Corta — Feature Conformance#

Documentation index · Project overview

What Corta must implement, in what order, and how completeness is measured. Priorities:

• P0 — without it the terminal is unusable; vim/tmux/htop visibly break, or programs hang.
• P1 — expected by any modern terminal; needed to be a daily driver.
• P2 — enhancement, deferrable, or explicitly declined.

A note on "features". Coloured git output, SSH and plain tmux are not features. They are consequences of a correct parser and a correct grid. Nothing in this repository is written "for git". Build the primitives; the applications light up on their own.

1. VT Parsing and Screen Model#

1.1 Rendering correctness#

OSC verdict table#

This is the complete deliberate OSC dispatcher surface. OSCCoverageTests compares numeric codes in both directions and tests that removing a row is caught. Unknown codes and unknown sub-forms are silently dropped. “Refused” means no state change and no reply for that sub-form. Security section numbers refer to SECURITY.md.

OSC 21 accepts the same RGB hex specifications as OSC 4/10–12; an empty value or a bare key resets. The protocol's unknown-key echo is deliberately omitted. OSC 22 returns boolean lists or fixed-table names for __current__, __default__, __grabbed__; unknown setters choose default. macOS lacks public wait/progress cursors, so these use the arrow fallback. Link hover takes precedence.

OSC 5522 supports only text writes, under OSC 52's 3072 decoded-byte cap. It does not claim full kitty extended clipboard conformance (64 MiB minimum, MIME aliases, primary selection or paste events). A successful permitted system write receives only the fixed type=write:status=DONE acknowledgement. Reads and unsupported packets are silent, and a bad packet invalidates the whole transaction. allow-clipboard-write is checked by the app before any pending copy reaches the system pasteboard.

Protocol references: iTerm2 extensions, iTerm2 images, kitty colours, kitty pointers, kitty clipboard.

1.2 Query / response sequences#

These are P0 and are the most commonly missed requirement. They are not about rendering: a program that asks a question and receives no answer either waits for a timeout or misdetects the terminal's capabilities.

All four shipped in M6 (M6.5, M6.6, M6.9), plus DSR operating status (ESC [ 5 n → ESC [ 0 n) and DECXCPR (ESC [ ? 6 n), both of which went unanswered until M8. A status query is the one sequence where silence is read as "the terminal is dead", and the programs that wait for it without a timeout wait forever.

DECRQM answers 0 — "not recognised" — for the modes Corta does not track, which is the honest reply and the one that unblocks the probe; the failure mode this table is about is silence, not a negative answer.

A mode reported as supported has to behave. DECRQM's four-state answer is a contract: a program that is told a mode is set lays its next screen out against that behaviour, so answering 1 or 2 for a bit nothing acts on is worse than answering 0. The four modifiable ANSI modes therefore split:

The same rule covers the private modes: DECOM (6), DECAWM (7) and DECTCEM (25) report their live state. Until they were implemented, 7 and 25 answered 3, "permanently set", while ?7l still wrapped and ?25l still drew the cursor — the contract above, broken.

4 is "permanently reset", which is a stronger answer than 0 — a program learns not to ask again.

Colour-space specifications (P2). OSC 10/11/12 accept #RGB through #RRRRGGGGBBBB and rgb:R/G/B. rgbi:, CIELab:, CIEuvY:, CIExyY:, CIEXYZ: and TekHVC: are refused: the sequence is parsed, no colour is changed, and nothing is written back. Each of those is a colour-space conversion needing a white point and a gamma curve — the answer depends on the display profile, so an implementation is either colour-managed properly or it is a wrong number dressed as a right one. Refusing is also the safe direction: a program that sets a colour and sees no change keeps legible text, whereas a mis-converted CIELab black-on-black is a terminal you cannot read. The corresponding esctest cases are recorded as expected failures for this reason (0.1 roadmap), and Performer+Query.parseColorSpecification carries the policy in full.

DECSCL gates DECRQM. A program that announced VT200 with ESC [ 62 ; 0 " p has asked to be talked to as an older terminal, and DECRQM arrived at VT300. Answering anyway is the terminal ignoring what it was told.

Every response is written to the child's stdin. Responses must therefore be fixed-format and never echo attacker-controlled text — see SECURITY.md §2.2.

2. Input, Rendering, Windows#

2.1 Input#

The candidate-UI row is the one whose evidence is incomplete. The code gap was real and is closed, but a live confirmation that Claude Code's slash-command menu accepts Tab inside a built Corta, compared side by side with a reference terminal under an English input source, a CJK source with no marked text and an active composition, has not been collected: the original report's environment cannot be recovered (CHANGELOG 1.0.0). The 2026-09-17 record's A1 items are the closest evidence since.

2.2 Rendering#

Runtime font scaling landed at M3 (⌘= bigger, ⌘- smaller, ⌘0 reset). The glyph atlas is rasterised for one size and scale, so a change rebuilds the renderer and re-fits the window around the unchanged grid. Measured on a 2x display (Menlo): 14pt → 9x17pt cell, 1100x554pt content (120x30 grid); 15pt → 10x18pt cell, 1220x584pt content; the 13pt step was re-measured live (980x524pt) when fixing the ⌘- shadowing below. The stock storyboard's Format menu (font panel, rich-text traits) was removed at the same time: its Font ▸ Smaller item claimed ⌘- first in menu order and routed it to modifyFont:, which a terminal never implements — the shortcut arrived dead. MenuShortcutTests pins the invariant: no keystroke is claimed by two menu items. The cursor uses the configured block, bar or underline shape, with optional blinking (off by default). DECSCUSR can temporarily override shape and blink; parameter 0 and terminal resets return to the configured defaults. Only the visible, focused live pane blinks; once its cursor is idle the blink is handed to a Core Animation opacity animation, so it draws no Metal frame every half second (DESIGN.md §7.10). Inactive, occluded and scrolled-back panes do not blink.

2.3 Windows and sessions#

2.4 Shrinking the screen#

Reducing the row count moves rows off the top, into scrollback, until the cursor fits. Only rows below the cursor — which are blank — come off the bottom. Truncating from the bottom instead destroys the newest output and does not preserve it in history, so making a window smaller silently ate the last commands that ran.

3. The Daily-Driver Checklist#

The operational definition of success from DESIGN.md §8. If all ten hold, Corta has replaced Terminal.app for this repository's own use. Each row names the record that last verified it by hand; an automated suite is listed only where one pins the behaviour afterwards. A row whose record is a roadmap tick has not been re-run since it landed.

4. Measuring Completeness#

Built during M1. Fixing the long tail without these is guesswork.

4.1 Golden-file grid tests#

The primary harness. Feed a recorded byte stream to a TerminalSession, serialise the resulting grid to plain text (characters plus attributes), and diff against a checked-in expectation.

This is how a change to one CSI handler is prevented from silently breaking vim. Written once, useful for the life of the project.

4.2 External suites#

Record the pass rate at each milestone. "Conformance improved" is only meaningful against a previous number.

How the esctest run is done. esctest2 (ThomasDickey/esctest2), run as the child of a live Corta window — it drives the terminal through its own tty, so it has to be the shell:

# A wrapper passed only in the environment of the launch you control.
# Never via `launchctl setenv` (§4.5).
cat > /tmp/corta-esctest.sh <<'EOF'
#!/bin/bash
export TERM=xterm-256color
cd /path/to/esctest2/esctest
python3 esctest.py --expected-terminal xterm --max-vt-level 3 \
  --logfile /tmp/esctest-run.log
exec /bin/zsh -l
EOF
chmod +x /tmp/corta-esctest.sh
SHELL=/tmp/corta-esctest.sh Corta.app/Contents/MacOS/Corta

Results, one row per run. "xterm-compatibility" is passes plus "known bugs" — the number esctest reports and the one comparable across terminals; it is not a pass rate, and every row states all three counts. The failing names of each run are kept in esctest/ so the next run is a diff rather than a re-reading.

1.1.1 (2026-10-03): the empty-Return patch adds real-shell PTY regression coverage and was confirmed in the launched development app after updating the installed integration. Full core and Unit suites passed; esctest2 was not re-run because this patch changes shell hooks rather than terminal escape-sequence handling. Evidence: 1.1.1 release checks.

1.1.5 (2026-10-07): esctest2 re-run on the release tree: 131 passed, 334 known bugs, 102 failed (82.0%); the row above has the per-test difference. The scroll-region-on-resize (#256) and reflow-cursor (#257) fixes have no esctest case; their own core tests and a replay of Claude Code's recorded output cover them. Evidence: 1.1.5 release checks.

1.1.6 (2026-10-07): draws the rounded box corners (╭ ╮ ╰ ╯) as geometry joined to the grid-drawn borders (#264). A renderer change with no escape- sequence handling in it, so esctest2 was not re-run; render tests, the launched app and a Release frame-CPU A/B cover it. Evidence: 1.1.6 release checks.

4.3 Fuzzing#

The parser consumes untrusted bytes and must never crash, hang, or allocate without bound. The harness is the corta-fuzz target in the CortaTerminal package (M6.11); it asserts the SECURITY.md §3 caps on every input rather than waiting for a sanitizer to notice — grid dimensions, the scrollback ring, cursor bounds, row width, the interned grapheme and hyperlink tables, and the size of the response one input can queue.

libFuzzer is not available on macOS with the current toolchain. Xcode 26 ships no libclang_rt.fuzzer_osx.a, and swiftc -sanitize=fuzzer is rejected outright for arm64-apple-macosx — verified, not assumed. What runs instead is a deterministic mutation driver over a checked-in corpus:

swift build --package-path CortaTerminal -c release --product corta-fuzz
CortaTerminal/.build/release/corta-fuzz --fuzz 500000 --seed 1 \
  CortaTerminal/Tests/Fuzz/corpus

It has no coverage feedback, so it explores far less per iteration than libFuzzer would. What it does have is a fixed seed, so a failure is reproducible from the command line that found it. Recorded at M6: 2.5M mutated inputs across seeds 1–5, clean. A separate 100,000-input run under AddressSanitizer (seed 3735928559) was also clean.

The corpus itself replays inside the test suite (FuzzCorpusTests), so a crash found by a long run is fixed by adding its input to CortaTerminal/Tests/Fuzz/corpus — from then on it is a regression test.

Targets beyond the feed (2026-10-08). --target points the same driver at the other inputs a hostile peer controls, each with its own corpus under CortaTerminal/Tests/Fuzz: osc frames every input as one OSC sequence whose code the first byte picks from the ones Corta handles (titles, OSC 4/5/10–12 colours, 7, 8, 52, 104/105, 133, 134); kitty frames it as one APC graphics command, two thirds of them as an o=z transmission whose zlib stream is the input, so the inflate ceiling, header and Adler-32 checks are what it reaches; sftp decodes it as one frame body (SFTPCodec.decodeFrame, the statvfs reply and the length check) and requires every frame that decodes to decode to the same message after encodeFrame. The terminal caps above hold for osc and kitty. SFTPFuzzCorpusTests replays the SFTP corpus in the test suite. PNG decoding is not a target: it is ImageIO behind the app's signature and dimension checks, and the SwiftPM harness cannot reach the app layer.

4.4 App-layer verification requires a launched app#

Offscreen render tests assert pixel coverage: that a cell with a known background produces that colour, that a glyph produces non-background pixels inside its cell. Every one of the following passed those tests and still shipped a blank or unusable window:

• a view whose frame did not track its superview, so most of the grid was drawn outside the visible area,
• glyphs rasterised upside down,
• the grid laid out in points against a pixel coordinate space, so everything rendered at half size on a Retina display,
• a transient window size at startup that the shell laid its early output out against,
• a transient winsize delivered at startup: the first layout ran at the content-rect height (window frame minus titlebar, before .fullSizeContentView took effect) and shrank the session 30 → 28 rows, then grew it back — stranding two blank rows under the prompt while stty size and the render rect both reported the correct 30 (M2 closeout, D.1; first fixed by gating session resizes on the view filling its window's frame, now by creating the window at its final size — DECISIONS.md, "What replaced D15 and D16").

These are properties of the live view hierarchy, of orientation, and of startup ordering — none of which a texture readback can see. Any change under Corta/ is therefore verified by launching the app and checking:

1. the window's content size matches columns x rows x point metrics,
2. stty size in the child agrees with it,
3. a screenshot shows text upright, full size, and filling the window,
4. output longer than the screen scrolls and uses every row,
5. gestures and menu actions reach the pane — the terminal view is first responder, so keyDown fires and First-Responder menu items (⌘V, ⌘=) are not dead,
6. a restored tabbed window (three tabs, one of them split and not selected, quit, relaunch) comes back as one window, tabs in saved order, the saved tab selected, and the background tab's split and stacked icon there before it is first shown — the arrangement whose layout only AppDelegate.restoredWindows and applyPendingRestore drive (D30),
7. in a non-English locale (-AppleLanguages '(zh-Hans)' on the launch), the menu bar is translated, not only the menus beneath it.

The app that gets launched is the development build — the Corta (Dev) scheme, CortaDev.app, bundle identifier dev.noahqin.Corta.dev (D22). It can run beside an installed Corta, so identify the one under test by bundle identifier or by PID; "the frontmost Corta" is ambiguous by design, and a check that reads the wrong window is a check that proves nothing. To run these against a Release build instead, stage it with CORTA_STAGE_DIR.

Secure Keyboard Entry is checked by hand. Shell ▸ Secure Keyboard Entry shows the titlebar lock only while a terminal window is key, and the lock clears when another app comes forward. Test the engaged state without recording input from another application. Historical system-entry-point checks are retained in the dated test-results records below.

Remote workflows (B13/B14) have a launched-app check of their own, CortaUITests/RemoteWorkflowUITests, which is the shape every remote-path change is verified in. CORTA_STAGE_DIR (AppPaths) moves the config file and Application Support under a throwaway directory — $HOME moves neither on macOS — SHELL names a script called ssh standing in for the remote shell (banner, a remote OSC 7, then /bin/sh -i), and CORTA_SFTP_SSH points the SFTP channel at a script that execs the real /usr/libexec/sftp-server. The UI-test runner is sandboxed (it reads all of /, writes only its container, which the app cannot read), so the app builds the stage itself: the test's first launch types stage-remote-ui.sh into an ordinary terminal. The walk: Remote: badge → keystrokes reach the pane → Browse Remote Files… (asked first, host prefilled, nothing spawned before Connect) → a listing answered by OpenSSH's own server → Edit → the "editor" rewrites the managed copy → the upload prompt → the remote file changed with no partial left → the fake shell exiting → badge gone → Reconnect → badge back, keyboard live → the stage removed through the same terminal. Nothing on the machine is changed and no network is used. Its first run found six defects the unit suites had passed over (a spawn that never returned, a write size the server rejected, a SIGPIPE that killed the app, a consent step that auto-connected, an untitled window, a badge that outlived its connection) — which is the argument for running it. What it cannot cover, and a human still judges against a real host: authentication and host keys (there is no ssh in the loop), and how the panes look — they are Metal surfaces the accessibility tree cannot read. SFTPRealServerTests in the CortaSFTP package target drives the same server without the app. The test selects the ABC keyboard layout for its own duration and restores the previous input source afterwards — a CJK input method would otherwise compose every typed line into candidates instead of delivering it to the terminal.

4.4.1 IME verification#

IME behaviour additionally requires driving a real input method in the launched app; no offscreen or in-suite test can do it (DESIGN.md §7.1 — synthetic events with baked characters bypass composition). Procedure used at M3:

1. Launch the app with a wrapper $SHELL that records stty size and ends with exec cat > capture-file (a backgrounded reader is stopped by SIGTTIN; the capture must own the terminal).
2. Select an enabled Chinese input source for the session via TIS (TISSelectInputSource, e.g. com.apple.inputmethod.SCIM.ITABC) and restore the previous source afterwards.
3. Inject key events at HID level (CGEvent.post(tap: .cghidEventTap)) with key codes only — setting a unicode string on the event makes the IME treat it as plain text. Requires the injecting process to be accessibility-trusted; without that grant this is a manual test.
4. Verify: typing pinyin opens a composition (marked text overlay at the cursor, underlined; nothing reaches the child), the candidate window appears under the cursor cell, selecting a candidate writes it to the child as UTF-8, and ⌃C / ⌃D / ⌃Z and the arrows behave identically with and without the IME selected.

4.4.2 Real-program verification (P0)#

Render tests and golden-file grid tests both assert that a byte stream produces a grid. Neither can tell you that vim is usable. The five P0 areas below are behavioural, and every one of them has a failure mode that a passing grid test is compatible with:

Run interactively on the release build (vim ~/.zshrc; tmux split %/" and window switch n/p; htop refresh; less on /var/log/system.log with /search, n, g/G; a CJK file in vim and in a narrow tmux split; a mid-line edit in vim; clear), judged by eye — not something a test target can assert. esctest (§4.2) covers the sequences; this covers the programs.

An earlier run of this table recorded less's search-match highlight (reverse video on a / hit) as never rendering, with the fault not isolated. The 2026-09-17 pass (G29) could not reproduce it: the highlight was visible on the same command. It is not tracked as open; a fresh reproduction with a grid dump of what less sends would reopen it.

4.5 Test fixtures must not outlive the test#

A fixture shell was wired in with launchctl setenv SHELL, which applies to every GUI application the user launches afterwards. Corta then started under zsh -f — no rc files, so no PATH — and a demo banner printed on every launch. Both looked like defects in the terminal.

Pass fixtures in the environment of a launch you control:

SHELL=/path/to/fixture.zsh Corta.app/Contents/MacOS/Corta

Never launchctl setenv, never the user's rc files, never defaults write. Delete the fixture when finished.

4.6 Manual scenario pass#

Run at every milestone, because these are the actual workload:

1. tmux with a split running htop, resize the window
2. Neovim editing a UTF-8 file with mixed CJK and emoji
3. ssh to a remote host, run vim, resize the window
4. A long training run producing continuous output for minutes
5. A Python REPL, paste a multi-line function
6. git log --graph --color through a pager

B01 additions — the real-workflow matrix. The issue asked for zsh, fish, ssh, tmux, Neovim, fzf, CJK input, long output, sleep/wake, restoration and AI CLI applications. zsh/tmux/Neovim/ssh/long-output are items 1–4 above; fzf and fish were covered by the 0.1.1 audit's real-program harness (U10 in the quality plan, which records what it proved and what it could not); it was a one-time verification and was removed in 1.1.0. The remainder, added here rather than to the scriptable harness because none of them are drivable through a PTY alone:

7. CJK input — an actual input source composing (not just CJK text, which item 2 already covers) through a live candidate window. Manual only — DESIGN.md §7.1's verification caveat: synthetic key events carry baked characters, so composition never opens for them.
8. Sleep/wake — the machine actually sleeping and waking with Corta running. Manual only, deliberately not scripted: sleep/wake and low-power mode change machine-wide state other processes depend on, and need a dedicated session on an idle machine, not a CI-style script (D13).
9. Restoration — force-quit or crash Corta with a multi-pane layout and scrollback, relaunch, confirm the arrangement and directories return (U07). Terminal text and running child processes must not return. Partly scriptable: a staged CORTA_STAGE_DIR with restore-windows = true and a written state.json drives the mechanism without touching global machine state — but a human still has to judge whether what came back looks right.
10. An AI CLI application — Claude Code (or a similar TUI-driven AI CLI) run as the child, covering ordinary interactive use including tab-completion and its own keyboard handling. Manual only, and the origin of B02's reported regression — see that issue's entry under §2.1 above; cross-referenced rather than duplicated here.

Items 7, 8 and 10 above have no automated substitute and are recorded with an explicit not judged state when a pass has not actually run one (precedent: the 0.1.1 manual verification's VoiceOver read-through, marked "not judged" rather than silently skipped when the tester could not follow spoken English closely enough to have an opinion). "Not judged" means exactly that — no automated check stands in for it, and no claim of success is made in its place.

4.7 The records#

Up to 1.2.0, every pass of §4.4, §4.4.2 and §4.6 was written up as a dated file under test-results/ — what was checked, what passed, what failed and what was not judged — and those records are preserved at commit f632d59, listed below. Since then a pass is recorded in the pull request or issue it verifies, in the same terms; the tree carries no dated records.

Program status and desktop notifications#

Claude Code is currently the only CLI with a dedicated task-state integration. General protocol parsing and process-name detection do not constitute task-state integration for other CLIs. No Codex, Gemini, pi, Kimi, Grok Build, Qwen, OpenCode or Aider state adapter is shipped.

OSC 7501 replies to probes with the constant OSC 7501 ; ? ST and accepts working/blocked/done/idle/error and clear, per optional bounded id (one main slot plus 32 subtask slots). done is a completed turn; idle is a separate state (including startup and stop). Prompt redraws and ordinary notifications do not change reported task state. Corta's internal unknown is used for process-only detection and OSC 21337 metadata, which do not establish an agent's task state. It is not an extra OSC 7501 wire state. OSC 21337 accepts escaped indicator/status/status-color metadata in a separate bounded slot. It decorates explicit state instead of competing with it; status text fills an empty task title. Native text uses system colours; status-color is retained, not rendered. OSC 9 distinguishes numeric ConEmu subcommands from notification text. OSC 9;4 supplies progress; a bare OSC 9;12 supplies a shell prompt mark. Neither establishes an agent's typed task state. OSC 9;6/9;7 never execute; OSC 9;9 directory reports and other unimplemented ConEmu commands are inert. OSC 777 accepts only notify.

OSC 99 supports title/body/close, bounded chunking and base64, occasion, urgency metadata, focus, expiry and silent/system sounds. Urgency never bypasses the OS's notification policy. The capability reply echoes only a charset-checked query id, as required by the kitty specification. The default kitty occasion is always; other protocols default to hidden panes. Corta coalesces all program notices to one mutable notice per pane. Up to eight unfinished chunked messages are kept, a ninth replacing the oldest; a close is applied to its own id only and never drops another id's notice. An explicit notice delayed beyond coalescing does not re-alert a pane whose current blocked episode was already announced; leaving blocked resets that suppression. BEL and kind changes use the same episode suppression. Fixed attention is cancelled when its wait ends; unrelated program messages are preserved. Visibility/occasion is rechecked before submission, including after OS authorization. OS delivery can occur after that final check.

Unsupported: a=report, c=1 event reports, p=alive, icons (n, g, p=icon) and buttons. These generate no stdin reports. Close requests remove only the pane's matching delivered/pending id; closing one cannot discard a newer pending id or reset a blocked episode. Program-chosen ids never enter click routing; clicks use Corta's pane id, window number and session generation.

ProgramSignalsTests covers byte-split sequences, bad fields/base64, entry and chunk exhaustion/recovery, sanitisation, refused ConEmu actions, progress, capability reply allowlisting and tab-status escaping. Launched-app acceptance also needs a real Claude startup/permission/completion, notification click routing and each explicit channel (iterm2, ghostty, kitty). Process fallback uses process changes, prompt return and exit; an active process alone means Unknown, a clean session end means Idle, and a known failed exit means Failed. OSC notifications and BEL never imply blocked, done or working; no idle timer is added. Accepted OSC 133 command boundaries clear stale children, waiting, progress and tab metadata, even if the CLI never sent clear. A command started on main may end while a crashed CLI leaves the alternate screen active: lifecycle metadata finishes against the parked main grid without switching or marking the alternate canvas. On the alternate screen a D takes effect only when the shell's next prompt A follows it, as every integration script sends them; a stray D printed by a live full-screen program (a log in less -R) leaves its paste and keyboard modes alone. A clean boundary preserves explicit done/error; otherwise it means Idle. Status 130 or a direct session terminated by SIGINT means interrupted/Idle, other known nonzero statuses mean Failed. The next command clears this summary. No shell boundary means no inferred CLI exit. Flood delivery is bounded to 0.2 notices/second/pane after coalescing.

RealClaudeStatusTests is opt-in: set CORTA_REAL_CLAUDE to the installed executable's absolute path and run the core test of that name. It starts the real program under TerminalSession in a fresh temporary configuration and checks that Claude accepts the constant probe reply. It submits no model prompt. It isolates file configuration and removes inherited API/OAuth tokens; it is not an assertion about the CLI's internal keychain access. It does not replace the permission, completion or Notification Center checks above.

CLI signal compatibility#

Development and acceptance version: Claude Code 2.1.310 (Claude Code), native macOS arm64. Dedicated task-state integration: Claude Code only. The adapter was developed against this installed version and exercised with real interactive sessions identifying the terminal as Corta (TERM=xterm-256color). The checked-in capture records the executable's SHA-256 alongside its version. This is a verified reference version, not a promise of compatibility with every Claude Code release.

The native OSC 7501 vocabulary above was checked against that installed version, including a captured idle → working → done turn. The opt-in core test verifies the probe; app fixtures verify state, layout and notification routing. The separate opt-in real-Claude UI acceptance checks background Bash permission, Dock tile screenshots, notification clicks, completion and the three explicit notification channels. See running the acceptance test. That UI test does not establish failure, cancellation or auth-required sessions. RealClaudeLifecycleTests separately exercises real permission cancellation, invalid-model failure, isolated invalid-token auth waiting, an actual Agent subtask id/clear, and abrupt exit back to an integrated shell with the alternate screen still active. These checks are opt-in and billable; their existence is not proof of a pass, and auth recovery remains separate. Newer versions must be checked independently. The vocabulary here is based on the installed CLI and captured output; it is not a claim of an officially documented shared standard or a guarantee for all Claude versions. The following upstream-source and interface references describe candidate integrations, not runtime-tested version ranges or adapters already shipped by Corta. Record exact CLI versions, source revisions and acceptance results in a change's PR when an adapter is added; an untested update is not a verified compatible version.

The official terminal guide and official changelog explicitly describe OSC 7501 support since 2.1.295. That minimum is not a Corta-tested version range. Full wire details below come from the installed 2.1.310 distribution; undocumented fields are not evidence of a defect.

Claude's notification timing is independent of status: permission/elicitation usually waits about six seconds without typing; idle reminders usually wait about 60 seconds, with no running background agent. A notification is not proof of completion. The distribution normally emits BEL-terminated OSC; identification as kitty selects ST. Tests replay both. Its kitty body packet omits d=0, completes the accumulated title/body, and is followed by an empty focus packet; tests assert exactly one resulting notice.

ProgramSignalsTests's distribution-derived wire fixtures are not captured lifecycle sessions. The checked-in, text-redacted claude-2.1.310-signals.json replays actual PTY captures for cancellation, failure, auth waiting, a subtask and abrupt exit, plus actual OSC 9/777/99 idle notices. It retains field order, ids and terminators. Mocked transitions also exercise stop/failure/auth parsing, not Claude's actual execution of those flows. The separate opt-in RealClaudeLifecycleTests runs selected real flows; it does not infer their results from mock transitions. ProgramNotificationTests injects authorization/submission/removal to test cancellation, visibility, retry and late submissions without touching system permissions. The opt-in UI test checks a later idle notification's real text separately from fixed 7501 permission attention, so a fixed notice cannot stand in for a channel. Dock screenshots still require visual review; taking them is not an assertion that the badge or progress is correct. Foreground acceptance and live model lifecycles remain separate checks, not implied by a background unit pass.

A StopFailure or tool-failure hook must not be confused with a normal completion; a failed individual tool can also be recovered within a turn.

Hooks, RPC events and application-internal events are not automatically visible in an ordinary terminal PTY. No tool configuration is installed or changed automatically, and Corta never classifies notification prose as success, failure or permission. Gemini's AfterAgent and Kimi/Qwen's Stop can request retries; observing either hook alone is not proof that automatic processing has stopped.