# Interaction and Coverage Matrix

Status vocabulary:

- `tested`: exercised against the live deployment without prohibited mutation.
- `source-confirmed`: behavior verified in pinned source but not invoked because
  it starts compute, uploads data, stops work or deletes history.
- `blocked-by-boundary`: a full outcome would violate the audit boundary.

| Surface / control | Trigger and precondition | Visible response | API / data dependency | Operational risk | Coverage and evidence |
| --- | --- | --- | --- | --- | --- |
| Login | Submit password on any unauthenticated path. | Correct: redirect to Gallery. Wrong: inline error, cleared field. | Wrapper `POST /__login`; signed cookie. | Low. | `tested`; screenshots 01–03 and cookie flags. |
| Logout | No visible control; direct POST only. | Redirect to login; cookie deleted. | Wrapper `POST /__logout`. | Low. | HTTP `tested`; UI absence observed. |
| Config display | Load page. | Three read-only rows for orchestrator, grounding and perception. | `GET /models`. | None. | `tested`; screenshot 03. It is not a picker. |
| Upload image | Activate label and choose image; no job/batch active. | Reset, upload, immediately begin job. | `POST /upload`; saved upload; new Job. | Upload + model cost. | UI/source-confirmed; valid upload `blocked-by-boundary`; 20 MiB limit `tested` with 413. |
| Run single case | Click anywhere on a case card; no job/batch active. | Reset, target set, Running status, timer/event polling. | `POST /start`; `/events/{job}`. | Model cost; large accidental click target. | `source-confirmed`; prior case9 canary proves runtime. |
| Select case for batch | Click small `.pick` corner inside card. | Checkmark, green border and count update. | Client `Set`; no API. | Low. | `tested`; screenshot 04. |
| Clear selection | Click Clear. | Selection set and count reset. | Client only. | Low. | `tested`; batch bar incorrectly remains visible. |
| Concurrency mode | Click serial/×n control. | Cycles serial → ×2 → ×5 → ×8 → serial. | Client state sent to `POST /batch`. | High at run time. | Cycle `tested`; screenshot 04 shows ×2. |
| Run selected | Click Run with one or more selections. | Batch strip, chips, lead-job stream and status polling. | `POST /batch`; `GET /batch/{id}`; `/events/{job}`. | Multiple model runs. | `source-confirmed`; execution `blocked-by-boundary`. |
| Follow parallel batch | Batch running with one or more active jobs. | Summary shows done/running; chips show queued/running/complete/error; UI follows one lead job. | Volatile Batch/Job stores. | None beyond running batch. | `source-confirmed`; no live batch during audit. |
| Stop | Running single job or batch. | Button becomes `stopping…`; job control kills CLI process; batch stops queueing. | `POST /stop/{job}` and/or `/batch/{id}/stop`. | Interrupts work. | `source-confirmed`; outcome `blocked-by-boundary`. |
| Resume after refresh | A live job or batch exists when page loads. | UI reattaches, replays event buffer from cursor 0 and resumes polling. | `GET /current`; in-memory stores. | Low. | `source-confirmed`; `/current` was empty. |
| Database open | Click Database. | Full overlay, loading placeholder, then flat archived grid or empty message. | `GET /db`; archive files. | Low. | `tested`; screenshots 05 and 16. |
| Archived card compare | Click card body. | Fullscreen target ↔ render; Database remains underneath. | Archived artifact URLs from `/db`. | Low. | `tested`; screenshot 06. |
| Archived card Debug | Hover card, click magnifier. | BBox overlay above Database. | `GET /debug/{base case}` plus raw current artifacts. | CPU/browser inspect. | `tested`; screenshots 07–09. Important: uses newest live workspace, not selected archive id. |
| Archived card Pipeline | Hover card, click film icon. | Grounding and epoch cards above Database. | `GET /timeline/{base case}`. | Low. | `tested`; screenshots 10–11. Important: uses newest live workspace, not selected archive id. |
| Archived card Delete | Hover card, click bin, confirm. | Archive directory removed and grid/count reloaded. | `DELETE /db/{case~n}`. | Destructive; no undo. | Affordance/source-confirmed; deletion `blocked-by-boundary`. |
| Debug mode: HTML | Open Debug with completed live workspace. | Render plus exact DOM boxes/list and client-recomputed summary. | `/debug`, `code.html`, grounding assets, events. | CPU inspect. | `tested`; screenshot 07. |
| Debug mode: Image | Click Image bbox. | Target plus grounded text/asset boxes/list. | `/debug` image list. | Low. | `tested`; screenshot 08. |
| Debug mode: Strategy | Click Strategy. | Target plus used crop/inpaint assets and thumbnails. | Client recomputation from code/assets/events. | Low. | `tested`; screenshot 09. |
| Debug labels | Toggle Labels. | Box labels appear/disappear; boxes remain. | Client only. | Low. | DOM/source-confirmed; visual default captured. |
| Debug box/list linkage | Hover/click box or row. | Matching item gets hot style and scrolls into view. | Client only. | Low. | DOM/source-confirmed. |
| Debug missing artifact | Invoke for an unrun case. | Toolbar error, empty body and broken base image. | `GET /debug/{case}` → 404 JSON. | Low. | `tested`; screenshot 19. |
| Pipeline open | Current case or archived-card base exists. | Grounding/epochs or explicit no-epoch state. | `GET /timeline/{base case}`. | Low. | `tested`; screenshots 10, 11 and 18. |
| Epoch detail scroll | Scroll within epoch card. | Spatial list then visual question bank. | Timeline epoch metadata. | Low. | `tested`; screenshots 10 and 11. |
| Pipeline frame compare | Click a grounding/epoch thumbnail. | Fullscreen frame ↔ target above Pipeline. | Artifact image URLs. | Low. | `tested`; overlay state recorded. |
| Fullscreen sync scroll | Scroll either pane with Sync checked. | Other pane mirrors proportional vertical position. | Client scroll handler. | Low. | DOM/source-confirmed; comparison captured. |
| Fullscreen fit width | Toggle Fit width. | Adds/removes `fit` class on both panes. | Client only. | Low. | DOM/source-confirmed; image often already fills pane. |
| Close buttons | Click visible Close. | Closes only the named overlay. | Client only. | Low. | Source/DOM-confirmed. |
| Escape | Press Escape with layered overlays. | Can close multiple layers in one key event because independent listeners observe updated hidden state. | Client only. | Context loss. | `tested`; Debug+DB both closed; Compare+Pipeline both closed. |
| Safe invalid case | Call existing client start function with nonexistent id. | ERROR badge and one stream line; no job created. | `POST /start` → 404. | None. | `tested`; screenshot 15. |

## Coverage Conclusion

All primary visible controls have a tested, source-confirmed or explicitly
blocked outcome. The only intentionally unexecuted outcomes are valid upload,
single run, batch run, stop and delete, because each crosses the agreed compute,
upload or destructive boundary. The prior case9 canary supplies real completed
run evidence for the screens that depend on those outcomes.