# Editable wheel lean — verification, 2026-09-15

## Delivered workflow

The user directed the reviewer to show best-guess wheel axes and an editable proxy horizon, then accept corrections in the app. This supersedes the plan's pre-implementation independent-pass gate. Scientific repeatability, paired utility, and coaching validity remain unvalidated; see [lean feasibility](lean-feasibility.md).

P05/P06 have local source-bound draft proposals in ignored `data/`. The app selects the first photo with lean evidence and opens **Wheel lean** mode. Yellow wheel endpoints and cyan reference endpoints are draggable in Single and Compare. A translated reference ray, angle arc, and degree label use the same full-panel coordinate transform. The label stays within the visible canvas; joint markers are independently toggleable.

Dragging previews geometry locally while the evidence report says the edit is pending. Release saves; Escape cancels. Endpoint selection and arrow buttons in the inspector provide keyboard-accessible correction. **Place / replace** uses two clicks for either line. Unknown, missing, degenerate, out-of-panel, or uncertainty-dominated geometry cannot produce a reviewed measurement. **Clear** and **Mark unobservable** preserve the initial proposal separately.

Three reference bases are available:

- **Image vertical:** apparent acute 2D wheel angle; comparison also requires comparable camera roll.
- **Assumed level line:** acute angle from the line's perpendicular, explicitly an assumption rather than calibration.
- **Shared stationary feature:** signed wheel-to-feature orientation, using a shared feature ID and reviewed correspondence. The feature need not be level. Branch ambiguity withholds the result.

Reference review, wheel confirmation, and pair comparability are separate. Any annotation change invalidates pair approval. Undo restores both the annotation and its previous approval. Differences use Rider minus Reference rider and conservative annotation-sensitivity bounds; an interval spanning zero leaves ordering unresolved. User-reported similar speed never enables comparability or a causal explanation. Live lean evidence remains separate from authored coaching's three-point budget.

## Persistence and compatibility

Schema 3 stores lean annotations and pair contexts alongside existing joint reviews. Source hashes, frame/panel binding, coordinates, uncertainty, and orphan records are checked on load/save. Schema 1/2 load with empty defaults; first save preserves the exact old bytes in `.schema1-backup` or `.schema2-backup` under the revision lock before atomic replacement. Backup mismatch or symlink and stale revisions abort replacement. Photo-coaching import and pose retries preserve lean evidence. Older binaries reject schema 3.

For rollback, preserve the current schema-3 review separately before restoring the appropriate older-schema backup with the corresponding older app. The backup does not contain subsequent edits. Never overwrite source photos. All private proposals, saved corrections, screenshots, and evaluation logs remain in ignored local storage.

## Verification evidence

- Geometry tests began with an expected missing-type failure before implementation. Synthetic checks cover upright/diagonal/horizontal axes, endpoint reversal, invalid segments, conservative endpoint perturbations, 0°/90° folding, shared-reference rotation invariance, and branch ambiguity.
- Persistence/eligibility tests began failing before schema/comparison implementation. Checks cover schema-1/2 backups, schema-2 mismatches/symlinks, malformed and foreign evidence, importer preservation, stale approval, shared-feature signed differences under independent image rolls, and mismatched feature IDs/bases. Similar-speed context alone cannot enable a difference.
- Model tests began failing before lean mutation support. The real model/store/canvas chain covers wheel preview versus committed evidence, reference-handle selection, Escape, release, stale targets, interleaved joint/lean Undo, approval restoration, reopen, save conflict, and protected navigation.
- Native Single and Compare inspection confirmed P05's yellow wheel lines, cyan proxy-reference lines, handles, arcs, readable labels, and default draft status. Subsequent native state showed zoomed correction and saves; the user's active editing was left undisturbed. P06 target selection was checked from the full originals and during the earlier native role-label audit. Automated UI tests use synthetic photos.
- Source hash checks verified all four originals unchanged. Existing joint edits, raw detections, authored notes, and comparison contexts were preserved through the real schema-3 upgrade; the schema-2 backup exists. Enum-keyed comparison dictionaries were compared semantically because Swift encodes their order variably.

## Final implementation review

- `scripts/swift.sh test --disable-sandbox`: 52 tests across both bundles, zero failures, two explicit private-input skips.
- `scripts/build-review-app.sh`: native app built and signed successfully. The running review window was not restarted during the user's edits.
- `git diff --check`: passed.
- Simplification checked reuse, clarity, and efficiency; no additional refactor was necessary.
- Code review covered geometry, source binding, migration/backup integrity, comparison invalidation, model state, canvas interaction, SwiftUI bindings, tests, and project rules. The project's main-thread tool mapping was followed: these were sequential self-review passes, with no independent reviewer or cross-model review claimed.
- Actionable findings: none remaining. Verdict: ready for the user-authorized editable draft workflow; general detection and scientific validation remain outside the delivered result.

## Validation limits

The initial proposals are authored source-only guesses; general automatic wheel detection is not implemented or validated. Neither user corrections nor synthetic tests establish physical lean accuracy. No reviewed real-pair utility or rider/coach validation is claimed. Independent evaluation remains available as an opt-in private check, with explicit skips when inputs are absent.