DOC_README.md

genet Documentation Index

The canonical index for genet/design_docs/, per DOC_POLICY.md §6. If any other index disagrees with this file, this file wins.

Founded 2026-08-24, when the canonical policy core was distributed across the workspace and the component documents for inker, nematic and verso-tile were repatriated here from mere.

Script backend naming (2026-09-26): Vano is our Nova fork, which we maintain and may improve or change as needed for the stack. The current integration still uses script-engine-nova, nova_vm, NovaEngine and --engine nova; these are technical identifiers, not a claim that Genet runs unmodified upstream Nova. Historical receipts retain their original names and dependency revisions.

Human checkpoints and WPT evidence (2026-10-07): ask and wait for an explicit answer, with no response timer or inferred approval. Keep the turn open while an input prompt awaits an answer, since ending the response dismisses its UI. Technical test deadlines remain part of their recorded gates. Revalidate generated assertion labels by unchanged source case and duplicate occurrence against the actual fresh maps; preserve raw comparisons and rows inside ERROR records separately.

Boundary correction landed, 2026-09-03: Cambium and Genet's upper application components moved to Mere under mere/design_docs/mere_docs/implementation_strategy/2026-09-02_platform_boundary_and_repository_topology_plan.md. Their documents moved with the code and are indexed in Mere. Genet retains web-platform implementation, observable behavior, raw host contracts, WPT, and a minimal engine host.

Read the policy's "Two doc homes" section first. This repository also has a flat docs/ directory of 166 older engine documents. The current engine work section below gives entry points into that corpus; it is not a complete inventory or a migration. The split is deliberate, and migration remains open, unscheduled work. New documents go here.

Required reading order

1. The root README.md — what genet is.
2. DOC_POLICY.md — the shared core plus this repo's addendum, including the docs/ boundary and the smolweb split.
3. The section you are working in, below. genet has no topic area root left: the last three moved to mere with their code on 2026-09-03, and active plans sit flat in design_docs/.

Current engine work (2026-09-07)

Use the linked plan's current gate and dated receipts before implementing a lane. Historical corpus totals are measurements of their named source, not a fresh baseline for this checkout. This map also covers selected plans in the older docs/ corpus without changing their location or governance.

Work	Current boundary and next proof
Arena semantic contract	G5 remains partially implemented overall. The single-arena native retain/detach/collect/adopt/mutate/render/release sequence passed on Boa and Nova at clean source ba7a4df56c6, with collection counters, matching frames and failing controls. Broader identity and browser-hosted acceptance retain their own gates.
Font fallback	Windows T1 is accepted with focused regressions and Ortet readback. Consumer revision adoption, upstream disposition, and other-platform measurements remain open.
Ortet	O0-O5 are landed for the native host. Exact-source Boa/Nova receipts accept native input, timer/microtask completion, bounded failure, idle-woken fetch and Worker delivery, semantic/pixel correlation, and stale-session rejection. Default Ortet stays script-free. Windows AccessKit native actions are accepted by the O2 UIAutomation receipt. Browser-hosted scripting remains open. Publication is a later packaging decision under the workspace's publish = false policy.
K6 fragmentation	K6a typed inputs, K6b's retained context/token model, and a dormant pre-K6c style/input dispatch seam landed. All 6,077 named records match the frozen pre-K6 baseline. Live formatter continuation and multicol geometry remain K6c work.
Flex and grid, Row 18	Bounded vertical-flex slices landed. Remaining work includes mixed-writing-mode baselines, generated/pseudo self edges, shared font metrics and percentage provenance, then a measured grid inventory. The dated guard review records 21 pre-K6 flex/grid pass-to-fail cases.
Floats and shapes, Row 12	Horizontal box-shape and direction slices landed. Vertical/orthogonal transforms and remaining shape families retain their own unproved boundaries.
Generated text, Row 17	Inline string/attr content and named decimal counters share retained text with AccName without changing DOM offsets. Nested/sibling counter scope and retained mutation fixtures pass; full package validation is recorded in the plan. Implicit list numbering, markers, other styles, quotes, images and general pseudo-box layout remain open.
Accessible names and descriptions	Bounded DOM algorithm and retained generated names; September 30 adds scoped Taproot refusal and public neutral-projection lowering, passing 28 Taproot and 40 render tests plus a failing preflight control. Turnstone adoption, full AccName/HTML-AAM and human AT remain separate gates. Earlier Cambium generated-name adoption passed 207 native tests and Wasm.
Shared Unicode text boundaries	Unicode 17 grapheme/word/sentence boundaries with byte/scalar/UTF-16 offsets; official corpus and Genet editor pass. Mere search and Cambium editing adoption published as ada6f265, with focused consumer gates. Locale dictionaries and remaining consumers stay open.
K7 foundational sizing and dispatch	Reconcile landed sizing fixes with remaining deferrals before choosing a slice. Fragmentainer-dependent work consumes K6; final closure includes deleting CSS-facing Taffy block dispatch. One slice, chosen by Knot's D1 rather than by that reconciliation, landed 2026-09-24 under the atomic-inline basis note: atomic inline roots resolve against their real containing block through a contribution pass and a basis pass, instead of the viewport, with no WPT pass -> anything else over six directories. A second slice closed the two pre-pass gaps the first found: atoms not admitted to shrink-to-fit now shrink to fit, and atom text is measured at the width it wraps at; its three pass -> fail transitions remove vacuous passes and are named there.
Line box model	In progress, 2026-09-27: each line box built per CSS 2.1 10.8 in genet-livery's line pass (a strut, each box's own half-leading, atoms by margin box, lines stacked from those heights) instead of correcting Parley's single line height afterwards, with the quirks-mode line height quirk and each document's quirks mode carried through the scripted tier to layout and compatMode. Found through Knot's tall inline-block sitting 2px into the line above. Slice A implemented; slice B implemented too: inline-blocks, buttons, table cells, inline tables and form controls align on their own baselines, with buckram keeping a table's declared baselines and synthesizing a baseline-less row from its stretched cells. Under line-height: normal a text run paints over its box's content area inside its line box, as Chromium does (2026-09-27, Isometry's ruling 329); Ruling 379 (2026-09-27) authorizes explicit-line-height content bounds and wrapped inline border/padding bounds together; both are implemented with six combined fixtures, two fault-specific broken controls and 867 passing Livery/Buckram tests (6 existing ignored); Independent source/control review passed; 200 own-9607 boundary tests pass, and the qualified local-c8 Isometry pair measures 187 rows with 0 short versus 39 short on published dependencies. Portable Isometry repinning is separate. Main integration awaits a safe window around concurrent retained-motion work; primary pins and lock are unchanged. Historical Chromium/WPT/187-row claims are qualified in the dated annotation. 2026-09-27 integration refresh: exact main f2e2850 merged into the existing text lane; the new wrapped/negative-leading retained-motion fixture passes. Combined CPU gates pass 876 with 6 existing ignored plus 200 boundary tests; the current 9607-family Isometry pair measures 187/0 short rows versus published 187/39. Sealed evidence and source qualifications are in the plan. Independent review passed and exact tested source 7b48f94d landed on main/origin; portable consumer repinning remains separate. Historical fixture output is preserved; automatic policy blocked worktree cleanup, so the integrated checkout remains. 2026-09-28 follow-up: measured formatting-line scroll extent is missing from both nested clamp consumers; Genet owner query/retained geometry and seven focused CPU fixtures are implemented; missing-line, first-fragment and intrinsic-owner controls fail as intended; restored Livery/Buckram passes 883 with 6 existing ignored. Independent review passed; exact tested source 7a60ad7965a is published on main/origin. Mere adoption and its original 12px consumer gate remain pending. See the dated plan annotation and raw receipt; existing font-content bounds stay unchanged.
Livery line breaking	S1.0–S1.1 landed on main, 2026-10-03. The S1.0 baseline and R14 release guard both cover 14 text/layout directories with 989 pass, 754 fail, 551 skip; two additional pre-existing entries (mediaqueries, css-position) complete the 16-entry guard. Both same-binary baseline runs had zero per-file status changes, and the R14 guard passed with unexpected=0 and no errors. S1.1 retains its shaped public break stream without changing Parley, uses the approved ICU4X 2.2.0 edges and CSS-required SA fallback, and applies the ruling-14 Anywhere override after the NCA nowrap gate. Full crate gates, per-fixture controls, and source/dependency provenance are recorded in the plan and evidence checkpoint. Rulings 10–14 are complete.
Image decode feature	Landed 2026-10-05, at Mere's mer3ly site canvas request (its Ruling 106): genet-livery's image decoding is the default-on image-decode feature, with one private decode point (src/image_decode.rs). genet-render, taproot, genet-documents, genet-scripted and genet-wpt take genet-livery without defaults and forward the feature; ortet asks for it explicitly. With it off, images get no natural size and are not painted. The plan lists the Mere rows a viewer cone must change.
Out-of-flow placement	Implemented 2026-09-26: a fixed box inside an absolute one no longer lands off by its ancestors' move (each placement is resolved just before its move, ancestors first); absolute, fixed, relative and sticky children no longer make a shrink-to-fit box fill its containing block (Buckram's intrinsic admission took only static children); and the one-shot layout entry, which CSSOM's resolved values read, shrinks an unadmitted inline-block to fit. Reported by the Knot session; each fix ruled by Mark. Open: the positioned queries' empty-leaf contract.
WPT harness and ledger	Exact scorer and reference-verification gates landed. Freeze a fresh candidate runner for new work; unsupported test/reference agreement earns no conformance credit.
Servo cone retirement	servo-paint's compositor half carved out as genet-compositor; the reftest lane renders through genet-render-host; the constellation trait cone left the graph 2026-09-07. All gates green; next proof is Mere's dependency rename at its next bump.
Web platform WPT census	Historical Boa snapshot retained: 82 maps, 21,671 genuine records plus one diagnosed fallback artifact. Full Vano refresh completed all 82 shards: 23,999 records and 33824/144238 passing reported subtests. Receipt separates historical/new membership, timeouts, no-results, unsupported cases and harness errors; profile/budget differences prevent an engine-only comparison. 2026-10-02: the 10 panics are attributed (3 in Vano, 7 in Genet), and Mark ruled that Vano's three be fixed in Vano.
Standards-to-features ledger	Founding counts preserved; status reconciled September 29 with published text consumers, scripted generated names and bounded decimal counters, alongside dated Selection/Range, MutationObserver, Worker and Shadow DOM receipts. Vano names our maintained Nova fork. Census refresh is in progress; generated content belongs to rendering Row 17. 2026-10-02: conformance targets ruled (C1–C3) and briefed: Encoding through encoding_rs, HTML constraint validation, WHATWG Streams, and a CSS-wide WPT census refresh.
CSS 3D transforms, first-frame scaling and scene viewport embedding	T3's bounded Genet content-box, shared 2D paint/input geometry and typed used-color seam implemented 2026-09-13; 61 focused checks pass. Native Bench B assembly is accepted on the recorded downstream development build (167 frames/15 captures, scale 2); a separate committed-dependency Mesocosm workspace check passes. Ordinary retained leaves gain no clip/layer; the percentage-padding approximation remains explicit. T3's host mutation instrument is built and measured 2026-09-15: a trait-level apply_host_mutations seam on DocumentSession, Ortet's --mutate driver, and per-frame timing that keeps actual work apart from presentation wait (--timing-json). On the bounded fixture the mutation costs ~2 ms of work per frame and the presentation wait absorbs it, so frame time alone would have shown nothing. The sweep is measured at 1,000, 5,000 and 20,000 elements and shows any host mutation costing a full-document geometry rebuild (532 ms of work per frame for two mutated elements at 1,000, against 1.85 ms unmutated); the sweep was repriced after T2 on 2026-09-16, 20,000 elements 560 s to 1.80 s per mutating frame and 50,000 first measured at 7.52 s. Genet's T3 seam acceptance is complete, 2026-09-16. The changed-source acceptance rerun at main f1f21c61d26 with netrender 06f3a12f4 passed the native composition receipt: 25/25 probes on Boa and Nova at scale 2, with captures byte-identical to 2026-09-11 (0xa440137ccc503f9c). The WebGL and G5 guards, netrender's GPU gate and the focused suites also passed. WPT maps at 101d9e9ade8^, 101d9e9ade8 and main found one pass -> fail introduced by the seam commit itself: pointerevents/pointerup_button_value_matches_corresponding_pointerdown.html. The rewritten hit test's half-open containment held no point of the zero-extent border box that Livery gives an unsized form control. Every later movement is T1's, apart from one cssom-view subtest loss from e629817a244. The hit-test fix closes done-condition bullet 3: a zero-extent border axis now holds its own coordinate, and four focused tests were added. The pointerup test passes 3 of 3 with zero pass -> anything else across pointerevents, uievents, touch-events and five reftest directories, and the native receipts reproduce their captures. The wing's bench still depends on Mere's producer lifecycle, picking/accessibility and update-cost receipts. Receipts: Code/testing/genet/t3_acceptance_20260916/results.md, Code/testing/genet/wpt-ledger/2026-09-16_t3_seam_attribution/ and Code/testing/genet/wpt-ledger/2026-09-16_t3_hit_test_fix/results.md. The Bench B consumer receipt is not an Ortet-composition or WPT rerun. T2 is implemented and measured 2026-09-15: a child index and a deferred aggregate-overflow rebuild in buckram's FragmentTree, the same bound on the relative, sticky, retained-root, incremental-query and retained-text translate paths, and two per-element style costs removed in genet-livery and livery; plus a --phase-timing flag on Ortet over a new genet_livery::phase recorder that reports parse, style, layout and paint for one frame. The L0b grid rerun on the same host: fitted growth exponent 2.156 -> 1.168, the 50,000-element first frame 1,172.21 s -> 7.68 s, every rendered digest unchanged. The plan's 1-second bound at 50,000 is not reached; 7.68 s is, with the rationale recorded under T2 — the remaining per-element constant is the cascade, which matches every rule against every element. WPT census over css/css-position, css/CSS2/abspos, css/CSS2/positioning, css/CSS2/normal-flow, css/css-transforms and css/css-values, before and after: zero transitions of any kind. Receipt Code/testing/wing/l0b_t2_2026-09-15/results.md. T1 is implemented and measured 2026-09-15: a Matrix3D composer under Livery's existing Matrix2D, the CSS Transforms Level 2 functions (matrix3d, translate3d/translateZ, rotate3d/rotateX/rotateY/rotateZ, scale3d/scaleZ, perspective()), the translate, perspective, perspective-origin, transform-style and backface-visibility properties moved out of the catalog's unimplemented table, and axis and three-component forms for the individual rotate and scale. In genet-livery the accumulated 4x4 reaches the existing shared paint/hit-test TransformSpec unchanged; a flat boundary projects; a preserve-3d context z-sorts its participating boxes by transformed depth; backface-visibility: hidden culls against the element's own 3D rendering context; and a perspective divide is recorded as a named TransformGap before the orthographic approximation is painted. Seventeen focused tests added; livery, genet-livery, genet-documents and ortet suites rerun green (206 / 527 / 51 / 32). css/css-transforms re-measured on this host at the base commit and on the lane: testharness 291 -> 650 subtests with zero pass -> anything else and two attributed subtest losses, reftest 534 -> 600 passing with 70 fixed and 4 attributed new failures. The wing fixture's silhouette agrees with isometer-mesh's bake to 98.73% with no pixel more than one pixel out; the yaw and depth-order headless readbacks pass 13 of 13 assertions. Receipts Code/testing/genet/t1_css_3d_20260915/results.md and Code/testing/genet/wpt-ledger/2026-09-15_t1_css_transforms/. T4 is implemented and measured 2026-09-16, in netrender as 06f3a12f4: placements inside rect-clip, alpha and element-filter layers retain and read back byte-identical to independently expanded references, and the clip-wrapped L0a rerun takes the 200,000-rectangle cell from 40.46-52.04 ms to 8.80-9.56 ms, within 1.07x of the same run's unclipped cell. T4's retained path is unreachable from Ortet and genet-wpt, which place no retained fragments; Cambium's Rootstock registers them but never places them (mere receipt 2026-09-16), so T4 is reachable from no host until that wiring lands. Form controls given intrinsic sizes 2026-09-16, closing the hit-test fix's rotation residual for every default-styled control. A first pass (UA defaults plus size/cols/rows presentational hints) regressed two WPT subtests that check the attribute never reaches getComputedStyle, since a presentational hint is cascade input by construction; reworked the same day into a hint-less, ratio-less sibling of apply_replaced_intrinsic_style (components/genet-livery/src/layout.rs) that writes the natural size straight to Taffy and never touches ComputedValues. The rework's own bisection also found and fixed a real css/css-sizing/max-content-input-001.html reftest regression — a fixed cross-axis dimension perturbing an unrelated max-content measurement, evidenced with before/after pixel captures rather than attributed by hypothesis — via a narrow guard against writing a natural dimension on an axis whose sibling is an intrinsic-sizing keyword. Final state: genet-livery 543 passed/6 ignored, livery 206, ortet 32 (36 with scripted-nova), genet-documents 51, all green. WPT testharness+reftest over html/rendering/widgets, html/rendering/replaced-elements, css/css-sizing, the input/textarea/button element directories, pointerevents and uievents: zero regressions, one improvement (the-select-element/select-1-block-size-001.html fail→pass). Native standards-compositing receipt unchanged, 25/25 probes, digest 0xa440137ccc503f9c, reproduced again after the rework. Receipts Code/testing/genet/wpt-ledger/2026-09-16_c_form_controls/ (including max_content_investigation/) and Code/testing/genet/c_form_controls_20260916/native_receipt_v2/. The animation-clock lane investigated and corrected the 2026-09-15 CSS Animations finding, 2026-09-16: testharness mode has no animation clock at all (a structural gap in the scripted DOM's style route, its own lane, not fixed here); reftest mode's negative-delay convention already worked; animation-play-state was unimplemented and is now implemented with paused-freeze semantics; and rotate-animation-with-will-change-transform-001's failure traced to an unrelated animation shorthand gap, not to the clock or T1. Five focused tests added, livery/genet-livery/genet-documents/genet-wpt/ortet suites rerun green, WPT before/after over four testharness and two reftest directories with one attributed regression (a vacuous pass removed) and five gains. Native compositing receipt not rerun (out of this lane's change surface). Receipts Code/testing/genet/wpt-ledger/2026-09-16_d_animation_clock/. T2's second half is implemented and measured 2026-09-16 (lane F): a rightmost-compound selector index — id, class, local name, universal bucket — replaces the cascade's every-rule-against-every-element loop in both branches of resolve_subtree_on_this_stack, with cascade order preserved by merging bucket candidates back into source order before matching and every tree-scope-crossing rule routed to the universal bucket; and the finer split found a second quadratic in layout, a linear placements.iter().find() inside a per-positioned-box loop in apply_admitted_positioned_inline_sizes, growing n^2.19 and costing 994 ms of the 50,000-element frame, replaced by a lookup table for a 157x cut. The L0b grid rerun on the same host with both ends measured in one session: 50,000-element first frame 5.93 s -> 4.80 s, the 20,000 -> 50,000 growth exponent 1.242 -> 1.016, every phase's per-element cost now flat across the whole grid, every rendered digest unchanged. The whole-grid fitted exponent barely moves (1.112 -> 1.126) and is a poor instrument for a constant-factor change on four points; the pairwise steps and the per-phase table are the result. The 1-second bound at 50,000 is still not reached and 4.80 s is the restated bound, with no superlinear term left anywhere in the four phases. The lane also corrects the 2026-09-15 cascade finding: a control that offers every rule puts the rule-matching loop at 157 ms of the style phase, not 2.25 s, so the index is worth 42x on that loop but 5% of the phase, and the remaining per-element constant is ComputedValues' shape — the double cascade and the 160-property colour walk — which inverts hypothesis 3's ranking and is left to its own lane. The inline style parse is measured at 156.5 ms (3.13 us/element) and deliberately not cached, because every element carries a distinct declaration and the parse genuinely happens once. Mutation reprice at 50,000 on lane E's command, both binaries: 6.96 s -> 6.01 s of work per mutating frame, the gain entirely in session.frame. WPT before and after over css/selectors, css/css-cascade, css/css-position, css/CSS2/selectors and dom/nodes (testharness) and css/selectors, css/css-cascade, css/css-position, css/CSS2/selectors and shadow-dom (reftest): zero transitions of any kind in all ten runs; css/css-scoping is absent from the checkout and was not run, and the css/CSS2/selectors testharness and shadow-dom reftest rows are null results because every file in them is skipped. Eight focused tests added; genet-livery 556, livery 206, genet-documents 51, ortet 32, all green. Native compositing receipt reproduced, 25/25 probes on both engines, digest 0xa440137ccc503f9c. Temporary phase probes removed before the lane closed, instrumented tree preserved in the receipt. Receipts Code/testing/wing/l0b_f_2026-09-16/results.md, Code/testing/genet/wpt-ledger/2026-09-16_f_selector_index/ and Code/testing/genet/f_selector_index_20260916/.
WPT harness repair	Earlier isolation/include/handler/deadline repairs retained. September 29 isolated Vano workers use a fresh runtime because harness snapshots lost the window proxy; real sync/microtask reporting passes on both engines, GC on/off (0c4aa9f60b8). In-process snapshots and server-mode network measurements remain separate gates.
XMLHttpRequest	XHR as a state machine over the fetch seam, landed 2026-09-07: xhr 53 to 281 subtests in disk mode, 831 of 1,336 in server mode, fetch holds. Residuals: responseXML needs DOMParser; 28 errors are Worker and document.domain demand.
Cheap globals	performance (+ PerformanceObserver), queueMicrotask, structuredClone, MessageChannel / MessagePort / BroadcastChannel and crypto landed 2026-09-07: 79 forward file movements, zero pass-to-fail, +462 subtest passes over ten directories. Next proof is crypto.subtle, real ArrayBuffer detachment, and the cross-agent reuse of the clone walker by the Worker lane.
IDL interface table	The scripted tier's HTML interface table is generated from WPT's vendored WebIDL plus its tag map, with 41 reasoned overrides and a drift test. 72 interfaces / 338 reflected attributes / 41 shape-only DOM-CSSOM interfaces. Next proof is extending the shape pass past html, dom and cssom, and the reflection-algorithm gaps (ReflectRange clamping, invalid-value defaults).
MutationObserver	The arena's mutation point now has two consumers: Livery's DomMutation stream and a spec-shaped observer record fanned out at the same mutators, off until something observes. Landed 2026-09-07 with four dom/nodes/MutationObserver-* files all-pass, +495 subtest passes and zero pass-to-fail. Range landed 2026-09-07 and closed that residual (childList 18/38 to 32/38, characterData 13/23 to 21/23). The DOM node model lane then closed the rest on 2026-09-07 — fragment insertion, normalize, outerHTML, attribute namespaces and the static-to-scripted clone of comments and PIs — and the four MutationObserver-* files now pass.
Selection and Range	Range / StaticRange / Selection over the scripted arena, with the live-range steps at the bootstrap's mutation funnel and a boundary index keyed by node. Landed 2026-09-07: selection 0/280 to 28,582/33,621 subtests, dom/ranges 0 to 10 all-pass, +29,126 subtest passes and zero pass-to-fail. The DOM node model lane supplied all three on 2026-09-07 (plus a constructible Document, the second floor in the same file) and dom/ranges unfloored to 15 all-pass / 35,466 subtests.
DOM node model	DocumentFragment insertion, CDATASection and real DocumentType nodes, the ParentNode / ChildNode mixins, normalize, outerHTML, namespaced attributes as live Attr nodes, DOMParser / XMLSerializer and Node.baseURI. Landed 2026-09-07: dom/ranges unfloored (15 errored to 1, 24 to 35,466 subtests), html/semantics/interfaces.html 298 to 435 of 438, +82,944 subtest passes over nine directories with zero pass-to-fail. Next proof is a server-mode receipt for responseXML, and static NodeList indexed access, which is a Proxy trap per read.
Tag-name casing and the window globals	tagName / nodeName fold only for an HTML-namespaced element whose current node document is an HTML document, element interfaces and custom element names match case-sensitively, document.importNode exists, and window / document / self have their [LegacyUnforgeable] and [Replaceable] shapes on both the window and the worker global. Landed 2026-09-07: Element-tagName.html 3/6 to 6/6, html/semantics/interfaces.html to all-pass, +31 subtest passes with zero pass-to-fail. Residuals: createElement's namespace on an XML document, and attribute-name folding, which still turns on the namespace alone.
Dedicated Worker	A second Runtime of the same engine on its own thread with DedicatedWorkerGlobalScope, Worker on the page, MessagePort across the boundary, and a JSON encoding of the clone record as the cross-agent wire. Landed 2026-09-07: workers 5 to 74 all-pass and 21 to 321 subtests, genet-wpt hosts .worker.js and .any.worker variants, +972 subtest passes with zero pass-to-fail. Both-engine automated coverage includes cycles, aliases, ports, transfers, fetch, errors and termination; O5 accepts bounded native headed Worker delivery. Conformance remains open: SharedWorker, cross-agent BroadcastChannel, module workers, nested-worker relay ordering, real ArrayBuffer storage/view detachment and cooperative termination remain residuals. Browser-hosted scripting acceptance remains open.
WebSocket	The WebSocket host object over netfetcher's transport, with the browser policy the Fetch algorithm does not wrap it in enforced on the connection path. Landed 2026-09-07: websockets 0 to 1,090 of 1,877 subtests in disk mode, 254 all-pass and 1,144/1,586 in the first server-mode run; fetch and xhr byte-identical. Residuals: worker-hosted sockets (214 files), WebSocketStream, real backpressure.
Reflector identity	Wrapper liveness follows node reachability: every wrapper has an opaque root, a connected node's wrapper lives as long as its document, a detached subtree's as long as script holds any one of it. Landed 2026-09-07 with zero census movement over six directories under both harness-collection settings; the receipts are the reproducer set and the restored ErrorEvent toStringTag, not a score. Residual: the between-tick window for detached trees.
Host contract ownership	Genet owns retained session contracts; Mere owns surface orchestration and product adapters. The older S0-S5 receipts need a consumer-side status refresh before resuming those lanes.
Shadow DOM	A parentless shadow root in both DOMs, a per-host slot assignment table maintained at the mutation, flat_children under Livery's rendering traversals, per-rule tree-scope matching with :host / :host() / ::slotted() / ::part(), event retargeting and composedPath(), and the declarative post-parse pass with <template>.content in one shared inert document. Landed 2026-09-07/08: shadow-dom 6 to 45 all-pass and 24 to 1,512 subtests, +1,761 subtest passes over four directories, one explained pass-to-fail. Residuals: :host-context(), adoptedStyleSheets, focus delegation, and declarative attachment consulting the custom-element registry (which needs parser/script interleaving — Mark's call).
Parser/script interleaving	HTML's parsing model with scripts run at the point the tree builder pops them: an html5ever TreeSink over the live arena, document.write at the tokenizer's insertion point, currentScript, the readyState transitions with DOMContentLoaded and load, parse-time custom-element upgrade, and declarative shadow roots consulting the registry. Landed 2026-09-08 in the engine (part one: +68 subtest passes over eight directories, 30 files fail -> pass, zero pass-to-fail, no repins). Part two, 2026-09-08, routed the WPT runner and LiveryScriptedDocument through the same parse and closed the named residuals: testharness.js as a prelude and one load dispatch, a two-phase LiveryCssom that resolves author sheets from the arena as the parser fills it, document.write tokenized inside the call so its markup is visible to the writing script and a written <script> runs, the open stream appending through one live tokenizer, upgrades at element creation, foreign-namespace scripts, and scripts in template contents left inert. +181 subtest passes over ten directories and +439 across the 79-directory disk census (excluding two identified timing artifacts), 19 census pass -> fail all attributed, six baselines repinned forward-only, all fourteen at unexpected=0, Ortet digest unchanged. Both Shadow DOM declarative regressions now recover in WPT — the open gate is closed.

| iframes and nested browsing contexts | Browsing-context tree, parent resource route and child paint-list composition landed 2026-09-08; the original script-free receipts remain dated in the plan. The Realms continuation resolved the runtime decision, implemented child and top-level navigation, and completed scripted headed G5 acceptance on both engines. The current residual inventory lives there; the earlier request for a runtime/WindowProxy decision is superseded. | | Realms | Status reconciled 2026-09-22 against source/history; existing September 13 receipts were not rerun. Proposed next slice: synthetic/template document metadata, with done-conditions in the plan. One runtime per agent, per-context realms, stable WindowProxy, navigation and ordinary/shadow/template adoption are landed. Latest closure, 2026-09-13: parent effective-base snapshots, frozen first-base semantics and retained Node/Document/Attr baseURI after queued teardown. All 160 focused tests and both isolated cost guards pass; 27 WPT files per engine preserve 74 Boa passes and gain four. Six headed runs preserve digest, 31 -> 31 nodes and collection. Open: synthetic document metadata, retired mutation, history/security qualifications, live canvas adoption and parser timing. Nova WPT no-results and prior aggregate timing variability remain qualified; no baseline repins. | | cadency, the owned selector engine | Removes what the servo/stylo repository still supplied after the fork left: stylo_malloc_size_of, servo_arc, and the selectors crate, replaced by an owned, spec-shaped standalone crate for the slice Livery enables. Landed 2026-09-18 (2c63a9aab16) and published 2026-09-20: components/cadency (10 tests), Livery's selector.rs 514 to 179 lines, cargo tree -i finds none of the removed crates, all suites at their 2026-09-16 counts, genet-wpt geometry relabelled buckram, and WPT before/after over lane F's ten runs plus shadow-dom testharness with zero transitions. The preserved imported_part direction bug was fixed after the measurement in 162831765e5. On crates.io: cadency 0.0.1, livery 0.0.5, buckram 0.0.3, genet-livery 0.0.4; livery 0.0.2-0.0.4 and genet-livery 0.0.2-0.0.3 yanked for depending on upstream selectors. Open: script-runtime-api's separate querySelector selector module as a second consumer; deleting the genet-stylo name-claim family on crates.io, which is Mark's. | | MallocSizeOf and allocator removal | Servo's about:memory trait, derived across paint-types, xpath and the media crates with no reporter ever calling it, and the inherited #[global_allocator] that installed jemalloc on non-Windows builds through it. Landed and published 2026-09-22 (333c31285a2) under Mark's ruling: full removal, the allocator dropped so the host chooses. Script-free Ortet's dependency cone 401 -> 353 crates, upstream taffy gone from it; every suite at its recorded count; native standards-compositing receipt at 0xa440137ccc503f9c on both engines. On crates.io: genet-paint-types 0.2.0, engine-observables-api 0.2.0, genet-scripted-dom 0.1.2. Open for Mere: its =0.1.1 pin of genet-scripted-dom moves at the next repin. | The Buckram master defines ownership and the lane program assigns residuals. The linked execution plans carry their current gate; a completed corpus census or bounded slice does not close its enclosing feature.

Servo cone retirement

• servo_cone_retirement_plan (landed 2026-09-07: retired servo-paint's message painter, paint-api and the embedder/constellation trait cone; keeps the platform compositor as genet-compositor and absorbs the testdriver input path into genet-wpt. Media, WebGL and Piccolo stay by consumer.)

Deferred web platform lanes

• deferred_web_platform_lanes_scoping (research 2026-09-07: Shadow DOM, Canvas 2D, service workers, iframes and nested browsing contexts, dedicated Worker, WebSocket, IndexedDB and storage, Web Animations, and editing. Reviewed against the landed globals, observer and selection lanes: required semantics, remaining design choices, shared scripted/persistent host prerequisites, and exact-slice acceptance requirements. Census counts stay historical. API lanes require dated plans; the shared scripted-host direction is planned in Ortet O5.)

• Encoding TextDecoder/TextEncoder (Landed on main, 2026-10-06): native-backed Encoding under E1/C2/E2 and the ruled E3 harness correction pass 1,100 merged-source tests across seven crates, with three existing ignores, and eight optimized reporting controls. Earlier per-crate ownership is corrected without changing totals or outcomes. Matched whole-directory runs gain 5,054 Boa and 5,053 Vano assertions, with zero existing passes lost and every movement attributed. The fixed API selection reaches 19,210/19,408 and 19,209/19,408 passes. Mark authorized branch publication and continued main integration; qualifications and known residuals remain recorded in the plan.

• WHATWG Streams (Landed and published, 2026-10-07): native transfer, private Promise reactions and Boa finalizer retention are qualified and published. Exact consumer 5a539ae3f40 passes 1,209 tests, three existing ignores, its optimized runner and all four fixture categories on both engines. C3 ceases evaluation throws. Matched maps improve non-transferable Streams to 88 passing files on Boa and 87 on Vano. All 46 genuine first-candidate old-pass losses are repaired; 24 label equivalents and 12 experimental owning/transfer losses remain separately recorded. Independent source review qualifies all 8,446 normalized movements with zero gaps. Mark approved the exact 12 experimental losses and authorized the final checkpoint. Exact integration e410a1e1dab8 is published on main: fresh 1,209-test gate, two WOFF2 controls, optimized runner and all fixtures pass; ten matched maps preserve every candidate result with zero movements. Main's independent fontsan/WOFF2 change is preserved. Forms Phase A is now authorized under its separate plan and Checkpoint A.

• HTML forms (Phase A checkpoint ready locally, 2026-10-08): arena value state shared by script, native editing, accessibility and retained control text. Mark authorized input value/placeholder/password rendering and textarea live-value painting. Local Genet value/paint and Mere consumer gates pass, including the bounded app-textbox width repair and fresh CSS guard. F5 authorizes bounded sibling compatibility; F6 chooses app accessibility leaves across projections. Fresh current Mere/Knot integration and public-pin sibling gates pass. Publication and a verified published-source repin precede acceptance. Validation and submission remain behind separate checkpoints. The plan owns decisions and receipts.

WPT census — the web platform beyond CSS

• census_panics_plan (Landed 2026-10-05: 876c7a2cba4 implements R1 live canonical wrappers without author calls during GC and R2 queued destruction after the current script. P1-P7 no longer panic on either engine. Six crate gates pass 936 tests; eight directory maps lose zero file or subtest passes. The frozen-pin receipt remains historical; separate Vano repin d7f08fecdc7 passed 836 affected tests and paired WPT guards, published 2026-10-05. The census lane receipt records all controls, 33 attributed movements and remaining feature forks.)

• tagname_window_globals_plan (landed 2026-09-07: the two shape residuals the interface-table and Worker lanes left named. The HTML uppercasing moved out of the arena's __tagName / __nodeName and into the bootstrap, because the rule depends on the node's current node document being an HTML document — which only the JS tier tracks, and which importNode and adoptNode change — so the natives now report a case-preserved qualified name and one elementQualifiedName folds per read. With case preserved, element-interface selection reads the local name case-sensitively (createElementNS(html, 'DIV') is an HTMLUnknownElement), custom element definitions are keyed by local name so foo-bar cannot claim foo-BAR, and isValidCustomElementName gained the first-code-point and no-ASCII-uppercase rules it was missing. document.importNode was added on a cloneNode refactored to take its destination document. window and document became [LegacyUnforgeable] accessors and self a [Replaceable] one, with a Runtime::new_worker so the worker global never defines what it must not have rather than deleting it afterwards — both backends, Nova included, accept a non-configurable accessor on the global. dom/nodes/Element-tagName.html 3/6 -> 6/6, html/semantics/interfaces.html 435/438 -> 438/438 (all-pass), Document-importNode 0/5 -> 4/5, custom-elements/Document-createElementNS to all-pass, unexpected-self-properties.worker holds at 57/57; +31 subtest passes over six directories, five files fail -> pass, zero pass-to-fail. Two baselines repinned forward. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_tagname_window_globals/.)

• worker_plan (landed 2026-09-07: the dedicated Worker. Both engines are !Send, so the worker thread constructs its own Runtime and owns it; the spawn needs no engine bound because Runtime::new records worker_main::<E> as a plain fn pointer. The cross-agent wire is a JSON encoding of the clone record, which is forced rather than chosen: CallCx marshals only strings, so the cheap-globals fused walk was split into __scSerialize / __scDeserialize over a heap of tagged nodes that preserves cycles, aliasing, holes and transfers. Resource loads — the classic script, importScripts, fetch — are synchronous requests back to the page, answered from a new ScriptResourceLoader route or the page's FetchHandler, so no network stack enters the worker thread. A transferred MessagePort leaves a stub behind and the host routes by port id, in both directions. Two scheduling facts fell out: a worker's idle report must carry the count of link messages it has consumed (a bare flag quiesced the page over live work, one Boa run in three), and the disk drive loop must run on wall time while a worker is live, or its first virtual jump fires testharness.js's own timeout before the worker has started. genet-wpt now hosts .worker.js and .any.worker variants — synthesizing the .any.worker.js file wpt serve would have generated — and keeps the skip reasons for shared and service workers. workers 5 → 74 all-pass and 21/574 → 321/967 subtests, workers/constructors 0 → 8 all-pass, workers/interfaces 0 → 30, xhr 64 → 95 with errors 28 → 5, html/webappapis 31 → 45; +972 subtest passes over five directories, 207 previously unenumerated variants now reporting, and zero pass-to-fail. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_worker/.)

• iframes_plan (landed 2026-09-08: nested browsing contexts. BrowsingContextTree in genet-documents is deliberately data, not a session — identity, origin, sandbox flags and one session history per context, joined to whichever engine renders the document by BrowsingContextId, so the script-free and scripted routes share one tree without importing each other. An opaque origin carries a serial, because HTML's opaque origin is same-origin with nothing but itself; initial_about_blank is a bit rather than a URL test, because a document can navigate to about:blank deliberately and that one neither inherits its container's origin nor lets its successor replace. ResolvedDocumentResources gained frames, so a child is fetched through exactly the route its parent used; nesting recurses one level up where an HTML parser lives, guarded by HTML's matching-nested-contexts rule and a depth bound. The composite is a paint-list splice, not the ExternalTextureDraw path paint_list_api names as an iframe candidate: an external texture is composed after the scene, so it sits outside the scene's clip and transform stack and is invisible to a software rasterizer — the reftest lane and Ortet's own capture would both see an empty box. Livery already recorded the right position for a custom leaf while its ancestors' clips were live, so <iframe> got its own FrameSlot list (a separate key space, because a custom leaf's key is an author attribute and a frame's is a node id). Two findings fell out: image keys are per-list ordinals while font keys are content-hashed, so splicing a child without re-keying its images draws the parent's picture inside the frame — a plausible wrong answer, not an error; and a recorded index into a command stream is invalidated by every later insertion, which translated and scaled_to both perform at index 0. <iframe> also became a real replaced element with a default object size and no natural ratio, which needed its own branch before every ratio rule — width: 600px; height: auto is 600x150, not 600x300. On the script side window.length and window[i] now read the document (which makes a templated frame correctly absent with nothing checking for a template), frameElement is null, and postMessage enforces targetOrigin. webmessaging 65 -> 67 all-pass, the-window-object 62 -> 69 subtests, dom +12; +23 over eight directories with zero pass-to-fail. The reftest maps are byte-identical, and four composite tests in genet-wpt prove that means no reftest exercises a frame rather than the composite never ran — two iframe reftests run in those directories and neither discriminates. Raw maps under Code/testing/genet/wpt-ledger/2026-09-08_iframes/. Residuals: the second Runtime and contentWindow — Mark's call, because two Runtimes are two engine instances and CallCx marshals strings, so a same-origin contentWindow needs realms in ScriptEngine or stays permanently partial — plus document.domain, the cross-origin WindowProxy, COOP/COEP enforcement, child navigation, lazy loading, focus, and a headed script-driven receipt.)

• websocket_plan (landed 2026-09-07: WebSocket and CloseEvent as a script-visible state machine over an extended netfetcher transport. Two halves, because WebSocket is not a shape of fetch(): the Fetch algorithm does not wrap the connection path, so scheme rules, Fetch's bad-port list, HSTS, mixed-content blocking, the CSP connect-src hook and redirect refusal are enforced in netfetcher::websocket::connect against the same caller-owned FetchContext and the same cookie jar the fetch path uses — one test per rule — and every one of them reaches script only as the specification's single error event. The transport gained requested/selected subprotocols, negotiated extensions, the Origin header, typed WsErrors in place of bool/Option, close code/reason/cleanliness and buffered-byte accounting, with no tungstenite type in its public API. Above it, a WebSocketHandler seam beside FetchHandler (one new HostState field, six completion entry points) and an implementation on genet-wpt's existing tokio worker: one task per socket, select!ing between its command channel and its frames, delivered through the drive loop exactly as a deferred fetch settles. The bootstrap does no URL parsing of its own — it reuses the fetch surface's __resolve_url / __url_parse sinks, which is why the constructor and URL families pass with no network at all. Three findings worth carrying: __ws was already the worker scope's prefix; MessageEvent.origin on a socket message is the socket URL's origin, so it carries the ws scheme, not the page's; and a 512-byte probe cut inside a U+FFFD had been panicking three constructor/016.html variants in the runner itself. websockets 0 -> 76 all-pass and 0/1,874 -> 1,090/1,877 subtests in disk mode; the first server-mode run is 254 all-pass, zero errors, and 1,144/1,586 subtests, with all 214 no-results files being .any.worker.html — a dedicated Worker has no socket relay yet. fetch and xhr maps are byte-identical, and there is no pass-to-fail movement anywhere. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_websocket/.)

• dom_node_model_plan (landed 2026-09-07: the core DOM residuals the MutationObserver and Selection/Range plans left to Mark. Inserting a DocumentFragment moves its children, as one coalescing group, so the spec's two childList records fall out of the machinery the observer lane already built. CDATASection joins NodeKind and DocumentType becomes a real arena node — name in text, external identifiers in reserved attrs keys, read back through a new defaulted LayoutDom::doctype_data — with document.doctype, createDocumentType, createCDATASection and nodeType 4 / 10. The ParentNode / ChildNode mixins run the spec's node-or-string conversion, which is one insert now that fragments move. normalize (walked live, because the merge removes siblings), outerHTML both ways, and attributes with real namespaces surfaced as cached live Attr views through a NamedNodeMap — which also makes MutationRecord.attributeNamespace non-null. clone_into now carries every node kind, so a parsed page's comments, PIs and doctype reach the live document. DOMParser.parseFromString builds a new Document in the same arena through html5ever or xml5ever, XMLSerializer walks it back, and XHR's responseXML is wired to both. Node.baseURI closes a four-subtest false pass: document.URL landed two days after the baseline was pinned, so undefined === undefined had been scoring. dom/ranges 10 → 15 all-pass and 24 → 35,466 subtests, dom 173 → 209 all-pass, html/semantics/interfaces.html 298 → 435 of 438, selection 12 → 31 all-pass; +82,944 subtest passes over nine directories, zero pass-to-fail, and both error regressions are throughput walls on files that never passed. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_dom_node_model/.)

• selection_range_plan (landed 2026-09-07: Range, StaticRange, AbstractRange, Selection and getSelection over the scripted arena. The DOM's live-range steps run at the bootstrap's own twelve-call-site mutation funnel rather than off the arena's observer record, because they need the child index and the boundary offsets as they stood before the mutation; boundaries are indexed by the node they sit in, since a flat list is quadratic and hung eight editing/run/* files in the first post map. One source of truth: the script-owned Range is it, and Livery's TextRange selection is a projection pushed through a new SelectionHandler seam, which also serves Range.getClientRects from the same range-rect primitive the overlay paints from. ProcessingInstruction became a real arena node in the same lane — both census directories' shared common.js aborted on its absence before a single subtest ran. Selection is declared by the generated table, which now reads selection-api.idl. selection 0 → 12 all-pass and 0/280 → 28,582/33,621 subtests, dom/ranges 0 → 10 all-pass, MutationObserver-childList 18/38 → 32/38 and -characterData 13/23 → 21/23; +29,126 subtest passes over five directories with zero pass-to-fail. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_selection_range/.)

• mutation_observer_plan (landed 2026-09-07: MutationObserver as a second consumer of genet-scripted-dom's mutation point. The arena fans out at the mutator into a spec-shaped ObservedMutation — siblings around a removal, old values, innerHTML / textContent as added and removed node lists, and the target's ancestor chain captured at mutation time — rather than widening or tapping the DomMutation stream Livery drains, which carries none of those and is fenced off from this lane. The record is off until something observes. The registry, MutationObserverInit validation, the interested-observer walk, transient registered observers and the notify microtask live in the JS bootstrap over three native sinks (__moObserving, __moTake, __moGroup); records are queued at mutation time through the bootstrap's twelve mutating call sites, because Nova's global natives cannot be interposed on. MutationObserver and MutationRecord left the generator's SHAPE_ONLY_DENY list, so the table declares them and the shape pass defers to the implementation. sanity 0/13 → 13/13, takeRecords 0/3 → 3/3, disconnect 0/2 → 2/2, callback-arguments 0/1 → 1/1, attributes 0/42 → 35/42, childList 0/38 → 18/38; +495 subtest passes over dom, custom-elements and html/dom with zero pass-to-fail. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_mutation_observer/.)

• idl_interface_table_plan (landed 2026-09-07: the scripted tier's hand-maintained HTML interface table is replaced by one generated offline from WPT's vendored WebIDL (tests/wpt/tests/interfaces/{html,dom,cssom}.idl) plus its tag map (html/semantics/interfaces.js), by a dependency-free generator at support/idl-interface-table. 65 → 72 interfaces, 277 → 338 reflected attributes, 74 → 148 tag names, and 41 shape-only DOM/CSSOM interfaces; 342 hand-written rows become 41 overrides, each with a stated reason. A drift test regenerates and byte-compares. Sixteen measured directories move 5 error -> fail and 5 fail -> pass with zero pass-to-fail, +2,049 subtest passes, and html/semantics/interfaces.html goes 0/438 → 298/438. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_idl_interface_table/.)

• cheap_globals_plan (landed 2026-09-07: the day-scale entries from the census's missing-globals inventory, each a JS bootstrap over the existing VM primitives. performance with hr-time, User Timing and a PerformanceObserver on the drive loop (timing.rs); queueMicrotask on the existing microtask checkpoint; the structured serialize/deserialize algorithm as an engine-neutral value walk with a transferable registry (structured_clone.rs), the substrate the Worker lane reuses; MessageEvent / MessageChannel / MessagePort / BroadcastChannel and a real window.postMessage (messaging.rs); and crypto over a RandomSource host seam with a dependency-free ChaCha20 default (crypto.rs). Image / Option / Audio needed no code — the interface table already declares them. hr-time 0 to 2 all-pass, user-timing 1 to 24, performance-timeline 0 to 17, webmessaging 20 to 52, WebCryptoAPI 104 to 72 errored; the structured-clone battery 0/150 to 119/150. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_cheap_globals/.)

• xhr_plan (landed 2026-09-07: XMLHttpRequest, XMLHttpRequestUpload and ProgressEvent over the deferred fetch seam, synchronous XHR through FetchHandler::fetch_blocking; first server-mode xhr baseline.)

• wpt_harness_repair_plan (landed 2026-09-07: genet-wpt testharness now runs every test in a worker subprocess, as test262 does, so the Atomics.waitAsync hang is recorded rather than survived; the disk loader stops swallowing WPT support scripts whose name merely ends in testharness.js and stops handing .py server handlers to the engine; the server-mode drive loop takes --drive-deadline and advances its clock to the next timer instead of sleeping to it. The re-run census moves 204 files, every one attributed, none from a passing status. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_harness_repair/.)

• reflector_identity_scoping (research 2026-09-07: why a node's JS wrapper — and its listeners — could be silently replaced at a GC tick. Establishes the mechanism with receipts on both engines and lays out four fix options. The entry this document recorded as owed, written by the fix lane below.)

• reflector_identity_plan (landed 2026-09-07: the fix Mark chose — wrapper liveness follows node reachability, not wrapper state. Every wrapper has an opaque root, the root of its node's tree, and is alive while that root is; a document is always alive. The engine contract gained minted_reflectors / root_reflectors / unroot_reflectors on Boa and Nova, with drain_dead_reflectors still the liveness signal for unrooted reflectors. Connected nodes are decided from the arena and host-rooted — on the mint, on insertion, and at each tick, against a tree-root cache keyed on a new structural-mutation epoch. Detached trees cannot be decided by the host at all, because a strong root destroys the evidence for the question, so their liveness is handed to the collector as an ephemeron cycle in the bootstrap. Policy cost over 4,002 touched nodes: 0.5 ms on a quiescent frame, 2–3 ms after a re-parent, against a 16 ms (Boa) / 107 ms (Nova) whole tick. The WPT harness now collects once per drive turn, on by default. dom, custom-elements, html/webappapis, workers, selection and html/semantics/interfaces.html are byte-identical before and after under both settings — zero pass-to-fail, zero fail-to-pass — with the one collection-off difference traced to --jobs 8 scheduling on a worker test that passes both ways in isolation. Seven regression functions on both engines, ten of the twelve confirmed failing with the policy switched off; the gc-arena soak restated to "bounded by reachable touched nodes" and asserting both directions. Baselines unexpected=0, Ortet digest unchanged. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_reflector_identity/.)

• parser_script_interleaving_plan (landed 2026-09-08 in the engine: the residual the Shadow DOM lane left to Mark. html5ever already had the seam — Tokenizer::feed returns TokenizerResult::Script(handle) when the tree builder pops a </script>, with the element and its text already in the tree — so the lane is a TreeSink over the live arena plus a drive loop around it. Parsing through the arena's own LayoutDomMut mutators is why a MutationObserver sees parser insertions for free: append_child already writes the record, maintains slot assignment and advances the structural epoch. The arena is moved between the host state and the parser's cell around each pause rather than shared behind a second RefCell, because a tree-sink call and a DOM native both want &mut ScriptedDom and are never live at once. The two questions the tree builder asks the script tier — allow_declarative_shadow_roots and attach_declarative_shadow — are answered from a table refreshed after each script, which is exact rather than approximate because the registry can only change while a script runs. document.write during a parse is BufferQueue::push_front, the spec's insertion point literally; after a parse it implies document.open and re-materializes the document, with the exact rule and its two limits named. readyState stopped being a bootstrap constant and became a host fact the driver moves through loading → interactive → complete at HTML's points. html/syntax errored 62 → 1 (61 of them one undefined document.write), dynamic-markup-insertion 1 → 30 all-pass, custom-elements 8 → 9, html/semantics/scripting-1 errored 125 → 103; dom, html/dom/documents and html/webappapis/scripting byte-identical. +68 subtest passes, 30 fail -> pass, 2 error -> pass, zero pass-to-fail, no baselines repinned, Ortet digest unchanged. innerHTML on a <template> was operating on its children and now operates on its contents. The two Shadow DOM declarative WPT files do not move: the runner never parses with scripts interleaved, and this lane was fenced out of ports/genet-wpt/src. Raw maps under Code/testing/genet/wpt-ledger/2026-09-08_parser_script_interleaving/.) Part two, landed 2026-09-08, closes that gate. run_test_with_webgl_and_style parses interleaved through a ParserScriptLoader over the existing ScriptSrcLoader, with testharness.js and the results bridge as a prelude and exactly one load dispatch (Runtime::begin_parsed_testharness); the XML corpus keeps parse-then-run because xml5ever has no pause driver. LiveryCssom::install_over_parse is the two-phase form both LiveryScriptedDocument::build and the runner's rendering session use: a live stylesheet source with a fetcher that serves nothing, so sheets enter the cascade at the point the parser inserts them. The one tokenizer moved into MarkupState, because HTML has the parser process written characters during the document.write call — the whole document-write/0xx battery is written in that shape — with the pause it reaches stalled for the driver, which keeps script timing where it belongs. Custom-element upgrades run at creation, by feeding the tokenizer a tag at a time while any definition exists; foreign-namespace <script> elements are collected at creation and run at the next pause; a script in a template's contents does not run; and the arena carries a parsing flag so an innerHTML from a parser-run script cannot free the tree builder's own handles. +181 subtest passes over the named subset with two explained pass -> fail, +439 across the 79-directory census once two identified timing artifacts are removed, 19 census pass -> fail all attributed — sixteen of them html/dom/render-blocking/*, which passed only because the old post-parse document.open had wiped the document they assert about. Six testharness baselines repinned forward-only; all fourteen and both reftest guards at unexpected=0; Ortet digest 0x6377ba8a6bf4dbc9 unchanged. Maps under Code/testing/genet/wpt-ledger/2026-09-08_interleaving_part_two/.)

• shadow_dom_plan (landed 2026-09-07/08: Shadow DOM across both DOMs. A shadow root is a real node in the same store with no parent, hung off its host through two side maps rather than through the host's children, so every existing dom_children walk — layout, serialization, querySelector, Fleece — skips it by construction rather than by being told to; <template> contents use the same trick, in one inert Document shared by a document's templates, per Mark's ruling. Slot assignment is recomputed eagerly per affected root at the mutation, behind a shadow_hosts.is_empty() guard, so a shadow-free document pays one hash check per structural mutation. Declarative <template shadowrootmode> is a post-parse pass, not an html5ever change, so one set of rules serves both tiers and a script-free page reaches the same flat tree. Livery's rendering traversals moved to flat_children while the DOM-ordered ones (selection sources, :nth-child ordinals, the canvas background source) deliberately did not; the cascade descends the flat tree and numbers siblings in the node tree. Style scoping is decided per rule from each sheet's owner node, because a flattened cascade has lost the sheet; selectors 0.39 already implemented :host / ::slotted() / ::part(), so what the lane built was the boundary around them. tree_root continuing through the host is the entire reflector-identity integration. shadow-dom 6 -> 45 all-pass, 36 -> 13 errored, 24 -> 1,512 subtests; the-template-element 273 -> 514; +1,761 subtest passes over four directories, 47 files fail -> pass, one explained pass -> fail and one explained fail -> error, both from Genet parsing a document before it runs its scripts. Three baselines repinned forward. Raw maps under Code/testing/genet/wpt-ledger/2026-09-07_shadow_dom/.)

• web_platform_wpt_census

• standards_to_features_ledger (complete 2026-09-06: exact genet-wpt testharness maps for every non-CSS WPT directory a web engine owns, html split by subdirectory; 676 all-pass / 13,845 fail / 2,392 error / 985 no-results / 3,774 skip of 21,672 archived keys (including one diagnosed fallback artifact), with the missing-global inventory and four historical harness caveats. The complete Vano refresh and full table are linked from the census. Raw maps under Code/testing/genet/wpt-ledger/2026-09-06_platform_census/.)

ortet — the raw host

• ortet_founding_plan (O0-O5 native landed; browser http(s) provisioning and its headed HTTP runtime receipt accepted 2026-09-06; AccessKit session-generation custody and the Windows UIAutomation native action receipt accepted under O2: the one headed port that proves the engine runs without Mere, over genet-winit-host, genet-render-host, genet-documents' Livery lane and document-session-api, with a cone witness that forbids every Mere crate and a self-driven frame receipt. Replaced Pelt as Genet's default host when Pelt moved to Mere.) O5 scripted platform host is accepted for native Boa and Nova 2026-09-08: the script-free/Boa/Nova selector, completion-driven scheduling, bounded semantic receipts, idle-woken fetch and Worker delivery, and stale-session rejection passed at exact source f3dc1bcf909. Ortet is Genet's reference host; genet-wpt owns conformance scoring and Pelt proves downstream composition. Browser-hosted scripting and persistent test storage require their own later receipts. Crates.io publication is a packaging precondition under the workspace's publish = false policy, rather than Ortet runtime work.

fleece — reader extraction

• fleece_preservation_contract_plan (partial implementation with automated receipts, refreshed 2026-09-09: Fleece 0.5 canonical-text preservation, selector projection, language/direction evidence and lossless embedded JSON-LD records are implemented. The full cross-crate Web Annotation profile and remaining standards gates stay open; these preservation contracts have no native headed or browser-hosted receipt. Capture and custody remain caller-owned.)
• fleece_followthrough_plan (complete 2026-08-26: the genet-extract shim is retired; retained static/scripted hosts activate Fleece-generated Text Directives with element fallback, indication, scrolling, one-fetch behavior, and script-visible URL privacy; Mere crawl and Gazette now consume supplied documents while eidetic-search drops its misplaced edge. Focused automated gates and the headed activation/indication receipt are green.)

layout and styling

• css_3d_transforms_and_first_frame_plan (bounded Genet seam implemented; downstream native Bench B accepted 2026-09-13: T3's existing custom-leaf/external-image route now exposes content-box placement, common 2D paint/input mapping and typed used foreground color. Its 61 focused checks include a plain retained leaf at zero layer depth; the percentage-padding approximation remains explicit. The native development build passes 167 frames/15 captures at scale 2 with tint, decorative-CSS, transformed input and producer-lifecycle checks; a separate Mesocosm workspace check passes on committed dependencies. Mere owns Cambium's producer and style consumer. Broader T3 acceptance and mutation measurement, the large-element sweep, T1 general CSS 3D, T2 first-frame scaling and T4 planar retention remain independent of the first bench. The downstream native receipt is separate from the prior Ortet canvas acceptance and is not an Ortet or WPT rerun. Application prerequisite authority: isometry/mesocosm/design_docs/2026-09-11_orthographic_voxel_presentation_plan.md#specimen-bench-prerequisites-2026-09-13.)

• common_script_font_fallback_plan (Windows repair accepted 2026-09-05: the paired Parley/Fontique patch queries actual text after authored faces fail. Both disclosure markers now paint through system fallback in Ortet, while Latin and explicit-font controls remain verified. Downstream product pins, upstream disposition, and other platforms retain separate gates.)

• livery_flex_shorthand_plan (complete flex-shorthand slice; Row 18 remains in progress: Livery now expands flex and flex-flow into the longhand style fields already lowered to Taffy. The exact 1,358-file flexbox map records 115 gains, three assigned downstream false-pass losses, and the numeric-basis parser repair forced by the first candidate. The current eight-input Taffy seam is published and consumed as genet-taffy 0.14.0, published and tagged genet-taffy-v0.14.0 at the Row 18 closure; 0.13.1 was the eight-input seam before it.)

cambium — the desktop host

• Cambium, Workbench and mere-surface-api left genet for mere on 2026-09-03 under the platform boundary plan; the host_ui_zoom_plan and the workbench_component_plan travelled with them and are now in mere's design_docs/.

inker_docs/, nematic_docs/, verso_docs/ — moved to mere

• The engine-management layer left genet for mere on 2026-09-03 under the platform boundary plan: inker, document-canvas, the scrying/graft/weld engine adapters, verso-tile, nematic, illume, errand and tinct. These three area roots travelled with their code and are now in mere's design_docs/.

codebase structure

• orchestrator_decomposition_plan (seven extraction phases complete 2026-08-29; follow-through recorded through 2026-09-02: the original phases preserved behavior. Later entries separately record the layout transaction split, sizing repairs and their bounded receipts. The two-builder assessment recommends factoring shared table helpers if pursued. Pelt's code now lives in Mere.)

archive_docs/ — completed plans

Per policy §4 and §8: a plan moves here once complete and once its open points have a home elsewhere. Links into a moved plan are repaired in the same session; links out of it are rewritten for its new depth.

• 2026-09-02/fleece_standards_adoption_plan (complete 2026-08-25, archived 2026-09-02: Fleece 0.2 shipped canonical DOM-text coordinates, W3C Text Quote and Text Position selectors, and a Text Fragment projection; 0.3 hardened JSON-LD syntax harvesting and HTML Microdata; 0.4 added ordered Open Graph grouping, DOM document links, and semantic HTML table grids and header associations. No open points carried.)
• 2026-09-02/knot_evaluation_export_plan (reconciled and complete for the first production capability set 2026-07-27, archived 2026-09-02; include closed, TOFU location rehomed to the fidelity plan, badge default carried by the block resolver plan. include transclusion fences over errand's smolweb transports, lua eval / rhai eval script fences via the BlockEvaluator slice, to_gemtext and gophermap exporters, the Knot production effect bridge, Turnstone consent, and the sealed attributable resolve cache. The production Knot adapter supplies anonymous HTTP(S) plus read-only Gemini, Gopher, Finger, Spartan, Nex and Guppy; Titan stays excluded.)

Working principles

• Retained diagnostics must scale with the shaped paragraph. A dormant opportunity stream still runs during real layout. Preserve semantic scans as test oracles, but index repeated owner/range queries in production and enforce a comparison-count bound. Record unchanged host fixtures separately from micro-timing; see the October 8 bounded lookup repair in the line-breaking plan.

• Set the target for commands that can run Cargo indirectly. Git hooks can inherit a shared CARGO_TARGET_DIR even when the preceding native gates used an explicit target. Set the approved reusable target and qualified toolchain in the publication command's environment too. Preserve foreign build owners. See the Streams engine-foundation publication receipt, 2026-10-06.

• WPT file acceptance requires successful harness completion. Keep the overall callback status separate from individual assertions. An incomplete worker report can contain only passing assertions and still have timed out. Honor long-timeout metadata before evaluating testharness, or configure the cached timeout before tests start. Compare matched runner/settings pairs and retain missing subtests explicitly. See E3 in the Encoding API plan.

• Content placement must not add an implicit compositing layer. A scene image's draw rectangle already bounds its pixels. Adding an unconditional clip around the generic host-content slot sends existing planar retained leaves through the measured layer fallback. Share content-box coordinates while preserving ordinary CSS-requested clipping; keep a zero-layer retained leaf as a regression. See T3/T4 in the scene viewport plan.

• Cross-arena runtime mutation: validate every participating operand before detachment; preserve pending layout records while consuming observer records at the semantic boundary. Group observer mutations by the physical owner, preserve canonical wrappers and their creation prototypes, and re-register private hooks from the cloned heap after a runtime snapshot restore.

• Cache custody is separate from object creation. Before discarding a realm, transfer surviving reflector cache entries and their roots to a registered owner. Agent-shared weak wrapper and group maps preserve identity without registering the old realm forever. Template retention is directed: the host retains its contents, while contents alone do not retain the host. Verify both the last reachable member and final collection.

• Execution registration is shorter than host lifetime. A discarded realm can leave host resources reachable through retained script objects. Runtime teardown must cover those hosts before the engine heap is destroyed; weak lifetime tracking provides that coverage without rooting discarded documents.

• Fuse the check with the decode, or the check is optional. A native sink got an agent-wide reflector id and a separate reflector_is_local to call before dereferencing it in its own arena — 60 sinks, 72 call sites, and nothing but the doc comment holding the order together. Returning the id only when the check passes, and handing back a handle that carries the owning store, makes "decode now, check later" unrepresentable rather than discouraged. The same shape as the per-realm HostData decision one section down: put the answer where the caller cannot get it wrong. See the realms plan's accessor phase.

• A serial is not an identity once storage moves. Adoption transfers nodes between arenas with their ids intact, so two arenas can hold the same allocation serial. A capture journal that recorded only the serial replayed onto whichever node the replaying arena happened to have allocated at that index — a live, wrong node, silently. The fix is not a better remint but a wider record: name the origin arena, keep an import registry on the store that received the adoption, and refuse an origin the registry does not know. When identity is packed out of two fields, check whether every consumer carries both before trusting a round trip.

• A removal that runs script is not a removal. Destroying a nested browsing context looked like one operation and is two: HTML takes the container's content navigable away synchronously, then unloads the document in a queued task, because the removing steps are forbidden from running script. Dispatching unload inline passed every hand-written regression and lost three named WPT subtests that exist to check exactly that. When a spec algorithm says "queue a task", the queue is usually the observable part.

• Read the test before believing the brief about it. This lane was handed a premise that a discarded context reports document as null. WPT asserts the opposite, twice, a hundred milliseconds apart — a Window's document is its document, and it is the WindowProxy's [[Window]] that a discard replaces. Implementing the premise cost two passes. A named expectation in the tree is cheaper to consult than a plausible sentence about it.

• New docs go in design_docs/, never docs/. See the policy's two-homes section for why both exist and what it would cost to merge them.

• The smolweb boundary is spec versus use. What a protocol is belongs to the smolweb workspace; what a browser does with it belongs here. Cite across the boundary by path — relative links do not survive it.

• Prefer runtime verification to extended static tracing. If runtime diagnostics are blocked, surface that blocker early rather than continuing to read code.

• State the exact standards layer implemented. Selector values are not the Web Annotation Protocol; JSON-LD syntax harvesting is not JSON-LD processing; raw URL attributes are not resolved links. Keep these boundaries visible in public types and receipts.

• Trace the values the consumer actually receives. Input normalization, script itemization and host projection can change the value under review. A diagnostic records that effective value and the selected implementation; an initially passing control is evidence to interpret, not a faulty test by definition.

• Keep current gates synchronized after integration. Update the parent, execution plan and this work map together. Preserve old receipts with their dates and source identities. When a dependency move retires a positive control, replace its exercised path or explicitly reopen that proof.

• Separate implementation from receipts. Report committed code, automated checks, native headed acceptance, and browser-hosted acceptance independently, with the source and feature scope each receipt actually exercised. A commit or a passing receipt on one host does not close the other gates.

• Freeze dependency resolution with a measured runner. Cargo.lock is intentionally ignored here. Retain the generated lockfile, its digest, target/features and local-override facts with the source and binary receipt.

• Scope behavior separately from implementation choices. Tree/realm, event, transfer and storage semantics constrain backend and host placement. A supported slice names required assertions and residuals; aggregate WPT gains alone do not close it. A hosted proof names its actual session engine and providers, including any scripted or persistent-host prerequisite.

• A lane's baseline map must come from the lane's own runner build. Cargo.lock is ignored and rewritten by builds, so two runners built at different times can embed different dependency revisions even from the same tree; the cheap-globals lane saw 14 files move under an unmodified tree for that reason. Another lane's post maps are therefore not a controlled baseline. Build the unmodified tree in your own target directory, run pre, then run post, and record both runner digests. Build pre before the first edit, or from HEAD sources restored for the build: a baseline build started in the background while the tree is being edited compiles whatever the crate looks like when the compiler reaches it, and the resulting binary is not a baseline. See the cheap-globals plan's Findings and the MutationObserver plan's Progress.

• A per-mutation walk over a script-created population is quadratic. The bootstrap's mutation funnel runs on every DOM change, so anything hung off it must be indexed by the node it concerns, not scanned. The Selection and Range lane's first live-range list turned eight editing/run/* files that had merely failed into hangs, at four times the directory's wall time; keyed by node, the same directory ran faster than its baseline. A post map that slows a directory down is reporting a complexity defect, not noise.

• A subtest that compares two absent things passes. Node-baseURI.html scored 4 of 9 for two weeks on undefined === undefined; defining document.URL correctly turned those four into honest failures and the checked baseline read it as a regression. When a directory goes down, look for a newly-defined name on one side of an equality before looking for a bug, and treat a pin taken over an unimplemented feature as a record of the pin, not of the score.

• A directory's census can be floored by one missing name. Two directories in this session reported almost nothing because their shared setup file threw on a node type neither lane was about, aborting every file before its first subtest. Probe the shared common.js of a directory that will not move before concluding anything about the feature under test. Supplying the missing name took selection from 384 reported subtests to 33,621. The same file floored dom/ranges twice: CDATASection and, behind it, a constructible Document. Re-probe after each unfloor rather than assume one name was the only one.

• A global native cannot be interposed on from the bootstrap. Boa's host globals are writable and Nova's are not (defineProperty throws there too), so wrapping globalThis.__someNative works on one backend and silently does nothing on the other. Wrap at the bootstrap's own call sites instead — they are few, because the bootstrap already funnels — and prove the behavior on both backends. See the MutationObserver plan's Findings.

• A virtual clock and a second agent are incompatible. The disk drive loop jumps to the next timer's due time and never sleeps, which is right while one agent owns all the work. The moment a worker thread is live, that jump fires testharness.js's own 10s timeout before the worker has fetched its script, and every worker test reports Test timed out. Run on wall time while another agent can still speak, and make "can still speak" a counted report — an idle flag that does not say "idle as of which message" will cross a message in flight and quiesce the page over live work. See the Worker plan's Findings.

• Verify paired forks from a standalone consumer. Cargo root patches are not inherited by downstream workspaces. A coupled dependency must travel with its caller; prove that resolution before refreshing product revisions.

• A liveness question the host cannot answer belongs to the collector. If the host takes a strong root to keep something alive, it can no longer ask whether anything else was keeping it alive — the root is the answer's own confounder, and no order of unroot, collect and query recovers it without the collection taking the object the question was about. Express the relation instead, as a reference cycle a tracing GC already resolves: a WeakMap from each member of a group to a shared array of all members is an ephemeron, so the group lives exactly while any member is reachable. See the reflector identity plan §1.1.

• Make encapsulation a property of the shape, not a flag every consumer checks. A shadow root and a <template>'s contents are both unreachable from the document by construction: neither has a parent, so no walk that descends dom_children — layout, serialization, querySelector, Fleece's extraction, the named-property scan — can enter one, and none of them had to be taught anything. The cost of the choice is that a copier must be told explicitly, and there were three (clone_into, copy_fragment_node, cloneNode); each was silently dropping the content until it was. That trade is the right way round: a missed copy is a visibly empty content, while a missed encapsulation check is a leak nobody notices. See the Shadow DOM plan's Findings.

• A named property script has replaced must survive the next refresh. __refreshNamedProperties deleted every name it had installed before reinstalling from the document. Its own comment already recorded that an id="test" element must not shadow testharness's test(), and its setter got the shadowing right — but the next refresh took the script's value back out. Nothing triggered a mid-file refresh until this lane's setHTMLUnsafe did, and then a shadow-DOM file died with not a callable function from calling test(...). A guard that is correct once and re-run later is not a guard; check that what you are removing is still the thing you installed.

• A container whose contents are deliberately unreachable must have every accessor told, one at a time, and each one is silent until exercised. The Shadow DOM lane found three copiers that walked a <template>'s children and so copied nothing; this lane found innerHTML, which had the same shape — the getter serialized an always-empty child list and the setter put nodes where no walk reaches. Nothing caught it for a day because nothing set a template's innerHTML. When encapsulation is a property of the shape rather than a flag, the bug is never a wrong answer; it is an accessor nobody has pointed at the contents yet. Enumerate them deliberately rather than waiting for a reproducer.

• A table a &self sink reads must be refreshed after the script, not before it. The tree builder asks the script tier questions from inside a live tokenizer, where an engine call would re-enter it, so the answers come from a table the driver refreshes at each pause. Refreshing at the top of the pause is one script too early: the definition the next stretch of tokenizing asks about is the one the script that is about to run has not made yet. See the parser/script interleaving plan's Findings.

• A model no consumer exercises is not validated by the tests that do not exercise it. The parser/script lane's part one queued document.write source until the calling script returned, and passed 22 runtime cases and a whole WPT directory doing it — because on both routes the DOM was never read back inside the writing script. The first honest consumer turned 21 document-write/0xx files from pass to fail in one step. When a design has a "we apply it later" step, find the test that reads it now before believing the green.

• A pass can be the absence of the thing being tested. Sixteen html/dom/render-blocking/* files passed because their document.write helper implied document.open, which wiped the document their assertion looks in; an empty document satisfies assert_false(!!getElementById(...)). This is the Node-baseURI principle at document scale: when a directory goes down, look for something that used to be absent before looking for a bug.

• A slower runner reads as a regression at the census timeout. One shadow-dom file takes 84.5 s on the pre runner and 90.3 s on the post one, against a 90 s census timeout, and its 376 subtests are the whole of that directory's apparent loss. Time the file on both runners before attributing a status move; the same directory at --timeout 240 was a gain.

• The tree builder holds ids the arena is free to reclaim. While a parser is building into the scripted arena, innerHTML from a script the parser is running must orphan a replaced subtree rather than free it — the open-element stack still points at it. The flag has the same shape observing already had, and the arena's own fence caught it on the first file that could have gone wrong silently.

• A headed digest is not a receipt until it repeats, and a moved digest is not a verdict until a control renders the same page without the feature. An Ortet page built for the iframes lane produced a different digest on every run; two captures differed by one pixel at a glyph edge in 9px text, in the parent, outside every frame. The same page with the frames replaced by plain boxes was equally unstable and article.html was byte-stable, so the cause was genet's glyph rasterization at very small sizes, not the new code. Take a digest three times before recording it, and keep receipt pages out of sub-10px type.

• A composite that happens after the scene is outside the scene. An external texture is composed by the host in its own pass, so no CSS clip, transform or stacking order reaches it and no software rasterizer sees it. Anything that must be clipped by its container, travel under an ancestor transform, or appear in a captured frame belongs in the paint list. See the iframes plan §3.

• Two resource tables, two key-minting rules, and only one fails loudly. Merging a child paint list into a parent's is a dedupe for content-hashed font keys and a re-keying for per-list ordinal image keys. Skip the re-keying and the frame draws the parent's image: a plausible wrong picture, never an error. Read how a key is minted before merging two lists that carry them.

• A recorded index into a command stream is a position, and positions move. Livery's host-leaf slots survived for months because nothing wrapped the list while a slot was outstanding; translated and scaled_to both insert at index 0, so the moment a second slot kind existed the bug was one page-zoom away. Every insertion has to shift every outstanding slot.

• A default object size is not an intrinsic size. Giving a replaced element with no natural dimensions a 300x150 "intrinsic size" hands it a 2:1 natural ratio, and width: 600px; height: auto then renders 600x300. Axes that never speak to each other need their own branch before every ratio rule, not a value threaded through them.

• A cross-instance boundary that marshals strings cannot carry object identity. The Worker lane could live with it, because the specification's worker boundary is a message queue. A same-origin iframe cannot, because the specification's boundary there is a shared object graph: iframe.contentWindow.document.getElementById(x) must return the node the child's own script sees. When a surface's contract is identity rather than transport, a marshalled proxy is not a partial implementation of it — it is a different thing that scores well. See the iframes plan §4.

• A cross-instance boundary cannot carry identity, but a cross-realm one is not a boundary at all. The Worker lane's JSON wire and the iframes lane's refusal to fake contentWindow are the same fact from two sides: two engine instances are two agents. One engine instance with two realms is one agent, so a value obtained in one realm is an ordinary reference in the other — no marshalling API is needed, and none was written. Before designing a proxy, check whether the two sides can simply share a heap. See the realms plan §1.

• Put the key where the party that cannot get it wrong already holds it. Per-realm host state looked like a job for the host: rekey HostState by realm and teach ~123 native sinks to ask which realm they are in. But the engine already knows the realm — it is the execution context — so putting HostData in the realm's own slot left every sink unchanged and made the wrong answer unrepresentable. When a fan-out of call sites all need the same contextual fact, look for the layer that already has it.

• An engine's realm switch may or may not nest, and that decides where installation happens. Boa's enter_realm is a call-frame field swap and nests freely; Nova's GcAgent::run_in_realm asserts an empty execution-context stack and cannot. A per-realm surface installed lazily from inside a native sink would have worked on Boa and asserted on Nova. This is the cross-target lesson in a new place: a green build on one backend proves nothing about the other's execution model.

• A null census is only readable with a lockfile control. A purely additive trait change should move nothing, and the realms lane's nine directories moved nothing — but "zero" is only evidence when the pre and post runners resolved identical dependencies. Record the Cargo.lock digest of both builds; without it, a null result and two cancelling effects look the same.

• Worktrees sharing a target directory share path-crate artifacts. Cargo keys a path package by its workspace-relative path and trusts it by mtime, so a tree checked out before another tree's build can link that build's artifacts for crates whose version did not change. A compile error is the lucky outcome; a crate that still compiles links silently. Before comparing binaries built from several trees in one CARGO_TARGET_DIR, prove each one: every path package in the closure was compiled in that build or is byte-unchanged since the other trees. See the T3 acceptance rerun's build/reuse_check.py.

• Parallel work needs commit fences as well as file fences. Pin one base, give each worker a disposable detached worktree and disjoint write paths, inspect staged paths before committing, and remove the worktree immediately after integration.

Status

Founded 2026-08-24; current work map reconciled 2026-09-07, including the IDL interface-table, cheap-globals, MutationObserver, Selection/Range and DOM node model lanes. The index covers the flat plans sectioned above and two archived plans; the count in this line was stale before 2026-09-07 and is now stated by the sections themselves. All three former component area roots now live in Mere. The older docs/ corpus has selected execution entry points above; its full migration and governance remain deferred under the policy's local addendum.

Realms continuation (2026-09-09, in progress)

The realms continuation began from the inherited patch at 640477b6138; aa12e16eb7c now contains phase one and in-progress continuation code. Later corrections remain in the working tree. The one-Runtime-per-agent ruling is active; the earlier iframes decision entries are historical. Engine corrections, per-realm surfaces and child integration are undergoing fresh gates against a frozen pre runner and nine pre census maps. Historical phase-one automated and native Ortet receipts do not validate the continuation. Continuation native Ortet verification is pending, and no browser-hosted realm receipt is recorded.

Realms continuation outcome (2026-09-09)

The realms continuation has measured per-realm host surfaces, real same-origin identity, cross-origin proxies, messaging and live child rendering. Aggregate suites passed 667 tests; the final localized exception correction passed its focused Boa/Nova cases. The final nine-directory census is +222 net subtest passes, with four valid cross-arena adoption assertions still regressing and one duplicate registration removed. Three baseline files were repinned forward-only; twelve of fourteen testharness slices and both reftest slices are unexpected=0. Broad dom/dom-nodes acceptance remains blocked. The guard's 30-second Range timeout also reproduces on the pre runner. Native default-route article captures match three times; frames matches three consecutive captures after a retained one-pixel caption outlier. These are not headed scripted-realm or browser-hosted acceptance. Remaining code is uncommitted and requires the archived local Boa/Vano patches. The plan and continuation ledger hold exact source hashes, maps and named losses.

WindowProxy and navigation (2026-09-11)

The WindowProxy and navigation phase builds the object the lifecycle phase declined to guess at. A browsing context holds one WindowProxy for its life, made natively before its realm's first instruction over a shadow target that retains no global object, and the cross-origin decision is made inside that one object per accessing realm — there is no second façade, because frame.contentWindow === frame.contentWindow has to survive a navigation that changes the frame's origin. The accessing realm is the native caller's, not the current one: calling a builtin enters its own realm even though a Proxy's internal methods do not. A child navigates for real through unload, a new realm, a new Document, a proxy rebind and an interleaved parse; fragment navigation keeps the document and fires hashchange; session history moves onto the browsing-context crate with popstate, and whether a traversal keeps the document is decided by document identity rather than by URL. The outgoing realm is discarded every time, including the realm the proxy itself was built in — both engines keep the handler, the shadow and the control function alive afterwards, so no realm is retained. Release runtime 542 passed / 0 failed / 0 ignored. The census gains 19 subtests and twelve files across nine directories against two pass-to-nonpass movements, both former vacuous passes, with no repins; twelve of fifteen testharness slices and both reftest guards at unexpected=0, each red one at the count it inherited, both Ortet receipts unchanged. The top-level realm is not replaced: MAIN_REALM is the agent's root host and the resolution target of every Runtime entry point, so making it movable is a Runtime API lane and not a navigation one; the host policy hook that gates a top-level navigation exists, and the document URL and session history move without it.

Browsing-context lifecycle (2026-09-10)

The browsing-context lifecycle phase implements HTML's iframe removing steps in their two halves — the container loses its content navigable synchronously, the document is unloaded and its realm discarded in a queued task — and that one mechanism carries live iframe relocation, browsing-context relocation and removed-frame teardown together. The engine contract gains discard_realm_from_call on both backends; the adoption refusal now asks whether an iframe still holds a context rather than matching its element name, and asks it differently either side of the removal steps. Release runtime 526 passed / 0 failed / 0 ignored, the two live-iframe fixtures un-ignored. The census gains 8 named subtests across eight directories with zero pass-to-fail movements, including all four move_iframe_in_dom files; one forward-only repin (dom_abort_boa), twelve of fourteen testharness slices and both reftest guards at unexpected=0, both Ortet receipts unchanged. dom and dom/nodes stay red and unrepinned: Node-isConnected.html: Test with iframes is now isolated to the parsing-time cross-arena refusal, not to iframes. Navigation with a stable WindowProxy is open and waiting on a ruling from Mark rather than partially built.

Owner-resolved accessor and imported-identity replay (2026-09-10)

The accessor and replay phase closes the two items the ordinary-adoption lane handed on. CallCx now answers arena-local reflector data in one step and the runtime resolves every reflector to its owning host before a sink can dereference it: 60 native sinks migrated, zero left decoding a bare id, seven deliberate cross-arena reads retained. Capture records name their origin arena and replay translates through the importing store's registry, refusing an unknown origin with a typed error instead of reminting onto a colliding serial. Release runtime 520 passed / 0 failed / 2 ignored; four census subsets move nothing against a lockfile control differing by one dependency edge; twelve testharness slices, both reftest guards and both Ortet receipts unchanged. Broad dom and dom/nodes remain red at their inherited counts and were not repinned.

Cross-arena adoption foundation (verified, 2026-09-09)

The realms adoption continuation now implements the G5 identity prerequisite and bounded detached storage transfer: complete u64 identities on all targets, explicit exhaustion and capture translation, and preflighted transfer without reminting. All 674 distinct native tests pass, with all 65 store tests repeated in release; a wasm32 store probe executes with exact u64 identity. Workspace compilation, table drift, Clippy and formatting checks pass. This updates the earlier S3/S4 boundary above. Authored cross-arena adoption remains refused while wrapper, owning-host, observer, Range and GC routing are coordinated. The four named adoption regressions and G5 headed acceptance remain open.

Runtime adoption continuation (in verification, 2026-09-09)

The runtime adoption phase implements ordinary-subtree authored adoption, canonical creation-realm wrappers, physical-owner routing, observer/Range coordination and mixed-realm GC groups. New regressions and crate gates are running; the phase carries no completed runtime acceptance claim yet. Associated trees and host-owned embedded contexts remain explicit unsupported transfer boundaries. This is the successor to the foundation-only refusal described above; full realms and headed G5 acceptance remain open.

Top-level realm (2026-09-12)

The top-level realm phase replaces the realm the WindowProxy lane recorded as unreplaceable. MAIN_REALM now means only the agent's bootstrap realm — the timer queue, the navigation drive, the WindowProxy factory, the one realm the engine refuses to discard — and the top-level browsing context's document lives in a realm created through the realm API, with its WindowProxy as the global this from the realm's first instruction, exactly as a child frame's is. The two are told apart by the top context's absent FrameRecord and by nothing else. One accessor, Runtime::top_realm(), answers every top-document question across 41 migrated call sites, and navigate_top_level asks the host policy hook and then takes the child's route exactly, draining on the bootstrap realm because that is the one realm guaranteed to outlive every document. Runtime::host() keeps its signature — a navigation writes the new HostState into the cell the embedder already holds — so genet-scripted, the WPT runner, Ortet and Mere-side hosts change nothing. The blocker cleared first was genet's, not vano's: Nova's snapshot_clone refusal on realm-creating agents was a wholesale realm_roots copy, and lifting it kept the 3.4 ms-per-clone harness path instead of 37.7 ms per test fresh. Release runtime suite 558 passed, zero ignored. The eight-subset, 2491-file census moves no file in either direction and exactly two subtests, both former passes that depended on the defect this phase fixed; no repins, twelve of fourteen testharness slices and both reftest guards at unexpected=0. dom 61 and dom/nodes 35 are reproduced exactly by the base runner and are deliberately left unrepinned for the merge to reconcile against main's copies. Ortet's article digest is stable over three runs and frames is bimodal at this base; an ortet built from the base commit produces the identical six digests, so both are properties of the base rather than of this lane. A discarded context's Location reporting about:blank remains open.

Associated-state transfer (2026-09-12)

The associated-state transfer phase replaces the last two adoption refusals that were stated by name rather than by fact. A shadow tree now moves with its host — nested hosts, open and closed roots alike, slot assignment tables and pending slotchange entries, ownerDocument following for every node, the adoptedCallback fanning out to a custom element inside a nested closed root, and every reflector the same object on the far side, on both engines; a closed root stays closed. A template's contents are re-homed onto the destination's inert template-contents owner document, recursively through nested templates, and the fan-out reaches every same-origin realm because the move may have run in any of them. The parsing guard becomes the rule HTML states: the tree sink tracks unpopped created elements plus the form element pointer, and the arena recovers the stack of open elements by intersecting that set with the current node's inclusive ancestors, so a completed sibling subtree may leave a document mid-parse while document.body is still refused — which recovers dom/nodes/Node-isConnected.html: Test with iframes. object and embed join iframe in arriving as ordinary subtrees that become fresh frames in the destination; a canvas holding a live drawing context is the one named residual, refused by fact because its registry index and texture producer answer to the source host alone. Release runtime 551 passed / 0 failed / 0 ignored. The census over dom, shadow-dom, custom-elements, the template element and the iframe element gains seven subtests across three files with zero pass-to-nonpass movements and identical key sets; dom_boa.json and dom_nodes_boa.json are repinned forward-only with no former pass demoted and no key dropped, taking dom from 60 to 0 and dom/nodes from 35 to 0 — so all fourteen testharness slices and both reftest guards are at unexpected=0 and the broad DOM guard is green for the first time. Both Ortet receipts are unchanged by the lane, established against an Ortet built at the lane's own base commit: article reads 0x86e02f7fcd1c5b04 there too, so the move off 0x6377ba8a6bf4dbc9 belongs to the Livery compositing commits, and frames is bimodal at this base in the same proportion before and after, so no single digest can honestly be recorded for it.

Headed G5 acceptance (2026-09-12)

The headed G5 acceptance phase closes the open item every realms phase since the adoption continuation carried forward. The host was chosen by fact, not built: Ortet on main already has a scripted route (--engine boa / --engine nova select the scripted session engine), so a real winit window drives the frame loop while the page drives itself. The fixture (ports/ortet/tests/native/realms/) is a parent document and a same-origin child iframe served over one loopback http origin — it cannot be served from the filesystem, because this engine gives every file: URL an opaque origin and an opaque origin is same-origin with nothing, so a file: parent cannot reach frame.contentDocument at all. One native click then runs the whole sequence: a subtree carrying an open shadow root, a nested closed root and a parser-created template is adopted from the child into the parent and back, the parent's own link goes the other way, the child is navigated twice and the top level once. Three things the script cannot see are read back and agree, on both engines: the presented frame (0x8df9c9b8815a6e22, three consecutive matching captures each, at a stated 640x560 CSS viewport on a 2.0 display), the accessibility projection the host published (the adopted link that ends up in the parent as a Link with a Click action, carrying the child's arena tag under a parent-arena root; the link adopted into the child and navigated away absent from that same revision; a post-navigation revision under a new root carrying the completion heading), and the live-node census of the top arena (31 before, 31 after, across the top-level navigation), with unpinned=14 collected=29 over the run. Two seams were added to make that readable — ortet --a11y-dump, a receipt file beside --artifact, and a live nodes first=/last= line — plus the scripted session's first accessibility projection, which had been None for every scripted document until now. One defect found and fixed: a node could not outlive the realm it was born in — creation_realm preferred the recorded birth realm unconditionally, so re-reflecting a node after the child it came from had been navigated away died with NoSuchRealm; the birth realm is now used only while it is live, and the node's current owner answers otherwise, pinned by a regression with a verified positive control on both engines. Four residuals are named rather than papered over: return-hop reflector identity (the tree returns correctly, the ShadowRoot wrapper and re-reflected nodes do not keep object identity); an external script of a document reached by an in-session top-level navigation is never fetched, though its stylesheet and child frame are; ortet.exe does not always terminate after its event loop exits, on Boa but not Nova; and the compositing lane's digest instability, which this lane characterizes as broader and size-dependent — article.html is stable at 640x400 physical (0xbebd4a74f765263d, four for four) and unstable at 1280x1200, which points at glyph rasterization rather than frame timing and means the article digests recorded by the two previous phases should be read as size-qualified. This lane's own fixture is drawn entirely at 20 px and above with flat fills, so its digest does not inherit that instability.

Realms residual closure (2026-09-13)

The residual closure phase closes external classic scripts on both top and child navigation, the discarded Location's URL/no-op behavior, and resource teardown for retired hosts. Eight new runtime regressions fail before the patch and pass after it on both engines; two bridge tests cover integrity, charset decoding and loader closure. All 841 crate tests pass, including 576 runtime tests, with zero ignored. The seven-directory census gains 37 passes with zero lost passing subtests; the Location file moves 8/46 -> 45/46, leaving ancestorOrigins unimplemented. The default DOM guards hit load-sensitive deadlines, with pre/post controls recorded in the plan; both rendering guards stay green and no expectations are repinned. Ortet's second document now depends on its fetched external script to complete the receipt. Both engines give three captures at the previous digest 0x8df9c9b8815a6e22, live nodes 31 -> 31, and normal exit code 0; both deliberate-failure controls exit 1. Source identities match before and after. The plan and iframe banner now distinguish completed continuation work from the remaining identity, canvas, parser, API and performance work.