bench(canvas): no-DOM HTML5-canvas vision-ladder qualification (accepted)

[abrichr]

What

Adds benchmark/canvas_ladder/ — the first live proof of the vision-only resolution ladder over a genuine no-accessible-DOM HTML5 <canvas>, the class Citrix Workspace-web presents. Drives the unmodified Recorder → compile_recording → Replayer over a noVNC/TigerVNC canvas with no structural backend, against a Dockerized clinic kiosk (reused from the rdp_ladder fixture, PR #177) + an independent document oracle.

This is Part 1 of the no-DOM/Citrix validation in ~/oa/src/.private/rdp_citrix_validation_2026_07_20.md (§8, the fastest $0 zero-gate canvas proof). Part 2 (a Citrix-Workspace-window pixel backend) is stacked on top.

Honest label

no-DOM HTML5-canvas class — NOT Citrix ICA/HDX. It reproduces the canvas surface class (server-side rendering, compression, scaling, latency, and — the load-bearing part — no accessible DOM inside the canvas) via VNC/noVNC. It has no HDX codecs, no ICA compression, and no Citrix-Workspace-client input path. Real ICA/HDX needs a Citrix entitlement (CVAD/DaaS trial or design partner); we do not fake Citrix evidence.

results.json — accepted: true (three regimes)

Regime	Asserts	Result
healthy	record→compile→replay succeeds, 0 model calls, visual rungs only (template ×3, structural never used), write independently confirmed by the oracle	✅
moderate (legible) drift	resolves to the correct target (ocr+geometry) — never a silent WRONG write (robustness, not over-halt)	✅
severe (illegible) drift	HALTS with no write and no model call — no blind coordinate replay (the anti-silent-wrong-action guarantee)	✅

Together the drift regimes prove the real property: under remote-display drift the system either resolves correctly or halts — it never silently writes the wrong thing; the healthy pass proves it is not merely always-halting.

Why this reaches a clean acceptance where #177 did not

PR #177 (benchmark/rdp_ladder) is a partial contract — its healthy effect was never confirmed (typing did not land through the RDP client focus path), so its "halt under drift" was likely a broken-flow false positive. Here the healthy path genuinely works (Playwright keyboard forwards through noVNC to the Tk field; the oracle confirms MRN A1001\tfollowup in two weeks), so the drift regimes are meaningful.

CI / tests

• Env-gated e2e tests/e2e/test_canvas_nodom_ladder_e2e.py (OAFLOW_CANVAS_LADDER_E2E=1) builds the fixture, runs the harness, asserts accepted.
• Nightly canvas-nodom-ladder workflow (drafted; not a per-PR required gate — it drives a real browser over a VNC round-trip, minutes not seconds).

License posture

Fixture apt-installs noVNC (MPL-2.0) / websockify (LGPL-3) / TigerVNC (GPL-2.0) as external apps run at test time in a repo-only image; nothing is vendored into or shipped by the wheel/sdist (benchmark/ excluded). Consistent with AGENTS.md License Hygiene.

🤖 Generated with Claude Code