What the PR does. omacom/omarchy#14054 (head 09bfcda4) fixes #14052: an uninstall confirmation left up stayed over the next menu summon, and the Enter meant for the new prompt uninstalled the app. open() now runs cancelDelete() when the confirmation is up, before it opens the prompt or route (Menu.qml:29). The rest of the mirror is proof work (SW-REQ-261002-VJR1, reviews, the fixed known issue, harness inputs).
Risk rationale: A one-line guard reusing the dialog's own Cancel path, pinned by a test that fails on the baseline, 56/56 tests passing and a behaviour comparison whose 3 differences are all classified intended. Medium, not low, because 4 prevents_ready disclosures remain (the unapproved compat findings), Menu.qml has no engine-measured code MC/DC, and the fix is not driven through a live shell in this package. Not merge approval.
Read the full review (6 more paragraphs)
Is the fix verified? The audit run is clean (0 errors, 0 warnings). Test results are ingested and current: 56/56 passed; all 29 changed requirements are observed_pass; 30 obligation cells observed_pass, 15 not_linked. The PR's test passes at the head and fails on the baseline Menu.qml (re-run by the reviewer). The behaviour-comparison harness and its 6 new inputs have observed outcomes (passed). Code-level MC/DC does not cover Menu.qml, so diffCoverage measures 0 changed decisions.
Compatibility. All four compat sources ran. 4 unapproved findings (prevents_ready): 3 differential, all classified intended against VJR1 (select, input and route summons over the confirmation: base uninstalls on Enter, head removes nothing and the new request takes the key); 1 removed_behavior, a static check in the out-of-scope proof-of-concept script that pinned the fixed bug. test_diff and mcdc_diff report none.
Questions for a human. Approve or reject each compat finding. Does the next key reach the new prompt in a live shell (not run live here)? Is dismissing the confirmation wanted for a same-route summon?
Traceability. Every in-scope changed file maps to a requirement (9/9). No spec-gap candidates.
Not caused by this PR. coverage_unmeasured (the .events inputs are data), changed_files_out_of_scope, checks_skipped (13 by configuration) and effects_unavailable (QML) inform only.
Readiness is not_assessed; next decision human_judgement (compat_changes_unapproved, 4 changes), reviewer authority. Nothing here is an approval.
AI-generated review opinion derived from the evidence package. It is not a verdict, does not change readiness, and must be confirmed by a human reviewer.
8 context notes (info — not a finding)
- AI · confirmedUpstream 09bfcda4: a summon now cancels a pending uninstall confirmation before it opens the prompt or route (SW-REQ-261002-VJR1)
open() gains
if (root.deleteConfirmOpen) root.cancelDelete()(Menu.qml:29) before it dispatches to openDmenu() or openRoute(). Before, the only place the confirmation was cleared was onOpenedChanged (Menu.qml:91), and a summon over an open menu keeps opened true, so the dialog stayed up with Uninstall preselected and took the next Enter: the key meant for the new prompt removed the app's desktop file and cancelled the prompt (#14052). cancelDelete() is the dialog's own Cancel path (Menu.qml:860): it removes nothing. VJR1 is new proof work that states the rule; the executable line is the upstream line unchanged. - AI · confirmedSW-REQ-260922-8CQ4 (uninstall confirmation): text unchanged; trace re-review and derived verification state only
8CQ4's clauses are unchanged. Its trace was re-reviewed with citations (requestDeleteSelected, cancelDelete and confirmDelete are byte-identical; a summon now reaches the cancel arm from open()), and its derived verification_state moved from failing to not_started because its only failing signal was the known issue this PR fixes. Proof work, not upstream.
- AI · confirmedThe other 27 changed requirements are file-level matches with trace re-review stamps only
Menu.qml carries a file-level fingerprint, so any edit to it stales every requirement traced to the file. All of them were re-reviewed with citations: only open() changed, and every other function is byte-identical (shifted by 3 lines). Their clauses and FRETish are unchanged (review.changes: code_changed). 50RE (open() dispatch) gains the new requirement in the same
// Implements:line; its dispatch on mode is unchanged. - AI opinion — unverifiedThe behaviour-comparison harness and its 6 new inputs now have observed outcomes (passed)
The harness test/bdiff/harness.mjs and the 6 seq-delete-confirm-*.events inputs trace to VJR1. The behaviour-diff run executed each input at the base and the head with no harness error, and every difference it found is classified intended, so the package records each as passed (observedBy behavior_diff). The 3 summon inputs witness the summon-over-confirmation row; Enter, Escape and the Cancel button on the dialog itself are the controls and print identical output at base and head.
- AI opinion — unverifiedCompat sources: all four ran; test_diff and mcdc_diff report no finding
review.compat checked test_diff (0 findings), mcdc_diff (85 decisions at the base, 86 at the head, 0 findings), removed_behavior (1 finding) and differential (219 inputs over 5 partitions, 3 findings). The 4 findings are unapproved; each is argued below.
- AI opinion — unverifiedDisclosure changed_files_out_of_scope: the proof-of-concept script is outside the verification scope (informational)
pocs/menu-qml-static.sh is listed under review.codeChanges.outOfScopeFiles; review.codeChanges maps 9/9 in-scope changed files and no changed file is unmapped. coverage_unmeasured (informs) names the 6 new .events inputs: they are data for the behaviour comparison, not code with lines to cover.
- AI opinion — unverifiedAnalysis bounds: no change-effects analysis for QML
review.effects is absent (disclosure effects_unavailable), so call-path statements here come from reading the code. The test and the harness replay the real Menu.qml and ConfirmDialog.qml functions under node vm.
- AI opinion — unverifiedMirror composition: upstream change vs proof work
Evaluated 5a62332f = baseline quattro-proof 5d4fb9a8 + 9e270c9f (upstream 09bfcda4: the 3-line hunk in Menu.qml and the new test, byte-identical; Menu.qml differs only by the baseline's
// Implements:annotations) + proof work (VJR1 and its variables, spec conformance review REVIEW-261002-MV7M, trace re-reviews, KI-MENU-OPEN-LEAVES-CONFIRM marked fixed, the static-check removal, the harness ops and 6 inputs, mirror-only annotations in the test) + an empty record commit. The audit run is 0 errors / 0 warnings, 56/56 tests passed.