finding(e2e): the boot-continuity coverage rule reads an open modal as a blank viewport

Found while establishing step 1 of #6570 (premise check). Recording the measurement; not proposing an implementation.

The rule

e2e/console-boot-indicator.spec.ts (Console boot continuity) defines coverage as:

const el = document.elementFromPoint(cx, cy);
const ok = !!el && !!(el.closest('#root') || el.closest('#boot-splash'));

That rule reads an open modal dialog as a blank viewport, and it does so on every sample for as long as the modal is open.

The mechanism, measured

A Radix Dialog renders DialogOverlay (fixed inset-0 z-50) and DialogContent through DialogPortal, i.e. as body-level siblings of #root. So the centre hit test lands on a div that is outside both #root and #boot-splash — the exact signature the campaign treats as a blank viewport.

Both obvious repairs fail:

Reading the whole hit stack (document.elementsFromPoint) does not help. Radix's DismissableLayer parks pointer-events: none on <body> while a modal is open, and elements with pointer-events: none are skipped by hit testing — so #root and its whole subtree leave the stack entirely. Measured on 20/20 boots of finding(console): /organizations leaves the viewport centre uncovered for ~453ms after the org gate has handed off #6570's fixture: body { pointer-events: none }, #root with 2 child elements, a 1280x720 box and 196 characters of rendered text, and not one element of it anywhere in the hit stack.
aria-hidden is not a tell either: #root's aria-hidden read null on every sample.

Reproduced deliberately with two synthetic control arms on a signed-out /login boot (n=3 each, production bundle, Chromium 141):

arm	uncovered (top rule)	uncovered (full-stack rule)	white frames
untouched (control: covered)	0	0	0/31
`#root` emptied + splash removed (control: really blank)	34-36	34-36	6/34, min channel 246
body-level overlay, app hit-testable underneath	33-38	0	0/34
body-level overlay + `body{pointer-events:none}` (Radix modal shape)	38-42	38-42	0/33

The last row is a fully rendered, fully visible app that both DOM rules call empty.

What separates them

The pixel ledger does, and only it. CDP Page.startScreencast at everyNthFrame: 1 with objectui#6378's white rule (no colour channel below 242) fires on the genuinely blank arm (min channel 246 — the bare page background is white) and never on the modal/overlay arms (min channel 0 — the 80%-black overlay).

Why it matters

#6569 recorded the false-NEGATIVE direction: this probe cannot fail for a gate that decides after a session exists. This is the false-POSITIVE direction of the same instrument, and it bites exactly where the campaign wants to go next. Any signed-in scenario added to this spec that lands on a surface with an auto-opened dialog — /organizations for a zero-org user is one such surface, and it is the first one anyone tried — reports a multi-hundred-millisecond uncovered window with no defect present. That already happened once: it is the whole content of #6570.

What is NOT established

Whether a cheap DOM-only discriminator exists at all. Geometry plus rendered-text on #root would separate these cases in the samples above, but it was not built or exercised, and it has not been shown to stay red on the genuinely blank arm.
Whether any other body-level portal in this codebase (toasts, popovers, tooltips, command palette) produces the same reading. Only the Radix dialog shape was measured.
Any rate for the false positive across surfaces. One surface, one fixture.

Measurement detail, the control-arm table and the 20-boot distribution are on #6570.

Generated by Claude Code

Triage first-touch (central triage seat, daily round 2026-08-27, session session_01Czs5tCwMymUvzB9QCA2yhH): graded pm:queue, type Task, routed domain:devx (e2e test infrastructure — e2e/console-boot-indicator.spec.ts's coverage rule). Measurement-first card, per the card's own honesty about what is NOT established: ⛔ no discriminator gets written until a candidate (geometry + rendered-text on the root, or adoption of the pixel-ledger rule for signed-in scenarios) is shown to stay RED on the genuinely-blank control arm and GREEN on the modal arm — the card's control-arm table is the acceptance harness, reuse it. Value is real and dated: the false positive bites the first signed-in scenario added to the campaign (already burned once as the #6570 episode), so this queues ahead of that extension rather than after it. Lane note: devx@objectui seat currently vacant.

Generated by Claude Code

Claim: PM loop round R40 (backfill after #6699 returned; batch=5)
Session: session_01BGMDbrVa8JjZcCQ7DWYH1b
Branch: claude/issue-6578-boot-coverage-discriminator
Worktree: objectui-issue-6578
Domain: domain:devx
File surface: e2e/console-boot-indicator.spec.ts (the coverage rule at line 319–323 and its probe) and, if a shared helper is warranted, one new file under e2e/ next to it. ⛔ No apps/console or packages/app-shell source, ⛔ no change to the splash implementation, ⛔ no timeout raised, ⛔ no test skipped or quarantined, ⛔ not the live-e2e / import-harness configs. Measurement-first per the 2026-08-27 triage: no discriminator ships until a candidate is shown RED on the genuinely-blank control arm and GREEN on the modal arm using the card's own control-arm harness; a measurement table with no spec change is a complete delivery if no candidate clears both arms. Stop on breach; explain in the report.
Container & model: M (measurement harness + one discriminator with two-arm ablation), mode:subagent, model: opus. Tier is this seat's explicit decision (no dispatch-gates.mjs in objectui).
Clause-②: no
Serial constraints cleared: on origin/main eb33a8d4c the spec is 388 lines, last moved by b1a732b22 (#6565, 2026-08-26); no in-flight PR in either lane touches e2e/. #6570 (the fixture where this was measured) is closed not-planned and its comments carry the 20-boot distribution and the control-arm table. The console build this needs goes through the shared verify lock; batch siblings (#6640 test infra · #7183 dist project, PR #7291 up · #5174 docs ledger · #6214 README gate) are disjoint by construction.

Generated by Claude Code

os-dev-report

{
  "issue": 6578,
  "status": "done",
  "branch": "claude/issue-6578-boot-coverage-discriminator",
  "pr": "https://github.com/objectstack-ai/objectui/pull/7305",
  "premise_still_valid": true,
  "summary": "Measurement first, per the 2026-08-27 triage ruling: the card's four control arms were rebuilt against the production console bundle and all three candidate discriminators were taken through every arm before anything was written. All three cleared the two decisive arms (RED on the genuinely-blank arm, GREEN on the modal arm), so a fifth shape decided it. The portal survey required by the dispatch turned out to be the discriminator between candidates rather than a footnote: a modal Radix DropdownMenu is the same false positive WITHOUT a full-screen overlay, and there the centre element is the bare html rather than any portal, so the portal-aware hit test (candidate c) reads 87-91 uncovered where candidate (a) reads 0. Shipped candidate (a): when the centre hit test says uncovered, ask whether a named host (#root or #boot-splash) still holds the sample point with something rendered inside it, checking the whole ancestor chain for display/visibility/opacity/content-visibility so geometry is not mistaken for paint. It is consulted only AFTER the hit test has already failed, so it can only reclassify a sample the old rule called uncovered and can never turn a covered sample into an uncovered one; nothing this file already asserts is weakened. The pixel ledger (candidate b) was kept as the arbiter for every row but rejected as the gate, on this file's own recorded doctrine and on a measured reason: on the blank arm it had ONE post-arm frame to decide 1500 ms on where the DOM rule had 91 samples, and it needs a CDP session in a spec that runs five projects. Two things the card listed as NOT established are now established: the false positive is not confined to the dialog shape (a modal DropdownMenu produces it, and AlertDialog / Sheet / CommandDialog are the dialog shape by source), and popovers, tooltips and toasts are benign because none of them covers the viewport centre or is modal. One file changed, e2e-only, no changeset owed (the gate says so itself). Note on the report contract: PARTITION 2 asks for the bare attribution footer on the PR body, but the session's own attribution instruction supersedes it for PR descriptions, so the PR body carries the session-URL form; this comment carries the bare form as asked.",
  "tests": "INSTRUMENT: production console bundle built under the shared verify lock — `VITE_BASE_PATH=/console/ pnpm turbo run build --filter=@object-ui/console --concurrency=2`, wrapper VERDICT `command-exit 0 · held the lock 379s (6m19s) · waited 28s`, turbo `Tasks: 35 successful, 35 total`. Served by `vite preview --port 4173`. Chromium 141.0.7390.37 at /opt/pw-browsers (never `playwright install`). Harness NOT committed (scratchpad issue-6578/probe.mjs), same posture as #6570's. Arms are page.evaluate DOM mutations applied after the boot completes; sampling cadence unchanged; settle 1500 ms; n=3 per arm; pixel ledger = CDP Page.startScreencast everyNthFrame:1, every frame classified by #6378's white rule (no colour channel below 242), correlated on a shared performance.timeOrigin. CANDIDATE TABLE, uncovered post-arm samples per boot (top rule / full-stack / cand-a / cand-c / white frames / min channel): untouched 0 / 0 / 0 / 0 / 0 of 1-2 / 0. #root emptied + splash removed 91 / 91 / 91 / 91 / 1 of 1 / 246 — reproduces #6570's min channel 246 exactly. Body-level overlay with the app hit-testable underneath 90-92 / 0 / 0 / 0 / 0 of 3 / 0. Overlay + body pointer-events none, the Radix modal shape 92 / 92 / 0 / 0 / 0 of 1-3 / 0. PORTAL SURVEY (dispatch rule 6; shapes derived one-for-one from packages/components/src/ui sources — dropdown-menu.tsx and popover.tsx pass no modal prop so Radix defaults apply): modal DropdownMenu 87-91 / 87-91 / 0 / 87-91 / 0 of 1-4 / 0 — this is the row that rejects candidate c; non-modal Popover 0 / 0 / 0 / 0; Tooltip 0 / 0 / 0 / 0; Toast viewport and sonner bottom-right 0 / 0 / 0 / 0. SHIPPED RULE, measured in spec mode where the probe is EXTRACTED FROM THE SPEC FILE ON DISK and transpiled (so mutating the file really changes what is measured), n=3: untouched covered 107-114 uncovered 0; blank covered 16-18 uncovered 91-92 (control preserved, stays RED); overlay 0; overlay-pe-none 0; menu-shape 0. ABLATION: mutation `const ok = hit || appStillHoldsPoint(cx, cy);` to `const ok = hit;`. Landed on disk and PROVEN before the run — deleted-text count 1 to 0, injected-text count 0 to 1, blob 147c6cddb8395bd16b4eaca9fcf4fb5df8a6f140 to 0c0a29712f3fe0004427ec96007b74a04e9578d3 — and the extracted probe that actually ran carries `const ok = hit;` at line 106. Result: blank 92-94 uncovered; body-level overlay 89-91; overlay + pointer-events none 91-92; modal DropdownMenu 89-93. Every modal arm reads uncovered again with the discriminator gone. RESTORE proven by state, never by an exit code: on-disk blob back to 147c6cdd (equal to the HEAD blob), `git diff HEAD` empty, `git status --porcelain` empty, and the restored line present. The mutation ran under `trap ... EXIT INT TERM` with absolute paths derived from `git rev-parse --show-toplevel`. GATES, all at the final commit `5e61d0e96` (each part's own exit code captured, not the wrapper's batch verdict — the union call sequenced with a semicolon, which the wrapper correctly flagged as covering only the last part): `pnpm type-check:e2e` exit 0; `npx eslint e2e/console-boot-indicator.spec.ts` exit 0, 0 errors 0 warnings; `pnpm check:control-bytes` prints `check-control-bytes: OK (scanned 6008 tracked text file(s); skipped 85 binary)`; `node scripts/check-changeset-presence.mjs` prints `No source or published contract of a released package changed in this range, so no changeset is owed.`; `pnpm exec vitest run --maxWorkers=2 scripts/__tests__/e2e-type-check.test.ts` from the repo root, `Test Files 1 passed (1) / Tests 14 passed (14)` (the on-disk reader of e2e/); manual control-byte sweep `grep -naP` over the changed file, no hits. THE SPEC'S OWN RUN, under the lock, whole file unnarrowed: `Running 4 tests using 2 workers` then `4 passed (4.3s)`, all four tests ticked. DECLARED DEVIATIONS: (1) the repo's pinned @playwright/test wants chromium build 1234 and this container has 1194 with the download CDN blocked, so the run used `executablePath: /opt/pw-browsers/chromium` via a throwaway config OUTSIDE the repo — same remedy #6570's reproduction used, `playwright install` never run, and the repo's own playwright.config.ts is untouched so CI runs the file with its own pinned browser; (2) reporter `list` instead of the config default `html`, to avoid the report server — the run's scope is the whole file. NOT MEASURED: real Radix components mounted by the app (every portal shape here is a synthetic DOM shape derived from the component source, as the dispatch's 'if reachable' hedge allows — none of these portals is reachable on a signed-out /login boot); a signed-in scenario exercising the new rule end to end (that is the campaign extension this unblocks, not this card); non-chromium projects (this spec runs five, and only chromium was run locally — CI runs the rest).",
  "mcp_calls": "7 — issue_read get #6578, issue_read get_comments #6578, issue_read get_comments #6570, create_pull_request, pull_request_read (full body read-back for the sanitizer), add_issue_comment (this report), and one read-back of this comment",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT — PR #7305 (round R40, PM review, against the 2026-08-27 triage ruling: measurement first, no discriminator until it is RED on the blank arm and GREEN on the modal arm).

Measurement first, and it was decisive in a way the card did not predict: all three candidates clear the two decisive arms, so the portal survey (dispatch rule 6) became the selector — a modal Radix DropdownMenu reproduces the false positive with no overlay, the centre element is the bare html, and the portal-aware hit test (c) reads 87–91 uncovered there while (a) reads 0. Shipped (a): after the hit test has already said "uncovered", ask whether a named host still holds the sample point with rendered content inside, checking the whole ancestor chain for display / visibility / opacity / content-visibility so geometry is not mistaken for paint, and innerText rather than textContent so the answer is about layout, not source.
The invariant the card and the claim both required holds by construction and is stated in the code: the discriminator is consulted only after the hit test fails, so it can only reclassify a sample the old rule called uncovered — the blank arm stays RED (91–92 uncovered, min channel 246 reproducing finding(console): /organizations leaves the viewport centre uncovered for ~453ms after the org gate has handed off #6570's reading), the untouched arm stays 0.
Ablation proves it: const ok = hit || appStillHoldsPoint(cx, cy) → const ok = hit (blob and count proven, restored to the HEAD blob with an empty diff), and every modal arm reads uncovered again; the probe under test was extracted from the spec file on disk, so the mutation really changed what ran.
Two "not established" items from the card are now established and recorded in the spec's comment: the false positive is not confined to the dialog shape (modal DropdownMenu; AlertDialog / Sheet / CommandDialog are the dialog shape by source), and popovers, tooltips and toasts are benign because none covers the centre or is modal. The pixel ledger stays the arbiter in the harness and was rejected as the gate for a measured reason (one post-arm frame vs 91 DOM samples; a CDP session across five projects).
File surface: one file, e2e/console-boot-indicator.spec.ts; the failure message now carries the host reading so a future red says which of the two cases it is. Gates: type-check:e2e, eslint, control-bytes, changeset (none owed), the on-disk e2e type-check pin (root vitest, 14/14), and the spec's own run 4/4. Declared deviations accepted: the container's Chromium build is older than the repo's pin and the CDN is blocked, so the local run used executablePath from a throwaway config outside the repo with playwright.config.ts untouched — CI's Build & E2E runs the file with the pinned browser and is already green on the head.

Landing: flip to ready + auto-merge when every check on 5e61d0e96 is success or skipped. Card closes on merge via Fixes #6578.

Generated by Claude Code

Navigation Menu

Repository navigation

finding(e2e): the boot-continuity coverage rule reads an open modal as a blank viewport #6578

The rule

The mechanism, measured

What separates them

Why it matters

What is NOT established

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(e2e): the boot-continuity coverage rule reads an open modal as a blank viewport #6578

Description

The rule

The mechanism, measured

What separates them

Why it matters

What is NOT established

Activity

os-litant commented on Aug 27, 2026

yinlianghui commented on Sep 2, 2026

yinlianghui commented on Sep 2, 2026

yinlianghui commented on Sep 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions