What the PR does. omacom/omarchy#14054 (head 09bfcda4) fixes #14052: an uninstall confirmation left up stayed over the next menu summon, and the Enter meant for the new prompt uninstalled the app. open() now runs cancelDelete() when the confirmation is up, before it opens the prompt or route (Menu.qml:29). The rest of the mirror is proof work (SW-REQ-261002-VJR1, reviews, the fixed known issue, harness inputs) on baseline 49cd12b0, which carries upstream quattro at 393a43d4.
Risk rationale: A one-line guard reusing the dialog's own Cancel path, pinned by a test that fails on the baseline, 57/57 tests passing and a behaviour comparison whose 3 differences are all classified intended. Medium, not low, because 4 prevents_ready disclosures remain (the unapproved compat findings), Menu.qml has no engine-measured code MC/DC, and the fix is not driven through a live shell in this package. Not merge approval.
Read the full review (6 more paragraphs)
Is the fix verified? Audit verdict at the head: pass (run run-d2533687). Test results current: 57 tests, 57 passed, 0 failed, 0 skipped; all 32 changed requirements are observed_pass; 31 obligation cells observed_pass, 17 not_linked (no tagged test). The PR's test passes at the head (10 ok) and fails on the 49cd12b0 Menu.qml (re-run by the reviewer). The 7 behaviour-comparison tests (harness + 6 inputs) passed; a re-run of the 6 inputs reproduces the 3 differences. Code-level MC/DC does not cover Menu.qml, so diffCoverage measures 0 changed decisions.
Compatibility. All four compat sources ran. 4 unapproved findings (prevents_ready): 3 differential (cf-58419914dab2f835, cf-64edcd0cc0114af1, cf-c57a38ab9ab3f83e), classified intended against VJR1: an input, route or select summon over the confirmation; base uninstalls on Enter, head removes nothing. 1 removed_behavior (cf-4d41f5e4cae16ee6): a static check in the out-of-scope proof-of-concept script that pinned the bug. test_diff and mcdc_diff report none. Auditor notes call all 4 acceptable (each recorded 5 times); those are notes, not approvals.
Questions for a human. Approve or reject each compat finding. Does the next key reach the new prompt in a live shell (not run here)? Is dismissing the confirmation wanted for a same-route summon?
Traceability. Every in-scope changed file maps to a requirement (9/9); coherence single; no spec-gap candidates. 30 of 32 requirements are file-level code_changed matches. The fixed known issue is consistent in status, severity and evidence; two poc_quality notes (CNF1; a85e29ab where the baseline is 393a43d4) and one severity justification are stale.
Not caused by this PR. coverage_unmeasured (the .events inputs are data), changed_files_out_of_scope, checks_skipped (13 by configuration) and effects_unavailable (QML) inform only.
Readiness is not_assessed; next decision human_judgement (compat_changes_unapproved), reviewer authority. Nothing here is an approval.
AI-generated review opinion derived from the evidence package. It is not a verdict, does not change readiness, and must be confirmed by a human reviewer.
8 context notes (info — not a finding)
- AI · confirmedUpstream 09bfcda4: a summon now cancels a pending uninstall confirmation before it opens the prompt or route (SW-REQ-261002-VJR1)
open() gains
if (root.deleteConfirmOpen) root.cancelDelete()(Menu.qml:29) before it dispatches to openDmenu() or openRoute(). Before, the only place the confirmation was cleared was onOpenedChanged (Menu.qml:91), and a summon over an open menu keeps opened true, so the dialog stayed up with Uninstall preselected and took the next Enter: the key meant for the new prompt removed the app's desktop file and cancelled the prompt (#14052). cancelDelete() is the dialog's own Cancel path (Menu.qml:860): it removes nothing. VJR1 is new proof work that states the rule; the executable line is the upstream line unchanged. - AI · confirmedSW-REQ-260922-8CQ4 (uninstall confirmation): text unchanged; trace re-review and derived verification state only
8CQ4's clauses are unchanged. Its trace was re-reviewed with citations (requestDeleteSelected, cancelDelete and confirmDelete are byte-identical; a summon now reaches the cancel arm from open()), and its derived verification_state moved from failing to not_started because its only failing signal was the known issue this PR fixes. Proof work, not upstream.
- AI · confirmedThe other 30 changed requirements are file-level matches with trace re-review stamps only
Menu.qml carries a file-level fingerprint, so any edit to it stales every requirement traced to the file. All of them were re-reviewed with citations: only open() changed, and every other function is byte-identical (shifted by 3 lines). Their clauses and FRETish are unchanged (review.changes: code_changed). 50RE (open() dispatch) gains the new requirement in the same
// Implements:line; its dispatch on mode is unchanged. PRNV, CYB9 and 74BZ (route resolution) are traced to Menu.qml by the baseline's own// Implements:line above resolveRoute (Menu.qml:959), so the PR's edit to the file stales them too; resolveRoute and openRoute are untouched by the PR. - AI opinion — unverifiedThe behaviour-comparison harness and its 6 new inputs now have observed outcomes (passed)
The harness test/bdiff/harness.mjs and the 6 seq-delete-confirm-*.events inputs trace to VJR1. The behaviour-diff run executed each input at the base and the head with no harness error, and every difference it found is classified intended, so the package records each as passed (observedBy behavior_diff). The 3 summon inputs witness the summon-over-confirmation row; Enter, Escape and the Cancel button on the dialog itself are the controls and print identical output at base and head. The reviewer re-ran the harness on the 6 inputs against the 49cd12b0 and the head Menu.qml: the 3 summon inputs differ exactly as recorded (base removes firefox and cancels the request; head removes nothing and the request gets its answer) and the 3 controls print identical output.
- AI opinion — unverifiedCompat sources: all four ran; test_diff and mcdc_diff report no finding
review.compat checked test_diff (1 existing test file changed, 0 findings), mcdc_diff (86 decisions at the base, 87 at the head, 0 findings), removed_behavior (1 finding) and differential (219 inputs over 5 partitions, 3 findings). The 4 findings are unapproved; each is argued below. The package listing shows 20 auditor notes: the same acceptable-assessment note recorded 5 times for each of the 4 findings. They are notes for the maintainers, not approvals.
- AI opinion — unverifiedDisclosure changed_files_out_of_scope: the proof-of-concept script is outside the verification scope (informational)
pocs/menu-qml-static.sh is listed under review.codeChanges.outOfScopeFiles; review.codeChanges maps 9/9 in-scope changed files and no changed file is unmapped. coverage_unmeasured (informs) names the 6 new .events inputs: they are data for the behaviour comparison, not code with lines to cover.
- AI opinion — unverifiedAnalysis bounds: no change-effects analysis for QML
review.effects is absent (disclosure effects_unavailable), so call-path statements here come from reading the code. The test and the harness replay the real Menu.qml and ConfirmDialog.qml functions under node vm.
- AI opinion — unverifiedMirror composition: upstream change vs proof work
Evaluated 15d3c8b2 = proof baseline 49cd12b0 + b8938c42 (upstream 09bfcda4: the 3-line hunk in Menu.qml and the new test; its diff is line-for-line identical to the upstream PR diff, re-checked against
gh pr diff) + proof work (VJR1 and its variables, spec conformance review REVIEW-261002-MV7M, evidence-backed trace re-reviews of the Menu.qml requirements, KI-MENU-OPEN-LEAVES-CONFIRM marked fixed with the PR's test as its in-suite reproducer, the static-check removal, the harness key events and 6 inputs, 9 annotation lines in the test that exist only on the mirror, known-issue evidence re-stamped and history entries put in time order after the replay) + an empty record commit. This round the mirror was rebuilt on 49cd12b0, which merges upstreamquattroat 393a43d4 (#6951: bin/omarchy-upgrade-to-quattro and its test) and adds baseline proof work (the theme remover and the app library enter the verification scope, SW-REQ-261003-C9GM with test/shell.d/menu-app-library-test.sh, KI-MENU-REMOVE-THEME-NO-THEMES). None of it touches Menu.qml, ConfirmDialog.qml, the harness or the proof-of-concept script; the mirror's own delta against its baseline is identical to the previous round's except re-stamped evidence (revisions, timestamps, content hashes) and the new history entries. Against 49cd12b0 the only product file that changes is Menu.qml (the hunk plus the// Implements:line). Audit verdict at the head: pass (178 checks passed, 13 skipped by configuration, 28 not applicable); 57 tests, 57 passed, 0 failed, 0 skipped.