ghostty-rs/docs/rewrite/notes/review-rv6-codex.md

Codex final verification (RV6, 2026-10-12)

Verified 847a16f65c88, read-only. 12 of 13 RV5 rows are resolved; crash handling remains partial. All 10 previous sweep findings are resolved. Six additional gap groups remain.

“Resolved” below refers to the reported defect, not complete parity of the entire module. Paths abbreviate crates/ghostty-<crate>/src/ as <crate>/.

RV5 row	Status	Current-code verification
Surface.zig	Resolved	Screen-file copy/paste preserve pathname bytes. os::open accepts &OsStr; regex links encode plain text, while OSC8 links retain raw bytes. binding.rs:630, open.rs:33
renderer/shadertoy.zig	Resolved	Plain-array reconstruction preserves padded uniform layout and whole-array use. shadertoy.rs:265
cli/args.zig	Resolved	Windows conversions use WTF-8/WTF-16 and preserve lone surrogates; literal escape characters round-trip. osbytes.rs:74
config/Config.zig	Resolved	Template creation decodes paths; substitution uses original bytes. config.rs:3953
apprt/gtk/class/surface.zig	Resolved	Confirmation decodes only explicitly encoded byte pastes. surface.rs:2680
os/resourcesdir.zig	Resolved	Windows resource exports decode through to_os(); TERMINFO uses an OS pathname. exec_windows.rs:604
config/path.zig	Resolved	Custom-shader paths become decoded PathBufs before loading. generic.rs:248
cli/list_themes.zig	Resolved	Hyperlinks percent-encode decoded pathname bytes. list_themes.rs:74
lib/allocator.zig	Resolved	Color records use parser auxiliary storage backed by the caller’s allocator. X11 lookup no longer allocates. color.rs:85
terminal/c/osc.zig	Resolved	C parser supplies caller-allocated auxiliary storage; growth and allocation refusal are handled there. osc.rs:82
crash/sentry.zig	Partial	Suspension is now balanced before returning; SIGABRT handoff exists. Remaining defects detailed below.
tripwire.zig	Resolved	CopyMap failure injection and cleanup/recovery are implemented. screen.rs:2619
build/GhosttyLibVt.zig	Resolved	Linker emits the versioned SONAME. Existing ELF reports libghostty-vt.so.0. build.rs:23

The remaining crash gap group has two concrete defects:

• SIGABRT receive failures are treated as success. request_abort_dump ignores the timed mach_msg receive result and unconditionally returns true, suppressing the signal-path fallback even on timeout/error. mach_handler.rs:464, signal.rs:257.
• SIGABRT’s signal-number subcode is discarded from the minidump context. from_signal supplies it, but ExceptionInfo.subcode retains subcodes only for EXC_BAD_ACCESS, excluding EXC_SOFTWARE/EXC_SOFT_SIGNAL. The event retains the signal; the minidump exception information does not. mach_handler.rs:511.

Previous sweep finding	Status	Verified boundary
1. GUI Open Config	Resolved	Decoded candidates and file creation: config/edit.rs:24
2. Background image	Resolved	Decode before loading: renderer/generic.rs:863
3. Crash directory	Resolved	XDG path decoded: crash/dir.rs:24
4. SSH cache directory	Resolved	XDG path decoded: cli/ssh_cache/disk_cache.rs:62
5. Executable directory / child PATH	Resolved	Native OS strings on Unix and Windows: termio/exec.rs:1193, exec_windows.rs:866
6. Fontconfig filenames	Resolved	Raw filename passed to face loader: font/deferred_face.rs:75
7. Relative links / OSC8	Resolved	Cwd decoded from bytes; OSC8 URI stays bytes: core/surface/mouse.rs:406, mouse.rs:1617
8. Kitty temporary directory	Resolved	Raw OsString and byte comparisons: terminal/kitty/graphics_image.rs:568
9. macOS .hushlogin	Resolved	Passwd home decoded before lookup: termio/exec.rs:1445
10. Benchmark C arguments	Resolved	Raw argument splitting and PathBuf data paths: lib/benchmark.rs:65

The new sweep found six additional concrete gap groups:

1. Default SHELL loses OS-string fidelity. std::env::var("SHELL") rejects non-UTF-8 paths/lone surrogates. Valid text containing literal U+FDD0 is stored without encoding and subsequently decoded as encoded command text, potentially changing executable bytes. Zig retains the environment bytes. config/config.rs:4621.

2. macOS executable search mishandles PATH. A non-UTF-8 PATH is discarded in favor of the default search path. A literal U+FDD0 sequence in valid UTF-8 PATH can also be wrongly decoded when constructing candidates. termio/command.rs:298.

3. Windows config environment overrides are not decoded. RepeatableStringMap contains encoded strings, but Windows inserts keys and values directly into EnvMap. Literal U+FDD0 and encoded surrogate values therefore reach the child incorrectly. The Unix implementation decodes both. termio/exec_windows.rs:690.

4. Windows environment-key comparison can overwrite a different variable. Lossy conversion makes distinct lone-surrogate keys compare equal; insert then replaces the existing key’s value. ASCII-only uppercasing also misses Windows’ non-ASCII case equivalences. This affects storage, not merely display. os/env.rs:31, env.rs:44.

5. +show-config does not round-trip escaped OS data. Path formatting emits as_encoded(), and stdout writes that UTF-8 unchanged. Reloading encodes the escape characters again. For example, an original pathname byte FF becomes literal U+FDD0/U+00FF after export and reload. config/path.rs:213, cli/show_config.rs:64, config/cli_args.rs:811.

6. Non-Apple C API initialization still lacks locale setup. ghostty_init → global::init_lib reaches the no-op ensure_locale; it never performs Zig’s setlocale and fallback behavior. The standalone GTK executable compensates separately, but the C API does not. os/locale.rs:34, lib/main_c.rs:127.

Other inspected stub markers were implemented elsewhere, unsupported cases shared with Zig, or upstream TODOs—including the unimplemented dynamic/special-color operations.

Verdict: in-scope parity remains partial.

Count	Result
RV5 rows resolved / partial	12 / 1
Previous sweep groups resolved / partial	10 / 0
New OS-data/encoding gap groups	5
New functional-stub gap groups	1
Total remaining verified gap groups, including crash	7
Selected existing-binary tests passed / failed	47 / 0

No rebuild or native macOS/Windows/WASM execution was performed. Findings are source-verified; passing tests cover selected behavior, not exhaustive parity. No files changed; working tree remains clean.