Good boundaries.
Explicit remaining work.

The separation is useful.
It is not finished everywhere.

The framework has real independent clients and avoids desktop/OS-service dependencies. The desktop receives adapters through port contracts, while production wiring lives in composition roots. Use cases depend only on the domain. These are meaningful boundaries, not just directory names.

The domain is mostly typed data and small behavior models. Some types enforce invariants, while others are public records whose callers can construct invalid values. Launcher and widget interaction now belong to child controllers with explicit borrowed inputs. The root still coordinates shared snapshots, settings and bar/dock presentation. Message payload sizes remain application-owned, and service error handling is uneven. Those limits should guide the next changes rather than adding more empty crates or abstractions.

The ongoing audit fixes concrete ownership and lifecycle problems, with separate evidence for unit tests, Vulkan pixels and native VM behavior. The implementation ledger tracks the larger backlog and unverified paths. Its current rollup and readiness guide distinguish implemented code, owned native fixtures and real application/hardware acceptance. Historical evidence keeps its original source and scope; a later test can supersede an old pending summary without rewriting that report. More crate names alone would not resolve those gaps.

Entities, value types,
snapshots and policies.

The new LauncherSize stores optional preferred dimensions. The settings validation use case rejects zero dimensions. The client enforces useful control sizes and screen/grid limits. Keeping screen pixels, theme tokens and compositor calls out of domain policy preserves the boundary.

AppId::new now enforces a non-empty desktop-file identity ending in .desktop, without path separators or control characters. Its storage is private and deserialization uses the same check; valid saved IDs keep their existing string representation. An invalid saved ID produces a settings error and preserves the original file. Date::new rejects impossible dates, derives weekdays and performs checked relative-month arithmetic. Placement::new and deserialization reject non-finite coordinates, while allowing negative positions. The client supplies grid spacing and screen bounds to use cases; those presentation rules are separate from finite-value validity.

Ports describe needs.
Adapters supply behavior.

DesktopAdapters holds injected implementations through Arc<dyn …Port> handles. desktop_adapters() chooses concrete adapters. A trait-object call is an ordinary synchronous Rust call; the effects/subscription machinery decides which thread invokes it.

The desktop composition root is the only desktop module selecting production service implementations. In-memory adapters let client tests exercise behavior without executing host commands. Lock and login have their own composition roots.

AudioPort and NetworkPort have native adapters and desktop children. BluetoothPort has a native BlueZ adapter, an independent consumer and a desktop child with explicit pairing prompts. Two owned virtual controllers pass radio controls, discovery, comparison-code pairing, bonding, trust/removal and confirmed Forget. The rebuilt adapter fixes a real signal-filter defect: external power changes now refresh the panel without a restart or client polling. Escape closes an active prompt without reopening it. Decline now cancels its matching owned attempt, and connected unpaired devices have Disconnect beside Pair without Trust. Native tests observe terminal phases while the reference peer remains running, and successful acceptance still produces a bond without automatic trust. Existing Bluetooth entrypoints now open the Rust child without terminal windows. Pending Connect cancellation, physical devices/profiles, incoming pairing and broader faults remain open. PowerPort now covers battery, profiles, brightness and session requests. TrayPort and a native StatusNotifier/DBusMenu adapter now have an SDK client and independent consumer; owned native fixture acceptance passes. One genuine wired NetworkManager Applet item/menu/information action now passes five interaction and four cleanup checks on unchanged 8e, one virtual output, plus thirteen independent post-removal preservation checks. Other apps, wireless/secret-agent flows, nested menus, hardware, pixel quality and performance remain open. See the Bluetooth service guide for ownership, command admission and lifecycle details, and the system map for retained tools and services.

Fix the boundary.
Check the behavior.

The native audio-panel report records real pointer controls, routing confirmed through backend state, a 120-move gesture, a deliberately suspended audio server causing command timeout, removal of a held device and service/socket restart without restarting the desktop. Recovery assigns fresh object identities; the client now offers Dismiss when a failed target is no longer available. These guest-only tests restore original audio settings and remove owned fixtures. They do not establish physical audio behavior, memory targets or hardware frame pacing.

The session-client report records a real rejected greetd login, clearing its retained username, an empty submit and a successful clean retry. The shared client owns active-field routing and zeroizing responses; PAM, greetd and libpolkit-agent retain authentication authority. Login, secure lock and permission dialogs disable local command/inspection IPC. Native secure-lock acknowledgement, masked-response clearing, authenticated unlock and wallpaper retention pass on the rebuilt session clients.

Permission cancellation also exposed a runtime lifecycle defect: the dialog disappeared visually while an empty native surface remained in the long-lived agent. Teardown now drops GPU surfaces before their protocol roles and flushes queued destruction while the connection is alive. The native cancellation regression runs two real policy checks, requires each denied result and no authorization surfaces between requests, and verifies that the same agent survives. It supplies no credentials and performs no privileged operation. This is presentation cleanup, never an authorization to unlock.

Tests verify boundaries and selected behaviors; they do not prove every operating-system feature works. Native visual tests use the real renderer, while hardware, login and secure-lock testing require separate environments. The authentication deployment updates three session clients; other installed executables retain their linked runtime until rebuilt.

The renderer validation report records eight focused GPU tests and 172 unchanged visual comparisons on each of the software and hardware drivers, plus native desktop checks. Derivatives and implicit texture sampling depend on neighboring fragment invocations, as described by the WGSL execution model. Moving discard fixed the reproduced driver difference; the test does not identify a specific compiler instruction defect or establish correctness on every driver. Late discard can execute shader work for clipped fragments, so this change makes no performance-improvement claim.

Where failures cross the boundaries

The notification delivery report records three reproduced protocol failures, four passing private-daemon regressions and native replacement/action/dismiss/expiration checks. Name contention and bus restart are confined to test-owned daemons. The VM check uses transient fixtures and real pointer clicks; it does not restart the desktop bus. Grouped durable history, explicit storage recovery and current-version action targets are implemented in the notification history guide. Native inline styles/links and prepared image content are implemented in the rich-text and image guides; their current application/compositor and performance acceptance remain separate.

The subsequent scene-validation report records nine focused renderer checks and all 172 unchanged visual comparisons on both drivers. Its rejection test retains previous pixels and pinned resources after both early validation and later glyph-preparation errors, then renders a valid next frame. Native launcher, restart and existing secure lock/unlock checks pass. The runtime still treats a render error as fatal; offscreen recovery does not establish native device-loss recovery or a process-memory bound.

Desktop's message handling currently ignores a failed system sample. The Weather child retains same-location last-good data, error/freshness, explicit units and configuration. Its strict/visual checks and scoped native opening/focus plus one production forecast pass; native form mutation and failure/retry remain open. Media owns loading/empty/unavailable observations, player selection, targeted commands and artwork errors in a native child. Ignoring a system sampling failure still loses the distinction between retained data and an unavailable service. Audio and media have separate native observation states; the remaining sample-based services need equivalent outcome and freshness policies rather than a generic error banner only at the root.

The next service slice should preserve a typed outcome from the adapter, retain the last successful sample when useful, expose freshness/failure in client state and verify recovery after disconnect. Domain contracts describe service meaning; adapters own protocol/reconnect details; components decide how to present that state. A port-shaped trait by itself does not establish those semantics.

Resources need eligible evidence.
Pacing still needs work.

The completed FHD video measurements on archived 9eb41939 use one virtual 1920×1080/60 Hz/1× output and the same 4K H.264 60 FPS source. With tracing OFF, 480 samples over 120.000454 seconds record 497.063 MiB mean/peak RSS, 616.008 MiB process-lifetime HWM, 142.633% of one logical core and zero process swap. A separate 120.000898-second instrumented process observes 7,179 distinct prepared-revision advances over 119.983329 compositor seconds: 59.833/s, with 16.667 ms p50/p95/p99 and 50 ms maximum feedback gaps. Both phases are host-pressure-ineligible. Their different process births prevent a memory-gain comparison; bound-resource feedback establishes neither visible pixels nor physical scanout or accepted 60 FPS. Preservation, driver restoration and a separate terminal-guardian/normal-OFF check pass. PR108/main fb7b1b26 adds CPU frame reuse, but this tested VM predates it. Memory investigation, eligible targets and broader hardware/application tests remain open.

The verified delivery checkpoint is PR108/main fb7b1b26, Pages run 40044620948: three HTML pages, native manifest/PNG and 116 inputs/480 captures from b3c91fab match the artifact; the same bundle passes 20 LAN HTTP checks. CI builds and publishes later main revisions through their own receipts. The earlier 9eb trial, 4K setup/restoration follow-up and failed V1 coverage attempt retain their recorded outcomes. The completed V2 phases do not establish the actual V1 failure cause or a PR108 gain.

The historical 26d03adf 4K A/B preflights verify virtual output geometry and restoration. Resource admission was refused: A lacked a lease below the unchanged 520-second measurement/cleanup budget, and B refused host-memory admission before sampler facts/binding. A later one-off proc observation at restored 1920×1080/60 Hz/1× records 604.594 MiB RSS, 539.586 MiB anonymous RSS, 16.242 MiB process swap and 680.293 MiB process-lifetime high-water RSS. Independent normal-OFF facts pass. No eligible 120-second interval, 4K causality, allocation-owner/GPU attribution, leak or pacing result follows. The observation motivates bounded memory investigation; historical measurements and target-acceptance flags remain unchanged.

The historical 35ed87ed upload trial observes 250.580664/252.394531 MiB normal mean/peak RSS and 154.032796% of one logical core on native RADV. Separately, post-conversion prepared-callback wall bounds are 59.733251–60.129012/s, while compositor feedback references 32.224499 distinct prepared-revision advances/s; presentation gaps p50/p95/p99/max are 33.333/33.334/50/83.333 ms. Host swap and I/O stalls make both phases ineligible, leaving the 300 MiB and 60 FPS targets unaccepted. Profiling restores off with independent verification. The renderer passes source/headless correctness checks; neither those tests nor this unmatched native observation establishes a pooled-upload gain, bottleneck attribution, pixel visibility or scanout. Earlier reports below keep their original source/workload boundaries.

The separate 85a5be63 geometry diagnostic describes a moving rounded rectangle through Component::view/ViewContext.now and requests continuing native redraw through Application::animating. The shared FrameDemand tracks dirty work and pending callbacks. Without media or stream uploads, the run records 4467 intervals over 120.566662 compositor seconds, or 37.050043/s, with 33.333/33.334/50/66.667 ms gap p50/p95/p99/max. Four execution and five restoration checks pass; one static image confirms partial visibility only. No pressure/resource collector ran, so the below-60 shared-path observation attributes no renderer, compositor or VM cap and accepts no target. Subsequent retired-fixture cleanup is separately verified maintenance, not a performance comparison.

The later CPU-profiled shape run reuses that binary and records 48.370556 feedback intervals/s. Its 5,851 successful draw rows average 0.658506 ms, p99 1.145934 ms and maximum 2.480036 ms; all 5,849 feedback rows join, with two terminal CPU rows outside the feedback window. Acquire/present CPU calls are short and uploads are zero. These successful-only wall times include driver waits but omit GPU execution, application update, callback/dispatch and unsuccessful retries. Four execution and five restoration checks pass; separate static review confirms partial visibility only. No pressure collector ran, so the gaps remain unattributed and no causal improvement or target acceptance follows.

The later callback trace diagnostic at 91b964ae records 5,286 contiguous events: 2,643 matched callbacks and 2,643 presented attempts. Mean request-to-handler is 44.175852 ms, handler-to-next-attempt 0.006112 ms and attempt duration 1.603372 ms; 2,641 feedbacks separately record 21.972535 intervals/s. Four execution and five restoration checks pass with normal 35ed preserved. The earlier wait combines transport, scheduling and dispatch with compositor waiting; these records do not attribute a cause or accept a target. The bounded runtime trace preserves separate clocks and typed outcomes without domain policy or extra repainting. This follow-up integrates that instrumentation on accepted main without the unaccepted renderer/video ancestors; its final source, CI and publication gates remain separate.

The separate 120-second normal-video sample of the Display binary a7f41ecc records 384.82 MiB mean / 403.88 MiB peak RSS and 101.466% of one logical core on llvmpipe, still above the 300 MiB target. Its 4K H.264 60 FPS source is fitted to one 1080p scale-1 output with source-rate playback. This uninstrumented resource sample preserves source, settings, media, output and playback state; it establishes no actual 60 FPS presentation. It is a different source/workload cohort from Weather, with no isolated speedup or physical-GPU claim.

The Weather-source 120-second software-Vulkan video sample records 424.12 MiB mean and 424.15 MiB peak RSS, above the 300 MiB target, with about 1.49 logical cores of main-process CPU. It has no matched before/after or actual 60 FPS presentation result. The accepted-main snapshot has newer preview and invalidation changes without a new matched resource sample. The earlier live display-fit comparison verifies one-output resize/integer/fractional retargeting, with software resource targets still unmet. Historical reports below keep their original binaries and workloads. The PR73 baseline sample measures 548.29 MiB mean and 609.41 MiB peak RSS during live playback, above the 300 MiB target. Main-process CPU is 250.132% of one logical core on software Vulkan. The single 1920×1080 scale-1 output retains 33,177,600 bytes of live RGBA pixels; physical-cover conversion and decoder/driver attribution need work. Source timing, density and effects were unchanged, and exact settings/wallpaper and the running binary were verified.

The earlier Bluetooth release's 120-second normal-mode static sample measured 206.82 MiB mean and 208.18 MiB maximum process RSS. Main-process CPU was 0.7% of one logical core; the service including helpers was 1.024%. Its final Linux residency snapshot had no swapped pages. Idle background and closed-dock surfaces submitted no frames. That different historical workload does not establish current live-video efficiency.

In that historical static sample, cold and warm launcher submission gaps reached 41.07 ms and 38.38 ms. The historical PR73 live-video sample has warm medians of 32.98–48.67 ms and a maximum of 98.97 ms. This single-output software-Vulkan VM runs on a shared host; submitted frames are not monitor scanout. The binary hash and compiled source are verified, and documentation/harness commits are distinguished from Rust changes. Long idle, decoder/GPU peaks, total GPU memory, physical pacing and helper CPU still need work. The historical comparisons below explain previous improvements; these different workloads are not an isolated comparison or a hardware result.

The wallpaper milestone's two-minute runs measured 406.92 MiB mean RSS before output-aware wallpaper retention and 293.25 MiB afterward: an observed reduction of 113.67 MiB. Detected display, workload, adapter, vCPU, memory and kernel metadata match; these are sequential runs on a shared host, not an isolated allocation-attribution experiment.

The wallpaper preparation report records native physical-size and integer-scale changes, rapid resize bursts, preserved source/preferences and the unchanged desktop process. BackgroundTarget validates checked physical dimensions in the presentation layer. The child retains one accepted refit and the latest size; the injected asset adapter prepares pixels. Framework image storage preserves natural aspect independently of retained mip dimensions. Last-good pixels remain visible after a normal decoding failure, with explicit retry. Decoder scratch, transient old/new images, fullscreen widget/open-overlay buffers and lock/login preparation still need separate work.

The earlier compact-dock milestone measured 284.22 MiB for the prior binary and 254.10 MiB for the new binary, an observed 30.12 MiB reduction. This fresh comparison uses the same wallpaper, prepared-asset payloads and detected display/workload metadata. The new release was sampled first, then the baseline; both ran for 120 seconds without profiling on a shared host. The earlier 293.25 MiB sample had a slightly different wallpaper payload and is not the baseline for this change. This sample is within the current 300 MiB RSS target. No CPU, startup or animation improvement is claimed.

The settled native dock is 1920 × 120 logical pixels at 1080p/1×, keeping its original display-grid position and whole shadow. One BGRA8 buffer payload is 0.88 MiB instead of 7.91 MiB; buffer counts, padding and total driver memory are unknown. The launcher child waits for a full submission before opening and a settled closing submission before shrinking. Sixteen paired compact/full comparisons pass on each Vulkan driver, and all 212 existing snapshots retain their baselines. Native pointer/keyboard, mode cycling, outside close, interrupted reopen, terminal launch, integer scaling and zero closed-dock idle frames pass, along with the existing desktop workflow.

The bounded-widget milestone moves settled cards into smaller native buffers. Overlapping paint bounds share a buffer so their original drawing order survives; disjoint groups do not rely on ordering within a Wayland layer. During capture, source geometry stays fixed and retains input without painting, while a full-display pointer-pass-through preview shows the cards and grid. Twenty-four paired scenarios pass on both available Vulkan drivers, including overlapping cards, narrow displays, both palettes and integer scales 1 and 2. Native placement, capture, snapped release, restart persistence and integer-scale cancellation pass, along with the existing desktop workflow.

The fresh, matching 120-second comparison measured 252.18 MiB for the previous release and 224.93 MiB for the new release, an observed 27.25 MiB reduction. The new release ran first, then the baseline under the same supervisor, wallpaper and workload; detected metadata and prepared assets match. The three settled widget buffers total 1.94 MiB of one-buffer BGRA8 payload, versus 7.91 MiB for the previous full-output buffer. Buffer counts, padding and driver allocations are unknown. This is a shared-host software-Vulkan comparison, with no CPU, startup or animation improvement claim; this sample is within the current 300 MiB RSS target.

Native tests exposed the old supervisor waiting for a permanent widgets buffer and stopping the new desktop after 30 seconds. Supervision and activation now share a pure readiness contract requiring first submissions from the declared widget groups; all-hidden widgets and the previous fullscreen client are supported. Both measured binaries stayed alive for their full samples. Test cleanup also checkpoints owned wallpaper snapshots and restores through IPC, verifying the active link instead of overwriting it with a stale legacy target.

Open overlays and the active drag preview retain full-output buffers. Decoding peaks, allocator/driver retention, per-output/fractional geometry and hardware frame pacing remain separate work. One observed dock opening submission gap reached 33.69 ms in the software-Vulkan sample; this does not establish smooth scanout or a flicker-free hardware transition.

Earlier 588.26 MiB and 389.93 MiB runs established the observed lazy-preview improvement on an earlier binary. The native cache test browsed a generated 73-image library, reached beyond the old preload limit, recovered a corrupt preview through retry, and verified the smaller closed-browser budget. Both live providers supplied thumbnails without changing the wallpaper or palette. These measurements do not establish hardware frame pacing or total GPU memory.

The monochrome coverage and allocation milestone stores themed icon and text coverage in one channel and requests wgpu's supported memory allocation preference. Dimensions, text supersampling, mip filtering and existing visual references stay the same. Prepared icon payload falls from 11.83 to 2.96 MiB; colored icons and wallpapers retain the RGBA path.

The baseline and new release ran sequentially in the same capped VM boot with matching display, workload and background metadata. The current release was restored and its running hash verified after the baseline. Earlier observations remain in the report: masks alone did not show lower average RSS across separate boots, then a same-boot run measured a smaller reduction. These payload counters exclude driver allocations; measured RSS includes mapped driver/software-GPU pages. Actual GPU memory, hardware pacing, long idle and fault behavior remain unverified.

The profiled report stores bounded CPU wall times. Text rasterization and texture upload are nested inside preparation; adding those numbers would double-count work. Submission/presentation may include driver waits. They are not Vulkan GPU timestamps or monitor scanout measurements.

A working shell.
An incomplete desktop platform.

These are tracked requirements, not features implied by the screenshots. The implementation ledger records acceptance criteria and evidence. Interactive sign-in with the rebuilt root greeter is now verified. Production authentication audits, native denied-lock recovery, authority/service faults, physical sessions and driver-fault injection remain open.

Use implemented use cases
to justify each abstraction.

1. Use the established notification and native-control boundaries to make sample-service status cohesive. Preserve unavailable/error outcomes through ports and adapters instead of converting them to empty data.
2. Investigate active dock/widget buffer lifetimes and peak image preparation alongside prepared-pixel and texture counters. Keep client asset policy separate from generic renderer resources.
3. Keep renderer admission limits separate from memory budgets and native recovery policy. Extend layout and text contracts through concrete input use cases, without treating offscreen rejection tests as device-loss evidence.
4. Validate the implemented output identities, per-monitor profiles and fractional-density path through simultaneous native input, hotplug and suspend in a real compositor session.
5. Continue applying explicit inputs and typed intents where bar coordination warrants a separate owner. Strengthen domain values where invalid inputs reach persistence or external commands, preserving migration behavior.
6. Complete each retained capability through its port, adapter, usable client and reversible acceptance check. Keep native shell ownership and secure rollback intact.

For changes, use the repository's framework skill or desktop/integration skill. The library guide and user configuration guide keep implementation concepts separate from everyday settings.