I re-checked every claim in this PR against main's source, plus a sample of assertions the body didn't list.

Six documents were genuinely verified, and some of it is excellent work. computer-use-cursor-provenance.md holds to the decimal — all thirty CURSOR_MOTION fields, SCORE_SAMPLES = 33, the five score weights, size:20 / shadowBlur:3 / boundsMargin:23, the glyph tuple, the 1725ms → 2100ms deadline. evidence-classes, host-events-contract, model-loop-foundation and the path/pin portions of provenance and provider-evidence all check out, including the bundled-tools.json commit and sha cited in provider-evidence, which match byte for byte. Scope discipline is clean: the diff is nine frontmatter blocks plus one hunk, no silent rewording.

The problems cluster in the one place the audit claimed a win, and they share a cause: the anchors listed in the body were checked and the surrounding prose was not.

P1 — The one drift fixed is replaced with a claim #4803 explicitly refused

Reachability ①. This is the document's verification contract.

computer-use-foundation-contract.md:129-133 now says the retired broad route inventory is carried by ax-tree-audit.mjs (layer 2) and the Storybook smoke (layer 4) at their owning boundaries. Checked against source: scripts/ax-tree-audit.mjs has exactly one consumer, scripts/storybook-visual-smoke.mjs:25, never runs against Electron, and is a generic rule set (ACTIONABLE_AX_ROLES, NAMED_SCOPE_ROLES) containing no route inventory. The Storybook side is a hand-maintained 29-entry story list, not the retired spec's dynamic enumeration of settings navigation.

More to the point, #4803's own body says the opposite: "Exhaustive menu/page inventory, particular copy, and click-through route sweeps are intentionally retired, not claimed as equivalent coverage … Generic AX auditing is no longer described as equivalent to all seven deleted AX journeys." This PR restores precisely the equivalence #4803 declined to make. A rewrite that swaps one false statement for another leaves the document worse than the drift did, because it now carries a last_verified stamp.

The untouched context line at :126 is caught by the same check: it calls ax-tree-audit.mjs the "Storybook 与 Electron E2E 共用的测试侧 AX 规则源", and no spec under apps/desktop/e2e/ references it.

Say what is true instead: layer 3 is gone, the route inventory was retired rather than relocated, and layer 2 is Storybook-only.

P2 — The same drift is still in computer-use-ui-coverage.md, which this PR marks verified

A miss rather than an introduced error, which is why it sits below the one above.

ui-coverage describes the retired spec in its prose: :61-63 "The Electron accessibility test dynamically enumerates settings navigation, then covers modules, global overlays, conversations and all workbar entry points"; :50 "Every current top-level navigation entry is enumerated from the running UI"; :80-82 "Overlay journeys wait for the specifically named prior dialog to close before opening and auditing the next one." None of that exists — the 19 surviving specs contain no AX audit.

foundation-contract:137 points here for the full inventory, so after this PR the two documents contradict each other. "Documents in the group do not contradict each other" is one of the checks #3522 exists to make, and both documents are in this group.

This is the failure mode worth naming for the remaining audit tracks: checking the anchors you listed is not the same as reading the document.

P2 — translation_status is wrong on all nine

On main, a single-language document with no counterpart takes source-only — 14 occurrences (cli-distribution, code-origin-audit, skill-catalog-policy, windows-support, workspace-privacy-context, permission-onboarding-plan, web-search-provider-capability, the astryx-* set). synced (19 occurrences) is for paired documents, as #3522 states. All nine here are unpaired; eight get synced, and computer-use-foundation-contract.md:8 gets original, a value that appears nowhere else in the repository. (model-metadata-firstscreen-optimization.md is the one synced-without-counterpart outlier — one precedent against fourteen.) All nine should be source-only.

P2 — Two more stale claims the pass didn't reach

• codex-pip-reverse-engineering.md is listed as having "no in-repo anchors to verify". It has at least three, and :251 cites apps/desktop/src/main/__tests__/computer-use-pip-motion.test.ts, deleted by #2478 — offered as the verification route for the physics and anchor scoring, so a reader following it finds nothing. The other two (:198, :238) resolve. Same class of drift the PR fixed elsewhere, in the document declared exempt from checking.
• computer-use-provenance.md:138-140 contradicts its sibling. It still lists "Exact cursor geometry, center hotspot, motion configuration, close-enough thresholds, path measurement, and core scoring weights" as binary-recovered facts informing cursor-engine.ts, present tense, and :127-128 says they "were transcribed into the cursor implementation". But computer-use-cursor-provenance.md:42-45 records that #3293 removed every one of them, and the current hotspot is the glyph tip, not its centre — confirmed in cursor-engine.ts. On a provenance document the standing claim is that proprietary-derived constants are in shipped source; that is the one place a stale statement actually costs something.

P3 — Smaller drifts in documents marked clean

• computer-use-provider-evidence.md:53 says "three evidence classes" and lists four; fault-injection was added without updating the count, and evidence-classes defines four.
• computer-use-foundation-contract.md:91 lists five permission lease classes including pointer mutation. packages/core/src/computer-use.ts:338-341 defines four: metadata_read, screenshot_read, keyboard_mutation, semantic_mutation. No pointer class exists.
• computer-use-foundation-contract.md:269 says 协议里没有窗口管理动词. window_action (move / resize / minimize) is in the strict union, and computer-use-tools.ts:137 uses "moving a window to the left edge of a screen" as its worked example — the exact task the section calls unsolvable. The section reads as a retrospective lesson record and #1952 landed both together, so it is defensible as history; resolving that ambiguity is what a verification pass is for.
• codex-pip-reverse-engineering.md carries implementation_status / document_status: current. main has precedent for historical on snapshots (astryx-full-surface-audit.md, frontend-architecture-astryx-review-2026-08-09.md, settings-astryx-deep-review.zh-CN.md). Its "where Maka does something else" section does describe current behaviour, so current is arguable — which reading did you intend?

What this means for the stamp

last_verified: 2026-09-11 turns a partial pass into standing authority. On six documents it is earned. On ui-coverage, provenance §3 and codex-pip it currently certifies text that is wrong, which makes them less trustworthy after this PR than before it. Worth fixing those three and the translation_status value before the stamps land.

PR 5172 Review

结论

APPROVE
Computer Use 文档组审计：唯一实质 drift（layer 3 指向已退役的 accessibility-coverage.spec.ts）修正且与源码核实一致——该 spec 在 HEAD 不存在，ax-tree-audit.mjs 当前唯一消费者是 storybook-visual-smoke.mjs:25。lease 四类名与 packages/core/src/computer-use.ts:338-341（metadata_read/screenshot_read/keyboard_mutation/semantic_mutation，无 pointer_mutation）一致；"four evidence classes" 与文档内列出的四个 bullet 一致；window_action 已在严格动作集（computer-use.ts:176）；MAKA_CU_AX_MODEL_LAB_ROOT 存在于 scripts/computer-use/lab-root.mjs。其余 8 份文档仅加 frontmatter。

Maka auto review

Requesting one factual correction before merging: the new PiP verification paragraph attributes a change to the cursor replacement that did not change PiP motion. The other reviewed corrections, including the explicit retirement of broad Electron AX route coverage, are supported by the source and #4803's stated tradeoff.

Thanks for correcting the distinction. I rechecked the P2 at 8de10b2a851b87a8016bf775f0f86b52f6982d79: pip-motion.ts has the identical Git blob before and after 047567c4b and at this head (5463c66868cf1eb029d745395a35feabd268c553). Its motion constants are still consumed by pip-window.ts. The revised paragraph now correctly separates retirement of the PiP test from replacement of the agent cursor.

The documentation problem is real, and correcting the existing records is the right scope for #3522. I also rechecked the prior corrections concerning retired Electron AX coverage, the Storybook audit consumer, permission lease classes, and metadata. No remaining actionable P0–P3 findings; no additional abstraction or implementation change is needed.

Current CI passes. This was a source and Git-history review assisted by Codex, not a new native/provider qualification or manual Desktop acceptance run.

The follow-up at 8de10b2a8 resolves the remaining provenance error. I verified from Git objects that pip-motion.ts is byte-identical before 047567c4b, after it, and at this head; the current pip-window.ts still consumes the same spring and throw implementation. The revised paragraph now correctly treats #2478 as ending the deleted unit test's coverage and clearly separates the agent-cursor replacement from the PiP window's unchanged motion model.

The earlier corrections also remain consistent with the current source: broad Electron AX route inventory is recorded as intentionally retired rather than equivalently relocated; the Storybook AX boundary is described accurately; approval and provider evidence class counts match their definitions; the historical window_action passage is scoped in time; and all nine unpaired documents use the repository's source-only metadata convention.

Validation at exact head: GitHub CI passed, git diff --check passed, and all 11 focused AX-rule tests passed. I found no remaining blocking or non-blocking review findings.