Chapter 79 Roadmap, Open Gaps, and How to Re-Audit This Book

The ledger now records 60 CNA findings in cnabugs.md: the original 54 implementation, capability, gate and documentation findings plus six alpha.1 release/build contradictions. Nine original findings are fixed in tag source, several are narrowed, one is an explicit architecture decision, and the rest remain open. The dispositions are source-derived rather than a 60-case runtime reproduction, so focused reproduction remains the first upstream step.

High-value starting points have small counterexamples and broad consequences: aliased Matrix::Transpose corrupts Plane::Transform; StorageContainer lacks path containment; the CNJ parser has no depth bound; the main CI workflow cannot configure; several capability queries promise operations their renderer refuses. Each should receive a minimal failing test, a scoped fix, controls on unaffected renderers, and a current evidence record.

The audit list must not become a second stale bug tracker. Once triaged upstream, rows need an issue or commit pointer and a status tied to a reproducer. Findings rejected as intentional behavior should move into the documented-deviation contract rather than disappear.

CNA already exposes 50 identities across 46 families. The next renderer milestone is not a larger count; it is truthful answers from the existing contract. Alpha.1 corrected the recorded HEADLESS/SOFTWARE MRT claims, but WebGPU’s MRT route and several query reports still disagree with their implementation; WebGPU and bgfx overclaim custom effects; several stencil reports remain inverted; DIRECTX10 inherits an unconditional colored extended-draw downgrade.

Build a table-driven capability conformance suite that pairs every true with a usable factory/draw case and every false with a deterministic refusal. Keep capability tests renderer-owned where one configure can exercise them and retain cross-renderer public fixtures as controls. A registry count cannot substitute for this behavioral matrix.

The public compiled-effect constructor and general XNB EffectReader now accept bounded XNA/FNA Direct3D 9 Effect Framework binaries. FNA3D enables the route normally; SDL_GPU, EasyGL and Vulkan require opt-in MojoShader-backed builds. D3D9’s separate stock-source comparison and ShaderEffect’s renderer-specific input remain different routes.

Further work is breadth and conformance: more renderer runtimes, hostile-binary hardening, real-game fixture coverage, and renderer-engaged parity for parameters, techniques, passes, samplers, textures, pass state, SpriteBatch and 3D draws. BGFX and many other families still have no compiled-effect runtime; MGFX, DXBC and source compilation remain out of this constructor’s contract. Do not hide that matrix behind one Boolean.

XNB support is real and substantial. Remaining work includes whole-file size enforcement, named unsupported reader/version policy, LZ4’s explicit deferred status, writer/tooling decisions, and continued hostile-input tests. CNJ needs the same depth/size/fuzz discipline already applied to XNB; its current recursive parser is an obvious first target.

The façade has additional contract work: Unload() disposes nothing, CanDeserializeIntoExistingObject is never consulted, Song/Video can resolve a same-name CNJ they cannot parse, and manifest data is introspection rather than resolution. Fixes should retain the separation between caller-selected asset paths and file-internal reference containment.

The tag closes the old UV-report, required-extension and PBR morph-stride findings and now exposes losses through GltfImportReportEXT. Remaining work is the explicitly bounded GLTF ROBUST matrix: broader renderer consumption of the newer PBR state, real point and spot lights through a shared light ABI, and a wider external-renderer image campaign. KTX2/Basis and WebP without fallback remain unsupported; carried-but-application-owned state and finite vertex-layout ceilings remain documented rather than silently discarded.

Advance one independently generated fixture at a time. Update the manifest, scene digest, semantic golden, runtime/offline parity, and renderer evidence together. Keep the pinned external validator audit distinct from deterministic generator self-checks; alpha.1 contains both, and neither replaces renderer-engaged evidence.

The adapted Android pin needs a fresh graphics build and emulator frame before it receives a current renderer claim. Retain the APK, configure log, logcat, screenshot, ABI/API/NDK identity, and lifecycle trace. Then cover background, foreground, low-memory, termination, asset access through ContentManager, and physical hardware.

The tag’s Apple workflow source contains macOS build/app launch plus iOS device final-link and simulator final-link/install/launch legs with a one-frame marker. Those definitions are stronger than compile-only project files, but this book did not observe a tag run; retain artifacts before promoting them to current execution evidence. Native Metal still needs retained validation, pixels, Retina, and frame-pacing evidence. tvOS remains an explicit non-claim. WebGL1, WebGL2, Canvas and PixiJS need HTTP-served browser verdicts, context-loss coverage, and shader/runtime evidence where applicable.

For Windows, retain the MinGW/Wine route while adding genuine native MSVC evidence where the public support table claims it. Every result must name translation runtime, GPU/software device, display, and prefix. A compatibility-layer pass is valuable and is not a native-Windows pass.

Replace obsolete EASYGL workflow selectors with public identities and make the full Linux and sanitizer legs reach compilation. Update the four post-modularization validator paths, run the Direct2D mutation campaign rather than only anchor dry-run, fix Device filter drift, and decide one authoritative direct-binary-versus-CTest policy for the full suite.

Label all renderer registrations consistently or publish generated selectors that do not depend on labels. Make link-closure evidence generator-independent instead of silently skipping under the project’s own presets. Bring SVG-DOM’s existing browser runner into automation and ensure the release gates, not only their non-release validators, are exercised.

Add code-coverage tooling only with a defined question. Line coverage can identify untouched code but cannot replace oracle authority, mutation sensitivity, or runtime engagement. Keep API-surface “coverage” under a different name so the metrics cannot be confused.

Alpha.1’s optional C API defines shared/static packaging, a version file, exported C headers, and an out-of-tree find_package(CNA CONFIG) consumer gate, but the tag cannot build the library because NanoVG is absent from its C renderer map. First repair that identity closure, add a CI leg that builds the final library and installed consumer, and make the aggregate release checker execute rather than recognize those gates. The broader C++ framework is still designed around sibling add_subdirectory composition and has no complete installed module/renderer SDK. A mature C++ consumer path would need installed module targets, public headers, renderer selection, dependency discovery, product-version compatibility, and its own small out-of-tree consumer test. It must not reuse the native C package’s ABI 0.7.0 as though that were the product or C++ API version.

Packaging work must preserve the one-SDL-instance invariant and optional-module closure. It should not force every renderer dependency onto a consumer that selects one identity or a small compatible runtime set.

Remove or banner claims that CNA cannot read XNB, that WebGL2 or Android graphics is pixel-verified, that the implementation-family count means public identities, or that old source paths still register gates. Generate renderer identity/family tables, reader inventories, workflow summaries, and test-selection tables from the same sources their validators use.

Dated reports may remain for history if their revision and superseding authority are prominent. Comments should explain why; scripts and tests should establish whether. The fastest way to create new drift is to copy a corrected number into five prose files without a derivation.

A future edition should repeat a bounded protocol:

1. 1.

   pin CNA and every cited sibling SHA; record branch divergence and keep them read-only;

2. 2.

   enumerate physical modules, public renderer identities/families, build options, workflows, scripts, test registration paths, content readers, and sample/example catalogs mechanically;

3. 3.

   re-run focused source audits by subsystem and record contradictions separately from defects;

4. 4.

   verify every explicit path and identifier in the manuscript against the pin;

5. 5.

   rebuild the complete book, require clean references/index/stale-term checks, render every changed physical page, and inspect high-risk tables and listings at full size;

6. 6.

   update PLAN.md and NEXT.md with commands, counts, page ranges, visual findings, fixes, and the next bounded batch.

The edition should change when evidence changes, not merely when prose ages. The final lesson of CNA’s own verification culture applies to this book as well: a claim is durable only when a future reader can prove that the intended source, runtime, oracle, and page actually engaged.