The Settings portal reads appearance exclusively from the compositor's
theme control socket and falls back to defaults when no compositor is
reachable, so the contract test could no longer assert appearance from an
on-disk KDL document.
Add a fixtures/theme_owner.py peer that speaks the theme IPC framing and
publishes schema-v2 snapshots, point the test at a private runtime socket,
and clear WAYLAND_DISPLAY and WAYLAND_SOCKET so the backend cannot reach a
host compositor. Assert the initial values, the SettingChanged payload
after a republish, and that ReadAll matches the published snapshot, then
confirm an invalid local document does not disturb portal-owned
appearance.
Add consent, zones and outside-edge barriers, connection-scoped leases, bounded input queues and keyboard/pointer forwarding. Restore local input on release, locking, topology or keymap changes, receiver loss and emergency escape. Preserve held-key state and distinguish finger stops from absent scroll axes.
Validation: independent review cleared; 5 native InputCapture unit tests; 32 portal tests; official D-Bus contract checks on a private bus; real installed libei receiver interoperability test. Live physical barrier and consent interaction remain to be checked in a desktop session.
Render selected toplevels through a private portal-only capture protocol, preserve logical snapshot geometry, and renegotiate PipeWire video on window resizing. Bound outstanding snapshots and retry temporary contention; stop on source closure and session locking.
Validation: portal unit tests (31), capture budget unit, private-bus portal contracts, and real nested/PipeWire isolation, workspace, resize, close and paused-lock tests pass. Independent review cleared. Monitor restore integration timed out on both this build and the unchanged previous compositor under the current nested host.
Samuel Onoja