Live interruption gate 4.3 — 2026-10-10

All five named cases passed on the newly built compositor and unchanged selected Rust shell. Results, command output and provenance preserve exact commands, source revisions, executable hashes, UTC timestamps and capture origins. This completes task 4.3’s named QEMU integration gate. The separate operator report records the user’s acceptance without asking them to repeat existing checks.

CARD_SHELL_SWAY=/nix/store/awym9l5znn6599q37wnhnnch77ggghjh-sway-unwrapped-riscv64-unknown-linux-gnu-1.12/bin/sway \
CARD_SHELL_CLIENT=/nix/store/yjb89ap4bq5vb29szdzkr5sv9lpw1sz6-card-composition-probe-client-0.1/bin/card-composition-probe-client \
K230_SHELL_RUST=/nix/store/q2rxmp980f9kxi962f29333z9pbixvbk-k230-shell-rust-riscv64-unknown-linux-gnu-0.1.0/bin/k230-shell-rust \
python3 tests/test_shell_motion.py --case reverse --case retarget --case unmap \
  --case refusal --case private-no-flash --output /home/jadams/tmp/k230-m43-proof3

Cancellation correction and observations

Back previously called immediate cs_leave, resetting an unfinished entry or expansion. Second contact used the same immediate path. The policy now seeds reversal from the current progress, offset and anchor; canceled contact streams remain consumed until release. Entry-mode releases drain through the same blocked-contact handling as other modes. Ordinary Back and hard-loss restoration retain their established paths. This fixes the existing command, without adding the successor’s side-edge gesture.

• reverse: finger reversal grows the held live app continuously; release restores it. Back reverses held entry through intermediate rectangles while retaining original focus and draining the canceled contact. Back also reverses a captured unfinished expansion to the original Overview rectangle. Held, finger reversal, Back entry, expanding, expansion reversal.
• retarget: second contact reverses current entry geometry, consumes both contact releases and preserves the app. A new contact during expansion returns to Overview; its remaining stream cannot activate or close the card. A fresh tap then expands the original app successfully. Second contact, new-contact interruption, return.
• unmap: the actual native neighbor/source process exits during held entry, and a selected source exits during unfinished expansion. Remaining apps stay visible and focus returns to a valid survivor; sampled recovery frames contain zero retired-source colors. Survivor, expansion before exit, recovered.
• refusal: the native client receives exactly one graceful close request and refuses it. Actual sampled frames retain live content while pending and after timeout; the policy reports message 6, the client remains mapped, keyboard input reaches it after return and a fresh entry works. Pending, timeout.
• private-no-flash: the public control contains 60,745 neighbor-colored pixels. Changing that live neighbor to private during held entry yields zero identifying content/icon pixels in four moved, held samples and every captured settlement sample. Selecting its card shows the neutral placeholder while its app remains mapped. Public control, private held transition, placeholder.

The prior compositor fails both early cancellation checks: control identities/results, Back failure, second-contact failure. Controls used the committed 844be7e0 fixture; its held-entry checks are unchanged in the final fixture. The later raw-capture change affects only unfinished expansion.

All eight task-4.1/4.2 compatibility cases pass on the new compositor: result, output. That run used committed d5eb34e4; the eight cases and default PNG capture have identical behavior in the final fixture. The host policy suite passes all 38 cases, including exact preservation of current geometry, stream drainage and normal/reduced-motion reversal: host output.

The expansion fixture reads actual raw PPM screencopy pixels, checks an intermediate row, sends the interruption and queries its state before encoding the evidence PNG. This avoids spending the 160ms live input window encoding and decoding PNG. It does not slow the product animation or inject a fabricated policy timestamp. Final recovery requires both the settled IPC mode and actual destination pixels, since a screencopy can precede the next IPC state.

Build and retained dependencies

The guarded component build succeeds, producing /nix/store/dicjv65r9b3gkmwhmdj2k11vzj6bnjsj-k230-card-shell. Only five changed compositor/wrapper derivations build. The prior task-4.2 retention repair preserves unchanged graphics outputs; no Cairo/Pango/HarfBuzz, kernel, image or Rust rebuild occurs. Input comparison shows identical old/new Sway dependency derivations and exactly the three changed adapter/policy source inputs, with copied store bytes matching committed source.

The verified retention receipt extends the previous all-output farm to 10,266 currently realized paths, including 13 new component paths. The durable root is ~/.local/state/tdisplay-k230/retained-builds/coherent-interruption-2026-10-10/build-closure. Every retained path passed validity checking; the new compositor’s actual GC-root query resolves to this root. Global GC policy and prior roots are unchanged; unrealized outputs are not rebuilt just for pinning. The earlier specific GC deletion event remains unverified.

Ownership and remaining gates

Worktree /home/jadams/tmp/k230-coherent-closeout-2026-10-10, branch closeout/coherent-integration-2026-10-10, task base b156d47d. Owned paths: motion and policy fixtures, adapter and policy source, this evidence directory, blob inventory, coherent task record and its work-board override. No board or serial reservation was taken. The temporary build slot is released.

Evidence class: headless Pixman, RISC-V processes under QEMU user emulation, native Wayland clients and injected wlroots input. Settings inputs are synthetic; audio and notification services are unavailable. Captures contain synthetic content. The absence checks cover sampled composed frames, not every output presentation or camera-visible instant. No physical latency measurement, board installation, system-mode boot or real-finger feel is claimed.

The umbrella is 29/39 complete and remains open. Accessibility task 1.5 and the separately named physical/trace/polish gates remain. The existing operator command for task 5.2 remains python3 tools/capture-feature.py coherent-cards --provenance real-touch --duration 60 --description 'Card motion and close recovery on glass' --output-dir docs/evidence/coherent-cards, with an identified installed artifact, board reservation and actual camera proof. This host closeout does not perform it.