ghostty-rs/docs/rewrite/notes/review-rv18-codex.md

Codex final verification (RV18, 2026-10-12) — final audit round

At HEAD 2040677, all 6 RV17 findings are resolved, with no verified regression attributable to Z20. Full parity is not established: 13 remaining findings—2 P2 and 11 P3. These comprise one incorrect registered claim and twelve unregistered differences, including corrections that should be preserved and documented.

No files were modified; the worktree remains clean.

RV17 verification:

Finding	Result
FreeType-only backend on Apple	Resolved: backend selection honors the feature and disables CoreText/discovery appropriately. Native Apple execution remains unavailable.
CLI feature-unification test	Resolved: assertions follow the selected font backend. Targeted tests pass.
Inspector font	Resolved: 32 px with FreeType on Linux. Remaining platform rasterizer differences are registered.
Inspector DCS descriptions	Resolved against Zig 0.15.2 formatting, including slice syntax and type prefix.
Inspector demo in release builds	Resolved: gated by the build profile instead of assertions.
Metal allocation correction	Resolved: preserved, tested through portable allocation arithmetic, and registered as entry 34.

The remaining verified findings follow. “Source” means the differing branch and consequence were checked in both implementations, without an end-to-end runtime reproduction.

#	Severity	Finding and evidence
1	P2	Deviation entry 10 incorrectly claims Rust handles the listed terminal inputs without panicking. A mode-2027/BOM sequence reaches debug_assert!(!b) in terminal.rs:824. Rust debug exits 101; assertion-enabled Zig aborts. Both production variants succeed. The repository’s release profile also enables this assertion. This is an unresolved shared upstream defect, not a defined-result mismatch.
2	P2	FreeBSD compilation selects an unavailable libc function. command.rs:549 selects libc::__errno_location() for every non-Apple Unix target; the pinned libc exposes __error() on FreeBSD. Source-verified build blocker; no cross-build performed.
3	P3	FreeBSD resource discovery uses Linux conventions. resourcesdir.rs:52 searches terminfo under share; Zig uses site-terminfo and local/share. A standard upstream FreeBSD installation is therefore missed without an explicit resource override. Source.
4	P3	Release resource precedence still treats assertions as Debug mode. resourcesdir.rs:74 makes an installed resource tree override GHOSTTY_RESOURCES_DIR in this repository’s assertion-enabled release profile. Zig ReleaseSafe honors the environment first. Source.
5	P3	Theme-search word editing is incomplete. preview.rs:113 lacks upstream word-navigation behavior. PTY reproduction: enter blue red, press Alt+B, then X; Zig produces blue Xred, Rust blue redX.
6	P3	Theme-search editing splits graphemes. preview.rs:100 deletes one Unicode scalar. PTY reproduction: enter e plus U+0301, then Backspace; Zig removes the grapheme, Rust leaves e.
7	P3	Theme-search case handling differs for non-ASCII names. preview.rs:150 Unicode-lowercases names but ASCII-lowercases queries. An exact query Ä fails against theme name Ä; upstream’s ASCII-only handling matches it. Source.
8	P3	Theme-preview initial colors differ. preview.rs:385 consults COLORFGBG; upstream initializes light until receiving terminal color reports. PTY captures without replies confirmed changing COLORFGBG changes Rust’s colors while Zig’s output remains identical.
9	P3	Theme-preview load errors are swallowed. preview.rs:440 ignores load_file errors and continues filtering with retained configuration. Zig propagates the error and exits the preview. This is separate from registered diagnostic-buffer flushing. Source.
10	P3	Subprocess cleanup silently gives up after approximately five seconds. exec.rs:1348 caps the wait for the child’s new process group. If the child remains delayed before setsid, cleanup returns without sending SIGHUP; Zig keeps waiting. Source.
11	P3	The development resource fallback is unregistered. resourcesdir.rs:140 discovers workspace resources where upstream returns none. This is a documentation/intentional-deviation finding.
12	P3	The PTY hangup output-loss correction is unregistered. exec.rs:742 drains remaining output after HUP; Zig exits immediately. A Linux PTY check confirmed `POLLIN
13	P3	The browser Canvas atlas correction is unregistered. web_canvas.rs:177 implements BGRA conversion, correcting upstream’s stale .rgba branch against an enum containing .bgra. Source-verified correction; preserve and register it. No browser-equivalence claim is made.

The minimal reproduction for finding 1 is:

b"\x1b[?2027la\xef\xbb\xbf\x1b[?2027h\xe4\xb8\xad"

Feed it to the differential drivers at geometry 20 × 8, scrollback 1000.

Verification coverage:

• 461/461 Zig files inventoried and interface-screened across every source category, including 2,801 public declarations, followed by targeted implementation comparisons. This establishes breadth of review, not exhaustive behavioral equivalence.
• 535 fresh CLI/config comparisons: 524 identical; 11 differences covered by registered build-metadata and output-flushing deviations.
• 1,200 fresh terminal cases: 1,187 identical successful results and 13 cases where both assertion-enabled implementations failed; zero defined-result mismatches. The documented 390k campaign was not rerun. Its exclusion of Zig-aborting cases explains why “zero divergences” does not establish the register’s no-panic claim.
• 2,451 successful selected unit tests, plus targeted backend checks. Fixture-writing tests could not run under the read-only restriction.
• Existing three visual scenarios and 36 sprite sheets remain pixel-identical. No new GUI captures were taken.
• 14 GLSL files and 11 VT C headers were byte-identical to upstream.

Inherently unavailable for native verification on this Linux machine: Apple Metal/IOSurface/CoreText, Apple input APIs, Mach handling and Apple packaging; Windows ConPTY/Win32 behavior; native FreeBSD execution. Swift was excluded as requested.

Other verification limits: existing build artifacts were used; no fresh build, live portal/D-Bus integration, real-browser rendering, or native io_uring execution was performed. These are coverage limits, not additional verified gaps.