Warm ledger verification

Scope: the W10 acceptance record, amended with the shipped W11/W12/W13 dispositions and the W14 manual/device evidence for the Warm ledger UI review (#369, #392/#393). It records the pinned executable and later evidence heads, automated and manual evidence, the qualitative Material 3 audit, and every remaining limitation. It does not claim a signed Play release; #41 still owns that gate.

The code contract is ADR-0079; the screen/component descriptions are in ui.md; the contribution workflow is design-contribution.md.

Pinned candidate

The documentation and screenshot commits that followed the W10 executable were docs-only at that point; the later W11 and W12 code commits are recorded in the amendment below, not folded into this historical candidate. Screenshots are debug-build captures with the deterministic DEBUG_SEED fixture, not release screenshots. Release builds never include the fixture receiver or the component gallery.

W14 acceptance candidate

W14 re-ran the remaining manual/device cases after the W13/#407 merge. It uses one executable and two device profiles; the automated gate logs are the W13 run at the same code tree.

w14-fold was created from the installed SDK for this run: avdmanager create avd -n w14-fold -k "system-images;android-36;google_apis;x86_64" -d pixel_9_pro_fold. git diff b0cf303 40120ac is CHANGELOG.md only, so the retained W13 gate logs exercise the same code and tests as the merged commit. All manual UI actions used the T3 device_open agent-device command; adb was used only for installs, logs, settings, display dumps and the TalkBack reboot.

W11/W12/W13/W14 amendment

The candidate table and gate log below are the historical W10 record at 49153ee. Later merged/shipped work changed Kotlin, tests and docs after it:

The W12 local gate log is retained in /tmp/opencode/w12-evidence for this run (run-local review artifacts, not committed binaries): the JVM/coverage/lint/ ktlint rerun and first-run flake note, docs/ui/supply-chain/QA-driver guard logs, the native API 36 XML (938 cases, 0 failures), the forced 320x640 API 36 XML (935 pass; only the three documented W08/W09/#407 editor-baseline cases fail), the API 26 smoke XML (15 cases, 0 failures), the release smoke log/PNG/crash log and the API 36 E2E journey/extras logs and captures.

CI at 9df87b0 failed 10 viewport-coordinate cases at 320x640/mdpi (8 Home shell-containment, 2 SectionHeader clearance). The fix keeps the logical 411x914/320x568/411x500 viewports but scales the simulation density so they fit the real physical px window, asserts the simulated viewport maps inside the physical px bounds and that the root keeps its requested logical size, and derives SectionHeader end/start expectations from the measured header root. Focused red/green at 320x640 and native 411 is 14/14; the native 411 full suite is 938/0. The forced local 320x640 full run leaves exactly the pre-existing editor-baseline cases (#407: date field, date picker, filtered reset); those are outside this change and are not among the 10 targeted failures. CI remains the authoritative 320 lane.

W13 (#407) classified the three pre-existing editor-baseline failures with measured evidence instead of asserting they were harmless:

• Two different 320x640 configurations exist. CI creates AVD test with no hardware profile (320x640 px at 160 dpi; status bar 24 px + navigation bar 24 px). The local reproduction used wm size 320x640 && wm density 160 on the Pixel 9 Pro AVD, which keeps that profile's 52 px status bar and 24 px navigation bar — 28 dp less content height. The original three tests pass 3/3 on a locally created bare 320x640 profile (matching CI's 938/0 artifact) and fail 3/3 under the stricter Pixel override, so the override is a stress viewport rather than a CI clone. Both were made green.
• filteredEmptyOffersResetThatClearsQueryAndFiltersTogether renders the real TransactionsContent at a 320x640 dp root. After performTextInput("xyz") the recovery column is taller than its result area, so Reset filters measured y 642..682 in a 640 dp root: clipped to zero bounds. The test's performClick() injected at that off-window point, the event was dropped, and the callbacks stayed query="xyz", direction=null, category=1. Invoking the button's SemanticsActions.OnClick from a fresh state, or dismissing the keyboard and scrolling first, cleared all three together, so the production reset was correct and the failure was the test's unstated "the action is on screen" assumption.
• The two date tests place the editor in a 411 dp-wide box that the 320 dp parent coerces to the window width, and assumed the Date & time row was visible. At 320x640 the row measured y 573..637 below the editor body's scroll viewport (the Save footer is a sibling, not an overlay), so assertIsDisplayed failed and the tap never reached the field (the date-picker test then looked for a dialog that never opened). Scrolling the real editor to the row (y 488..552) restores both the announcement assertion and the picker OK path (OK at x 276..334, partially clipped but clickable).
• The fix is test-only: dismiss the search keyboard where it is up, scroll the existing scrollable owner before acting, and keep every behavioural assertion, including "query AND filters clear together" plus newly asserted chip visibility before and after the tap; no production state, control or layout changed.

The current tree declares 1395 JVM test declarations and 760 instrumented test declarations at the time of this amendment. The first local JVM run at 5bc4d65 hit one unrelated flake in TransactionDetailDraftRecoveryTest.delete_cleansNewlyStagedFilesAndReleasesReservations; it passed alone and the full JVM/coverage/lint/ktlint rerun was green with no source change. The W10 table's 1388/899 counts describe that historical candidate only. Local API 37 remains under the standing before-app-assertion infrastructure exception; CI API 37 is mandatory.

Automated evidence

All commands below were run locally at the pinned candidate unless noted. Logs, JUnit XML and captures are retained in /tmp/opencode/w10-evidence/.

Local API 37 is governed by the standing policy: it may be skipped only when the pinned image fails before app assertions, with the exact head, image and logs. No API 37 attempt was made at the W12 code head 5bc4d65 or final head 18085df; there is no exact-head attempt to claim. W13 did attempt the smoke subset on its branch working tree (based on e04f575, before this evidence commit) and the failure is again before any app assertion: the first install attempt failed and a retry succeeded; two instrumentation runs then produced testRunFailed with INSTRUMENTATION_ABORTED: System has crashed / Instrumentation run failed due to Process crashed and zero executed tests. The emulator exited during the run, and the retained boot log shows cmd: Failure calling service activity: Broken pipe (32) while the system was still starting. The exception rests on the inherited image/host diagnosis:

• Image system-images;android-37.0;google_apis_playstore;x86_64 (Pixel_9_Pro_API_37, API 37.0), emulator 37.2.13.0 build 16740729.
• W10 attempt/retry logs: /tmp/opencode/w10-evidence/api37-smoke.log, api37-smoke-retry.log, api37-emulator.log; W11 logs: /tmp/opencode/w11-evidence/api37-smoke-final.log, api37-emulator-final.log.
• Failure before any app assertion: adb install returned cmd: Can't find service: package/activity; the W11 device then failed to list additional_test_output with Transport endpoint is not connected.
• The host, SDK image path/version, AVD definition and emulator binary are unchanged from those attempts (Linux alienware 7.3.1-pikaos, image revision 7, API 37.0, emulator 37.2.13.0 build 16740729); W13 installed no new image or toolchain. CI API 37 remains mandatory and validates the exact PR head.

Material 3 audit (qualitative scores)

Scores are a qualitative reading of the shipped code and evidence; they are not pass/fail acceptance and do not replace the manual matrix below. Intentional Warm ledger choices count in the score; the score does not ask the app to adopt stock M3 fonts, radii or a spring-only motion system.

Overall qualitative score: 86/100 (sum of the ten rows). The score is intentionally separate from the acceptance disposition: a high score cannot hide a failed or unrun mandatory manual case.

Priority finding dispositions

All twenty-two child findings (#370–#391) have a shipped disposition. The PR column is the merged wave that carried the fix; issue state is GitHub metadata, not evidence of a remaining code gap.

New findings raised by this final matrix (not silently absorbed into a closed issue):

Manual and device acceptance

Device: pinned docs-shots AVD (pixel_7, API 36, build google/sdk_gphone64_x86_64/emu64xa:16/BE2A.250530.026.F3/13894323:userdebug/dev-keys), 1080×2400 px, density 420 (411×914 dp), font scale 1.0, locale en-US, light theme, gesture navigation, TalkBack 16.0.0.738667889 when enabled. Manual actions used the T3 device tools; keyboard injection (where the device command has no key-event primitive) is labelled. W14 added w14-fold (Pixel 9 Pro Fold profile, API 36) for posture and cutout checks; its device metadata, captured frames and a TalkBack log excerpt are in /tmp/opencode/w14-evidence/. Automated tests are listed separately above.

W08/W09 320 dp editor baseline

W09 recorded three temporary transaction-editor failures under a forced 320×640 / 160 dpi display override. This pass reproduces the original three methods, not an unrelated sibling test:

• Tests: TransactionDetailScreenTest#dateFieldAnnouncesTheValueOnceAndNamesTheChangeAction, TransactionDetailScreenTest#datePickerOpensOnTheLoadedTransactionDate, TransactionsContentTest#filteredEmptyOffersResetThatClearsQueryAndFiltersTogether.
• Native baseline on API 36: 3 tests, 0 failures (all three pass; retained XML editor-320-original-native.xml).
• Forced 320×640 / 160 dpi: 3 tests, 3 failures, 0 skipped (retained XML editor-320-original-override.xml). The date row failed assertIsDisplayed; the date picker failed to find its OK node; the original filtered-reset case failed with expected:<[]> but was:<[xyz]> — the query remained after Reset filters.
• Manual check at the same 320×640 viewport: the Date & time row is reachable after one scroll, the date picker opens, and OK is visible at the bottom (date-picker-320.png). That supports a test-viewport explanation for the two date cases only.

W13 disposition (#407). The filtered-reset case was measured, not assumed: under the Pixel-profile 320×640 override the recovery action row measured y 642..682 in a 640 dp root, so the test's un-scrolled click was injected outside the window and dropped; the callbacks stayed query="xyz", direction=null, category=1. Invoking the button's semantics action from a fresh state, or dismissing the keyboard and scrolling first, cleared query and both filters. The same original tests pass 3/3 on a bare 320×640/160 dpi AVD profile (status bar 24 + navigation bar 24), which is what CI boots; the Pixel override is 28 dp shorter and is the stricter reproduction. A manual 320×640 journey on a seeded API 36 device reproduced the filtered-empty screen (query xyz, Expenses + Food chips) and its small scrollable recovery viewport, scrolled to Reset filters, and the tap restored the 14-row month with the query and both chips gone. The date row likewise sits below the editor body's scroll viewport until scrolled. W13 repairs the three tests only (the reset test dismisses the search keyboard and scrolls; the date tests scroll the editor body; every behavioural assertion is kept); production reset/picker code, layout, routes and money are unchanged. W13 gate results on the branch based on e04f575: JVM 1395/0 with lint/ktlint/coverage green, full API 36 938/0 at native 411x914, 938/0 on a bare CI-profile 320x640 AVD, and 938/0 at forced Pixel-profile 320x640, API 26 smoke 15/0, release smoke pass, and E2E seed/journey/extras pass. The repair is merged as

410 at 40120ac; the retained W13 logs are in /tmp/opencode/w13-evidence/.

W14 is the evidence-only follow-up and leaves #393 open for the two remaining manual cases.

Screenshots and fixture metadata

Regenerated with the repository tooling:

bash scripts/generate_screenshots.sh

It built assembleDebug, booted the pinned docs-shots AVD (pixel_7, API 36, 1080×2400, 420 dpi → 411×914 dp, font 1.0, en-US, light, gesture navigation), cleared only the debug package, launched the app, broadcast DEBUG_SEED, entered SysUI demo mode and captured the 11 routes. The run finished with done: 11 PNGs; each capture waited for a rendered, settled frame.

The images are debug, seeded captures: home, transactions, budgets and reports use the demo month; review-queue is the fixed two-row sample. unsaved-changes and transaction-detail contain a focused text field, so their pixels are not byte-stable between runs. Recordings were not regenerated; the tour clips remain historical until the recording workflow runs on a host with ffmpeg and the pinned AVD.

Remaining limitations and #41 handoff

• #393 is not accepted by this pass. W14 closed the foldable-posture gap on an actual foldable AVD, measured the real cutout geometry (including the lock screen) and re-bound TalkBack with observed TTS synthesis requests; the remaining mandatory gaps are a full TalkBack explore-by-touch/focus/action traversal and a visually rendered cutout. #393 therefore stays open for those two items and the #41 handoff must not treat it as accepted.
• RTL money signs were fixed by W11 (2917624, #405); the W12 Home regression re-asserts the money role.
• 200 % Home was fixed by W12 (#406): whole-token statistic columns and a FAB-safe View all action. The full TalkBack traversal and rendered-cutout cases still block #393 acceptance.
• 320 dp filtered reset (#407) was fixed by W13 as a test-harness defect and merged as #410 at 40120ac: the three affected tests now scroll their existing scrollable owner before acting at 320×640, with every behaviour assertion retained. Production reset, date-picker and editor code did not change.
• TalkBack: W14 rebound the service after a reboot and observed touchExplorationEnabled=true, a launch focus ring and real en-US TTS synthesis from a slow injected pan; injected taps still did not drive a reproducible explore-by-touch focus sequence and the spoken text is not exposed by the device tools. A human/physical-device traversal remains the gate.
• Cutout / foldable: W14 passed the foldable posture cases on w14-fold (CLOSED/HALF_OPENED/OPENED; rail vs bottom bar; lock captured). The cutout remains partial: the foldable's framework cutout is real and the lock content clears it, but the emulator framebuffer does not paint the notch, so a rendered-cutout visual needs a physical device.
• Release: the release smoke proves the minified APK installs, launches, resumes and does not crash; it does not prove signed-Play, 16 KB, pre-launch, soak or production gates. Those remain #41's scope.