ef95d950

docs: M11 close — convergence harness held 10/10, campaign table recorded

a73x 2026-08-09 21:22

Commit message

docs: M11 close — convergence harness held 10/10, campaign table recorded

The campaign table moves into decisions.md in full: 18 product mutations,
old suite 7, new suite 13, and the six-row delta is all paint/overlay/clip.
Both kill-criterion legs recorded with their evidence, the three defects
found en route with the rules extracted (a timing margin is a number you
compute, not a sentence you write), and five both-miss rows closed as one
unit assertion and four banks with written reasons.

roadmap: M11 complete; the trial-friction tier rewritten around three
field findings from real usage (attach auto-start, the missing muxd stop,
an error-message audit); ASAN/valgrind and the unit-layer sweep stay
banked, each annotated with what the campaign taught about it.

The campaign scratch doc is deleted — this commit is the pointer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/decisions.md

+proceeding. One review round was NOT-APPROVED; everything else landed
+without rework cycles.
+## 2026-08-09 (M11 — e2e hardening: convergence, pins, soak, mutation campaign)
+**Verdict: cleared, both legs.** The e2e suite has stopped asking whether
+a marker string appeared and started asking whether the screen the client
+painted equals the screen the daemon holds — **22 convergence points
+across 10 scenario checkpoints**, both counts asserted as literals at
+runtime, every scenario ending in `assert_converged` with each declined
+exception named in a comment at its own site. `SOAK_N=10 make soak` is
+**10/10 green on the code that ships**, ~116s a run. The campaign that
+grades the harness broke the product **18 times**, one mutation at a
+time, and ran every break against both assertion sets out of the *same*
+mutated binaries: the old suite caught **7 of 18**, every one of them
+through a counter or a marker; the new suite caught **13 of 18**; and the
+six-row delta — rows 1, 2, 3 (paint path), 9, 10 (prediction overlay), 17
+(clip bound) — is entirely the byte-blind class the harness was built
+for, a wrong *picture* drawn from right *bytes*. Zero rows ended
+undecided: the five both-miss rows closed as one new unit assertion and
+four banked entries with written reasons. Spec:
+superpowers/specs/2026-08-09-m11-e2e-hardening-design.md.
+### The campaign table
+The milestone's measurement, as M9's latency table was. Mutations lived
+only in a detached worktree, one at a time, restored and diff-verified
+between rows; both suites ran sequentially against the same build. The
+old suite is `test/e2e.sh` at `37ec262` — the last commit predating every
+M11 assertion — carried untracked as `e2e-old.sh`, with one deviation
+recorded below the table.
+| # | site | mutation | old suite | new suite | disposition |
+|---|------|----------|-----------|-----------|-------------|
+| 0 | control | none (unmutated) | PASS | PASS | baseline |
+| 1 | paint path | delta paint drops each delta's last row | survived | caught: `base attach` — render diverges | demonstrated |
+| 2 | paint path | delta rows painted one row too low (CUP row+2) | survived | caught: `base attach` — render diverges | demonstrated |
+| 3 | paint path | full repaint preamble loses `\x1b[2J` | survived | caught: `quic epoch resync` — render diverges | demonstrated |
+| 4 | paint path | delta row's leading `\x1b[0m` stripped (SGR bleed) | survived | survived | banked: no grid can hold it (unit-pinned already) |
+| 5 | paint path | delta paint drops the `?2026` synchronized-update wrapper | survived | survived | new assertion: the `paintDeltaClipped` wrapper pin |
+| 6 | replica sync | delta painted and applied, but never fed to the replica | caught: `line mode: contradicted=1, want 0` | caught: `quic delta resume` — render diverges | both caught |
+| 7 | replica sync | snapshot's cols/rows prefix ignored (replica never resized) | survived | survived | banked: needs a resizing client fixture |
+| 8 | replica sync | resume attach quotes one seq MORE than the client holds | caught: `reconnect was served a snapshot (7 -> 8), not a delta` | caught: same line | caught by counters (both) |
+| 9 | prediction overlay | a CONFIRMED prediction keeps its underline painted | survived | caught: `line-mode prediction` — render diverges (styled leg only) | demonstrated |
+| 10 | prediction overlay | a made prediction is also fed into the replica engine | survived | caught: `raw mode` — render diverges | demonstrated |
+| 11 | delta production | delta payload omits its highest-numbered dirty row | caught: `line mode: contradicted=1, want 0` | caught: `base attach` — render diverges | both caught |
+| 12 | delta production | delta rows emitted in reverse row order | survived | survived | banked: order is not a state property |
+| 13 | delta production | `update()` never marks row 0 dirty | caught: `line mode: contradicted=1, want 0` | caught: `base attach` — render diverges | both caught |
+| 14 | seq/epoch | every second update reuses its predecessor's seq | caught: `raw mode: displayed=1, want 2` | caught: same line | caught by counters (both) |
+| 15 | seq/epoch | reconnect served a delta even when a snapshot is owed | caught: `restarted daemon served no snapshot (0); the stale seq was honoured` | caught: same line | caught by counters (both) |
+| 16 | seq/epoch | every snapshot prefix carries `epoch + 1` | caught: `reconnect was served a snapshot (7 -> 8), not a delta` | caught: same line | caught by counters (both) |
+| 17 | scrollback/clipping | client clip bound one row short: the last tty row is never painted | survived | caught: `reattach after kill` — render diverges (plain, `-sh-5.3$`) | demonstrated |
+| 18 | scrollback/clipping | resync no longer leaves scroll view (`scroll_pages = 0` deleted) | survived | survived | banked: needs a pty-driving client fixture |
+| 19 | paint path | every SGR run stripped from delta rows at the client paint | not run (scaffolding retired) | caught: `styled content` — render diverges (styled leg only) | gate for the styled scenario |
+Every "render diverges" cell is the suite's own failure line, `e2e FAIL:
+NAME: client render diverges from daemon grid`, named by the scenario it
+fired in. Row 19 is not one of the 18 product mutations: it is the gate
+that justified the styled scenario Task 12 added, and its old-suite
+column is honestly blank — the scaffolding was retired with the worktree,
+and a marker grep cannot see a colour by construction.
+**Tally: six demonstrated** (1, 2, 3, 9, 10, 17 — new caught, old
+survived), **three both-caught** (6, 11, 13), **four caught by counters in
+both columns** (8, 14, 15, 16), **five both-miss** (4, 5, 7, 12, 18), all
+five closed below. The control ran first and green on both suites at
+main's tip, 114s each: a campaign whose baseline is red measures nothing.
+**The deviation in the old suite, recorded because it flatters nobody.**
+`e2e-old.sh` carries one line that is not the 37ec262 original — the
+burst scenario's keystroke interval, bumped 0.2 → 0.25, the same fix
+landed on main in 2bc64e8. Left unpatched, that defect (below) would have
+reported false "caught" verdicts on the old suite's burst line and
+inflated the old column. Nothing else was touched: the old suite's
+assertions are the object of comparison, so they stand exactly as they
+were.
+**Where the delta actually is.** Rows 1-10 mutate the client and rows
+-16 mutate the daemon, and the halves invert cleanly. Client-side
+breaks are mostly invisible to counters, because the counters live on the
+client and a client that lies to the screen still counts honestly.
+Daemon-side breaks are the opposite: the daemon is upstream of both the
+replica and the client's prediction bookkeeping, so five of those six
+trip a counter in *both* columns. That is not the convergence checks
+failing to earn their keep — it is the honest observation that the old
+suite's blind spot was the client, not the server, and the new checks are
+an instrument pointed at exactly that spot.
+### Defects found and fixed en route
+**The burst knife-edge (2bc64e8) — a timing margin is a number you
+compute, not a sentence you write.** `delaypipe` drains one chunk per
+`DELAY_MS` serially in each direction, so burst keystrokes closer
+together than `DELAY_MS` queue, and each ages `(DELAY_MS - interval)`
+longer than the one before it:
+```
+age at which keystroke k is confirmed = 2*DELAY_MS + k*(DELAY_MS - interval)
+```
+At the old 200ms interval the fifth prediction reached judgment at
+`600 + 4*100 = 1000ms` — `predict.expire_after_ms` to the millisecond, a
+coin flip decided by which of two `milliTimestamp()` calls in the same
+poll iteration saw the boundary first. It failed 4 runs in 20 on an
+**idle** machine; no load required, and no prediction was ever judged
+wrong. The comment above the scenario had claimed margin on both sides,
+and that margin had never been computed. At 250ms the fifth lands at
+ms, measured 798-799 across 12 runs. The same formula, applied
+backwards, retroactively explains the M9-era `DELAY_MS=400` collapse
+recorded above under "the burst/expiry ceiling": it puts the SECOND
+keystroke at 1000ms, which is the `confirmed=1` that was diagnosed then
+as a queueing effect and is now a closed-form one.
+A second rule came out of the same bug: **`expired` increments
+`contradicted` through the shared `abandonAll` tail**, so
+`contradicted >= expired` is an invariant and a burst assertion that
+checks `contradicted` first reports an age-out as "a prediction judged
+wrong" — a different defect with a different cause, and the reason this
+flake was first investigated as a reconcile bug. The burst assertions now
+check `expired` first.
+**The scroll-suppression reconnect bug (412f38f) — found by the campaign
+on UNMUTATED code.** Reading `client.zig` in order to grade row 18 turned
+up a real defect in HEAD: the resync path clears `scroll_pages` but never
+calls `overlay.setScrollMode(false)`, and `flush()` does not clear the
+mode — it drops pending and retired predictions and nothing else. A
+reconnect taken while scrolled therefore leaves the client painting live
+rows with the overlay still suppressing, and the "any other key leaves
+scroll mode" branch can never rescue it because that branch is guarded by
+`scroll_pages > 0`, which the reconnect has just made false. Local echo
+prediction is off for the rest of the session, silently. Fixed
+client-side with one call next to the existing `scroll_pages = 0` —
+deliberately not by making `flush()` clear the mode, because every
+snapshot flushes and a snapshot is not a reason to leave history; the
+overlay would start deciding where the viewport is, which is the client's
+business. Pinned where the property can be reached: `a flush leaves
+scroll mode exactly where it found it` (src/predict.zig) holds the
+contract in both directions. The end-to-end pin — "a reconnect while
+scrolled leaves prediction working" — rides the banked pty-fixture debt
+below and is **not** claimed here.
+**Phase 1 landed with zero convergence failures, and one of those zeroes
+is evidence.** The plan named a candidate defect in advance: the
+raw-mode scenario's expired prediction (`j`), suspected since M9 of
+leaving a phantom underlined glyph no repaint ever removed. Twenty-two
+convergence points went green on first placement, styled leg included,
+which proves the client does repaint on expiry the way it already does on
+contradiction. A suspected gap that is checked and found clean is a
+result, not a non-event — the alternative is carrying the suspicion
+forward for another milestone.
+### Findings that reshaped what we thought the code was
+- **The client has no seq-continuity logic at all** (row 8). The
+  specified mutation — "remove the client's gap detection so a stale
+  delta is applied" — could not be written, because there is no such
+  code: the delta arm sets `last_seq` and applies unconditionally, and
+  every gap decision is the daemon's, in `sendResync`. Expressed instead
+  from the one client-side lever that exists (quote `last_seq +| 1`), the
+  daemon's range guard noticed the lie and served a snapshot — the safe
+  answer — so the screen rendered perfectly, all convergence points
+  agreed, and only the counter spoke. A delta silently applied across a
+  gap is **unreachable from the client**; the property is defended
+  entirely by the daemon and is already mutation-proven there. This is
+  the exact complement of rows 1-3, and a fourth proof of the standing
+  entry "counters are asserted because markers are blind to *how* a
+  resume was served".
+- **ghostty's formatter closes every styled row it emits** (row 4). The
+  campaign's own prescription for row 4 was a styled scenario, on the
+  reading that the styled leg was the right instrument handed no
+  specimen. The scenario landed, the mutation was re-run, and it still
+  survived — because `dumpVtRow`'s output both opens and closes with a
+  reset ("style is reset before newline to prevent background colors
+  from" bleeding, in ghostty's own test suite). Verified on the wire, not
+  inferred: the delta row for `styled-red` carries two resets and the
+  mutation strips only ours. So our leading reset is redundancy against a
+  live pen that no byte source in the client can produce, and the only
+  pen it could protect against belongs to the HOST terminal — which no
+  rendered-grid comparison can ever hold, since the render helper replays
+  into a fresh engine at the default pen by construction. The unit test
+  at `src/client.zig:1837` is the real guard and fails under the mutation
+  today; the bank names the dependency guarantee it rests on.
+- **Catch parity is not diagnosis parity** (rows 11 and 13). Both suites
+  catch both mutations, so the disposition column reads "both caught" and
+  says nothing interesting. What the columns hide: the old suite fails
+  eleven scenarios in, at `line mode: contradicted=1, want 0` — a
+  prediction was contradicted because the row that would have confirmed
+  it never arrived, which is a symptom three inferential steps from the
+  cause — while the new suite fails at `base attach`, the first scenario,
+  and **prints the missing row**. Same verdict, eight scenarios of
+  runtime and the entire distance between "a counter is off" and "this
+  row is missing". Diagnosis cost is part of a suite's value even where
+  catch parity is exact, and a table with a disposition column cannot
+  show it, which is why this paragraph exists.
+### Accepted gaps, and banked by M11
+The five both-miss rows closed as **one new assertion and four banks**,
+zero undecided. The banks fall in two classes and neither is a weak
+convergence check: rows 4, 5 and 12 are properties **no rendered grid can
+represent**, and rows 7 and 18 are branches **no fixture can reach**.
+- **A pty-driving client fixture — now the suite's single largest
+  coverage debt.** Rows 7 and 18 both wait on it. Every e2e client
+  captures stdout to a file, so `ttySize` returns null and the client
+  runs at the non-tty default of 80x24, which is also the daemon's: the
+  snapshot-apply resize branch is dead code for the whole run, and no
+  assertion of any kind could grade row 7. Scroll view is the same story
+  from the other side — entering it requires stdin to deliver
+  `\x1b[5;2~` in one read, which no suite contains, so `scroll_pages` is
+  invariantly 0 and deleting an assignment of 0 to it is a semantic
+  no-op. Neither is drivable from a unit test without a refactor this
+  milestone should not make: the mutated statements sit inline in
+  `session()`, which takes a live transport, two file descriptors and a
+  run loop, has one caller and no test. One fixture — a client that owns
+  a pty — makes both branches reachable and both mutations gradeable, and
+  would also carry the end-to-end pin the 412f38f fix is missing.
+- **Row 12: row order is not a state property.** `composeDelta` emits
+  `CUP(row+1);1H` + `EL(2)` + the row's bytes for each row it iterates,
+  so the payload is a *set* by construction and permuting it is a no-op
+  on the resulting grid. Asserting an emission order would forbid an
+  equivalent implementation while pinning nothing a user can observe,
+  which is the wrong trade for a wire format still moving; structural
+  corruption is already rejected by the `seen != hdr.row_count` check. If
+  row order ever becomes load-bearing — relative addressing, a
+  scroll-region optimization — it becomes a protocol property and belongs
+  to a `composeDelta` unit test on the composed byte string.
+- **The debugger's observation, unproven and owed a design pass.** The
+  client calls `overlay.expire()` before reading frames that arrived in
+  the same poll wakeup, so a prediction can be abandoned while its
+  confirming evidence is sitting readable in the buffer. This came out of
+  reading, not from a failing sample — **no spurious contradiction
+  actually occurred** in this milestone, and the raw-mode expiry
+  behaviour was proven correct by the styled leg. It touches the retired
+  repaint list and the ordering of the poll loop, so it needs its own
+  design pass rather than a patch; it is plausibly the same territory as
+  M9's banked input-ack item, which remains the proper fix if spurious
+  contradiction ever does appear.
+- **ASAN or valgrind over the QUIC tests** — carried from M9 unchanged,
+  and unchanged is the point: this campaign was an e2e mutation campaign
+  and says nothing about use-after-free. M9's two reasoned-not-pinned
+  `deinit` orderings are still owed the only honest instrument for them.
+- **The unit-layer mutation sweep** — carried, and the campaign supplied
+  evidence that it would pay. Two of this milestone's mutations were
+  resolved by pins at the *unit* layer, not the e2e one (the `?2026`
+  wrapper, which was pinned at no layer at all despite an assumption to
+  the contrary; and the delta row's leading reset, where the existing
+  pin turned out to be the whole guard). Both were found by aiming an
+  e2e campaign at the product and discovering the unit layer's shape by
+  accident. A sweep aimed at the unit layer directly would not need the
+  accident.
+### Process note: the recording rule survived contact with a wrong premise
+The rule was "every both-miss ends as a new assertion (mutation re-run to
+prove it fires) or a banked entry with a written reason — no third
+bucket, because 'noted' without a decision is the failure mode the
+campaign exists to prevent". It held, and the interesting part is *how*:
+one of the five rows had its prescribed disposition **disproved by
+attempting it**. Row 4 was filed as the single debt the convergence
+checks could pay, the fix being a styled scenario; the scenario landed,
+the mutation was re-run against it, and it survived — the premise was
+wrong, and the row moved to the "no grid can hold it" pile with a
+dependency guarantee named. A prescription that can be executed and found
+wrong is worth more than one that is merely plausible, and a rule that
+demands re-running the mutation is what forces the discovery instead of
+booking the fix as done. The scenario itself then had to justify its
+continued existence on its own terms and was gated by a new mutation
+(row 19) aimed at what it actually covers; before it, the byte-exact leg
+had exactly one specimen source in the entire corpus — the prediction
+overlay's own underline.
+## Open (owed by later milestones)
+- Scrollback retention *tuning*. The policy itself was decided in M1 and

docs/roadmap.md

Old		New
@@ -5,9 +5,12 @@ The forward view, one item per line, ranked. History and evidence live in
5	this file at each milestone close and whenever the queue reorders; the	5	this file at each milestone close and whenever the queue reorders; the
6	queue's order is set by the user, not by this file.	6	queue's order is set by the user, not by this file.
7		7
8	Now: M1–M10 complete; `v0.0.1-2` published as a Linux tarball; in	8	Now: M1–M11 complete; `v0.0.1-2` published as a Linux tarball; in
9	field trial on real VMs. Trial feedback outranks everything below —	9	field trial on real VMs, and the trial has started producing the queue.
10	what actually hurts in use is better data than any of this ranking.	10	Trial feedback outranks everything below — what actually hurts in use is
		11	better data than any of this ranking, and the three items at the top of
		12	the friction tier are there because they hurt this week, not because
		13	they were predicted.
11		14
12	## M9 — prediction (speculative local echo) — complete	15	## M9 — prediction (speculative local echo) — complete
13		16
@@ -47,12 +50,50 @@ not fail, and a third cross-binary constant drift — all fixed, all with
47	the rule recorded ("assert the literal, never the constant the code	50	the rule recorded ("assert the literal, never the constant the code
48	under test reads").	51	under test reads").
49		52
		53	## M11 — e2e hardening — complete
		54
		55	Verdict: cleared, both legs. The suite has stopped asserting that a
		56	marker string appeared and started asserting that the screen the client
		57	painted equals the screen the daemon holds: **22 convergence points over
		58	10 scenario checkpoints**, both pinned as literals, every scenario ending
		59	in a convergence check with the declined exceptions named where they are
		60	declined — and `SOAK_N=10 make soak` at 10/10 on the shipping code,
		61	~116s a run. Then the harness was graded the only honest way, by breaking
		62	the product 18 times and running each break against both assertion sets
		63	out of the same binaries: old suite 7 of 18, all via counters and
		64	markers; new suite 13 of 18; the six-row delta is all paint, overlay
		65	and clip — the byte-blind class, a wrong picture drawn from right bytes
		66	(decisions.md, M11, which carries the table in full). Zero rows ended
		67	undecided. En route the campaign found a real bug in unmutated code — a
		68	reconnect taken while scrolled left prediction silently off for the rest
		69	of the session — and a computed timing knife-edge in the burst scenario
		70	that had been sitting on the expiry bound exactly, whose formula also
		71	explains the M9-era `DELAY_MS=400` collapse retroactively. The rule
		72	extracted: **a timing margin is a number you compute, not a sentence you
		73	write**.
		74
50	## Trial friction, likely next — and still outranked by trial feedback	75	## Trial friction, likely next — and still outranked by trial feedback
51		76
52	- Attach auto-start: `muxd proxy` and local `mux` call the spawn	77	The first three are field findings from this week's real usage on a
53	helper `muxd start` already uses, so `mux user@host` works on a box	78	jump-host box, not predictions. They are one natural bundle and the
54	where nothing is running. Sketched in the M10 spec; the helper is	79	likely next cut; the order within it is the user's call.
55	built and shipping.	80
		81	- Attach auto-start — now field-motivated, not merely sketched.
		82	`mux user@host` against a box where no daemon is running fails with
		83	`muxd proxy: cannot connect`, which is a correct message about the
		84	wrong thing: the user asked for a session, not for a daemon. `muxd
		85	proxy` and local `mux` call the spawn helper `muxd start` already
		86	uses. Sketch banked in the M10 spec; the helper is built and shipping.
		87	- `muxd stop` — the lifecycle verb is simply missing. `muxd start
		88	--quic` against an already-running default daemon says to stop it
		89	first, and there is no way to do that but find the pid yourself. Small
		90	on its own; it stops being small the moment auto-start ships, because
		91	auto-start makes socket-squatting common.
		92	- Error-message audit — the `--via` failure hint "(is muxd installed
		93	on the host?)" guessed wrong when ssh itself failed on a host-key
		94	rejection, and sent the reading in the wrong direction. The rule to
		95	apply across every failure path: say what happened, name the way out,
		96	and do not guess a cause a lower layer has already named.
56	- ssh→QUIC handoff: `muxd endpoint` prints port+key over ssh;	97	- ssh→QUIC handoff: `muxd endpoint` prints port+key over ssh;
57	client caches both, tries QUIC first under a ~2s deadline, and the	98	client caches both, tries QUIC first under a ~2s deadline, and the
58	coordination ssh stays alive as the fallback proxy. Full sketch —	99	coordination ssh stays alive as the fallback proxy. Full sketch —
@@ -62,6 +103,29 @@ under test reads").
62	backoff step; measured ~4x win available on fast links, ~2x on slow	103	backoff step; measured ~4x win available on fast links, ~2x on slow
63	(decisions.md, M7).	104	(decisions.md, M7).
64		105
		106	## Test debt, banked by M11
		107
		108	- A pty-driving client fixture — the suite's single largest coverage
		109	debt, and the campaign is what sized it. Every e2e client captures
		110	stdout to a file, so it runs at the non-tty 80x24 default and can
		111	never enter scroll mode; two mutations (snapshot resize prefix, scroll
		112	view exit on resync) are therefore not merely unobserved but
		113	unreachable, and no assertion of any kind could grade them. One
		114	fixture makes both branches gradeable and carries the end-to-end pin
		115	the scroll-suppression fix is currently missing.
		116	- The unit-layer mutation sweep — still banked, now with evidence it
		117	would pay. Two of M11's findings were resolved by pins at the unit
		118	layer rather than the e2e one (the delta paint's synchronized-update
		119	wrapper, which turned out to be pinned at no layer at all, and the
		120	delta row's leading reset, where the existing unit pin turned out to
		121	be the whole guard). Both were discovered by accident, while aiming an
		122	e2e campaign at the product. A sweep aimed at the unit layer would not
		123	need the accident.
		124	- ASAN or valgrind over the QUIC tests — carried from M9 unchanged,
		125	and unchanged is the finding: an e2e mutation campaign says nothing
		126	about use-after-free. M9's two reasoned-not-pinned `deinit` orderings
		127	are still owed the only honest instrument for them.
		128
65	## Banked, ranked by expected win	129	## Banked, ranked by expected win
66		130
67	0. Prediction polish, as a group — backspace prediction (the	131	0. Prediction polish, as a group — backspace prediction (the

docs/superpowers/plans/2026-08-09-m11-campaign.md

Old		New
@@ -1,781 +0,0 @@
1	# M11 Phase 2 — the mutation campaign
2
3	Phase 1 taught the e2e suite to assert render-vs-dump convergence. This
4	campaign measures what that bought: break the code deliberately, one
5	mutation at a time, and run each break against BOTH the suite as it
6	stood before Phase 1 (markers only) and the suite as it stands now
7	(markers + convergence + count pins). The catch-rate delta between the
8	two columns is the harness's measured value — the same way M9 measured
9	prediction against its own controls, rather than asserting it had
10	helped.
11
12	This document is the record. It lives in the MAIN checkout because
13	results are not mutations; the mutations themselves never touch main.
14
15	## Method
16
17	Where. Every mutation is applied in the worktree at
18	`/home/xanderle/code/rad/mux-m11-campaign` (detached at main's tip —
19	`main` itself is checked out by the primary working copy, so the
20	worktree cannot hold the branch). The main checkout is never mutated.
21
22	One at a time. Apply a single edit, build, run both suites, restore
23	with `git checkout -- src/ test/`, and verify `git diff --stat` is
24	empty before the next mutation begins. A mutation that does not compile
25	is not a mutation — rework it into a different expression of the same
26	break until it builds.
27
28	How built. Each mutation is built in the worktree with the pinned
29	toolchain, `~/Downloads/zig-x86_64-linux-0.15.2/zig build`. The system
30	zig (0.17-dev) cannot build this repo. Note that `make test` does not
31	rebuild the `zig-out/` binaries; the build step is not optional.
32
33	Binary provenance. Both suites run the SAME mutated binaries, out
34	of the worktree's `zig-out/bin`. The old suite is not re-run against
35	some separately built tree — the only variable between the two columns
36	is the assertion set. The suites are run SEQUENTIALLY, never
37	concurrently; both rely on `$$`-isolated temp paths, which makes
38	sequential runs safe and concurrent ones not.
39
40	The old suite. `OLD_SUITE_SHA = 37ec262` ("test: render helper
41	replays a client capture into a dump-format grid") — the last commit
42	whose `test/e2e.sh` predates every M11 assertion. Task 1 landed the
43	render helper but touched only `build.zig` and `test/render.zig`, so
44	the e2e suite at that sha is the pre-convergence one; extracted to
45	`e2e-old.sh` in the worktree it has zero `assert_converged` calls and
46	takes FOUR args (no RENDER). It is scaffolding and stays uncommitted.
47
48	One deviation from a verbatim extraction. `e2e-old.sh` carries the
49	burst scenario's keystroke interval bumped from `0.2` to `0.25` — the
50	same one-line fix landed on main in 2bc64e8, which found that typing at
51	200ms places the burst's fifth prediction at exactly the 1000ms expiry
52	bound (measured 4/20 flake on an idle machine). Left unpatched, that
53	defect would report false "caught" verdicts on the old suite's burst
54	line and inflate the old column. Nothing else in the file was touched:
55	the old suite's assertions are the object of comparison, so they remain
56	exactly as they were.
57
58	Recording rule. Every mutation gets one row, and every row carries
59	an old-suite verdict, a new-suite verdict, and a disposition. A
60	mutation that BOTH suites miss is a FINDING, not a footnote: it is
61	resolved either as (a) a new assertion landed in this milestone, with
62	the mutation re-run to prove the assertion now fires, or (b) a banked
63	entry with a written reason the gap is accepted. There is no third
64	bucket — "noted" without a decision is the failure mode this campaign
65	exists to prevent.
66
67	Hygiene. Stranded daemons from a mutated build are killed by
68	tracked pid only, never by name or pattern.
69
70	## Results
71
72	\| # \| site \| mutation \| old suite \| new suite \| disposition \|
73	\|---\|------\|----------\|-----------\|-----------\|-------------\|
74	\| 0 \| control \| none (unmutated) \| PASS \| PASS \| baseline \|
75	\| 1 \| paint path \| delta paint drops each delta's last row \| survived \| caught: `e2e FAIL: base attach: client render diverges from daemon grid` \| demonstrated \|
76	\| 2 \| paint path \| delta rows painted one row too low (CUP row+2) \| survived \| caught: `e2e FAIL: base attach: client render diverges from daemon grid` \| demonstrated \|
77	\| 3 \| paint path \| full repaint preamble loses `\x1b[2J` \| survived \| caught: `e2e FAIL: quic epoch resync: client render diverges from daemon grid` \| demonstrated \|
78	\| 4 \| paint path \| delta row's leading `\x1b[0m` stripped (SGR bleed) \| survived \| survived \| banked: no grid can hold it (unit-pinned already) \|
79	\| 5 \| paint path \| delta paint drops the `?2026` synchronized-update wrapper \| survived \| survived \| new assertion: the `paintDeltaClipped` wrapper pin \|
80	\| 6 \| replica sync \| delta painted and applied, but never fed to the replica \| caught: `e2e FAIL: line mode: contradicted=1, want 0` \| caught: `e2e FAIL: quic delta resume: client render diverges from daemon grid` \| both caught \|
81	\| 7 \| replica sync \| snapshot's cols/rows prefix ignored (replica never resized) \| survived \| survived \| banked: needs a resizing client fixture \|
82	\| 8 \| replica sync \| resume attach quotes one seq MORE than the client holds \| caught: `e2e FAIL: reconnect was served a snapshot (7 -> 8), not a delta` \| caught: `e2e FAIL: reconnect was served a snapshot (7 -> 8), not a delta` \| caught by counters (both) \|
83	\| 9 \| prediction overlay \| a CONFIRMED prediction keeps its underline painted \| survived \| caught: `e2e FAIL: line-mode prediction: client render diverges from daemon grid` (styled leg only) \| demonstrated \|
84	\| 10 \| prediction overlay \| a made prediction is also fed into the replica engine \| survived \| caught: `e2e FAIL: raw mode: client render diverges from daemon grid` \| demonstrated \|
85	\| 11 \| delta production \| delta payload omits its highest-numbered dirty row \| caught: `e2e FAIL: line mode: contradicted=1, want 0` \| caught: `e2e FAIL: base attach: client render diverges from daemon grid` \| both caught \|
86	\| 12 \| delta production \| delta rows emitted in reverse row order \| survived \| survived \| banked: order is not a state property \|
87	\| 13 \| delta production \| `update()` never marks row 0 dirty \| caught: `e2e FAIL: line mode: contradicted=1, want 0` \| caught: `e2e FAIL: base attach: client render diverges from daemon grid` \| both caught \|
88	\| 14 \| seq/epoch \| every second update reuses its predecessor's seq \| caught: `e2e FAIL: raw mode: displayed=1, want 2` \| caught: `e2e FAIL: raw mode: displayed=1, want 2` \| caught by counters (both) \|
89	\| 15 \| seq/epoch \| reconnect served a delta even when a snapshot is owed \| caught: `e2e FAIL: restarted daemon served no snapshot (0); the stale seq was honoured` \| caught: `e2e FAIL: restarted daemon served no snapshot (0); the stale seq was honoured` \| caught by counters (both) \|
90	\| 16 \| seq/epoch \| every snapshot prefix carries `epoch + 1` \| caught: `e2e FAIL: reconnect was served a snapshot (7 -> 8), not a delta` \| caught: `e2e FAIL: reconnect was served a snapshot (7 -> 8), not a delta` \| caught by counters (both) \|
91	\| 17 \| scrollback/clipping \| client clip bound one row short: the last tty row is never painted \| survived \| caught: `e2e FAIL: reattach after kill: client render diverges from daemon grid` (plain, `-sh-5.3$`) \| demonstrated \|
92	\| 18 \| scrollback/clipping \| resync no longer leaves scroll view (`scroll_pages = 0` deleted) \| survived \| survived \| banked: needs a pty-driving client fixture \|
93	\| 19 \| paint path \| every SGR run stripped from delta rows at the client paint \| not run (scaffolding retired) \| caught: `e2e FAIL: styled content: client render diverges from daemon grid` (styled leg only) \| gate for the styled scenario \|
94
95	Control run (row 0). Both suites green on unmutated code at main's
96	tip (2bc64e8), first attempt, no re-runs. Old suite: `e2e OK`, 114s.
97	New suite: `e2e OK (9 scenarios, 21 convergence points)`, 114s. A
98	campaign whose baseline is red measures nothing; this one measures.
99
100	Rows 1-5 (paint path). All five built on the first attempt with the
101	pinned toolchain; no compile reworks were needed, though row 1 had to be
102	written as a two-pass count-then-skip over `proto.deltaRowIterator`
103	rather than an `rows[0..n-1]` slice, because the delta rows arrive from
104	a streaming iterator and there is no slice to trim. No suite run was
105	re-run: every verdict below is a first-attempt result, and no scenario
106	failed in a place unrelated to its mutation, so there are no flake
107	attributions to make.
108
109	Rows 1 and 2 — the structural-blindness demonstration. Both are
110	caught by the new suite at the FIRST convergence point, `base attach`,
111	and both are plain-diff catches (the normalized grid differs, so the
112	styled leg never has to speak). The two diffs are mirror images and
113	worth keeping: dropping the last row leaves the client's grid missing
114	`sh-5.3$ printf ... / e2e-works`, while painting one row low leaves it
115	with an extra leading `sh-5.3$` and everything shifted down. The old
116	suite passes both, and passes them for exactly the reason the milestone
117	predicted: `e2e-works` is present in the byte stream either way, so a
118	marker grep sees a healthy session. Same bytes, wrong picture.
119
120	Row 3 — the missing clear survives longer than expected. Dropping
121	`\x1b[2J` does NOT fire at `base attach`; a full repaint over an empty
122	or already-correct screen is indistinguishable from a correct one. It
123	fires at `quic epoch resync`, the first scenario where a repaint lands
124	on a screen that already holds different content: the client's grid
125	keeps `quic-attach-ok`, `quic-reattached`, `quic-pre-tear` and
126	`quic-pre-restart` under the post-restart lines the daemon's grid ends
127	at. Plain diff again. The lesson for the harness is that convergence
128	coverage is only as good as the state the scenario leaves on screen
129	before the repaint — the check that caught this is the one whose
130	fixture had something to clear.
131
132	**Row 4 — both suites missed, and the reason is fixture data, not the
133	check.** The mutation does fire: delta rows really are built with a
134	leading `\x1b[0m` (pinned by the `paintDeltaClipped` unit test, which
135	asserts `\x1b[4;1H\x1b[2K\x1b[0mfits`), so the client really did strip
136	four bytes off every row it painted. But no scenario in either suite
137	ever emits a styled byte — no `tput`, no colour SGR, nothing that
138	leaves a live attribute at end of row. With no live style upstream, a
139	suppressed reset resets nothing and the styled leg has no divergence to
140	find. This is a gap in the CORPUS, not in the assertion: the styled
141	(`--vt`, byte-exact) comparison is the right instrument and is never
142	handed a specimen. Resolution per the recording rule: land a scenario
143	that emits styled output spanning two delta rows and re-run this
144	mutation to prove the styled leg fires. Until that lands the row stays
145	`pending`.
146
147	Row 5 — both suites missed, and this one is honest to accept. The
148	`?2026` wrapper is a flicker property: it changes WHEN the terminal
149	shows the paint, never WHAT it shows. The convergence harness replays
150	the client's stream into a grid, and a grid has no concept of tearing,
151	so no diff can exist by construction. Recorded expectation confirmed.
152	One correction to the going assumption, though: this is NOT unit-pinned
153	on the delta path. `src/client.zig` pins `?2026h` in two unit tests, at
154	`renderClipped` and at the prediction overlay, but the only
155	`paintDeltaClipped` unit test asserts row clipping and cursor clamping
156	and says nothing about the wrapper. So the delta path's synchronized
157	update is currently unpinned at every layer. Cheapest resolution is a
158	unit assertion at `paintDeltaClipped`, not an e2e one — e2e is the
159	wrong instrument for a property no grid can observe.
160
161	Rows 6-10 (replica sync and the prediction overlay). All five built
162	on the first attempt. No suite run was re-run: every verdict is a
163	first-attempt result, and each failure landed in a scenario the
164	mutation plausibly explains, so there are no flake attributions. One
165	mutation (row 8) had to be reworked before it could be written at all;
166	that is recorded under its own heading below rather than as a footnote,
167	because the reason it could not be written as specified is itself the
168	finding.
169
170	**Row 6 — the two suites catch the same break at different places, by
171	different organs, and the new one gets there first.** Removing
172	`replica.feed(composed.bytes)` from the delta arm leaves the paint
173	entirely correct: the screen is drawn from the delta payload, which the
174	mutation does not touch, so every scenario that only ever paints looks
175	healthy. What rots is the replica, and it surfaces the moment something
176	reads it. The new suite fails at `quic delta resume` (test/e2e.sh:850)
177	— a resume repaints from the replica via `renderClipped`, and the
178	replica has not seen a delta since the last snapshot, so the client's
179	grid is missing precisely the delta-only lines:
180
181	```
182	sh-5.3$ printf "quic-%s\n" reattached
183	quic-reattached
184	-sh-5.3$ printf "quic-%s\n" pre-tear
185	-quic-pre-tear
186	```
187
188	Plain leg, and a clean statement of what the mutation deleted. The old
189	suite gets there too, but 372 lines later and by a different route: at
190	`line mode` (test/e2e.sh:1222) it reports `contradicted=1, want 0`,
191	because reconcile judges the overlay against a replica that never
192	advances, so a correctly predicted keystroke goes unanswered until the
193	expiry bound abandons the queue. Both columns say "caught", and the row
194	is honest about that — but the mechanisms are not interchangeable. The
195	counter catch depends on a prediction scenario existing downstream of
196	the damage; the convergence catch reads the corrupted state directly,
197	at the first scenario that repaints from it.
198
199	**Row 7 — pending, and the branch is not merely unobserved but
200	unreachable.** The mutation deletes `replica.resize(prefix.cols,
201	prefix.rows)` from the snapshot arm. Both suites pass, which was the
202	recorded expectation, and the reason is stronger than "no scenario
203	resizes": the mutated statement is never executed at all. It sits under
204	`if (prefix.cols != grid.cols or prefix.rows != grid.rows)`, and in the
205	suite that condition is never true. Every e2e client captures stdout to
206	a file, so `ttySize` returns null (`src/client.zig:917` — `isatty`
207	fails) and the client runs at its non-tty default of 80x24
208	(`src/client.zig:478`), which is also the daemon's. `test/rawmode.zig`
209	does not change this: it is a shell stand-in on the daemon side, not a
210	pty allocated for the client. So `grid` starts at 80x24, every snapshot
211	prefix says 80x24, and the branch is dead code for the whole run.
212	Resolution per the recording rule: this is a banked gap with a written
213	reason — there is no path to a non-80x24 grid anywhere in the corpus,
214	and closing it needs a scenario that actually resizes (a client on a pty
215	plus a `resize` frame), not a new assertion. Until such a scenario
216	exists, no assertion of any kind could catch this mutation, so it is not
217	evidence about the convergence checks either way.
218
219	**Row 8 — reworked, because the check the mutation was supposed to
220	delete does not exist.** The specification was "remove the client's
221	gap-detection so a stale delta is applied rather than triggering
222	resync". There is no such code. The client has no seq-continuity check
223	anywhere: the delta arm sets `last_seq = composed.header.seq` and
224	applies the frame unconditionally, and every gap decision is made by the
225	DAEMON, in `sendResync` (`src/server.zig:1436`), which serves a delta
226	only when the client's `have_seq` names this epoch and falls inside
227	`[reset_seq, seq]`. Removing a check that is not there is not a
228	mutation, so the same break was expressed from the one client-side lever
229	that exists: the resume attach quotes `last_seq +\| 1`, claiming one seq
230	more than the client actually holds.
231
232	What that produced is worth more than what was asked for. The intended
233	desync never happened, because the daemon's range guard noticed the lie
234	(`have_seq <= self.tracker.seq` fails when the daemon has not yet moved
235	past the claimed seq) and served a SNAPSHOT — the safe answer. The
236	screen therefore renders perfectly, all 21 convergence points agree, and
237	the only witness is the counter: both suites fail identically at
238	`reconnect was served a snapshot (7 -> 8), not a delta`. This is the
239	exact complement of rows 1-3. There, convergence saw what counters were
240	blind to; here, a resume served the wrong WAY renders identically
241	either way, and the counter is the only organ that can tell. Recorded in
242	`docs/decisions.md` already, under "counters are asserted because
243	markers are blind to how a resume was served" — this run is a fourth
244	proof of it, arrived at from the client side.
245
246	The residual finding: a delta silently applied across a gap is not
247	reachable from the client at all. Understating `have_seq` yields a
248	superset delta (correct); overstating it yields a snapshot (correct);
249	and the malformed-delta arm, which is the client's only resync REQUEST,
250	never fires because no e2e payload is ever malformed. The property is
251	defended entirely by the daemon, and it is already mutation-proven
252	there. No new assertion is owed.
253
254	**Row 9 — the styled leg fires, alone, and this is the check earning its
255	keep.** Confirmed predictions are retired into `overlay.retired` so the
256	authoritative row paint can take their underline off; the mutation
257	repaints `\x1b[4m` over every retired cell instead, leaving confirmation
258	visible forever. Counters are deliberately untouched — `markPainted` is
259	not called for retired cells, so `made`, `displayed` and `confirmed` all
260	read exactly as they do unmutated — and the old suite duly passes.
261
262	The new suite fails at `line-mode prediction`, and the attribution is as
263	sharp as this campaign gets. The normalized grids are byte-identical;
264	the styled grids are two bytes against fourteen:
265
266	```
267	daemon (.dvt): z
268	client (.rvt): ^[[0m^[[4mz^[[0m
269	```
270
271	Same character, same cell, same plain grid — the client is simply still
272	calling it a prediction. This is the live test of M9's
273	overlay-never-becomes-state invariant, and it is caught by exactly one
274	of the four legs the harness owns. Note the contrast with row 4, which
275	also needed the styled leg and got nothing: there the style had to come
276	from the fixture, and no scenario emits one. Here the client's own
277	overlay supplies the specimen, so the styled comparison finally has
278	something to compare. The lesson is not "styled diffing is unreliable" —
279	it is that a byte-exact check needs a source of bytes, and prediction is
280	the one part of the client that generates its own.
281
282	Row 10 — the plain leg, at raw mode, and the counters cannot see it.
283	Feeding the predicted byte into the replica is the violation M9's design
284	names outright, and it fails at `raw mode`: daemon grid `abc`, client
285	grid `abcj`. Plain diff, so the styled leg never ran (the harness stops
286	at the first divergence and leaves no `.dvt`/`.rvt` behind).
287
288	Why the old suite survives is the instructive half. Raw mode's swallow
289	phase is chosen precisely because the application answers nothing, so
290	the daemon sends no frames — which means `reconcile` is never called and
291	the self-confirmation the mutation would otherwise cause never gets the
292	chance to happen. The idle `expire` path fires instead, exactly as it
293	does unmutated, and every counter reads normally. The overlay's own
294	glyph is then rolled back by the expiry repaint, as designed. What
295	cannot be rolled back is the byte that went into the replica: an overlay
296	is erasable and state is not, which is the entire reason the invariant
297	exists. The counters see a textbook expiry; the grid sees a permanent
298	`j`.
299
300	What rows 6-10 measured. Two demonstrated (9, 10 — new caught, old
301	survived), one both-caught by different organs at different scenarios
302	(6), one caught by counters in both columns (8, and only because the
303	daemon defended the break the client tried to cause), one pending on an
304	unreachable branch (7). Combined with rows 1-5, the convergence checks
305	have now caught five mutations the old suite passes (1, 2, 3, 9, 10),
306	and the three both suites miss separate cleanly by cause: row 4 is the
307	right instrument handed no specimen and is resolvable by landing a
308	styled scenario; row 5 is a property no grid can represent and belongs
309	to a unit test; row 7 is a branch no scenario executes and needs a
310	resizing client before any assertion could speak. Only the first of the
311	three is a debt the convergence checks themselves can pay.
312
313	Rows 11-16 (daemon side: delta production, seq/epoch). All six built
314	on the first attempt with the pinned toolchain. No suite run was re-run:
315	every verdict below is a first-attempt result, and each failure landed
316	in a scenario the mutation plainly reaches, so there are no flake
317	attributions to make. One planned mutation had to be widened to reach
318	its target and is recorded under row 15.
319
320	The shape of this half. Rows 1-10 mutated the client; these six
321	mutate the daemon, and the difference shows up as a change in which
322	organ speaks first. Client-side breaks were mostly invisible to the
323	counters, because the counters live on the client and a client that
324	lies to the screen still counts honestly. Daemon-side breaks are the
325	opposite: the daemon is upstream of both the client's replica AND the
326	client's prediction bookkeeping, so a broken daemon usually trips a
327	counter somewhere even when nothing was built to watch for it. Five of
328	these six are caught by the old suite. That is not the convergence
329	checks failing to earn their keep — it is the honest observation that
330	the old suite's blind spot was the client, not the server.
331
332	**Rows 11 and 13 — the same catch from both suites, but only one of
333	them says what is wrong.** Both mutations withhold a row that really
334	changed: row 11 drops the highest-numbered dirty row from every payload
335	(from the header count and the row list together, so the payload stays
336	valid and `composeDelta`'s count check has nothing to object to), row 13
337	swallows every change to row 0 by never stamping it in `update()`.
338
339	Both suites fail on both. But the old suite fails at `line mode:
340	contradicted=1, want 0` — the eleventh scenario in, and by a prediction
341	counter — while the new suite fails at `base attach`, the very first
342	scenario, and prints the missing content:
343
344	```
345	row 11: -sh-5.3$ printf "e2e-%s\n" works
346	-e2e-works
347	sh-5.3$
348	+e2e-works
349
350	row 13: -sh-5.3$ printf "e2e-%s\n" works
351	+sh-5.3$
352	```
353
354	Row 13's diff is the whole diagnosis in two lines: one row, the first
355	one, holding the prompt and the echoed command on the daemon and only
356	the bare prompt on the client. The old suite's verdict is true but
357	oblique — a prediction was contradicted because the row that would have
358	confirmed it never arrived, which is a symptom three inferential steps
359	from the cause. Same disposition, very different debugging cost, and
360	the gap is eight scenarios of runtime plus the entire distance between
361	"a counter is off" and "this row is missing".
362
363	Worth naming why the prediction counter is the old suite's organ here
364	at all: the shell prompt is where typing happens, so the row a
365	prediction is judged against is exactly the row these mutations
366	withhold. Row 11 withholds it because the prompt is the highest dirty
367	row; row 13 because a fresh shell's prompt is row 0. The counter is not
368	watching for lost rows. It is watching for lost predictions, and lost
369	rows happen to eat predictions.
370
371	**Row 12 — pending, and the reason is that row order is not a state
372	property.** Reversing the row order inside each delta payload changes
373	nothing either suite can see, including all 21 convergence points.
374	This was the honest expectation written before the run, and it is
375	confirmed twice over — once by both suites passing, and once by
376	reading the code that would have to object.
377
378	Nothing objects. `composeDelta` emits `CUP(row+1);1H` + `EL(2)` + the
379	row's bytes for every row it iterates, and its only validation is
380	`seen != hdr.row_count`. Every row therefore paints at its own absolute
381	address, independent of every other row, so the payload is a set and
382	not a sequence: permuting it is a no-op on the resulting grid by
383	construction. The final CUP to the header's cursor position is emitted
384	after the loop and is unaffected by the loop's order.
385
386	This is a genuine gap in the harness, but it is not a gap worth
387	closing with a grid check, because no grid can hold the evidence. If
388	row order ever becomes load-bearing — a relative-addressing delta
389	format, a scroll-region optimization — it becomes a protocol property
390	and belongs to a `composeDelta` unit test asserting on the composed
391	byte string, not to an e2e convergence point. Filed alongside row 5 as
392	"correctly unmeasurable here", as distinct from row 4's "measurable but
393	unmeasured".
394
395	Row 14 — the grid converges perfectly and the seq is still wrong.
396	Making every second update reuse its predecessor's seq (a `reuse_seq`
397	toggle flipped on each advance) leaves the delta CONTENT correct: with
398	the seq unadvanced, `buildDeltaSince(seq - 1)` selects the rows stamped
399	at the current seq, which is this update's rows plus the previous
400	update's, so every client receives a superset of what it needed. All 21
401	convergence points pass. Both suites then fail at exactly the same
402	place, `raw mode: displayed=1, want 2`, with the full counter line:
403
404	```
405	predict made=4 displayed=1 confirmed=3 contradicted=1 expired=1 abandoned=1 suppressed=1
406	```
407
408	The mechanism runs through `reconcile`'s first guard, `if (p.made_seq
409	>= applied_seq) continue` — "too new to be evidence about". A
410	prediction made while the client holds seq N is stamped `made_seq = N`;
411	the next frame legitimately carries N+1 and judges it. Under the
412	mutation every second frame carries N again, so the guard defers a
413	prediction the frame could in fact have judged. Deferred judgement
414	means a deferred `confirmed`, which means a streak that lengthens a
415	frame late, which means `.adaptive` promotion to `confident` arrives
416	late — and `displayed` only increments for predictions painted while
417	confident. The lost display is not a lost prediction; it is a
418	prediction that was still invisible when its moment passed.
419
420	This is the cleanest instance in the campaign of a break the
421	convergence checks structurally cannot see. A seq is not a cell. The
422	replica ends in exactly the right state and the screen shows exactly
423	the right bytes; what is wrong is the numbering that tells the client
424	WHEN it is allowed to believe things. Row 12 and row 14 are the same
425	lesson from opposite ends: row 12 is a wrong wire ordering with no
426	consequence, row 14 is a wrong wire numbering with a consequence no
427	grid can express.
428
429	**Row 15 — the control, and the old suite catches precisely what it was
430	built to catch.** Both suites fail identically, at the M7b restart
431	scenario, with the message the campaign brief predicted verbatim:
432	`restarted daemon served no snapshot (0); the stale seq was honoured`.
433
434	The mutation had to be widened, and the discrepancy is worth recording.
435	The plan asked for a delta served "when the client's quoted have_seq is
436	below the tracker's floor (or from a dead epoch)", which implies
437	dropping two of `sendResync`'s four guards — `have_epoch == self.epoch`
438	and `have_seq >= self.tracker.reset_seq`. Dropping only those does not
439	reach the restart scenario at all, because a RESTARTED daemon's tracker
440	sits at a very low seq while the client quotes a high one from the dead
441	instance, so the surviving upper bound `have_seq <= self.tracker.seq`
442	sends it to a snapshot anyway and the mutation is inert. Expressing the
443	intended break therefore meant reducing the guard to `have_seq != 0 and
444	self.tracker.rows != 0` — "serve a delta to anyone quoting any nonzero
445	seq". The daemon then answers the reconnect with a delta whose
446	`since` exceeds every row seq it holds: an empty, structurally valid,
447	completely useless payload.
448
449	What the two suites see is identical, and the scenario's own comment
450	explains why the markers stay silent:
451
452	> Markers are blind to the kind of resume — a broken epoch fence handing
453	> back a garbage delta would render "m7b-post-restart" just as well.
454	> Only the counter sees it.
455
456	The grid-content assertion in the same scenario greps `muxd dump`, i.e.
457	the DAEMON's grid, which never held the pre-restart marker no matter how
458	the resume was served. It cannot fire. The snapshot counter is the sole
459	witness, it was written to be the sole witness, and it is. This row is
460	the campaign's evidence that the old suite is not being graded on a
461	curve: where it has teeth, they close on the first attempt.
462
463	Row 16 — the same fence from the other side, and the same verdict.
464	Stamping `epoch + 1` into every snapshot prefix (the daemon's real
465	`self.epoch` untouched) poisons the identity the client echoes back:
466	the client stores `prefix.epoch`, quotes it on reattach, and
467	`sendResync` compares it against the true `self.epoch`, which now never
468	matches. Every resume that should have been a delta becomes a snapshot.
469	Both suites fail identically at the M7 delta-resume scenario:
470	`reconnect was served a snapshot (7 -> 8), not a delta`.
471
472	Rows 15 and 16 are exact mirror images and it is worth stating the pair
473	together, because between them they pin the fence from both directions.
474	Row 15 removes the fence, so a resync that is owed a snapshot gets a
475	delta; row 16 corrupts the identity the fence checks, so a resync that
476	is owed a delta gets a snapshot. Neither disturbs a single pixel — row
477	16's snapshots are perfectly correct snapshots, merely unearned — which
478	is why all 21 convergence points pass under both and the counters are
479	the only organ that speaks. It also explains the identical failure
480	string shared with row 8: row 8 broke the same fence from the client's
481	side by quoting one seq too many. Three different mutations, one
482	mechanism, one assertion, and the assertion holds each time.
483
484	What rows 11-16 measured. Zero demonstrated, two both-caught (11,
485	13), three caught by counters in both columns (14, 15, 16), one pending
486	(12). Read against rows 1-10 this is a clean inversion and the reason is
487	structural, not accidental: the convergence checks compare a client's
488	rendering against a daemon's grid, so they are an instrument pointed at
489	the client. Aim a mutation at the daemon and the daemon's own
490	counters — snapshots, deltas, and the M9 prediction stats the client
491	derives from the daemon's seq stream — are already watching, in both
492	suites equally. The new suite still wins rows 11 and 13 decisively on
493	diagnosis rather than detection: same disposition, eight scenarios
494	earlier, with the offending row printed instead of inferred.
495
496	Campaign totals across all 16 rows. Five demonstrated (1, 2, 3, 9,
497	10 — new caught, old survived), three both-caught (6, 11, 13), four
498	caught by counters in both columns (8, 14, 15, 16), four pending (4, 5,
499	7, 12). The four pending separate cleanly by cause, and only one is a
500	debt the convergence checks themselves can pay: row 4 is the right
501	instrument handed no specimen and is fixed by landing a styled
502	scenario. Row 5 (synchronized-update wrapper), row 7 (a resize branch
503	no scenario executes) and row 12 (row order under absolute addressing)
504	are not convergence-check debts at all — they are properties a rendered
505	grid cannot represent, and each belongs to a unit test on the byte
506	string or to a scenario that does not yet exist.
507
508	Row 17 — the clip bound, one row short. The client paints through
509	two bounded loops: `renderClipped`'s `limit = @min(grid_rows,
510	tty.rows)` for a full repaint, and `paintDeltaClipped`'s `if (row.row
511	>= tty.rows) continue` for a delta. Both were clamped one row short
512	(`tty.rows -\| 1`), so on the suites' 80x24 clients row 24 is structurally
513	unpaintable while the replica and the daemon both still hold it. Two
514	lines, one file, one idea — a single-line edit would have been half a
515	mutation, because either loop alone leaves the other painting the row.
516
517	The old suite survives it and the new suite fails at the FIRST scenario
518	after the control, `reattach after kill`, on the plain arm of the
519	convergence check, with the missing row printed:
520
521	```
522	--- .../re.dump.n
523	+++ .../re.render.n
524	@@ -21,4 +21,3 @@
525	58
526	59
527	60
528	-sh-5.3$
529	```
530
531	That diff is the whole argument for the new suite in four lines. The
532	scenario is the same one in both suites — `seq 1 60` into a scrolled
533	shell, kill the client, reattach — and the old suite runs it too. What
534	the old suite asks is whether the marker text came back, and the markers
535	are the numbers, which live in rows 1..23 and came back perfectly. The
536	one thing that ends up on row 24 of a screen that has just scrolled is
537	the prompt, and no marker grep was ever written against a prompt. So the
538	old suite watched the exact byte stream that carried the bug and had
539	nothing to say about it. Worth recording as the general shape: a marker
540	grep is a test of the rows a fixture happens to write text into, and the
541	bottom row is precisely where a scrolled session puts the thing the
542	fixture did not write.
543
544	The unit layer is a near miss, and instructively so. The clip tests at
545	`src/client.zig` "renderClipped paints only rows that fit and clamps the
546	cursor" assert the two NEGATIVE facts — no `\x1b[25;`, no "bottom row"
547	from a 30-row grid — and one cursor fact, `\x1b[24;80H`, which survives
548	untouched because `clampCursor` was not mutated. Nothing there asserts
549	that row 24 IS painted. The tests pin the ceiling and leave the floor
550	open, so this mutation walks under them. Both of the campaign's
551	instruments for this bug therefore agree on the same lesson from
552	opposite directions: the new suite catches it only because a convergence
553	check compares whole grids rather than chosen rows.
554
555	Row 18 — the resync scroll reset, unreachable and unpinned. The
556	mutation deletes `scroll_pages = 0` from the reconnect path in
557	`fn session` (`src/client.zig` ~609), so a client that reconnects while
558	paged into history stays in scroll view instead of returning to live.
559	Both suites survive, and the reason is not that the assertions are weak
560	but that no e2e client can enter the state at all.
561
562	The evidence is exhaustive rather than argued. `scroll_pages` is a local
563	in `session()`, initialised to 0, and the only site that raises it is the
564	Shift+PageUp branch, which requires stdin to deliver exactly `\x1b[5;2~`
565	in one read AND `history_rows > 0`. Neither suite contains that byte
566	sequence anywhere: `grep -c $'5;2~' test/e2e.sh e2e-old.sh` returns 0 and
567	0. So at the mutation site `scroll_pages` is invariantly 0 in every e2e
568	run ever executed, and deleting an assignment of 0 to a variable already
569	0 is a semantic no-op. This is not "the suites missed it"; there is no
570	behavioural difference to miss. Disposition `pending`, cause: unreachable
571	fixture, not absent assertion.
572
573	The unit layer does not cover it either, which is the part worth acting
574	on. `session()` has exactly one caller and no test drives it — the run
575	loop is exercised only end-to-end — so the reset is pinned nowhere in the
576	tree. The nearest pins are adjacent but distinct: `src/predict.zig`
577	(~1128-1140) pins that `setScrollMode` flushes the overlay and that
578	`predictAt` suppresses while scrolled, and `src/client.zig` pins
579	`renderScrollback`'s paint and `scrollPageRange`'s arithmetic. All three
580	are about scroll mode; none is about leaving it. Closing this needs a
581	scenario that pages back and then forces a reconnect, which in turn needs
582	a pty-driving client fixture (`rawmode` is the existing precedent) — the
583	same missing-fixture debt as row 5, not a convergence-check debt.
584
585	One genuine finding fell out of reading for this row, and it is in
586	unmutated HEAD, not in the mutant. The resync path clears `scroll_pages`
587	but never calls `overlay.setScrollMode(false)`, and `overlay.flush()`
588	does not clear `scroll_mode` — it only drops pending and retired
589	predictions. So after a reconnect taken while scrolled, the client is
590	back on live rows with `scroll_mode` still true, and since the "any other
591	key exits scroll mode" branch is guarded by `scroll_pages > 0` it can
592	never run again, `predictAt` suppresses unconditionally, and local echo
593	prediction is dead for the remainder of the session. It is invisible to
594	both suites for exactly the reason row 18 is: no e2e client can page
595	back. Recorded here, deliberately unfixed — this campaign commits no code
596	— and it belongs with the fixture debt above, since the same pty fixture
597	that would pin the reset would expose this.
598
599	Campaign totals across all 18 rows. Six demonstrated (1, 2, 3, 9,
600	10, 17 — new caught, old survived), three both-caught (6, 11, 13), four
601	caught by counters in both columns (8, 14, 15, 16), five pending (4, 5,
602	7, 12, 18). The last row of the table is also the campaign's cleanest
603	single result: row 17 is a real client-side rendering bug that the old
604	suite runs the fixture for and cannot see, and the new suite reports at
605	the first scenario with the offending line printed. The five pending
606	rows now separate into three causes, none of which is a weak convergence
607	check: one specimen the checks want and do not have (row 4, styled
608	scenario), two properties a rendered grid cannot represent (rows 5 and
609	12), and two branches no fixture can reach (rows 7 and 18), both of which
610	want a pty-driving client fixture rather than a new assertion.
611
612	Worktree retired. The campaign worktree
613	`/home/xanderle/code/rad/mux-m11-campaign` (detached at 2bc64e8, tracked
614	diff empty at teardown) was removed after row 18. Its one piece of
615	scaffolding, `e2e-old.sh` — the pre-M11 suite, carried untracked so that
616	each row could be graded against both — was deleted with it; sha256
617	`aa04ecbebfa2f2dbc425cb651b543ebb995fe30dc45393fc5b797bd004ea1c27`, for
618	anyone reconstructing an "old suite" column later.
619
620	## Dispositions
621
622	The recording rule allows two endings and no third: a NEW assertion
623	landed now, with the mutation re-run to prove it fires, or a banked
624	entry with a written reason. All five pending rows are closed below.
625	The mutations were re-applied in the MAIN checkout, one at a time,
626	apply-run-revert, with `git diff` verified between each — the campaign
627	worktree is gone, and an in-checkout gate is the repo's established
628	pattern for proving a new assertion fires.
629
630	Row 4 — banked, and the campaign's own prescription was wrong. The
631	prescription was a styled scenario, on the reading that the styled leg
632	was the right instrument handed no specimen. The scenario landed
633	(`styled content`, test/e2e.sh, a session printing two bold-red rows
634	followed by a plain prompt row) and the mutation was re-run against it.
635	It still survives. The reading was wrong, and the reason is a contract
636	nobody had checked: ghostty's VT formatter closes every styled row it
637	emits. `dumpVtRow` returns `\x1b[0m` (the prefix `formatSelection` adds)
638	plus the formatter's own output, and for a styled row that output both
639	opens with a reset and ends with one — ghostty's test suite spells out
640	why, "style is reset before newline to prevent background colors from"
641	bleeding. Verified on the wire, not inferred: the delta row for
642	`styled-red` paints as `\x1b[2K\x1b[0m` `\x1b[0m\x1b[1m\x1b[38;5;1m`
643	`styled-red\x1b[0m`, two resets, and the mutation strips only ours. A
644	full-width background fill and a styled line wrapped across two rows
645	were both tried; both close their pen the same way.
646
647	So the leading reset is redundancy against a live pen, and no live pen
648	exists. Every byte source the client paints from closes itself: the
649	formatter's rows, `paintOverlay`'s per-cell `\x1b[4m{c}\x1b[0m`,
650	`bannerText`'s `\x1b[7m{s}\x1b[0m`. The only pen the reset could
651	protect against is one the HOST terminal had already set before mux
652	started, which is exactly the thing no rendered-grid comparison can
653	ever hold — the render helper replays into a fresh engine at the
654	default pen, by construction. This is not a corpus gap; it is a
655	property that is invisible to the harness for the same structural
656	reason as rows 5 and 12, and it moves to that pile.
657
658	It is also already pinned where it lives. Re-running mutation 4 against
659	`make test` fails on the assertion that has been there since the paint
660	landed:
661
662	```
663	error: 'client.test.paintDeltaClipped skips rows beyond the tty and clamps the cursor' failed
664	src/client.zig:1837: try std.testing.expect(std.mem.indexOf(u8, out[0..n], "\x1b[4;1H\x1b[2K\x1b[0mfits") != null);
665	Build Summary: 196/197 tests passed; 1 failed
666	```
667
668	No new assertion is owed, and adding one that says what line 1837
669	already says would be theatre.
670
671	Row 19 — the styled scenario stays, and here is what it is worth. A
672	scenario landed on a disproved hypothesis has to justify itself on its
673	own terms or come back out, so it was gated by a mutation aimed at what
674	it actually covers: strip EVERY SGR run from delta rows at the client
675	paint, not merely the leading reset. Glyphs unchanged, colours gone.
676	The new scenario is the first convergence point to fail, on the styled
677	leg alone:
678
679	```
680	e2e FAIL: styled content: client render diverges from daemon grid (-daemon +client):
681	(plain diff empty — 0 bytes)
682	daemon (.dvt): ^[[0m^[[1m^[[38;5;1mstyled-red^[[0m
683	client (.rvt): styled-red
684	```
685
686	Before this, the byte-exact leg had exactly one source of specimens in
687	the whole corpus — the prediction overlay's own underline (row 9). Now
688	the fixture supplies one too, which is what puts daemon-side style
689	emission and the delta path's style transport under the check at all.
690	The old-suite column is honestly blank: `e2e-old.sh` went with the
691	worktree, and a marker grep cannot see a colour by construction — the
692	text is identical under this mutation.
693
694	Row 5 — new assertion, at the unit layer, gated. `paintDeltaClipped
695	brackets the whole paint in one synchronized update` (src/client.zig)
696	asserts the delta paint STARTS with `\x1b[?2026h\x1b[?25l` and ENDS with
697	`\x1b[?25h\x1b[?2026l` — on the ends rather than by substring search,
698	because the property is that every row lands inside the brackets, which
699	only position can show. e2e is the wrong instrument here and always was:
700	a synchronized update changes when the terminal shows a paint, never
701	what it shows. Re-applying mutation 5 (wrapper dropped from the delta
702	path) fails exactly this test and nothing else:
703
704	```
705	error: 'client.test.paintDeltaClipped brackets the whole paint in one synchronized update' failed
706	src/client.zig:1868
707	Build Summary: 197/198 tests passed; 1 failed
708	```
709
710	Row 7 — banked: needs a resizing client fixture. The branch is
711	unreachable, as row 7's note established, and the question left open was
712	whether the snapshot-apply resize is drivable from a unit test instead.
713	It is not, without a refactor this milestone should not make. The
714	mutated statement sits inline in `session()`'s frame switch — read the
715	prefix, compare against `grid`, `replica.resize`, restamp `grid` — and
716	`session()` takes a live transport, two file descriptors and a run loop.
717	There is no `applySnapshot` seam to call, `session()` has one caller and
718	no test drives it, and `Engine.resize` is already tested on its own, so
719	a test of the callee could not catch a deleted call. Banked with row 18:
720	same debt class, a fixture that can drive a client at a size other than
721	80x24, which today means a pty. Note the asymmetry with row 4 — that one
722	is invisible to the instrument; this one is invisible to the corpus.
723
724	Row 12 — banked: order is not a state property. Rows are absolutely
725	addressed — `composeDelta` emits `CUP(row+1);1H` + `EL(2)` + the row's
726	bytes for each row it iterates — so the payload is a set by
727	construction and permuting it is a no-op on the resulting grid.
728	Asserting an emission order would forbid an equivalent implementation
729	while pinning nothing a user can observe, which is the wrong trade for
730	a wire format that is still moving. Structural corruption is already
731	rejected: `composeDelta` validates `seen != hdr.row_count`. If row order
732	ever becomes load-bearing — relative addressing, a scroll-region
733	optimization — it becomes a protocol property and belongs to a
734	`composeDelta` unit test on the composed byte string.
735
736	Row 18 — banked: needs a pty-driving client fixture. No e2e client
737	can enter scroll mode, because entering it requires stdin to deliver
738	`\x1b[5;2~` in one read and no suite contains those bytes; with
739	`scroll_pages` invariantly 0 the mutation is a semantic no-op. Closing
740	it needs a scenario that pages back and then forces a reconnect, which
741	needs a client on a pty (`rawmode` is the precedent, but it stands in
742	for the SHELL, on the daemon side). Banked together with row 7 as one
743	debt: a client fixture that owns a pty, which would make both branches
744	reachable and both mutations gradeable.
745
746	The bug the campaign found, now fixed. Row 18's note recorded a
747	genuine defect in unmutated HEAD and deliberately left it alone, since a
748	campaign commits no code. It is fixed here. The reconnect path in
749	`session()` cleared `scroll_pages` but never told the overlay, and
750	`flush()` does not clear `scroll_mode` — it drops pending and retired
751	predictions and nothing else. A reconnect taken while scrolled therefore
752	left the client painting live rows with the overlay still suppressing,
753	and the "any other key leaves scroll mode" branch could never rescue it
754	because that branch is guarded by `scroll_pages > 0`, which the
755	reconnect had just made false. Local echo prediction was off for the
756	rest of the session, silently. The fix is one call,
757	`overlay.setScrollMode(false)`, next to the existing `scroll_pages = 0`.
758
759	Client-side deliberately, rather than making `flush()` clear the mode
760	itself: every snapshot flushes, and a snapshot is not a reason to leave
761	history — the overlay would start deciding where the viewport is, which
762	is the client's business. The counters do not move either way, because
763	`setScrollMode` is a no-op when the bit is already false and its flush
764	would otherwise abandon exactly the predictions the flush ten lines
765	later abandons.
766
767	Tested where the property can be reached: `a flush leaves scroll mode
768	exactly where it found it` (src/predict.zig) pins the contract the fix
769	depends on in both directions — a flush taken while scrolled still
770	suppresses, a flush taken live still predicts. The end-to-end pin, "a
771	reconnect while scrolled leaves prediction working", rides the banked
772	pty-fixture debt above and is not claimed here.
773
774	Where the five rows ended. One new assertion (row 5, unit), four
775	banked (4, 7, 12, 18), zero undecided. The banks fall in two classes and
776	neither is a weak convergence check: rows 4, 5 and 12 are properties no
777	rendered grid can represent, and rows 7 and 18 are branches no fixture
778	can reach. Row 4 changed class during resolution — it was filed as the
779	one debt the convergence checks could pay, and paying it disproved the
780	premise. One product bug fixed, one scenario added, pins moved to 10
781	scenario checkpoints and 22 convergence points.

docs/superpowers/plans/2026-08-09-m11-e2e-hardening.md