Resolve exact source-glyph UNORM conversion mismatch on Intel macOS #363

Resolved in published preview.67 under the owner's narrow conversion exception. Original diagnostics and decision history follow.

Release blocker for #360 / #361.

On exact producer 06e2db5ae0bd9d2057b5d83a34b6539e48609f94, the Intel macOS native job fails the original Microsoft sheared-glyph reference. The Apple Paravirtual Metal device produces red 252 instead of 253 at pixel (40,28), in both cold and warm frames. Exactly one byte differs in the original 16,384-byte frame. Source scene hash a348801418647002, 3,480 bytes, matches the passing physical M3 ARM64 and Rosetta x64 observations. Original input, reference captures and zero-difference assertions remain unchanged.

The independent raw WebGPU diagnostic isolates this from source geometry: original coverage 112867 / 113984 is observed as float 0.9902004; straight-alpha blending, direct RGBA8 output and premultiplied blending all store 252 on the hosted device. Explicit diagnostic byte conversion produces 253, matching the original reference. The same diagnostic on physical M3 stores 253 in all four paths. This demonstrates a render-target conversion difference, not evidence that prequantizing product coverage or changing paint/blend ordering is valid.

Acceptance:

• Preserve the original Microsoft full-frame references, source scene identity, both contour windings, opacity layers, and cold/warm checks.
• Implement the owner-approved bounded conversion exception with independent GPU evidence and rejection controls; preserve original product rendering.
• Verify both native providers and affected managed shader paths, including fractional coverage, brush/state opacity, gradients and overlapping composition.
• Pass the original Intel macOS job and all package/application gates in a whole successful producer Build.

An independently passing physical M3 or Rosetta run does not qualify this failing hosted device. No product rounding change has been made from this diagnostic alone.

Current producer and release decision

Exact Build at 8b9802b4dbb77a00e2865b86d334c23c691c03f8 reproduces the same original one-byte difference in cold and warm frames: source hash a348801418647002, 3,480 bytes, red 252 versus 253 at (40,28), all other 16,383 bytes identical. Its independent diagnostic again reports float 0.9902004; straight/direct/premultiplied UNORM store 252, explicit diagnostic conversion stores 253. The Intel native suite is 46 passed / one failed of 47.

The Direct3D 11.3 FLOAT-to-UNORM specification allows 0.6 ULP on the integer side. The original rational coverage gives approximately 252.501096645 on the byte scale, so both observed conversion results fall within that allowance. This is evidence for a narrow documented conversion exception, not permission for a blanket one-byte image tolerance or proof of arbitrary rendering parity.

The owner explicitly approved the documented conversion exception on 2026-10-11: “Allow documented conversion exception.” Implementation and qualification are now in progress.

The approved scope preserves the original Microsoft captures and original scene/font/paint inputs. Only the independently diagnosed conversion at (40,28), and corresponding original contour/opacity cases with independently verified causality, may differ. Every other byte/channel, complete frame, cold/warm result and exact source identity remains checked. Rejection controls must reject additional differences, changed coordinates or source bytes, and missing or inconsistent raw GPU conversion evidence. Each accepted conversion must be logged.

No blanket +/-1 tolerance, product coverage/alpha quantization, blend-order change, skipped native job or claim of exact byte parity is approved. Full producer, package and application CI remains mandatory. #364's Windows repair already passes both hosted native suites and unchanged Basic Render Driver samples; downstream dependency pins await whole-producer success.

First approved-policy hosted result

At c4dfa4e88a889e9e7f9fb16a3938fd7bbb1a4b21, Intel job 114451747122 independently verifies and accepts all four bounded original scenes: both contour windings give red 252 versus 253 at (40,28), and both half-opacity scenes give 126 versus 127 at that same coordinate. Every other 16,383 byte matches, cold and warm. The raw probe is uniform across 256 samples, measures the exact original float, returns 252 for direct/straight/premultiplied conversion, 253 for diagnostic explicit conversion, and independently verifies 126/127 for the two stored-byte half-opacity paths.

The job then reaches a later original DrawGlyphRun comparison and fails. That comparison was previously hidden by the first failing sheared fixture. Its exact pixel gate remains intact; the bounded exception has not been expanded. New diagnostics will report the complete original glyph mismatch inventory and exact serialized failed inputs before the corpus still fails, so the next investigation can classify all affected cases together. Whole-producer success and releases remain pending.

Corresponding original recorder case

The diagnostic Intel job at a880ccfc0 completes the original glyph comparison inventory and reports only frame 8: red 126 versus 127 at (40,28), cold and warm, with every other byte exact. This is the only one of the 278 original Microsoft captures byte-identical to the approved half-opacity capture. All 3,800 hosted source bytes equal the independently captured M3 recorder input (FNV 2965cd6f1f153c10, SHA-256 289211c66da19109d1cc229eb4fa5bee68b213781541093a8388a66f6debcc8b). Its brush, mesh, all 2,688 vertex bytes, opacity and physical-frame payloads are exactly equal to the direct half-opacity scene; the original owner, PUSH/POP_STATE and pixel-center clip flag remain separate and unchanged.

Published c162cd7165a22461d7d1ec8dc8aea0aaa59dc02b adds the corresponding recorder gate with its own complete source snapshot and the same independent conversion proof. It admits the same approved coordinate/value pair only. No other original glyph case or pixel is relaxed. All 49 local native tests pass across both providers, including exhaustive source-byte/other-channel rejection controls for the five original scenes. The new whole Build must now qualify the complete candidate.

Complete Intel native gate passed

Intel job 114458530889 succeeds at c162cd7165a22461d7d1ec8dc8aea0aaa59dc02b, including all 47 native tests, its separate Dawn header test and the complete extended integration. All six native producers and twelve companion workflows succeed. Successful CTest output suppresses individual passing-test diagnostics; the earlier original byte/receipt captures above remain the detailed evidence. The whole Build still fails an unrelated managed package fixture that omitted explicit shader capture metadata. That fixture is corrected at 2f006c16d63aea3a7f8d521ff811f7382fc9184c. Final candidate c99539abac17f9e0cdf4f09f590a2a8330a1d47d also aligns release runtime dependency production with Build and preserves the immutable installed ICU archive; fresh complete Build 38140592436 must pass before release. This issue remains open through final package and release qualification.

Final qualification and publication

Product source 915c0bded45b283163bc85489111b0d74a4d9d44 passed PR Build 38181868576 and default Build 38185119471, 59/59 jobs each, including Intel/ARM64 macOS, both native providers, original managed/package/graphics comparisons and consumers. All 19 original release validation jobs passed in 38185156962. The reviewed packaging-only recovery passed another 59/59 Build.

Preview.67 is now published after successful bounded publication recovery. All 63 public package metadata/provenance checks and all 122 asset hash checks pass. Fresh-cache macOS ARM64 execution of all ten original package-consumer scenarios also passes, with every original entry in the four restored native/backend/SDK packages identical to its qualified archive.

The accepted scope remains exactly the independently diagnosed original coordinate/value pairs and full source guards; no original reference, product rounding, unrelated pixel, native assertion or deadline is changed. This resolves the release blocker under the documented conversion latitude; it does not claim exact byte parity on the hosted Intel device or admission of unsupported application families. Broader work remains in #361.