's BACKGROUND scrolls the
document today**, though the enum's own doc says the band "still owns
the pixel."

The enumeration B1 carries. **Every cell is normative** — "vertical
today" is the measurement, "vertical RULED" is the contract, and where
they differ 1b closes the gap:

| wheel target | classified | vertical today | vertical RULED | residual owner | horizontal RULED |
|---|---|---|---|---|---|
| Panel cell | `PanelCell` | emits (`:3282`); **vertical replay LANDED in #243** (`src/editor.rs:3277`) | emit **both axes**; the horizontal leg is B1–B3's | per panel | emit `ScrollLeft`/`Right` |
| Panel divider / background | `PanelDivider` / `PanelBackground` | **scrolls the document** | **consume both axes** — the band owns the pixel | **none — discards** | consumed, no emit |
| Terminal | `Elsewhere` + `terminal.is_some()` (`:3292`) | emits (`:3302`) | emit **both axes** | per terminal | emit `ScrollLeft`/`Right`; **inert when not reporting** |
| Minimap | `Elsewhere` | document `scroll_by_lines` | document viewport, **own residual** (B6) | **its own** | inert |
| Document | `Elsewhere` | `scroll_by_lines` (`:3306`) | unchanged | document | `code_scroll_left` (B3) |
| Chrome | `Elsewhere` | document | **shares the document's**, deliberately | **the document's** | shares the document's |

**Divider and background consume both axes, and BANK NOTHING.** Falling
through to the document contradicts `PanelBackground`'s own doc —
*"the band still owns the pixel"* — and is a measurement, never a
decision.

**Revision 15 gave them the panel cell's residual. That was a defect,
and it is the very jump B1 forbids.** Motion over an inert target would
be banked and then spent the instant the pointer entered a cell, so a
gesture that scrolled nothing could complete a tick on arrival — a
surface-switch jump manufactured by the accumulator itself. Consumption
therefore **discards and resets both axes**; if an implementation keeps
state here at all, it must be state that **can never combine with cell
input**.

**Crossing witness (required):** a partial motion over the background,
then a partial motion over a cell, **must not reach a tick** — neither
sub-tick alone is enough, and the first must not be available to
complete the second. The mutation is exactly revision 15's error:
share the cell residual with the background, and this row jumps.

##### "Per axis and surface" needs three separations, not one

The crossing witness above proves **one** of them — a category change,
background to cell. **Two more are unwitnessed by it, and an
implementation can satisfy every row written so far while failing
both.** B1's phrase has two nouns in it, and each needs its own
discriminator:

**Axis.** A single accumulator per surface, fed by both axes, passes
every row above: each one moves in one axis at a time. **R1 —
cross-axis:** a sub-tick **horizontal** motion followed by a sub-tick
**vertical** motion over the *same* surface must reach **no tick on
either axis**. *Mutation: one residual per surface instead of one per
(surface, axis)* — the two half-ticks combine and R1 sees a tick.

**Identity, not just kind.** "Per surface" that means "per surface
*kind*" leaks between two panels or two terminals, which is the same
defect as leaking between kinds but invisible to a kind-level row.

- **R2 — panel A→panel B:** bank a sub-tick over panel A, replace it
  with panel B (the `buffer_id`/`panel_epoch` replacement acceptance 49
  already models), motion over B must **start from zero**. *Mutation:
  key the residual by "the panel" rather than by panel identity.*
  **Revision 22 adds the disposal discriminator R2 alone could not
  supply:** A starting from zero is satisfied by `BufferId` keying even
  while A's stale bank remains. Drive a direct accepted A → B → A (or
  same-buffer/new-`panel_epoch`) replacement with no `Absent`; A's first
  successor half-notch does nothing and its second completes. Run it in
  both mapped and legacy frame families. A geometry-only successor is a
  negative control and preserves the bank.
- **R3 — terminal A→terminal B:** the same, across two terminal
  buffers. *Mutation: key the residual by "the terminal".*

**R2 and R3 are not the whole of identity, because the document and the
minimap do not get replaced — their state OUTLIVES the buffer.** A
panel or terminal residual can be keyed to a surface that goes away; the
document's and the minimap's live in the long-lived GPU `State`, which
survives a buffer switch. **Their reset is manual, and there is a list
to be forgotten from.** Buffer replacement (`pmacs-gpu/src/main.rs:6217`
onward) zeroes `scroll_top`, `code_scroll_residual` and
`code_scroll_left` **one explicit line at a time**, each with its own
comment — including `code_scroll_left`, added later precisely because a
switch *"inherits the PREVIOUS document's leftward viewport and renders
the new buffer scrolled sideways until a cursor motion repairs it — a
symptom nothing about the new buffer explains."* **A new wheel residual
will not reset itself.** Two more legs:

- **R4 — document A→document B**, covering the document residual **and
  the chrome residual it shares** (chrome's owner is the document's, so
  one reset must serve both): bank a sub-tick over the document, replace
  the buffer, motion over B **starts from zero**. *Mutation: omit the
  document residual from the replacement reset.*
- **R5 — minimap across A→B:** the minimap's residual is **independent**
  (B6), so it needs its own reset and its own leg. *Mutation: omit the
  minimap residual from the replacement reset.*

Two mutations, deliberately separate: **one reset omitted at a time**,
because a single "forgot to reset" mutation would bite both legs and
prove neither field is individually covered. This is the same defect
`code_scroll_left` already had once, and the reason it now has a
comment explaining itself.

R2 and R3 also pin the **discard on disappearance**: a residual banked
against a surface that no longer exists must not be inherited by its
successor. That is the identity question and the staleness question at
once, and acceptance 49's epoch machinery is the existing precedent for
answering it.

**The end-to-end panel row exercises BOTH axes.** "A wheel moves the
panel viewport" leaves the horizontal half untested precisely where
the emit-and-discard defect lived — the axis with no handler at all.
Vertical and horizontal are separate legs.

**Chrome shares the document's scrolling and the document's residual.**
That is today's behaviour, and making it normative is what keeps 1b
from having to change both frontends' hit testing for no user-visible
gain. It is written down so it is a choice rather than a leak.

**The horizontal gap is not a wire gap.** `MouseKind::ScrollLeft` and
`ScrollRight` already exist (`pmacs-protocol/src/message.rs:245`,
`:247`) and round-trip (`src/protocol.rs:720`), so **emitting them
needs no protocol bump** — 1b stays non-protocol-bearing.

**The terminal answer follows from the encoder.** `sgr_mouse_report`
(`src/terminal/input.rs`) already encodes `ScrollLeft` as **66** and
`ScrollRight` as **67** (`:130`–`:131`), so the terminal handles both
axes the moment they are emitted. Its guard (`:120`) returns `None`
unless `mouse_sgr` is on and tracking is not `Off`, so a
**non-reporting terminal is horizontally inert** — which matches the
TUI, where nothing consumes a horizontal tick either. No new arm is
needed.

#### The panel replay gap — a pre-existing defect, repaired in a prerequisite lane

**Revision 14 cited `src/daemon.rs:6683` as the panel's `ScrollUp`
handler. That was wrong: it is a test fixture**, inside `#[cfg(test)]
mod tests` (opened at `:6813`). Citing a fixture as production is
precisely the error B1's enumeration exists to prevent, and it hid a
real defect.

**As measured at `72da24a`**, the production path was
`dispatch_semantic_panel_pointer` (`src/editor.rs:2674` *at that base*).
It validated the coord against the panel grid, resolved the side
window, focused when the gesture activated — and **returned `true`
without replaying anything.** Its own doc said so: *"**Replay is out of
scope in Stage 2B-2.** Driving selection, listview rows, or child SGR
reporting is **parent acceptance 48**, which needs the GPU band and
lands in **Stage 2B-3**."*

**THAT IS NO LONGER THE BASE. #243 landed the replay, and revision 20
re-measures it.** On `0ec13b3` the dispatcher is split into
`classify_panel_pointer` (`src/editor.rs:2985`) and
`apply_panel_pointer` (`:3088`), and the effect path replays a **panel
wheel's vertical axis** for real: `PKind::ScrollUp =>
self.scroll_window(side, -SCROLL_LINES)` and its `ScrollDown` twin
(`:3277`–`:3278`).

**So "a panel wheel does nothing today, on either axis" is FALSE on this
base, and the sentence is corrected rather than deleted** — it was true
when written and is the reason the prerequisite lane existed. What
remains is narrower and was already assigned here: **the horizontal
document-panel leg is B1–B3's**, per the "Panel-replay consequence"
paragraph in §1b.

**Ruling as made (historical): 1b does not absorb it, and 1b does not
ship before it.** The replay was to be repaired in a **prerequisite
lane** carrying parent acceptance 48, with **1b depending on that
lane**. Two reasons were given, and the one revision 15 gave was wrong:

1. **Replay is broader than 1b, and already owned.** Acceptance 48
   (`docs/bottom-panel-framing.md:1719`) has `PanelPointer` driving
   *"listview row selection, panel selection, terminal mouse reporting,
   and click-to-focus without disturbing the document mirror"*, plus
   activation ordering and coalescing rules. A wheel is one gesture in
   that set. Implementing it alone from an input slice would deliver a
   fragment of an acceptance criterion owned elsewhere.
2. **The defect predates 1b** and was not horizontal-specific:
   vertical panel scrolling was **equally dead at `72da24a`**. A fix
   belongs where the contract lives, not bolted to the slice that
   happened to find it.

**STATUS AT `0ec13b3`: the ruling was carried out and the dependency is
DISCHARGED.** #243 was that prerequisite lane, it merged, and this base
contains it. The two reasons above are why the work went there rather
than here; they are not live obligations.

**Revision 15 said "it is not input work". That was wrong** — replay
includes terminal mouse reporting and click-to-focus, which is exactly
input work. The reason is ownership and breadth, not category.

##### Ordering — and why emission-only witnesses are not enough

**The defect is precisely "the frontend emits and the receiver
discards".** An emission-only witness asserts the half that already
works and cannot see the half that does not — *it reproduces the blind
spot that let this sit undetected.* Passing panel rows would again mean
nothing about whether a panel wheel scrolls.

**Steps 1 and 2 are DONE. Step 3 is 1b's, undiminished.**

1. ~~The replay lane merges first.~~ **#243 merged.**
2. ~~1b rebases onto it.~~ **Done: 1b's base is `0ec13b3`**, which
   contains #243. §2a's other measurements were unaffected by that
   lane, as predicted — it touched the daemon side.
3. **1b carries an END-TO-END panel-wheel EFFECT witness, on BOTH
   axes, driven by FRACTIONAL input.** Per axis, over a panel cell:
   - **a first individually sub-threshold delta produces NO viewport
     effect** — nothing moves, and nothing is emitted that would move
     it;
   - **further same-panel sub-threshold deltas, once they accumulate
     past a tick, produce EXACTLY ONE viewport effect** — the panel's
     viewport moves once, not zero times and not twice.

   Not "a `PanelPointer` was emitted" — the observable effect on the
   panel's viewport.

   **A whole-tick witness would NOT do, and that is the point.** A full
   tick passes straight through #243's existing vertical receiver even
   if B1's new accumulator discards every sub-tick delta it is given.
   The justification for owing this witness at all is that **B1's
   producer is new**; a witness that never exercises the producer is
   satisfiable with the new mechanism completely broken, which is the
   vacuous shape this document has rejected elsewhere.

**Why BOTH axes are still owed, when #243 already supplies the vertical
receiver.** These are different things and revision 20's first draft
conflated them:

- **The receiver path** for a vertical panel wheel exists now
  (`src/editor.rs:3277`–`:3278`). That is implementation, and #243
  discharges it completely within its scope;
- **B1's evidence** is not discharged by any of it, on either axis,
  **because B1's producer is NEW**. 1b introduces a per-surface
  fractional residual accumulator that did not exist when #243 was
  written and that no #243 test exercises. A vertical panel wheel
  routed through a new accumulator can fail in ways the old whole-tick
  path could not — dropped sub-ticks, residue carried across a surface
  switch, a residual keyed to a panel that is gone.

So: **#243 discharges the PREREQUISITE. It discharges none of the
WITNESS.** The horizontal leg additionally has no handler at all, which
is where the emit-and-discard defect lived — but the vertical leg is
owed for its own reason, not as a formality.

**Panel inertness is therefore NOT an option and is not claimed.** The
panel's contract is "emit both axes with its own residual, and the
panel scrolls."

**Without this table the rows are satisfiable by an implementation that
is wrong**: one global accumulator passes every per-surface row that
only ever tests one surface, and a document-and-minimap-only
implementation passes B1 and B6 while panel and terminal traffic still
carries residue across surfaces or drops sub-tick deltas silently.

### CORRECTION 3 — three rows say "nothing exists" where something does

Each of these reads as an empty field in the table and is not one. The
contracts are unaffected; the **implementation shape** is.

- **B3 — "no horizontal scroll to clamp".** The GPU has a horizontal
  origin: **`code_scroll_left`** (`:1681`), a pixel offset *snapped to
  the column grid*, moved by its own `horizontal_follow` (`:8117`).
  What is missing is a **wheel-driven** horizontal scroll. B3 adds a
  second writer to an existing field, which is a different job from
  introducing one.
- **B5 — "no I-beam".** True as stated, but the cursor already has an
  owner: **`apply_panel_cursor_icon`** (`:7743`) sets `RowResize` over
  the divider and **`CursorIcon::Default` everywhere else**. An I-beam
  written as a separate site would be **clobbered by that else branch**.
  B5 must extend this function, not join it.
- **B4 — "no middle-click path".** 1-pre already built the landing
  site and named this row in it: `PointerRoute::UnusedButton` (`:3803`)
  is documented *"Stage 1b's B4 gives the middle button a meaning
  (PRIMARY-selection paste on Linux) and lands here."* `route_pointer`
  (`:3811`) sends every non-left, non-right-press button there. B4
  splits a variant that already exists.

### CORRECTION 4 — B7 re-opens a deferred question, and the table does not say so

This is the finding that needs a ruling rather than a renumber.

The TUI horizontal origin is **`window.view_left`** (`src/window.rs:386`),
and `horizontal_follow` (`src/editor.rs:5233`) already **pins it to 0
under wrap** — so *B7's wrap clause is implemented today*, for the
caret-follow path. Both frontends share the arithmetic
(`pmacs_protocol::scroll::follow_left`, `scroll.rs:134`), deliberately.

But that function's doc states the premise B7 removes:

> there are no explicit scroll commands, so **every viewport move
> originates here**, and Q#HS4's snap-back hazard cannot arise.

**B7 is an explicit horizontal viewport move.** `docs/horizontal-scroll-framing.md`
is explicit that such commands *"are what re-opens Q#HS4"* (`:189`), and
Q#HS4 is recorded as **DEFERRED, not answered** (`:202`). The hazard is
concrete and already cost this project once — §1.5 there quotes
`scroll_window`, which carries the cursor with a **vertical** wheel
scroll for exactly this reason:

> the renderer has an "auto-scroll to keep cursor visible" pass that
> would otherwise snap `view_top` straight back … so the user's
> mouse-wheel scroll would feel stuck after one notch.

(That citation is itself stale: `scroll_window` is **`src/editor.rs:4583`**,
not `:3628`.)

So a wheel-driven `view_left` that does **not** carry the cursor is
snapped back, and horizontal wheel scrolling "feels stuck after one
notch" — the identical bug, one axis over, on **both** frontends, since
the GPU's `horizontal_follow` (`:8117`) has the same shape.

**And it happens on the next PAINT, not the next caret event.**
`prepare_window_cursor_visible` (`src/editor.rs:5256`) calls
`horizontal_follow` unconditionally as its **first** act (`:5277`), and
`paint_frame` (`:5485`) calls it every frame (`:5590`, and `:2863` for
the panel). Revision 13 said "the next caret event"; that was wrong and
understated the exposure — the origin is overwritten by a redraw with
no input at all.

**B7's stated contract does not mention the cursor**, so its mutations
cannot detect this: a clamp row and a wrap row both pass against a
viewport that is overwritten on the next frame.

#### Q#S1-11 — does a horizontal wheel scroll carry the cursor? **RULED: (B), viewport only**

**(A) is not viable in 1b, and the vertical precedent does not reach
it.** `scroll_window` carries point because it is **TUI-side**, where
the editor owns the cursor directly. The GPU has no such power:
`OwnCursor` (type doc `pmacs-gpu/src/main.rs:2448`; the field is
`:1774`) is *"pmacs-gpu's own cursor
position, **mirrored** from `CursorByte`"* — a read-only reflection of
daemon state. The only wire operation that positions it is `Pointer`,
and `dispatch_pointer` (`src/editor.rs:4376`) sets `active_frontend`,
calls `break_command_chain`, and — by its own comment — *"Every
`PointerKind` moves point or changes the selection."* Carrying point
from a wheel would mean **a new wire operation**, which contradicts
1b's non-protocol scope outright.

Note also that **GPU vertical scrolling already does not carry point**:
`apply_wheel` ends at `send_viewport` (`:3309`). (A) would therefore not
even be internally consistent — it would make the horizontal axis carry
point on a frontend where the vertical axis does not.

##### The lifetime contract (B)

A ruling that only says "do not carry" leaves the origin's lifetime
undefined, which is the part that decides whether the feature works.
**All five clauses are the ruling**, not commentary on it:

1. **Horizontal wheel changes the VIEWPORT only** — never point, never
   selection, on either frontend.
2. **An effective wheel move makes that origin authoritative**, and it
   stays authoritative while the cursor position is unchanged. "An
   effective move" means one that actually changed the origin; a move
   fully absorbed by the clamp arms nothing.
3. **Preserved by** repaint, a same-cursor follow, resize, and vertical
   wheel. **Clamped by** geometry and content changes — clamped, not
   released. **A WIDER viewport lowers the maximum origin**
   (`widest − viewport`), so widening re-clamps downward; the gesture is
   preserved at the new bound rather than discarded, and authority
   survives the clamp. (Revision 14 said "a narrower window", which had
   the direction backwards — narrowing *raises* the ceiling and needs no
   clamp at all.)
4. **A genuine cursor-position change releases it**, and normal follow
   resumes on that same event. Release is driven by the cursor
   *changing*, never by elapsed time or by the follow running.
5. **Wrap and buffer replacement clear it and pin the origin to zero.**
   This is the existing rule (`horizontal_follow`'s wrap branch, and
   the GPU's wrap branch at `:8120`; `:8089` is only the
`horizontal_follow` call). On the TUI the latch must be cleared too; the
GPU has no latch, so clearing the origin is the whole representation of
this rule there.

##### What B7 and B3 must witness

Rows against the **real call sites**. A unit test of a helper cannot see
a follow that runs inside a frame.

**The two frontends need DIFFERENT preservation drivers, and this is
where revision 14 was wrong.** It said "the next paint" without
qualification. **That is TUI-only.** The GPU's `render()` (`:10296`) goes
straight to `render_to_view` and **never calls `horizontal_follow`**;
the follow reaches it only through `ensure_caret_painted` (`:8071`),
whose callers are cursor paths (`:5897`, `:5949`, `:6066`, `:6610`) and
geometry paths — `resize` (`:10266`), `apply_font_facts` (`:10144`),
`reflow_dynamic_code_geometry` (`:10087`). **A GPU wheel-then-paint row
would stay green with the overwrite mutation restored**, which is a
vacuous witness of exactly the kind this framing keeps producing.

##### The discriminating setup, required by every row

**Revision 15 stated this for L3 alone. It is required by every row
whose discriminator is the origin.** If the cursor sits *inside* the
manually scrolled viewport, `follow_left` returns that same origin, so
preserved and released authority produce identical visible state and
an origin assertion proves nothing.

**Setup for L1, L2, L3, L6, L7 and the TUI's L8: the cursor is at a
column OUTSIDE the manual viewport**, so preservation keeps the wheel
origin and release snaps to the caret. **L4 is the deliberate
exception:** the TUI's vertical wheel carries point only when the caret
is inside, so L4 puts it inside and uses the latch itself — not the
coincident origin — as its discriminator.

| # | witness | driver (cursor outside unless the row says otherwise) |
|---|---|---|
| L1 | preservation, TUI | wheel sideways → **a real paint** (`paint_frame` → `prepare_window_cursor_visible`) |
| L2 | preservation, GPU | wheel sideways → **a HEIGHT-ONLY `resize`**; Q#F6's painted-before policy skips the follow, preserving the origin structurally |
| L3 | release, **both frontends** | wheel sideways → a genuine cursor-position change outside the manual viewport; TUI releases its latch, GPU accepts a moved `CursorByte` and follows immediately |
| L4 | cross-axis, **TUI only** | wheel sideways → wheel **vertically**; vertical wheel carries point in the TUI (`scroll_window`), so a naive authority-on-any-cursor-write releases here. Clause 3 says the origin survives |
| L5 | point and selection unmoved | wheel sideways on both frontends → point and selection byte-identical (clause 1) |
| L6 | clamp-absorbed motion does not arm, **TUI only** | at the bound already, wheel further → origin unchanged **and latch NOT armed**, so the next paint follows normally (clause 2's "effective"); the GPU has no authority state to arm |
| L7a | re-clamp on **viewport widening**, both frontends | wheel sideways → **widen** the viewport → origin re-clamped to the exact new maximum; TUI latch remains held, GPU preservation remains structural |
| L7b | re-clamp on **content shrink**, both frontends | wheel sideways → **shorten the widest line** so the maximum falls → origin re-clamped exactly; GPU drives the incremental edit path that bypasses full `reshape` |
| L8 | wrap and buffer replacement clear the **TUI latch** | wheel sideways → toggle to `Wrap` (and separately, replace the buffer) → origin zero and latch cleared, verified by a following `truncate` where the caret rule governs again. GPU origin resets are existing Stage 5 evidence; it has no latch |

**L2 is height-only for the same reason L3 leaves the viewport.** A
resize that changes width also changes the clamp, so the origin could
move for a reason unrelated to authority and the row would not
discriminate.

**CORRECTION (revision 21, implementation).** This paragraph said
height-only "invokes the real follow path
(`resize` → `ensure_caret_painted` → `horizontal_follow`)". **That is
false in the setup L2 itself requires.** `resize` runs
`ensure_caret_painted` only when the caret was painted, and L2's caret
is deliberately outside the manual viewport — so Q#F6's painted-before
policy skips the follow, and no follow runs at all.

**The consequence is that the GPU needs no authority flag.** The TUI
does: `horizontal_follow` runs on every paint there and would drag the
origin back, so only a latch can outrank it. On the GPU the follow
reaches the origin only through `ensure_caret_painted`, which is
skipped exactly when the user has scrolled the caret off screen — and
when the caret IS on screen it is inside the viewport, where
`follow_left` returns the origin it was handed. **GPU authority is
structural: there is no follow to outrank.**

A flag was carried there for a while, written in four places and read
in none. **It has been removed rather than completed** (user decision,
2026-09-02): giving it a reader would have duplicated the
painted-before policy and needed a cursor baseline of its own to avoid
suppressing genuine cursor movement. **The contract is behavioral; the
two frontends are not required to share a representation.**

So the GPU's rows are: **L2** (height-only preserves, witnessing the
policy — mutation: follow unconditionally), **L7a** (widening clamps to
the exact bound), **L7b** (a content shrink clamps **through the
incremental edit path**, which bypasses `reshape` and so bypassed the
clamp), and **L3** (a moved `CursorByte` pulls the viewport back —
the "until the cursor changes" boundary, which without a flag is the
only thing that marks it).

**L7 needs both legs.** Clause 3 promises re-clamping on *geometry and
content* changes; widening the viewport witnesses only the geometry
half. **L7b shrinks the content** — the maximum is
`widest − viewport`, so a shortened widest line lowers it with the
viewport untouched.

**The TUI's L8 is not covered by its existing wrap-origin rows.** Those
assert the origin is zeroed; they cannot see a stale TUI latch surviving
the wrap, which surfaces only on the return to `truncate` when the caret
rule should have resumed and does not. The GPU has no corresponding
state: its existing wrap and snapshot rows assert the complete origin
reset directly.

Mutations. Per §6's dependency-aware rule, each must **bite its named
rows**; where one *necessarily* breaks dependents, the dependency is
named rather than treated as a failure of the mutation.

**A dependency belongs in the third column only when it is
UNAVOIDABLE**, and revision 16 put two there that are not. Predicting
collateral damage is not the same as deriving it, and a predicted bite
that does not occur reads afterwards as a witness that failed to fire.

| mutation | must bite | necessary dependents |
|---|---|---|
| TUI follow ignores manual authority (always overwrites) | TUI L1 | TUI L7a/L7b — their outside caret makes an unconditional follow discard the preserved origin |
| GPU resize follows an unpainted caret unconditionally | GPU L2 | GPU L7a — the follow snaps to the caret before the widen, so the clamped gesture cannot remain non-zero |
| TUI manual authority never releases on a genuine cursor move | TUI L3 only | none |
| GPU moved `CursorByte` does not run `ensure_caret_painted` | GPU L3 only | none |
| TUI authority armed by *any* wheel event, effective or not | TUI L6 | none |
| TUI re-clamp releases authority instead of preserving it | TUI L7a/L7b | none |
| GPU omits the `reshape`-tail clamp / its exact bound is off by one | GPU L7a | the shared off-by-one also bites GPU L7b's exact bound |
| GPU omits the incremental-path clamp | GPU L7b only | none |
| TUI wrap/replacement zeroes the origin but leaves the latch set | TUI L8/L8b–L8e, at the affected site | none |
| either frontend's wheel path writes point or selection | that frontend's L5 leg | none |

**The two removed dependencies were assumptions, not derivations.**

- *"Never releases" → L8.* Clause 5 gives wrap and buffer replacement
  their **own explicit clear**, which does not run through the
  cursor-change release path. An implementation with release suppressed
  and clause 5 intact clears the latch on wrap and L8 passes. **Scoped
  to L3.**
- *"Writes point" → L4.* L4 asserts the horizontal origin survives a
  vertical wheel. A horizontal wheel that spuriously writes point does
  not change what the *vertical* path does, so L4 can pass while L5
  fails. **Scoped to L5.**

**Additional bites are recorded only after a mutation run shows
them** — observed, with the run named, never predicted in advance.

Clause 5's *origin* half is already implemented for the caret path; the
existing wrap-guard removal named in the B7 row remains its mutation.
**TUI L8/L8b–L8e cover the half that is new there — the latch.** The
GPU has no second half.

### CORRECTION 6 — B3's right bound is vaguer than B7's, for the same bound

B7 states its upper bound exactly — *"(widest display-line width − text
viewport width), SATURATING AT ZERO"* — and pins that the final display
column stays visible. **B3 says only "content bounds"** and witnesses
just the negative-origin end. That asymmetry is not defensible: it is
the same bound on the same rule, and B7's exactness exists because the
loose version *blanks the viewport*.

**B3 takes B7's rule verbatim, in the GPU's column-grid units.** The
GPU already reckons in that grid — `horizontal_follow` (`:8117`)
derives `cols = (width / advance).floor()` and `left_col =
(code_scroll_left / advance).round()`, then re-multiplies to snap the
offset back onto the grid, deliberately, so both frontends put the same
first character on screen. The clamp is therefore stated in **columns**
and applied to `code_scroll_left` through the same conversion — not in
pixels, which would break the snap the shared rule depends on.

B3's rows, matching B7's:

- **Lower bound:** the origin never goes negative (already named).
- **Upper bound:** clamped at *widest display-line width − text
  viewport width*, **saturating at zero** — a buffer narrower than the
  viewport clamps to 0, not to a negative.
- **Narrow-buffer row:** every line shorter than the viewport → the
  origin stays 0 however far the wheel is pushed.
- **Final-column-visible row:** at the upper bound, the widest line's
  **last display column is still on screen**. This is the row that
  distinguishes the correct bound from the plausible one.

**Mutation: clamp at the full content width.** It must fail the
final-column-visible row — that clamp lets the origin advance past
every glyph and leaves the viewport blank, which is exactly the defect
B7's revision found and B3 currently has no row to catch.

## 3. PR topology

`1-pre` → `1a`\* → **panel-replay lane** → `1b` → `1c` → `1d` → `1e`\*
 (\* `--protocol`)

**1c is NOT protocol-bearing** under Q#S1-8's ruling. Protocol slices
are serialized.

**The panel-replay lane WAS a hard prerequisite of 1b. It is
DISCHARGED.** §2a found, at `72da24a`, that
`dispatch_semantic_panel_pointer` validated and focused but **replayed
nothing**, so a panel wheel was dead on both axes — a pre-existing gap
in **parent acceptance 48** (`docs/bottom-panel-framing.md:1719`), which
owned it.

**#243 repaired it, and it is in this base.** `0ec13b3` contains the
split dispatcher (`src/editor.rs:2985`, `:3088`) and the vertical
panel-wheel replay (`:3277`–`:3278`). **1b has no outstanding
prerequisite**, and the rebase this revision was written on is the one
the order below called for.

**What does NOT lapse is the witness, on EITHER axis.** The reason for
demanding it stands unchanged: 1b's B1 makes the panel a first-class
wheel target **with its own residual**, and **the original defect was
exactly "frontend emits, receiver discards"** — so a 1b that witnessed
emission alone would repeat the blind spot that hid it.

**#243 supplies the vertical RECEIVER; it does not supply B1's
EVIDENCE.** B1's producer — a per-surface fractional accumulator — did
not exist when #243 was written, and no #243 test exercises it. So
**1b owes the end-to-end effect witness on BOTH axes**: the horizontal
leg because it has no handler at all, and the vertical leg because it
now runs through a new accumulator that can drop sub-ticks or carry
residue across a surface switch.

**Order, as it now stands: the prerequisite is met; 1b implements
B1–B7 on this base and lands the both-axis effect witness.** 1b's base
is **`0ec13b3`**, off `72da24a` as the earlier order required; the rest
of §2a is measured on the GPU and TUI sides and is unaffected.

## 4. Q#S1-8 — RULED: (A), preserve pre-window readiness

`AttachRequest.initial_size` for a semantic session is a **named,
provisional `SEMANTIC_BOOTSTRAP_GRID` of 24×80**. It is **not measured
geometry** and **must never become semantic frame or panel authority**.
**`FrontendCellGeometry`, sent after window creation, is the sole real
frame declaration.**

This **codifies current daemon behaviour**, so **1c stays
non-protocol-bearing** — unless implementation changes that behaviour,
which would be a wire-contract change even with no bytes moved.

## 5. Q#S1-9 — RULED: `TextInput` precedence

**A `KeyboardInput` stays `Key` unless a rule below moves it.**

1. **Named keys and control text remain `Key`**, regardless of
   `KeyEvent.text` — so `Enter`'s `"\r"` never becomes text.
2. **Ctrl/Alt chords remain `Key`**, except **printable Ctrl+Alt
   recognized by the existing AltGr rule**.
3. **Meta/Super-only text stays reserved to the OS.**
4. **Plain printable SINGLE-scalar remains `Key`** — preserving mode
   keymaps and today's typed provenance.
5. **Printable MULTI-scalar becomes one `TextInput`.**
6. **Every non-empty `Ime::Commit` becomes one `TextInput`**, even
   single-scalar.
7. **`Key::Dead` is 1d-owned; 1a buffers nothing.**
8. **`Shift` is already reflected in resolved text** and is **not**
   carried on `TextInput`.

**Provenance and chain.** A **single-scalar** `TextInput` rotates to
`buffer.self-insert` and creates **today's one-codepoint typed
provenance**. A **multi-scalar** `TextInput` **breaks the command chain
and creates no typed provenance**. Both are **one edit, one undo unit,
one hook, one eligible CRDT op**.

**Modal precedence is preserved:** terminals take **raw UTF-8**;
search and minibuffer **consume** text; menu and query-replace **retain
their shadow behaviour**; **only the ordinary document path performs the
atomic edit**.

**Payload cap: 64 KiB UTF-8, oversize REJECTED, never truncated.**

## 6. Evidence

**The promise, corrected.** Revision 4 claimed every mutation fails only
its own clause. That is **false and cannot be made true**: clauses have
real dependencies — D1 gates every 1d row, D3's failure surfaces at A6,
and **E0 and E2–E6 all presuppose E1** (no transport, no receiver). The promise is therefore
**dependency-aware, and split by clause kind** — revision 5 still said
"every clause fails today", which C6 falsifies by design:

- **CHANGE clauses** have a witness that **fails today** and a mutation
  that fails **at least** its own clause.
- **PRESERVATION clauses** (marked **[P]**) **pass today**; their
  witness pins behaviour that must not regress, and their mutation is
  the change that would break it.
- Where a mutation necessarily breaks dependents, **the dependency is
  named**.

P3 remains an accepted structural exception: not headlessly testable.

### 1-pre

| # | Contract | Witness (fails today because) | Mutation |
|---|---|---|---|
| P1 | Every handled family routes through an extracted function | no extracted functions exist | misroute one family → that family's row |
| P2 | Harness records outbound events **and local effects** (exit, redraw, resize, state mutation) | no harness | record outbound only → exit/redraw rows |
| P3 | `window_event` is a thin call-through | — | **structural/code-review invariant; not testable headlessly** (no `ActiveEventLoop`) |

**Revision 10 — one finding against the implementation, not the
design.** The 1-pre seam is built and the table above holds, with one
scope correction that could not be seen from the design. *(Revision 10
also argued P2 was satisfied by classification alone. It is not — see
revision 11 at the end of this section.)*

**P1 has a SECOND structural exception, and it is winit's rather than
this seam's.** `KeyEvent` carries a `pub(crate) platform_specific`
field (`winit-0.30.13/src/event.rs:655`), so **no
`WindowEvent::KeyboardInput` can be constructed outside winit** and no
headless test can feed one to the router. P1's mutation — misroute a
family, fail that family's row — is therefore unavailable for the
**keyboard** family alone.

Three things bound it, so it is a measured exception rather than a
blanket one:

- **The exception does not extend to the pointer families.** Winit
  provides `DeviceId::dummy()` for exactly this purpose, and
  `CursorMoved` / `MouseInput` / `MouseWheel` are constructible. Checked
  before the exception was written down; all three are witnessed.
- **What stays unwitnessed is one pattern arm with no logic in it.** The
  family's only decision — a press is acted on, a release is claimed and
  discarded — is factored into `route_key_action(ElementState) ->
  KeyAction`, which takes a constructible argument and is witnessed
  directly, with both misroute mutations failing that row alone.
- **P3 is now measured, not assumed.** Replacing `window_event`'s entire
  body with `let _ = (event_loop, event);` — a GUI that responds to no
  input at all — leaves **every `pmacs-gpu` test green**. That is the
  exception's true extent: no headless test anywhere in the crate
  observes the delegation. **Re-measured at the current shape after
  revision 11: 265/265 under `PMACS_REQUIRE_GPU=1`** (it was 256 before
  the effect rows existed, and the number is re-run rather than carried
  forward). Revision 11 also shrinks what the exception *covers*:
  `window_event` is four lines, so the unwitnessed residue is one `if`
  rather than a 33-line match.

**Revision 11 — P2 IS IMPLEMENTED AS WRITTEN. Revision 10's argument
here was wrong and is retracted.**

Revision 10 claimed a route-classification transcript covered both
halves of P2 because a route "names its local effect". **The wheel
falsifies that.** A wheel route carries a delta; whether that delta
becomes a viewport update, a panel event, a terminal event or nothing at
all depends on `State`. The route names the *family*, and only running
the body names the *effect* — so classification could not have
satisfied P2, and arguing that it did was a narrowing wearing the
costume of a mechanism.

P2 now has a second harness beside the routing one:

- **`EffectHarness` drives production end to end** — a real
  `AttachClient` over a `socketpair` (real handshake, outbox, writer
  thread, encoder, so the transcript is the wire), a real windowless
  `State`, and `App::dispatch_window_event`.
- **`App::dispatch_window_event` is what made this reachable.** Left
  inside `window_event`, the dispatch would force a harness to
  re-implement it, and a harness that re-implements what it tests
  witnesses its own copy. **P3 therefore narrows from a 33-line match to
  a single `if`**: `window_event` is now `call dispatch, exit if it
  asks`.
- **Local effects are read where they land**: exit from the returned
  `EventOutcome`, redraw from a test-only `render_calls`, resize from
  the surface config, modifiers from `App`, scroll from `scroll_top`.
- **Steps are delimited by a non-coalesceable sentinel key, not a
  sleep** — "this step sent nothing" is otherwise undecidable without
  waiting, and a fixed-duration wait against a writer thread is the
  core-count assumption of PR #235's CI red.
- **The rows never skip.** A missing wgpu adapter is an assertion
  failure; mutation M21 confirms all nine effect rows fail loudly while
  the thirteen GPU-free routing rows stay green.

`M22` (blind to outbound) and `M23` (blind to local) fail rows in both
directions, which is P2's contract executable rather than asserted.

The routing rows stay, and the division of labour is deliberate: the
routing harness answers *where did this event go*, the effect harness
answers *what did it do*. **P2 is owned by the effect rows.** The
routing transcript row is only the sole owner of the *routing*
harness's own recording, which is what keeps that one mutation
surgical — revision 10 claimed it owned P2, and it never did.

**One further correction revision 11 carries, and it is the design
consequence 1a inherits.** Revision 10 stated that Stage 1a's A4 would
leave `EventOutcome` with a single variant and that the type should go
with the Escape branch. **Both are wrong.**

`EventOutcome` has **two producers today**: `LifecycleRoute::Exit`, a
native window close that must always exit, and `apply_keyboard`'s idle
Escape, a local quit. **A4 removes the keyboard one**, leaving **exactly
one `Exit` producer** — the native close.

**One producer is not one variant.** The type survives because
`dispatch_window_event` still has to distinguish `Continue` from
`Exit` on every event it handles: the overwhelming majority of
dispatches must *not* exit, and the native close must. What A4 actually
removes is `apply_keyboard`'s need to return an outcome at all, which is
a change to that one signature rather than to this type.

The crate has **exactly one** executable `event_loop.exit()`, in
`window_event`.

### 1a — `TextInput` (v24)

| # | Contract | Witness (fails today because) | Mutation |
|---|---|---|---|
| A1 | `F1`–`F35` → `F(1..=35)` | `_ => return None` | map `F13+` → `None` → F13–F35 rows |
| A2 | Shift+Tab → `BackTab` with `Shift` set | produces `Tab` | drop `Shift` → A2 only |
| A3 | `ContextMenu` → `Menu` | produces nothing | map to `Char('\0')` → A3 only |
| A4 | Idle Escape reaches the daemon, never exits | exits — `apply_keyboard` (`main.rs:3219`) returns `EventOutcome::Exit`, performed at `main.rs:4452` | restore the quit branch → A4 only |
| A5 | Precedence per §5 (1–8) | multi-scalar truncated; IME ignored | move rule 1 (control text → text) → the `Enter`-in-dired row |
| A6 | One commit = one edit, undo unit, hook, eligible CRDT op | commit truncated to one scalar | one edit per scalar → undo-unit row (**and D3 surfaces here**) |
| A7 | Prompts consume scalars **in order** | multi-scalar never arrives | reverse order → A7's prompt transcript |
| A8 | Terminals get **raw UTF-8, never bracketed paste** | multi-scalar never arrives | route via `Paste` → terminal row shows bracket markers |
| A9 | **64 KiB cap; oversize rejected, not truncated** | no cap exists | truncate instead → the oversize row observes silent loss |

### 1b — pointer and scroll

> **Read §2a first, and note that it CHANGES two of these rows.** §2a
> is measured at **`0ec13b3`**; the line numbers it replaced were
> `72da24a`-era. Every
> line number below was measured before 1-pre and is stale. §2a
> re-measures them — at `72da24a` when this note was written, and at
> `0ec13b3` since revision 20; records three rows whose "nothing
> exists yet" is wrong (B3, B4, B5); **replaces B1's undefined
> "surface" with a normative six-target enumeration**; **replaces B3's
> "content bounds" with B7's exact saturated upper bound**; and rules
> **Q#S1-11 (B, viewport only)** with a five-clause lifetime contract
> and eight witnesses. B2, B4, B5, B6 and B7 are unchanged. **None of
> B1, B3 or B7 is implementable from this table alone.**

| # | Contract | Witness | Mutation |
|---|---|---|---|
| B1 | Residual per **axis and surface** — primary document, panel document and minimap are distinct owners | deltas discarded | share one accumulator → primary↔panel or document↔minimap surface-switch jump |
| B2 | Wheel-right raises the leftmost column of the **document surface under the pointer**; wheel-down raises its top line. Primary-document horizontal state stays frontend-local; a panel-document tick reaches the daemon's window-targeted `view_left` path | `x` discarded; panel replay currently claims and drops document `ScrollLeft`/`ScrollRight` | invert a sign → that axis's row; omit the panel effect → primary moves while the panel remains inert; omit the GPU local redraw request → `code_scroll_left` changes while the waiting event loop never presents it |
| B3 | Each document surface clamps at its own content bounds; never a negative origin, and wrap pins horizontal origin to zero | no horizontal scroll to clamp | remove a clamp → **at-bounds row: that surface's origin goes negative and the view blanks**; reuse primary bounds for a panel → unequal-width surface row fails |
| B4 | Middle-click paste uses **PRIMARY on Linux** | no middle-click path | use `CLIPBOARD` → B4 only |
| B5 | I-beam over text content only | no I-beam | extend over the gutter → B5 only |
| B6 | Wheel over the minimap scrolls the **document viewport** with **its own residual accumulator**; click/drag remains scrub | **a FULL tick already scrolls today** — minimap pixels are `Elsewhere` (`main.rs:2061`) and the wheel falls through to `scroll_by_lines` (`main.rs:3373`). What fails is **fractional accumulation**, and **residual ownership distinct from the document's**: sub-tick minimap deltas are discarded, and a **surface-switch fractional witness** (part-tick over the minimap, then over the document) must not carry residue across | share the document's accumulator → the surface-switch fractional row jumps |
| B7 | **TUI horizontal**: **three columns per wheel tick**, sign per B2; **left origin clamps at 0 and at (widest display-line width − text viewport width), SATURATING AT ZERO**; **wrap pins the origin to 0** | events arrive at `:3203` and are dropped | step of one → the three-column row; clamp at the widest line's **full width** → **the right-bound row blanks the viewport**; drop the wrap guard → the wrap row scrolls a wrapped buffer sideways |

**B7's right bound corrected.** Clamping at the widest line's full width
lets the origin pass every glyph and leave the viewport **entirely
blank**. The bound is *width − viewport*, saturating at zero for buffers
narrower than the viewport, and **the right-bound witness asserts the
final display column is still visible**.

**Panel-replay consequence — the prerequisite is DISCHARGED (#243, in
base `0ec13b3`), the WITNESS is not.** B1's producer is new, so the
end-to-end panel-wheel effect witness is owed on **both** axes and must
be driven by **fractional** input: a first sub-threshold delta moves
nothing, and accumulated same-panel deltas move the viewport **exactly
once**. A whole-tick witness passes through #243's receiver with B1's
accumulator broken. See §3's step 3.

**Ruled after §5a's 2026-08-20 re-measurement.** “Horizontal panel wheel” has three receiver outcomes,
not one. When terminal precedence selects child reporting it already
forwards `ScrollLeft` and `ScrollRight` as SGR codes 66/67. The local
terminal branch — selected by Shift, reporting-off or a scrolled-back
view — has no horizontal viewport and remains inert. **B1–B3 own the missing
document-panel leg**: fractional production/residuals in the GPU, the
lossless `PanelPointer` tick, and the daemon's window-targeted
`view_left` effect and clamp. This is a named deferral from panel replay,
whose source comment already assigned it here; it does not make the
prerequisite lane implement half of 1b early.

**Why B6 changed — and revision 5's reason was wrong.** Scrubbing on
wheel is not *impossible*: the wheel handler already reads the cached
`state.pointer_pos` for surface routing (`main.rs:3337`), so an absolute
target is available. It is the **wrong semantics**: a wheel is a
**relative** gesture, and mapping relative ticks onto an absolute
position would make one notch jump to wherever the pointer happens to
rest. Click and drag remain scrub because those *are* absolute.

### 1c — session and window signals

| # | Contract | Witness | Mutation |
|---|---|---|---|
| C1 | Title `"<buffer> — pmacs"`, `"pmacs"` when unnamed | title is static | drop the name → C1 only |
| C2 | **Visible bell: 120 ms, WHOLE CLIENT AREA visibly changes**; repeats **neither queue nor extend** the first deadline | `Bell` unconsumed | let repeats extend → the repeat row's flash outlasts 120 ms; flash a sub-region → the headless render witness cannot see it |
| C3 | `Goodbye` names the daemon's reason, else an explicitly **locally-classified** transport/EOF reason; never blank | live-loop reason discarded | blank the fallback → EOF row |
| C4 | `FocusLost` precedes `Detach`; `FocusGained` only after attach completes | `Focused` unhandled | swap → C4 only |
| C5a | **Local DPI correctness**: at scale 1→2 with **unchanged logical size**, logical wrapping, row count and hit testing are **stable** while **physical pixels double** — glyphs, clips, caret, hit tests and overlays all rescale | `scale: 1.0` hardcoded (`main.rs:8950`) | rescale glyphs only → **caret, clip and hit-test rows fail while text still looks right**, which is the bug this splits out |
| C5b | **Geometry declaration**: the epoch advances and `FrontendCellGeometry` is emitted | no `ScaleFactorChanged` arm | suppress the emit → C5b only, **C5a still passing** |
| C6 **[P]** | `initial_size` = `SEMANTIC_BOOTSTRAP_GRID` (24×80), **never** frame or panel authority | **passes today** — this codifies current daemon behaviour; the witness pins that a semantic frame/panel is sized from `FrontendCellGeometry` alone | derive a frame or panel extent from `initial_size` → the panel-authority row |
| C7 | Close contract — §7 | see §7 | see §7 |

**C5 was one row and hid half the defect** — suppressing the wire emit
says nothing about glyphs or hit tests staying at scale 1.

### 1d — IME

| # | Contract | Witness | Mutation |
|---|---|---|---|
| D1 | `set_ime_allowed(true)` | zero occurrences — **no composition arrives at all** | omit → **every 1d row (stated dependency, not a matrix defect)** |
| D2 | Preedit overlay with caret and selection; **indices are BYTE OFFSETS** into the preedit string | no overlay | treat as char indices → multibyte row |
| D3 | `Ime::Commit` emits A5's `TextInput` | commit ignored | emit per-scalar `Key`s → **A6's undo row (named dependency)** |
| D4 | **`set_ime_cursor_area` updated** after caret motion, scroll, resize, font/DPI change, and every preedit change | never called → candidates misplaced | update on caret only → scroll and resize rows |
| D5 | Overlay clears on **empty `Preedit`, `Ime::Disabled`, and focus loss** — all three | no overlay | clear on focus loss only → `Disabled` row leaves stale text |
| D6 | Dead-key state owned here; 1a buffers nothing | dead keys dropped | buffer in 1a → D6 by construction |

### 1e — `OpenTarget` (v26)

| # | Contract | Witness (fails today because) | Mutation |
|---|---|---|---|
| E0 | **SUCCESS**: a **successfully handled valid target** is **resolved, installed, hooked and dispatched through the existing file/directory pipeline**, and the originating frontend receives **exactly one terminal result** — `Opened { request_id, buffer_id }` when a commit lands, **or `Handled` when an extension legitimately claims it** | no receiver — a drop does nothing | dispatch without firing the open hooks → the hook row; settle before the deferred commit lands → the async-directory row (Q#S1-10) |
| E1 | Versioned `OpenTarget { request_id: u64, cwd, path }` carrying `InitialTarget`'s raw shape. **`request_id` is unique among a frontend's OUTSTANDING requests; a duplicate is REJECTED at the protocol boundary** and must never replace or settle the original completion | no variant exists | **omit `request_id`** → the two-concurrent-drops row misattributes; **accept a duplicate id** → the reuse row settles the first drop's completion with the second drop's outcome |
| E2 | Source is **authenticated** | no receiver | accept an unauthenticated sender → E2's forged-source row |
| E3 | Primary document `ViewDestination` captured **immediately on receipt**, before any await | no receiver | capture after the open resolves → **frontend-switch row: the file lands in whichever frontend is ambient** (the #231 defect) |
| E4 | **No window identity trusted from the wire** | no receiver | accept a window id → E4's forged-window row |
| E5 | Failures **before terminal disposition** — including completion-aware `Deferred` work — are **visible to the ORIGINATING frontend** as bounded `Failed { request_id, message }`. After `Handled`, responsibility and any later failure belong to the claiming extension, and no second result is sent — see §8 | no receiver | swallow the error → the permission and embedded-NUL rows |
| E6 | `InitialTarget` limits enforced: **32 KiB per raw path**, **non-empty path**, **absolute non-empty cwd**, **embedded NUL rejected** | no receiver | drop the NUL check → the embedded-NUL row |

**The failure taxonomy was wrong in revision 5.** **A missing path is
NOT a failure**: the resolver deliberately creates an **empty
path-backed buffer** on `NotFound` (`src/editor_core.rs:1177`), which is
how "open a file that does not exist yet" works. **Directories are valid
targets too.** Genuine failures are permission denial, validation
rejection (E6), and open errors that are not `NotFound`. Revision 5
listed "missing-path" and "not-a-directory" rows that would have pinned
the opposite of the intended behaviour.

### Q#S1-10 — RULED: the result is TERMINAL

Directory opening completes **asynchronously**, so `OpenTargetResult`
either waits for the captured-destination commit or merely acknowledges
dispatch. **Ruling: terminal.** The result is sent **when the request
reaches a terminal disposition** — for `Opened`, after the commit
resolves; for `Handled`, at the moment responsibility transfers; for
`Failed`, at the failure, **which for several paths has no commit at
all**. Asynchronous failure is reported through the same result — an acknowledgement-plus-later-channel design would need a
second source-scoped mechanism to carry exactly the failures that matter
most.

```
OpenTargetResult::Opened  { request_id: u64, buffer_id: BufferId }
OpenTargetResult::Handled { request_id: u64 }                  // claimed; no buffer attributable
OpenTargetResult::Failed  { request_id: u64, message: String }  // 4 KiB cap
```

**Terminal completion must be TOTAL over the existing pipeline, and
"after the commit resolves" is not** — three legitimate paths reach
neither a commit nor a result:

- **Claimed**: a `path.open-directory` listener returns `proceed =
  false` and the dispatch **returns without committing**
  (`src/editor.rs:1375`).
- **Disabled**: the `directory_handler` slot is clear, which is a
  supported configuration — the dispatch emits a **status message and no
  commit** (`src/editor.rs:1389`).
- **Asynchronous fallback**: the default handler calls `open_async` and
  **returns immediately** (`builtin/runtime/dired.lua:750`), so the
  commit lands long after the dispatch unwinds.

**Mechanism: a request-scoped ONE-SHOT COMPLETION with an EXPLICIT
STATE MACHINE**, carried through the directory pipeline, settled
**exactly once**, and **discarded on source detach** — a frontend that
left cannot be told anything.

```
Pending ──(defer before scheduling)──▶ Deferred ──▶ Settled
   │                                    │
   └──────────(commit / failure)────────┴──▶ Settled
   │
   └──(source detach, from Pending or Deferred)──▶ Cancelled
```

**`open_async` transitions to `Deferred` BEFORE handing the completion
to scheduled work.** The ownership transfer is explicit and does not
depend on whether today's scheduler starts a coroutine synchronously or
a future scheduler defers its first step. Without the transition the
dispatch unwinds while the completion is still `Pending`, the
end-of-turn fallback fires, and the request is settled *before* the
commit it was waiting for.

**The end-of-turn fallback acts ONLY on `Pending`.** A `Deferred`
completion is owned by the scheduled work. **Any later settlement is
exactly-once**: a second attempt against `Settled` or `Cancelled` is a
no-op, never a second message.

*Mutation:* omit the `Deferred` transition, or delay it until after the
end-of-turn fallback → the async-directory row receives a premature
`Handled`/`Failed`; exactly-once settlement then suppresses the later
`Opened` attempt when the commit lands.

`open_async` carrying the completion to the commit is what makes the
asynchronous path terminal rather than silent.

**Total disposition, so no path can fall through:**

| path | settles as |
|---|---|
| commit lands | `Opened { buffer_id }` |
| listener **claimed** and did not settle | `Handled` |
| **replacement handler** ran and did not settle | `Handled` |
| handler slot **disabled** | `Failed` naming that directory opening is disabled |
| **synchronous error** (listener raised, validation, permission) | `Failed` with the reason |
| pipeline unwinds **still `Pending`** at end of dispatch turn | `Handled` if a listener claimed or a replacement handler ran; **otherwise `Failed`** |
| **source detached** before settlement | discarded — nothing is sent, and the completion is dropped rather than leaked |

**`Handled` exists because `Opened` cannot be honest there.** A claim
means a user listener took responsibility and **no buffer is
attributable**; reporting `Opened` would require inventing a
`buffer_id`, and reporting `Failed` would mislabel a supported
extension point as an error. `Handled` is the terminal responsibility
transfer: any later extension-owned failure uses the extension's own
reporting surface and cannot emit a second `OpenTargetResult`.

*Witness:* one case per **live-source** row, each asserting **exactly
one** result. **The detach row asserts the opposite and must not be
read as "one result":** zero messages sent, **no completion retained**,
and a later settlement attempt **ignored** rather than delivered.
*Mutation:* drop the end-of-turn fallback → the claimed and disabled
rows hang with no result at all, which is the defect this ruling
closes.

`message` uses the **existing 4 KiB error cap**. **Both affected enums
get an independent frozen-byte pin on their own preceding final
variant** — `FrontendEvent` for `OpenTarget`, `InstanceMessage` for
`OpenTargetResult` — because an appended variant's own round-trip cannot
detect a discriminant shift in either.

## 7. The close contract

`send_event` only enqueues (`attach.rs:1145`); the writer takes a batch
and releases the lock before blocking writes (`:671`); **`enqueue`
returns `false` once closed** (`:414`).

**So revision 4's order was literally unexecutable** — closing first
would have rejected the `Detach` it then tried to enqueue.

**Contract — state inspection plus any append/transition is ONE atomic
critical section under a single lock hold, dispatched on the outbox
STATE. The lock is released before notifying the writer, waiting on an
acknowledgement, returning, or shutting down.** Holding it while waiting
would prevent the writer from taking the suffix or transitioning to
`Drained`. The four states are tabulated below; this paragraph is their
normative statement, and revision 6's "append `Detach` /
already-closed → fallback" wording is superseded:

- **Open** → under the lock, append the **complete suffix** (`FocusLost`
  when currently focused, then `Detach`), transition to `Sealed`, and
  capture its acknowledgement handle; release the lock, wake the writer,
  then wait.
- **Sealed** → under the lock, capture the **existing acknowledgement**;
  release the lock, then join it. Do not re-append, do not seal again,
  do not shut down.
- **Drained** → release the lock, then return immediately.
- **Failed** → release the lock, then take the socket-shutdown fallback.

**An ordinary post-seal `send_event` REJECTS and does nothing else** —
it must not invoke shutdown, because a healthy drain is in flight.
**`Detach` is exempt from coalescing.** **Wake the writer after
append-and-seal**, or
a sealed outbox with a pending `Detach` waits on a condvar nobody
signals and the 250 ms bound expires on a daemon that was reading fine.

**The exactly-full case, which revision 5 left undefined.**
`OUTBOX_MAX` is **8192**, and a queue at exactly that length is a
**valid OPEN state**: the *next* ordinary `enqueue` both **sets
`closed`** and **rejects the event** (`attach.rs:427`). So terminal
close must not go through the ordinary path. **Ruling: the terminal operation appends the whole required SUFFIX
atomically** — **`FocusLost` when currently focused, then `Detach`** —
reserving **at most `OUTBOX_MAX + 2`**.

**One slot was not enough, and C4 is why.** C4 requires `FocusLost`
before `Detach`; at exactly `OUTBOX_MAX` an *ordinary* `FocusLost`
enqueue is **rejected and sets `closed`**, so the terminal append would
then find a closed outbox and fall back — losing both events. Revision 6
reserved one slot and so contradicted a contract two sections above it.

**Exact-cap witness:** fill to exactly `OUTBOX_MAX` **while focused**,
then close. The transcript ends **`… FocusLost, Detach`**, the writer is
woken, and acknowledgement precedes exit. *Mutation:* reserve one slot →
`FocusLost` is dropped and C4's ordering row fails at exact cap only.

**Outbox states — clean SEALED is not failed CLOSED.** Revision 6 had
one `closed` flag doing both jobs, so a duplicate close or a post-seal
send would see "closed" and **invoke the socket-shutdown fallback,
aborting the drain it should have joined**. Four states, with distinct
behaviour:

| state | ordinary enqueue | close called again |
|---|---|---|
| **Open** | ordinary policy: accepted below the cap; a cap-crossing lossless append is rejected and transitions to `Failed` | performs the terminal append-and-seal |
| **Sealed** (suffix appended, drain in flight) | rejected | **waits on the existing acknowledgement** — never re-seals, never falls back |
| **Drained** (acknowledged) | rejected | returns immediately |
| **Failed** (overflow, or transport error) | rejected | **takes the socket-shutdown fallback** |

*Mutation:* collapse `Sealed` into `Failed` → the duplicate-close witness
aborts a healthy drain and exits before `Detach` is written.

**Acknowledgement point:** the batch containing `Detach` **fully written
and flushed to the socket**. **Bound: 250 ms.**

**Two witnesses, mutually exclusive:**

- **Responsive reader** — all preceding lossless events **and** `Detach`
  are written, acknowledgement occurs, **then** exit. *Mutation:* drop
  the drain → exit-before-`Detach` is observable.
- **Stalled reader** — the deadline fires, socket shutdown yields EOF
  cleanup, the frontend **exits anyway**. *Mutation:* remove the bound
  → this test hangs.

*Seal mutation:* permit a late enqueue → an event appears after
`Detach` in the responsive transcript.

## 8. Wire contracts

| | **1a — `TextInput`** | **1e — `OpenTarget` + `OpenTargetResult`** |
|---|---|---|
| **floor** | **v24** | **v26**, after v25's mapping generation, serialized |
| **encoding** | **appended variant**; never widen a field in place — postcard is positional | appended variants |
| **byte pin** | frozen-byte fixture on the **previous final variant** | same |
| **gate** | daemon accepts from `>= 24`; producer withholds below | **`>= 26`**; producer withholds below |
| **old peer** | a `< 24` frontend **retains its existing `Key` behaviour and its existing limitations** — it truncates multi-scalar input today and ignores IME, and continues to. **The guarantee is NO REGRESSION, not retroactive correctness** | a **`< 26`** frontend cannot drop-open; nothing it already had degrades |
| **bounds** | **64 KiB** UTF-8; oversize **rejected** | **32 KiB** per raw path; non-empty path; absolute non-empty cwd; **embedded NUL rejected**; `Failed.message` capped at the **existing 4 KiB** error cap |
| **pins** | frozen bytes on `FrontendEvent`'s previous final variant | **two independent pins** — `FrontendEvent` for `OpenTarget`, `InstanceMessage` for `OpenTargetResult` |

**E5's delivery mechanism.** `StatusFacts.message` is **global and can
be cleared before the originating frontend observes it**, so it cannot
carry this. **1e adds a source-scoped `OpenTargetResult`, correlated by
a frontend request ID**, so a failure reaches the frontend that dropped
the file and no other.

## 9. Coherence impact (§20)

- **Journey steps**: **5**; **3** (1e); **6(e)** on the GPU column.
- **Islands**: Escape ceasing to be a local quit **removes** one;
  Q#S1-7 adds none → the census **falls by one**.
- **Config registry**: none. The bell's 120 ms is a constant.
- **Background work**: **1e adds no new worker**, but it **attributes
  the existing asynchronous directory operation to an originating
  frontend and request** until terminal settlement — the one-shot
  completion is that attribution — **and drops it on source detach**.
  That is §9's ownership question appearing in miniature, and it is
  answered here for this one operation rather than in general.

## 10. Rulings

**Q#S1-1** native close detaches, `editor.quit` shuts down the daemon
and its attachments, Escape only cancels/round-trips · **Q#S1-5** A/`1e`
· **Q#S1-6** B/`TextInput` · **Q#S1-7** Meta/Super → Stage 2, arc §2.5
and the backlog amended by 1-pre's first PR · **Q#S1-8** (A),
`SEMANTIC_BOOTSTRAP_GRID` · **Q#S1-9** precedence per §5 · **Q#S1-10** terminal `OpenTargetResult`.

**Q#S1-11 — RULED: (B), viewport only** (§2a). A horizontal wheel
scroll never moves point or selection; the origin it sets is
authoritative under a **five-clause lifetime contract**, and B7 and B3
carry preservation, release and cross-axis witnesses at the real call
sites. (A) — carrying point, as `scroll_window` does vertically — is
**not viable in 1b**: the GPU cursor is a mirror of daemon state, the
only wire operation that positions it also breaks the command chain and
changes selection, and a new one would break 1b's non-protocol scope.
This settles `docs/horizontal-scroll-framing.md`'s **Q#HS4** for the
wheel case, which was deferred against exactly this arrival.

## 11. Gates

`./scripts/gate --acceptance gpu_invocation_acceptance` plus touched
input suites, and `PMACS_REQUIRE_GPU=1 cargo test -p pmacs-gpu`.
**`--protocol` for 1a and 1e only.**