qwen-code/docs/design/cua-upgrade-acceptance-2026-10.md

Computer Use upgrade acceptance record (2026-10-16)

English | 简体中文

Implementation follows the approved decisions and platform port ledger. Work is on lazzy/cua-upgrade-2026-10, based on a8eb74fdf5b60851e1fc4a8e258e043273df4411. Version 0.26.0 is the local development target and has not been released. At the F31 native checkpoint, no push, PR creation, shared-branch merge or release workflow had occurred; isolated local merge-validation commits are identified below. The subsequent PR submission decision is recorded next.

PR submission and evaluation schedule (2026-10-20)

The user authorized this feature PR and explicitly moved OSWorld evaluation after release. The native/runtime acceptance facts below retain their candidate identities and limitations; absent benchmark results are not marked passed. The release audit also separates the three Computer Use npm packages from CLI version bumps and publication, while preserving their shared 0.26.0 version and dependency publication order. Production release execution has not been requested in this submission step.

Acceptance clarification (2026-10-20)

The user confirmed mini unlocked, clarified that the previously observed transient macOS target/menu cover is acceptable and expected, and requested a fresh Codex comparison. Strict zero-cover is no longer a blocker. Historical strict-oracle failures below remain factual measurements of cover; they are not evidence that cover disappeared or that macOS makes prevention impossible. Functional correctness, exact target ownership, requested modifier semantics, uncertainty/no replay and recovery remain separate checks.

All remaining native GUI tests and the new comparison run on mini. The earlier local Writer preflight sent zero document actions, and the subsequently abandoned local comparator preparation sent zero Codex actions and was cleaned. Local work covers source, compilation, packages and merge validation. OSWorld/model evaluation remains deferred. The immutable clarification and new run reports are kept in the worktree's ignored evidence directories.

The adopted F31 repair passes two fresh mini Writer background workflows: the original observer reads the exact seed body unfocused before one public App click and focused afterward; one input changes the live text without changing the file; one toolbar Save persists exactly that text in valid FODT XML. The prior v27 negative and rejected F28/F30 experiments remain separate. F31 uses existing native focus preparation and a read-only caret query before the existing AXFocused setter; the public acknowledgement stays conservative and no uncertain action is replayed. Its native tree is 6abc23df3e6066a73f5110bfe77c041def4cc90852b5c5d6bde9ae537033eec3 (453 native plus 12 support inputs). Each successful Writer case has one document window; existing ambiguous-keyboard-destination protection remains and these cases do not prove arbitrary multi-window focus transitions.

Fresh v27 mini canvas, popup and context-menu effects pass 3/3 with receiver modifiers and recovery recorded; the F31 change is restricted to official LibreOffice text areas. The requested official Codex comparison is inconclusive: even the installed matching bundled CLI and existing mini consumer profile fail at application binding with app-server exit -10005, before any native action. A separate ordinary stdio initialization succeeds, so the cause is unresolved. No Codex functional failure, performance comparison or zero-cover conclusion follows. Comparator-owned services, sockets and fixtures were removed while the shared remote service was preserved.

Local implementation

P1–P6 implementation and packaging changes are in an isolated worktree. Node REPL exposes only js/js_reset, defaults to 30 seconds, and preloads global cua and platform documentation. The driver owns app/window resolution, short IDs, observation diffs on all three platforms, screenshot coordinates and dispatch errors. Direct MCP exposes 19 default operations. macOS retains background AX and directed events; Windows/Linux may use foreground fallback only after explicit pre-dispatch refusal. Explicit desktop input and held keys belong to a session; normal end/reset awaits release. Browser integration returns the existing browser-use SDK objects without changing browser behavior.

Native Wayland implementation is removed; X11 applications, including X11 apps under XWayland, remain supported. SDK, native packages, browser-use and Node REPL share version 0.26.0. Standalone npm installations pin dependencies and verify native download checksums. Default Windows installation does not require a signed UIAccess worker; explicit opt-in still checks signing and a safe installation path. Qwen CLI/core product changes consist solely of removing two bundled SKILL.md files.

Local checkpoints: P1 cf89555254, P2 d2995a50c5, P3 b7c4d9c86c, P4 56a3ec2ba5, P5 fcc473d4a6; P6 is carried by the commit containing this record.

Evidence obtained

Scope	Result and limits
Repository build/types	Root build and typecheck pass, including final browser-use type checking.
Node REPL	68 relevant tests pass, including asynchronous reset/dispose cleanup in real child processes. An actual standalone tarball installed into a consumer directory without repository dependencies passes documentation preload, variable persistence and reset checks.
SDK / browser-use	SDK: 51 pass, 6 skip. Browser: 594 pass. Wrapper tests use the original SDK; they do not establish Chrome GUI success. All three npm packages were actually packed; publishing was dry-run only.
Linux native	Locked all-target checking and SDK/driver builds pass in an isolated ARM64 container. Coordinate tests: 38; Computer Use: 5. Real Xvfb desktop chain: 96/96; App coordinate chain: 29/29. Actual display resize was skipped.
Linux first installation	Real archive/checksum HTTP download, cache hit, incomplete-cache repair, bad-SHA refusal, missing-checksum refusal and postinstall: 14/14. The actual downloaded SDK/bridge loads from cache and passes GTK input, screenshot and key-release checks: 14/14. This does not use native overrides or development symlinks.
macOS native	All-target checking and ARM64/Intel SDK/bridge builds pass. Both combined universal files contain arm64/x86_64. Loading was executed only on ARM64; Intel runtime and notarization were not verified.
Windows	GNU cross all-target checking passes. P6 did not execute desktop/UAC tests. Pure-state regressions establish that post-dispatch UIA errors and worker disconnection no longer cause a second click.
Release configuration	Shared-version constraints, dependency publication order and production gates pass. The workflow was not triggered.

Closing review repaired three consumer defects: an old normalization environment variable transformed canonical pixel coordinates twice; a post-dispatch Windows UIA error was considered safe to click again; direct MCP initialize still described obsolete tools and normalized coordinates. Failed reproductions and post-fix evidence are retained separately.

The final P6 native source manifest is v5: 688 files, tree SHA-256 c8a662cdc5c53eaa4cbbd14b146b8e844a86fc060d1b8f16a8f7bb4014c7dbee. It again passes Linux/Windows GNU all-target checks, actual MCP initialize/list 11/11, exact desktop chain 96/96, actual download 14/14 and cached SDK GUI chain 14/14. SDK/driver were rebuilt for v5; the bridge explicitly reuses the fresh v2 build because its source and ABI did not change. Earlier v2/v3/v4 results retain their original identities.

Raw logs and independent reports are in .qwen/e2e-tests/cua-upgrade-2026-10-artifacts/ in this worktree. Main report: .qwen/e2e-tests/cua-upgrade-2026-10.md; P6 report: p6-validation.md; self-audit: .qwen/investigations/cua-upgrade-2026-10/parent-self-audit.md.

After P6 fixes, two complete diff/consumer audit passes found no further issues, and the independent P6 boundary review was CLEAN. Codex /review is unavailable in this environment; Qwen Review was not used as a substitute.

Historical P7 checkpoints (2026-10-19)

mini is unlocked and executes actual AppKit input, screenshot and key-lifecycle tests through the existing GUI Node host. Windows has built the real MSVC driver, SDK and pinned Node bridge. Linux executes GTK/AT-SPI tests in an Ubuntu Xorg guest on ECS. Earlier lock-screen and cross-compilation-only limits no longer describe the whole current state; historical P6 results retain their artifact identities.

Review of upstream 0.20.0 → 0.35.4 found applicable fixes beyond the P4 ledger. Current changes and evidence include:

Fix	Evidence and remaining limits
Linux top-left window coordinate offset (#4967)	Same GTK scene hits an adjacent row before the fix and the exact target afterward.
Linux missing _NET_WM_PID (#4214)	Removing the property loses discovery/observation before the fix. XRes preserves the correct PID, window, AX and screenshot afterward.
Linux temporary keyboard mapping lifetime	Candidate and upstream both lose remapped Unicode while the GTK main loop is busy for 3 seconds. The queue-barrier candidate preserves input in busy GTK/Chrome scenes. Final v5b timeout returns normal sent/unconfirmed without replay; missing protocol support refuses before input. This does not substitute for physical MPX or all toolkit/IME acceptance.
macOS non-finite window dimensions (#5125)	Actual CFNumber tests fail before and pass after, retaining normal and negative coordinates.
macOS screenshot PATH (#3755)	Narrow PATH reproduces ENOENT on the real machine; the candidate returns an actual 1920×1080 PNG under narrow and normal PATH.
macOS raw clicks (#2907/#4690/#5137)	Same-PID parent/sheet reproduces lost middle-click targeting and duplicate events. Two real-machine reruns restore exact-window targeting and the correct event-pair counts. Default App middle-click was already correct and is a separate route.
macOS Electron background scrolling (#4861/#5079)	Normal v4 SDK passes seven native cases: raw page/inner × AX/pixel and default App inner retain page +404px or inner +114px, with the other region unchanged. Exhausted inner raw/App refuse with actual sent:false and no offset changes. v2/v3's reversed -96px down movement remains the before result. Read-only native diagnostics identify ROW35 above the viewport as a false bottom sliver; v4 excludes the wrong document-order candidate. Each case makes one public request, without replay, foreground fallback or browser APIs. Main routes retain uncertain ACKs. Six geometry unit tests pass. v2's controlled 43 cases and the later controlled-program startup timeout remain separate; 44 passes are not claimed. Normal v7 independently repeats and passes all seven GUI cases. This does not establish all directions, AX layouts or human concurrency.
Element token/native-object binding (#3616/#3873)	Actual core/token/cache controlled interleavings reproduce old tokens reading new objects. Capture/resolve/reverse cases pass afterward and all three consumers compile. Windows native-v2 MSVC cache: 5 pass, 2 explicit skips; tokens: 30 pass. No GUI click was performed by this reproduction.
MCP schema (#4888)	Actual default 19 and EXTRA 70 wire declarations pass offline compatibility checks; runtime still refuses invalid target combinations. No real model provider was requested.
Windows GUI-host console (#5136)	MSVC tests verify no console appears for a console-less host and inheritance remains for a console host.
Windows screenshot failure cleanup (#4333)	Actual GDI allocation/fault tests pass without handle growth over repeated failures. Interactive screenshot acceptance remains separate.
Windows shortcut environment variables (#3975)	Real IShellLink returns an unusable literal path before, and resolves the target while retaining arguments after.
Implicit-session idle recovery (#4283)	The same real MCP connection resumes after about 34 seconds. Explicitly ended/named sessions remain terminated; old element tokens are invalid.
Recording ownership/stop/time (#3632/#3714/#5144/#5145)	Public entrypoints verify named ownership, encoder errors and timing. Independent retest finds an omitted implicit connection; a second fix passes same/cross-connection and lifecycle regressions.
macOS recording completion (#4238)	Real-machine before results include false empty recordings and files growing after success. Five candidate 120ms recordings decode fully immediately; file SHA remains unchanged one second later.
Recording AX budgets/session lock (#4215)	Actual ToolRegistry with a controlled provider establishes that a hung after-capture no longer blocks state/stop. Six cases cover the 2-second return ceiling, same-PID busy refusal, late-result discard and stop→start isolation. Two native MSVC tests cover recording-thread COM initialization and release order, with all-target checking. This is not a GUI AX-hang test.
macOS Retina metadata (#3328)	At the same actual display mode, 3600px/1800pt, the public interface returns 1 before and 2 after. This does not imply default click coordinates were wrong.
macOS accessory-app identification (#3456)	On mini, the same installed accessory app loses running status in both default/running_only before; native-v3 returns actual PID 9402 through both public entrypoints. Exact installation paths and every running instance are retained; another copy sharing a bundle ID is not substituted.
Symlinked output directories (#4210)	Manifest and public ToolRegistry tests refuse a new file below actual /tmp-style directory aliases before and resolve its authorized path with one dispatch after. Outside-root, broken-link and file-parent cases still refuse. This is not a GUI screenshot test.
Windows named-pipe cleanup (#4279)	A private Win32 pipe reproduces creation failure and recovery after release. Source adds bounded retry and shared PID/SDK cleanup. Native-v4 MSVC driver/SDK build, 6 cache tests and 30 token tests pass; production daemon retry/cleanup still needs the interactive desktop entrypoint.
Uninstall MCP configuration ownership (upstream ff770f5d5, etc.)	Isolated fixtures verify five foreign configuration classes are retained and removal uses the actual executable of the selected payload. No complete uninstall ran. Configuration may already be committed if later deletion fails; original-byte backups permit recovery.
Typed-schema numeric formats (#3462)	The upstream regression fails before and passes after. Inputs/outputs retain valid formats and literals; 37 contract tests and 1 generator test pass.
Windows installer ancestor protection (#4398)	Twelve independent controlled cleanup/legacy-delegation checks pass. PID cleanup protects ancestors and skips task End when a driver ancestor exists. Sealed UnitOnly passes without changing PATH or performing actual task/full installation.
Windows autostart/isolated installation (#3180/#4284)	32 controlled tests, 11 native MSVC unit tests and all-target checks with restored compile fixtures pass. Cancellation/null no longer reports success; replacement does not first delete the task; isolated release installation preserves the shared task. Real UAC, scheduler atomicity, login startup and full installation remain separate.
macOS release-install recovery (#3297)	Actual shell branches reproduce copy failure losing the old app before. Eighteen isolated scenarios and 350 independent checks pass after, covering staged/post-copy verification, copy/rename/link failure, retained backup on restore failure, first install, TERM and repeated cleanup. Permanent regression tests include original-byte restoration. These are controlled filesystem transactions, not actual install/signing/permission operations. No automatic TCC reset or SIGKILL/power-loss recovery is claimed.
Chromium AX readiness (#3783)	Sixteen controlled actual-function cases, 2 old/new publication races and 2 actual core budget-propagation tests pass. A shared 500ms readiness budget adds no polling for actions/screenshots/recording. Real Chrome refuses opt-in; the accepted path remains unverified.
AppKit launch-window recovery (#4309)	The 1-second active-search budget shares the original observation start. Actual-function controlled tests: 27; G17 outer-consumer regressions: 49. A fix removes active retry after sleep exhausts the budget. One Mac unit test and Mac/SDK all-target checks pass. Final App body/native IPC are outside this ceiling; real AppKit launch timing remains unverified.
Ordinary macOS AX traversal budget (#3882)	Controlled actual traversal reproduces raw/App reading after 1 second before. After: 27 traversal scenarios and 3 node-admission checks; preparation is separate, an exactly-at-deadline complete tree is not falsely truncated, and recording absolute budgets/legacy node limits remain intact. Actual core ToolRegistry/default App/Mac version/cache/token consumers pass 6 controlled snapshots and 22 independent checks: old-ID refusal, stable resolved bindings, partial-result warning and cleanup. Six tree, 4 cache and 27 core version unit tests plus Mac/SDK all-target checks pass. Full platform/SDK/GUI slow-AX behavior remains unverified; no whole-call 1-second hard deadline is claimed.
macOS backing-store capture (#4996)	Thirty-two controlled after checks pass; current-Space public/private raw/App routes return correct PNGs. A later normal candidate captures B on Space68 while A is foreground on Space1: raw/App images and five ROIs pass and are byte-identical. All 120 capture samples retain Space1 and foreground/topmost A; synthetic input reaches A 6/6. Normal binaries do not record the private route, so causality is not inferred. The full batch remains FAIL because its fullscreen-exit-button precondition was false; cleanup passes after owned processes exit.
macOS omitted AXWindow recovery (#4068/#4085/#4509)	Four native files add exact PID/SPI identity, restricted remote-token recovery and default App/tree/facts consumers. Three Mac unit tests, Mac/SDK all-target checks, 24 independent boundary checks and 49 actual outer-consumer checks pass. Actual omitted-window acceptance remains incomplete.
macOS special-key flags	After real Space preparation fails, a no-delivery native reproduction identifies missing structural flags shared by candidate/upstream. Four named-key builders pass native 128-keycode comparisons, explicit modifier/release and ambient-isolation checks; 11 unit tests and Mac/SDK all-target checks pass. One normal candidate Ctrl+Left is independently observed to return to Space1 about 638ms from call start. There is no resend; B does not receive the system-consumed Left, and its actual event flags are not inferred.

The stable Linux nested-Xorg focus/end-session batch passes 31 checks; one insufficient TCG-timing case remains inconclusive. Unicode and mapping restoration pass under normal response. A later 3-second GTK-main-loop pause makes 13 remapped Unicode keypresses become NoSymbol in both candidate/upstream, independently identifying premature map restoration. The original frozen primary-GNOME batch remains an infrastructure confound. Client ping passes in GTK/Chrome, but Chrome responds before DOM input completes, so it cannot establish semantic success. Native-v5a/v5b separately validate mechanism and final response: timeout can still lose text and requires observation before another action.

MPX now confirms the complete ordered batch from the exact virtual keyboard. Unconfirmed/failed devices retain pending state; their next request refuses before mapping, focus or input. Initial warm-up also needs complete confirmation before temporary-key planning. Independent controlled lifecycle tests improve from 7/10 violations before to 10/10 passes after; 13 event-matcher cases, 12 Linux native tests and all-target checking pass. Real kernel inter-batch delay, hot-unplug and physical MPX were not established by those controlled results. Current v7 native regression adds 16/16 MPX and 7/7 key-alias passes; dedicated real uinput/evdev/Xorg acceptance is ongoing.

macOS T04 raises the target over the user's window throughout three native-v3 runs, about 3.1–3.3 seconds, while the user window remains front/key and receives all synthetic input. Dual-query diagnostics distinguish the complete window list from actual visible order. Fix 1 switches to visible order, but reactivation succeeds without restoring order and the rerun fails. Fix 2 raises only the current foreground AXFocusedWindow: three runs remove sustained cover but retain 99.4, 200.5 and 192.8ms transients. The zero-interference gate has not passed. One preparation-only diagnostic observes no cover, without excluding short transients or guard masking. A separate requested-pair-only switch to public CGEventPostToPid confirms actual click effect via source-PID mouseDown, native field editor and final forced AX focus, yet A observes 194.110ms cover and independent WindowServer ordering 196.695ms. Public publishing does not demonstrate a remedy and is not adopted in production. Synthetic keys reach A 10/10; only one key occurs within the click and none during observed cover, so this does not prove human-input safety during cover. T06 menu/T10 target self-activation regressions pass, as does exact Unicode readback through explicit Desktop foreground input. Later exact-window SPI tightening belongs to a new candidate. The independent two-top-level-window fixture has not started successfully; parent/sheet tests do not replace it.

Electron native scrolling has the main-route port and seven-case real-machine evidence, including the reproduced exhausted-inner reversal. Without visible anchors the original geometry heuristic remains; reordered/multi-column AX graphs remain outside the proof. Ordinary AX partial-result and actual-consumer controlled checks are complete; full SDK/native slow-AX boundaries remain. Cross-Space capture has the effect evidence above. Exact AX-window recovery, accepted Chromium readiness and AppKit launch recovery still require their own native cases. Cross-Space AX returns 85 elements with explicit incompleteness and does not prove remote-token recovery. Default App selection, pre-action checking and observation forwarding remain in scope; changing only the raw walker cannot establish completion.

Full-diff review also finds extra native references not owned by the macOS recording hook. Independent actual walker/hook/cache tests combine controlled AX data with real CoreFoundation retain counts: three before calls leak 1, 2 and 3 references; repeated complete/incomplete after calls return to zero, existing tokens remain valid and seven JSON payloads differ only in elapsed time. The fix reuses the unpublished snapshot owner without registering/replacing action tokens. Three native regression tests pass; all 39 evidence entries are verified byte-for-byte. This is not native GUI/AX acceptance and does not cover serialization failure or actual budget truncation.

In the same review, independent complete-tool-module tests with controlled providers reproduce raw double/right-click replay through pixels after semantic effect followed by AX error. Once AXOpen/AXShowMenu is attempted, the candidate returns normal sent/unconfirmed with a warning and does not replay. Successful semantic and unadvertised-semantic pointer routes remain. Six double-click and 4 right-click controlled cases pass; three uncertain responses retain unverifiable/accessibility and warnings through actual core public projection and typed validation. A mistaken actual-foreground report for a foreground request is also fixed: AX without a foreground transaction reports background. The added native projection regression and existing route test pass. Default App's early forwarding is a control, not evidence it shares the bug. An actual AX server effect-then-error GUI proof is still pending.

G34 explicitly rejects #5124/#4856's blanket native omnibox paste/newline refusal: the approved selected App/window contract allows native input at current focus. ASCII Return and non-ASCII AX insertion are tested separately; insertion readback does not prove navigation. Hotkey, pressKey and paste are reviewed individually. #4835 cold foreground field/selection differences remain a narrow raw/EXTRA reproduction task, unreachable through default App; no AllWindows or fixed stabilization sleep is introduced.

G07's latest production-entrypoint test exits during SDK creation in SSH Session0 for lack of an interactive user session, in 23ms, before reaching named-pipe acceptance. No private pipe exists and the shared driver is unchanged. Pipes themselves can work in Session0; that does not make this entrypoint reachable. G23's second standalone startup diagnostic compiles but has no readiness/stage logs after its single 8-second launch. Another diagnostic of the same binary and ordinary Node launch remains unready after that window. One 1-second sample exits 0 with 89 _dyld_start +0 main-thread samples and unavailable images; it does not locate the wait mechanism. Neither case dispatches AXPress; the later diagnostic creates no SDK/AX session. No TCC/EDR cause is inferred or security settings changed on that basis. An existing Electron host with a task-owned native addon is being prepared as a new fixture.

All 499 upstream changes are classified; the former insufficient-evidence and unreviewed-P4-reference categories are empty. Applicable differences still need reproduction, porting or explicit disposition; classification is not acceptance. The latest 2026-10-19 whole-JavaScript build/typecheck pass; SDK: 51 pass, 6 explicit skips. The initial missing-corepack failure remains, followed by success using a task-local entrypoint and existing pinned local caches, without global installation. Normal v7 has 453 native inputs plus 12 exact compile-support files, tree 70001802535ebff45ed2f9bc8a0a55b0ba7edfb6f07d1c76aae1b5eb6a002693. Mac/SDK, Linux/driver/SDK and Windows GNU/driver/SDK all-target checks and the default SDK build pass. Linux x64 and Windows MSVC driver/SDK releases now also build from that exact manifest. Windows adds 2 COM, 11 autostart and 1 bounded-capture pass. Linux's current normal direct-MCP GUI tests pass GTK 7/7 and Chrome 3/3. The unchanged core retains its exact-source eight-check checkpoint. Earlier omitted-fixture failures are retained.

Normal v7 independently passes G05's seven GUI cases using SDK SHA-256 4d2b048131c42055991f1716b41691715da9abf3b7b176fc125548a12dff60fe. Independent fixture IPC confirms inner +114px/page +404px and unchanged exhausted offsets. All 143 ordering/pointer/clipboard-count samples retain A; owned processes/LaunchAgents are cleaned and shared processes retain their lifetimes. The root verifies all 634 referenced evidence entries. Sampling is 8.444–12.213Hz, not proof of zero transient interference or human concurrency.

P7's first full audit covered 89 changed paths and found the recording/replay issues above. A later complete clean pass was followed by a second pass finding missing bilingual design documents; translation repair resets the consecutive-clean count. Two complete clean passes over the final updated scope are still required. Full three-platform regression remains ongoing. Detailed before/after results, invalid batches and artifact identities remain in .qwen/e2e-tests/cua-upgrade-2026-10-artifacts/p7-*; P6 results do not establish acceptance of subsequent P7 changes.

Historical external acceptance checkpoint

Windows ordinary SSH is restored and current console/runner/shared-driver lifetimes are rechecked. The user explicitly approves the task-owned \QwenCuaP7Acceptance task: no triggers, existing Administrator InteractiveToken, Limited, no stored password, at most 2 hours, verified deletion afterward. Current v7 interactive acceptance is being prepared. No other process token is borrowed. The user also approves normal Automation dialogs for the existing mini Node host controlling Finder/TextEdit, and test-machine permissions needed for this work; no TCC database edits are required. Linux's dedicated real uinput/evdev/Xorg chain is a separate topology from the nested guest. Nested Xorg alone does not establish physical user input, MPX or XWayland acceptance.

Three-way tool comparison and OSWorld-20 model evaluation remain incomplete. Earlier provider 400s remain historical failures. Current gpt-6.1-sol passes global qwen 0.25.2 text preflight and actual CLI→MCP→Node REPL execution. The third effective synthetic-image preflight returns a real PNG and correctly identifies all four color/shape/position facts, using 2 model requests and 1 tool call. The first two timeout/transcription refusals produced no image and remain separate. No native desktop session was created, so this is not GUI acceptance.

All 20 local task definitions are located and frozen; they default to Linux and only two contain explicit Windows branches. A bounded mini search of 1,003 non-credential text files did not locate the historical adaptation. The existing stable20 set uses different tasks/scaffolding. The user now explicitly authorizes read/export of historical groups group-5cff67aa55934a09a45160e3194b5801-s1 (macOS) and group-bc7a3539903b4735bc3508e04e5791d5-s1 (Windows). Each actual AP request passes the exact official mini AP Client 0.5.1 version gate. Group metadata, jobs and evaluations are recovered; artifact export is ongoing. Raw exports stay private on mini; credentials are not copied into this repository or local artifacts. Both groups contain 20 terminal Succeeded jobs, which does not imply task success: macOS mean score 0.2613, 1/20 passed; Windows 0.1206, 0/20 passed. Their template commits differ (d1b8341d17659205b9aa735e0390f54301be0dc7 / b70f9f90b3df26f177d78279bc942490f7cc37e7) and both use azure.gpt-6-astra, unlike the current gpt-6.1-sol preflight. No new AP job, retry or cancellation is authorized or performed. Current candidate OSWorld execution count remains 0, and no matched success-rate, token, turn, wall-time or Codex/upstream improvement claim is made. These pre-release gates remain active.

Historical v13 P7 acceptance snapshot (2026-10-19)

This historical snapshot superseded the earlier checkpoints at v13. Its source identities and open items describe that checkpoint; the current scope and later verification are recorded below.

Current candidate and distribution

The current native freeze is v13: 453 production/build inputs plus 12 exact compile-support files, tree SHA-256 c43e1b300706eff833a9999f889b7f7c418a414b6863d3b3c102ca339770f83c. Linux uses its fresh v13 CLI and SDK. macOS tests use the normal default-feature v11 SDK (4131a02af8d64a88572e981dbd9dfa5e7d0eaa9ec5ac5509be341c159d59ce9d); Windows uses the native MSVC v10 executable (c5ca0054810eb4512986aef0f6231e81497ada15d1809bcb9bd5521016ef3fca) and SDK (91f871c885e13e856ee8284af0efed149232abbf58d9c7fc4584dee3d1f02283). The intervening Linux-only changes require a target-specific source-equivalence audit before those other artifacts establish current acceptance.

All three publishable packages pass local npm pack dry runs at 0.26.0: CUA SDK 34 files, Browser Use 9 files and Node REPL MCP 46 files. The whole JavaScript build and typecheck pass, with SDK 51 pass and 6 explicit skips. The complete current working-tree snapshot merges without conflict with main a250fd033941cab10c88d6eb8beb5756405193b9; no branch/ref, push, PR or release was created by that object-only check. Final formatting and two complete clean source-audit passes remain required.

Native fixes and actual effects

• macOS G23 now has an actual AppKit AX server proof: four v10 cases cover raw/default App with a handler returning NO or raising NSException after toggling. Each performs one request and one effect. The exception response is normal sent/unconfirmed with no pointer replay. Returning NO can still produce AX success and is kept separate. A v11 regression is pending.
• macOS default App T04 now uses exact editable AX focus for a single unmodified left click on a supported native field. Three fresh v11 click-only cases independently confirm the field editor and fresh AX focus without value changes or observed cover. All observed canary characters reach A, but none of those click request windows contains a new keyDown; they do not prove input concurrency. The full click-and-type regression passes; a higher-frequency overlap run is ongoing. Pointer-only diagnostic variants that still raised B are not adopted or counted as fixed.
• Linux MPX successful delivery now carries an explicit background/LinuxUinput execution record, avoiding a public action_outcome_mismatch after text had actually arrived. Ordered raw-key confirmation, pending-device refusal and session cleanup prevent replay after timeout.
• Openbox 3.6.1 promotes a virtual master's core FocusIn to global activation. Fresh zero-key controls attribute this to the WM/Xorg interaction. v12 refuses MPX keyboard before map/device/input work on that identified WM. Six native requests return background_unavailable/sent:false with zero input. The public hybrid route may then use foreground once. It restores the original foreground, core focus, pointer, map and stacking top; a lower-window order change remains observable and is not counted as background zero interference. Mutter 42.9 preserves the stronger complete order in the corresponding background tests.
• Linux AT-SPI InsertText requires a UTF-8 byte length while caret offsets remain character positions. The earlier implementation and upstream 0.35.4 truncated real mixed text. v13 fixes the shared length conversion before dispatch. Ten native/public/SDK/facade cases now read back exact CJK, emoji, combining characters and nonzero-caret insertion with zero raw key events. Readback does not change the runtime's conservative sent/unconfirmed projection.

Platform verification and remaining native work

Windows v10 completes 14 native regressions, 68 direct-MCP/SDK/native/Edge checks, 10 production Node REPL kernel checks and 12 ordinary private production-serve checks. The last two cover actual kernel lifecycle and pipe ownership respectively, not a Node REPL MCP-wire GUI session or injected later-instance pipe failure. An ordinary serve supports low-level CuaDriver.connect; the retained ComputerUse.connect factory still requires authenticated session ownership and cannot bind that ordinary serve. Documentation now states that boundary. WinForms background samples preserve A and pointer; Edge typing deliberately uses the one permitted foreground fallback. Upstream 0.35.4 meets the expected results on 12 native and 8 Edge checks. No verified Windows Codex entrypoint was available.

Linux v13 passes 53 focused native tests, with one pre-existing ignored test, all-target checks and release builds. Ten semantic Unicode/caret cases and a real-kernel MPX smoke pass. v12 separately covers responsive/blocked/timeout/pending-refusal/forget-and-fresh lifecycle through native, SDK and Node facade consumers on private real Xorg displays. The external-input interruption proof uses a separate owned uinput device, not a human physical device. Neither a software-rendered Mutter container nor nested Xorg is presented as shared GNOME, native Wayland, physical-human concurrency or VM performance evidence.

The macOS v11 full fixture matrix has run, with its detailed independent readback still in progress. Remaining observations are retained as failures or limitations: sheet typing refuses with same_pid_keyboard_ambiguity; WKWebView typing refuses with no_focused_text_input; two short layer-order overlap samples need attribution. A non-document native field's AXValue is replaced while the fixture delegate callback stays absent; that stronger callback oracle remains false, and no second input is added to manufacture it. Normal TextEdit save and Finder rename still need their approved Automation regression. Clipboard generation alone cannot establish restored clipboard contents.

The temporary Windows task has been deleted and read back absent, its runner has exited, and all owned helpers are gone. Limited task configuration is recorded separately from the built-in Administrator's actual High integrity. Shared driver/process lifetimes are preserved. Linux input processes and temporary devices are removed, while the private display fixtures remain for final cleanup. macOS owns a desktop mutex and cleans exact run-owned process/LaunchAgent identities. Synthetic canaries and sampled focus/order observations are always distinguished from physical-user proof.

Matched model evaluation

The approved read-only AP export is complete using the official mini AP Client 0.5.1 with the version gate before each actual request. Raw credential-bearing exports stay private on mini. Both historical groups use qodercli 1.1.52 and azure.gpt-6-astra. Their image/template versions differ. macOS scores average 0.26128 with 1/20 passed; Windows 0.12058 with 0/20 passed. Terminal Succeeded is not task success. Historical token counters are unavailable zero-filled fields, not zero consumption; only 13 Windows traces have complete final turn/time metrics.

The exact baked macOS pilot cases/plugins have been recovered, with all 20 instructions matching the AP exports. Windows matches 19/20: its historical 001 instruction names Calendar.app, while the recovered Windows override correctly uses Thunderbird Calendar. Base-layer seeds, genuine runner/generic scoring, websites and dependencies are being restored with complete layer hashes and platform-specific overlays. Setup must preserve existing files/profiles, use run-owned listeners/process cleanup, and fail preflight when Calendar persistence, application, codec or website requirements are missing. Scorer/gold files are never supplied to the autonomous model.

A fresh matched comparison must keep the harness, task seed bytes, instruction/rubric, model/provider and budgets constant across the intended old/new tool stacks. Historical Qoder results remain a reference, not that controlled baseline. The current gpt-6.1-sol global Qwen CLI passes text, real Node REPL and synthetic-image transport checks. A separately deployed production Node REPL MCP process on mini also passes initialize, exact js/js_reset listing, real kernel/preload, reset and EOF cleanup over the existing SSH connection without model credentials or a native GUI session. Actual candidate OSWorld task execution remains zero. Success-rate nonregression and round/token/wall-time gates remain open; no performance or three-way parity claim is made.

Historical first-four scope (2026-10-19)

The user now prioritizes native macOS, Windows and Linux X11 acceptance plus runtime, installation and package checks. Codex/upstream comparisons and OSWorld/model evaluation are deferred. Future model runs are configured for gpt-6-sol; no new model/AP task is part of this scope. Completing these four items will not establish the deferred model gates or authorize publication.

Candidate identity and completed checks

The validated v21 native source freeze has 453 production/build inputs and 12 support files, tree SHA-256 11b0fafab2419448a16542a73cde08cea58ee67b3a7b922fdfe12fee456f9dad. Relative to v20, only the CLI entry changes: when effective telemetry consent is false, a finite command runs directly instead of starting an unnecessary observer child. Consent precedence and the enabled path are preserved. The macOS backend remains the v20 SDK: pre-signing SDK binary SHA-256 886bf05463a6c8273d0125b28482ee4f5ba8e9c1cffe5b4d5230e5fef2e77eee, or 134b334ea8b7e912e51ac0c27383d71b6c245e17b8f99f69cbee6e08c07fb064 after the candidate Developer ID signature. Code-section equivalence is independently checked. Windows and Linux backend inputs remain target-equivalent to their v19 acceptance artifacts; new CLI checks keep their own version labels.

• macOS v20 passes fresh sheet typing and single-Return confirmation, WebKit click/type/submit, exact paste with clipboard type/byte restoration, and safe negative/positive two-window input. Production Node REPL MCP passes eight real wire/lifecycle checks with exact deployed source/dependency identities. TextEdit Unicode save and Finder semantic rename have independent C9 disk readback. Finder inline keyboard rename safely refuses when native parent/window ownership cannot be proved. The internal key-window preparation contains NaN-location mouse records: the old Swift JSON logger omitted them, so earlier claims of no internal mouse events are withdrawn.
• Windows v19 passes actual MSVC checking/building and 37 focused tests, retaining the independently identified native GUI regressions. A production MCP-wire action times out after its one real WinForms effect; no replay occurs, and reset/EOF cleanup passes. Complete CI-shaped packages pass owned fresh, official-old-byte layout upgrade, repeat, uninstall and purge checks. Unsigned explicit UIAccess deployment is rejected; neither signed UIAccess nor ARM64 native execution is claimed. The current isolated uninstaller passes 14 actual Windows PowerShell regressions, including a task mixing owned Exec and foreign ComHandler actions. Shared processes and the deleted temporary task remain protected.
• Linux v19 passes 53 focused tests, one explicit ignored test, actual release builds and native MCP initialization/listing of 19 tools. Real Mutter/Xorg/uinput input preserves the complete sampled focus/order and exact Unicode; production Node MCP passes 15 checks with real AX readback. CLI installation and SDK cold/warm cache tests use complete packages. Openbox fallback restores the original foreground/top window but changes lower stacking order; it is not counted as background zero interference. Synthetic owned input is distinct from physical-human concurrency.
• All three npm package dry runs pass at 0.26.0; SDK tests pass 51 with six explicit skips. The repaired Node MCP preload test holds SDK evaluation behind an observed barrier before timing out, then checks the next real request; the full MCP file passes eight tests, with 113 Node tests covered across the retained runs. Independent mutation evidence detects a late continuation. Installer Python checks pass 57 with five explicit skips and four subtests.

A subsequent v22 freeze (de5d5030e7dbf5b3f64c7946dc8d335ee2d988db14e8fe0994226d2f6f980245) adds an Excel-only Apple Events compatibility fix and corrects the window-order comment. Excel uses full-name1773 and saved1842 rather than the missing Standard Suite path/modified properties; a case-sensitive full-path guard precedes its one save. Exact and mismatched-path read-only argv probes pass. Six existing Apple Events unit tests, Mac/SDK/CLI all-target checks and the ARM release build pass; the SDK binary is 04d996ff2b51337bf07a72da408dee0ea0b987081b209bb680e28e8eb3f92499. ARM and Intel release builds pass. Fresh v22 native Excel save also passes: one save returns in 316.586 ms, the modified flag changes true to false, and an independent XLSX oracle confirms the exact A1 marker with B1 unchanged. Both earlier dirty documents remain unchanged. Its click still produces 48.937083 ms of observed cover, so this is a save-function pass, not zero-interference acceptance. The updated v22 Mac package checks below also pass within their disclosed scope. Windows/Linux target inputs are unchanged.

Runtime, installer and package verification

The v21 Windows/Linux CLI appendix now passes actual builds, existing consent/disabled tests, default-off and explicit-off finite commands, native MCP initialization/listing/EOF and current owned install/repeat/purge. Its 287 files and all four complete package archives have an independent parent hash/member readback.

On mochi, the coherent v22 macOS candidate uses the existing product Developer ID team NF4574S59H for CLI, theme, SDK and bundle, without timestamp or notarization. The signed SDK hash is 5a0dd6d011e633fee9bd6b751444ee82430cc0c8632a5ab43e5c4143cfa93946; packaged code sections match the fresh ARM and Intel inputs. ARM and Rosetta Intel finite/native MCP checks, installed ARM checks, SDK cold/warm installation and twelve production Node MCP checks pass. Fresh install, upgrade from a private complete signed 0.17 bundle, and repeat install pass fourteen assertions; the replacement satisfies the old signing requirement. The original global bundle and v21 artifacts remain unchanged. The parent independently verifies all 636 regular evidence files (738 tar entries including 102 directories), all four package archives and their members, native identities and all-architecture signatures for CLI, theme, SDK and app. The unchanged CI NAPI artifact retains its documented unsigned Intel-slice boundary.

These checks complete the fourth item for v22 within the disclosed owned/local candidate scope: macOS ARM plus Rosetta Intel, and Windows/Linux x64 with verified unchanged target inputs. Installer tests use documented destination/writeability/download/stop-helper seams and real filesystem, signing and replacement operations. The two actual rollback fault cases are retained from v21 under the unchanged installer source, not newly executed v22 faults. Shared services are preserved; this does not establish stock global replacement, Windows signed UIAccess, ARM hardware coverage or official notarization. Earlier installed ad-hoc ARM failures remain retained; the coherent Developer ID candidates pass that installed runtime path without a security-policy change. The baseline absolute nested-local SDK import defect is retained with identical base/current loader bytes; installed bare-package and global cua consumers pass separately.

Remaining gates and evidence limits

macOS canvas pointer input still raises the target over A for roughly 100–200 ms despite preserving foreground identity and canary delivery. Menu coverage also remains open. Exact effect plus eventual restoration does not satisfy zero cover. Authentication, public-post, key-preparation, default mouse-subtype and PrivateSource diagnostic variants retain coverage and are rejected; private variants never replace the normal artifact. PrivateSource produces one exact native effect but still about 199 ms of coverage. A read-only causal review does not establish system impossibility; none of these pointer factors addresses AX-only popup coverage. A fresh whole-preparation-omission counterfactual still covers A for about 206 ms and loses the native canvas effect, so that candidate is rejected too. The subsequent read-only review finds no evidence-backed next external-driver repair hypothesis; it does not prove system impossibility.

A fresh normal-v20 slider alternative passes: one setValue('80') produces both value80 and the independent native callback80, with no observed disturbance. Excel's original selected-grid state and LibreOffice's newly opened document state return no_focused_text_input before dispatch; neither is a saved-document pass. Excel Edit subsequently confirms the typed marker through its native formula-editor description and Return through A2. An initial save remains unknown after an Automation prompt and caller deadline; after normal authorization, a fresh document’s one save returns automation_failed (-50), sent:true, with no disk marker. The v22 native save fix is verified above; its pointer coverage remains a separate failure. LibreOffice’s public body click leaves a group focused; a separate read-only body probe reports settable AXValue/AXFocused but actual focus false. No replacement input or saved-document pass is claimed. The native still-launching public chain now passes: an independently identified installed accessory fixture is still launching when its one getApp starts, with over 900 ms of native launch delay remaining; it returns the exact AX marker in 1.056 seconds, followed by independent finished-launching proof. Twenty action-plus-settle order samples show no owned coverage and six synthetic canaries arrive at A. This does not prove which retry ran or that the old 400 ms implementation failed: the first AX IPC may itself block until readiness. Earlier no-request and scratch-helper-exclusion attempts are retained separately. One pre-overlap MCP sample has an external System Settings window above A; without per-RPC absolute timing it is not attributed to the candidate or reported as uninterrupted A-on-top.

Immutable reports, raw failures and manifests remain under .qwen/e2e-tests/cua-upgrade-2026-10-artifacts/, including p7-normal-v20-native-regression-independent-report.md, p7-windows-first4-final-v19-20261019.md, p7-linux-final19-first4-acceptance.md, p7-mac-zero-cover-causal-boundary-review.md and the versioned package appendices. Evidence-only clean passes do not count as the required two final full-source audit passes. The earlier main merge check is historical; final source validation and mergeability must cover the completed tree. No push, PR, merge or release has occurred.

Historical v25 checkpoint (2026-10-20)

The current 453 native plus12 support inputs have tree SHA-256 6faac284650aeffaa64c5fa6b220ab1799ae25f69f0e68845e21159bf7d50e5a. Linux v24 repairs partial-send classification at prefix/first-character/key-release/flush boundaries, admits MPX pending input only after focus validation, and cleans up failed press/probe release. Actual Linux focused tests, all-target checking, CLI/SDK release, private install, finite MCP and SDK cold/warm checks pass. Four fresh Xorg/Mutter cases exercise public CLI Unicode and named keys, the current SDK C ABI trusted-session seam, and one paused-target uncertain request. The last case delivers only a after resume, correctly remains sent/unconfirmed, and has no extra physical events at return, after1.7seconds or session end; it is not a complete-text success. The parent verifies38 evidence hashes, original callbacks, full distinct old/new Xorg logs and owned-container cleanup. Earlier tail-log count overclaims retain their correction and originals.

v25 changes only macOS exact-target resolution relative to v24. A real LibreOffice failure showed a same-window app-focused AXGroup explicitly reporting false while its text body actually reported true. This precise condition now invokes the existing bounded, complete, unique text-focus proof; PID/window binding, cross-window rejection and final rechecks remain. ARM and Intel CLI/SDK release builds, six existing exact-target units and all-target checks pass; the new ARM SDK has a verified Developer ID signature. The new coherent universal Developer ID package passes ARM/Rosetta finite commands and direct MCP, packed SDK cold/warm installation, production Node MCP, and14 owned fresh/official0.17-upgrade/repeat assertions. The parent independently verifies four archives and all38 regular member occurrences,11 result reports,465 source/support pins and five all-architecture signatures. Signing remains offline without timestamp/notarization, and installation uses the disclosed private-prefix/local-endpoint seams. Complete current-source audits and final merge preparation remain separate checks. Windows/Linux/shared inputs are unchanged by this Mac repair.

Fresh original T15 confirms one public ASCII insertion through independent body AXValue and selection readback. Its one Save times out waiting for OS Automation permission, reports sent:true, and has no independent disk marker; no Save is replayed. LO reports AXEdited=false even with the changed body, so that attribute is not a save oracle. The local canary process has no posting permission:121 posting attempts and zero receiving Sentinel keydowns do not prove canary delivery or uninterrupted user typing. Numeric foreground/top/pointer samples retain their bounded observation scope. Earlier LO focus observations above remain historical; positive insertion now passes, while saved-document acceptance stays open.

Strict pointer/menu zero-cover still fails. A fresh signed own-window bit21 control returns Set0 but reads the requested bit unchanged, then Clear0 and exact baseline restoration. It does not validate a foreign-window remedy. Earlier unsigned-helper SIGKILL and its empty logs remain stage-unknown, and no unsupported OS-wide impossibility claim follows. All-platform acceptance and PR readiness remain incomplete until these native gates, final checks and current-tree merge preparation pass. No push, PR or release is authorized.

v26 LibreOffice pointer safety checkpoint (2026-10-20)

The v25 checkpoint above is historical. Current v26 has native tree SHA-256 9bb4ffe40e1801d750f5a71ae20ea354293fe8bff01f0191554a7ca1facaabe3; its 465-input manifest is f16523c3823554f6d0e74d257ee232d768b7b8cebe17a80bf6b787d2591b4042. Only the three macOS click tools changed relative to v25. Windows, Linux, shared native inputs and the JavaScript SDK are unchanged.

A fresh default public Calc request targeted C5, but three independent exact-window Name Box reads returned B28. The original sent/unconfirmed request was not replayed. Exact LibreOffice 26.2.6.3 source reads the global NSEvent.mouseLocation for VCL mouse callbacks; the observed screenshot-coordinate inversion was coherent. This establishes an incompatible pointer-reading mechanism, without proving the precise native callback responsible for B28.

The repair adapts upstream #4864's refusal principle using the fork's existing NSRunningApplication identity for org.libreoffice.script. It prevents PID-routed pixel click, right-click, double-click and element-pointer alternatives from acting at an unrelated hardware-pointer position. It preserves advertised AX actions and safe editable-focus/AX-selection paths. The old raw foreground pointer routes are also refused because they do not move the hardware pointer. This is narrower than upstream's mapped-library detector: rebranded or unbundled VCL processes are not identified by this rule. Canonical public Mac actions remain background-only and do not expose a new JavaScript foreground option.

An independent new-document v26 request returns public background_unavailable, sent:false and request committed:false; three bounded same-window Name Box reads remain A1. This passes safe-refusal verification, not C5 background-selection success or raw AXPress runtime equivalence. The original stricter harness outcome remains failed because it expected internal effect/toolkit fields that the existing public error projection deliberately reduces to code/reason/sent/next. Its raw output and the separate contract-based adjudication are both retained. SDK operation.dispatched:true means entry into the FFI request lifecycle, not physical input delivery.

Current ARM click14, AX-dispatch1 and double-click1 focused tests, all-target checks and release CLI/SDK builds pass; the ARM SDK has a verified offline Developer ID signature. Current-source packaging and further native regressions are recorded separately. The temporary local validation commit a9fe798b6dac938392f450f2edf55456a6dfc6e0 retains the clean merge of fixed main 5dcf7c7cb162e825d95d531081f67ee60da3c0e1. Its complete 8 GiB build script passes in201.876seconds and normal root typecheck in72.948seconds, including integration and without NODE_OPTIONS for typecheck. These are verification timings, not a performance comparison. Earlier default4GiB merge/main failures remain failures; that command was not rerun or marked green for v26.

The independent v25 public-toolbar Save passed actual FODT XML verification; the original Cmd-S/AppleEvents Save remains UNKNOWN and was never replayed. A later own-window bit21 positive control passed, but the trusted normal-caller foreign-window experiment did not change the bit and was rejected after exact restoration. Historical Codex canvas samples received Command despite an unmodified client request, with unknown origin, so they cannot establish an ordinary unmodified-click baseline; its composite popup/context samples also retain actual cover. Strict macOS pointer/menu zero-cover remains FAIL. Current-source audits, native acceptance and PR readiness must be assessed separately; no shipping P7 commit, push, PR or release has occurred.

Historical v27 Writer focus candidate — not native accepted (2026-10-20)

The v26 package checkpoint is complete: ARM/Intel builds, focused checks, coherent universal archives and all11 non-GUI runtime/install report groups pass. A fresh independent readback verifies92 evidence files,38 regular archive members,465 source inputs and5 all-architecture signatures. These package/protocol results do not close Writer or zero-cover acceptance.

A source-slice reproduction executes the actual v26 predicates and shows that an official LibreOffice AXTextArea with no advertised action is refused even when its value/focus attributes are writable. A separate target-only, read-only query of the preserved v25 Writer process confirms exactly one same-window body, empty action list, and successful true AXValue/AXFocused settable flags. Its application-focused element is AXGroup while the body reports AXFocused=true. This is real old-instance property evidence, not a current action pass.

The intermediate v27 candidate changes only click.rs from v26: the default App single-unmodified-left-click branch may focus a known official LibreOffice AXTextArea through the existing editable-focus path, with both settable gates and current PID/window ownership checks intact. Other applications' text areas remain excluded. The raw click implementation, generic role helper and original tests are byte-identical to v26. Focus/value confirmation is unchanged: the AXGroup mismatch can still produce an unconfirmed result, followed by observation; there is no pixel fallback, replay, caret relocation or stronger success claim. Native tree is c52f7cb6ac11aa65a9d7a226c5d4e38f55ee52820bcc4085ed4314b006b40538, manifest SHA-256 a3aed6e4f6b77b532395729b611f9817de06bac65c6d64c4811e0ed17c870ad1 (465 inputs). Focused builds/review are separate from the still-open fresh Writer click/type GUI test.

The latest Writer Stage1 stopped before LibreOffice or document actions because the owned sentinel could not obtain the foreground. System-window content remains unknown after Computer Use rejected access to that system app; no alternate channel bypass was used. Mini still reports locked in a fresh authenticated read-only check. Strict pointer/menu zero-cover remains FAIL. The successful full8GiB build/typecheck belongs to local merged checkpoint a9fe798b; it is not a full-build claim for the development checkout. Only the four later Markdown updates and this Mac Rust delta are intended for a refreshed local validation snapshot; any inherited build evidence must state that boundary. A new validation commit also changes the generated Git commit constant, so strict byte-identical compiler-input equivalence is not claimed. No final P7 shipping commit, push, PR or release.

F31 native and distribution checkpoint (2026-10-20)

The accepted Writer source adds nine guarded lines to v27 click.rs and exactly matches the mini-tested SDK 091df63289f3542c8d1518f0be0db458863b7f87d4002de281579fca377509ab. Both fresh documents independently transition from body AXFocused=false to true after one App click. Their one input and one toolbar Save persist exact XML, with saved hashes 83d5fd0c80a0e654d18f55b6d181bfb6be6ca1463a09b1885cad45393071cdb2 and c4d557fa50ab5d7f449891d8fd139f0da24334880a44b31268bdd911f7ab01d1. The parent verifies all 46 sealed evidence files and the first native read in each case. Pointer and text-clipboard state stay at each case's starting values; sampling gaps of up to 122.5/118.1 ms do not prove uninterrupted zero cover. The earlier v27 desktop click/input/save positive is a separate explicit foreground workflow. The original Cmd-S/AppleEvents request remains UNKNOWN and was not replayed.

F31 ARM/Intel CLI and SDK release builds and relevant native/all-target checks pass. The coherent universal packages pass all 11 non-GUI report groups: ARM/Rosetta finite commands and direct MCP, packed SDK cold/warm installation, production Node MCP, private owned installation/replacement and installed ARM/Rosetta commands/MCP. The final manifests retain exact slice/archive/signature identities and the disclosed offline Developer ID signing and private installer seams. A task-specific caffeinate identity preflight failed before these checks launched; its correction and the subsequent actual full run are preserved separately. Windows v21 and Linux v24 retain their original native identities; the intervening Mac changes do not alter their target inputs.

Formal Codex review of the new delta produced one multi-window concern, recorded and triaged rather than described as zero findings. The existing preparation sends process-scoped focus records, so its keyboard ambiguity gate remains; two single-window positives do not establish arbitrary multi-window support. Earlier complete source audits keep their pinned scope; final updated-delta audits, latest-main default build/typecheck, source equivalence and PR draft are recorded in the ignored final readiness evidence. No local source/build result substitutes for a native effect.

The first-four scope is platform-native effects plus runtime/installation/distribution verification, with the documented safe refusals and uncertainty limits. G17/G18/G24 accepted-opt-in native coverage, the later-instance pipe-fault injection and physical-human concurrency retain their individual unverified limits. The requested new Codex behavior comparison is inconclusive before action; matched model/OSWorld success, tokens, turns and timing remain deferred. None is silently scored as a pass, and no publication is authorized.