Harden remote display qualification evidence

[abrichr]

What changed

• refuse unsupported horizontal RDP scroll before any input instead of silently delivering only the vertical component
• classify RDP and pixel-only remote-display text, key, and wheel transport errors as delivery-uncertain after the host input boundary
• test viewport rebaselining after RDP resize and pixel-to-screen remapping after a resize or cross-monitor move, while retaining the exact-frame refusal for geometry changes during one armed action
• require the real Citrix acceptance collector to sign the exact display fingerprint, including viewport, DPI, scale, window mode, and monitor-topology digest
• require session-runner receipts to report zero retries and zero model calls
• add explicit terminal counts for conditions, verified and halted outcomes, silent incorrect success, over-halt, retries, and model calls
• update public claims and backend documentation to state the supported behavior and its evidence limits

Why

The remote backends already supported a new coordinate space after a fresh capture, but the public contract did not say this clearly or test the full between-action resize and cross-monitor case. Some input paths also allowed a host transport error to escape without the typed uncertain-delivery result. The RDP wheel path silently dropped an unsupported horizontal component, which could turn one demonstrated gesture into a different action.

The real Citrix acceptance harness bound a configured display fingerprint, but its independent live collector did not return that display observation on every trial. Its report also did not name all reliability counts required for a deployment decision.

Evidence boundary

This PR does not claim general RDP or Citrix production readiness.

• RDP remains scoped acceptance. The retained real-network result is 3/3 for one Windows 11 Aardwolf task at 1280x800 with an independent guest-tools file oracle. The 27-trial multi-window campaign is synthetic contract evidence.
• Citrix remains code-qualified. The retained no-DOM qualification and public real-ICA preflight do not prove a live ICA/HDX deployment.
• The implementation supports resize and display changes between actions after a new capture. It refuses geometry changes during the exact frame-to-input lease.
• Composite or Workspace multi-monitor behavior still requires counted evidence for the exact deployment.

Customer acceptance still required

A live Citrix acceptance must use the exact Workspace, server, application, account, session, policy, display, and network matrix. It must include at least three counted trials for every configured condition, an independent system-of-record effect oracle, real resize and full-screen cases, every supported monitor topology, reconnect and lock behavior, latency and timeout limits, and the retained failure taxonomy.

Validation

• 4839 passed, 22 skipped in the full non-e2e unit suite (the same invocation the required test job runs)
• 250 passed, 1 skipped in the focused remote-display, RDP, ICA-qualification, claims-validator, and CI-contract suite
• ruff check openadapt_flow, ruff format --check openadapt_flow tests, and mypy passed
• scripts/validate_claims.py --check --structure-only passed
• scripts/validate_claims.py --check --ci-job test --junit runs/unit-claims-junit.xml passed (the new pass-bound claims gate: every cited supported test file appears and passes in the required job's real JUnit result)
• docs/VERIFICATION.md and docs/verification.json regenerate with no drift
• scripts/check_release_consistency.py passed
• public-artifacts.json regenerated with --write-public-artifact-inventory; only the claims.yaml and docs/verification.json hashes moved

Coordination

This branch is rebased onto main at 16c9177, so it now includes:

• ci: bound qualification and browser setup #370 (bounded CI: Playwright install, RDP presentation, AT-SPI qualification, job and step timeouts)
• fix: require passing evidence for supported claims #371 (the claims gate requires that every cited evidence path corresponds to actually-passing JUnit cases; a committed doc can no longer supply pass state)
• ci: bump the actions group across 1 directory with 2 updates #363 (pinned-action bump)

It does not depend on the unmerged admission work in #372. PR #364 also changes generated claims and product-status files; whichever of #364 and this PR merges second must regenerate the claim views and the public artifact inventory.

🤖 Generated with Claude Code