fix(identity): prove refs in the coordinates allocation writes

The capture proof looked refs up by native child index while allocation writes positions in the projected tree, so after a walker skipped a sibling a unique ref was published unproven and failed with identity_not_unique. The proof now walks the allocation path through the observation's own child lists, and projection keeps those lists instead of moving them out.

Author: lahfir

crates/core/src/locator/live_locator/observed_tree.rs

@@ -255,7 +255,7 @@ impl ObservedTree {
             .known()
             .cloned()
             .unwrap_or_else(|| "unknown".into());
-        let child_indices = std::mem::take(&mut node.children);
+        let child_indices = node.children.clone();
         let projected = AccessibilityNode {
             ref_id: node.ref_id.take(),
             role,

crates/core/src/refs/ref_capture_proof.rs

@@ -23,7 +23,7 @@ const MASKS: usize = (NATIVE_ID | NAME | DESCRIPTION) as usize + 1;
 /// will count later.
 pub(crate) struct CaptureProof<'a> {
     observed: &'a ObservedTree,
-    paths: OnceLock<HashMap<&'a [usize], usize>>,
+    start: Option<usize>,
     buckets: [OnceLock<HashMap<LiveKey<'a>, usize>>; MASKS],
     unread: Vec<(u8, LivePredicate<'a>)>,
     whole_window: bool,
@@ -36,7 +36,7 @@ impl<'a> CaptureProof<'a> {
         Self {
             observed,
             whole_window,
-            paths: OnceLock::new(),
+            start: observed.roots.first().map(|root| *root as usize),
             buckets: std::array::from_fn(|_| OnceLock::new()),
             unread: observed
                 .nodes
@@ -49,18 +49,49 @@ impl<'a> CaptureProof<'a> {
         }
     }
 
+    /// Starts allocation paths at the node whose observed path is `prefix`, as a
+    /// drill does: the prefix is that node's own path, and the rest of an
+    /// allocation path counts positions in the projected tree below it.
+    pub(crate) fn rooted_at(mut self, prefix: &[usize]) -> Self {
+        self.start = self
+            .observed
+            .nodes
+            .iter()
+            .position(|node| node.path.as_slice() == prefix);
+        self
+    }
+
+    /// Whether `entry`, allocated at `path`, is proven. The path is read the way
+    /// allocation wrote it: the start node's own path, then child positions in
+    /// the projection, which skips no child the observation kept even when the
+    /// native indices have gaps.
     pub(crate) fn proves(&self, entry: &RefEntry, path: &[usize]) -> bool {
-        self.paths
-            .get_or_init(|| {
-                self.observed
-                    .nodes
-                    .iter()
-                    .enumerate()
-                    .map(|(index, node)| (node.path.as_slice(), index))
-                    .collect()
-            })
-            .get(path)
-            .is_some_and(|index| self.proves_node(entry, *index))
+        let Some(mut index) = self.start else {
+            return false;
+        };
+        let Some(prefix) = self
+            .observed
+            .nodes
+            .get(index)
+            .map(|node| node.path.as_slice())
+        else {
+            return false;
+        };
+        let Some(steps) = path.strip_prefix(prefix) else {
+            return false;
+        };
+        for step in steps {
+            match self
+                .observed
+                .nodes
+                .get(index)
+                .and_then(|node| node.children.get(*step))
+            {
+                Some(child) => index = *child as usize,
+                None => return false,
+            }
+        }
+        self.proves_node(entry, index)
     }
 
     /// Whether `entry` was proven unique at the node it was built from: the

crates/core/src/refs/ref_capture_proof_tests.rs

@@ -302,3 +302,41 @@ fn a_published_entry_is_proven_by_its_own_predicate_not_the_preferred_identifier
     assert_eq!(named.matches.len(), 1);
     assert!(named.matches[0].entry.identity.unique_at_capture);
 }
+
+#[test]
+fn a_skipped_native_sibling_does_not_unprove_the_refs_after_it() {
+    let observed = ObservedTree::from_roots(
+        vec![ObservedSubtree::new(
+            evidence("window", "Fixture", Vec::new(), 0),
+            vec![
+                ObservedSubtree::new(
+                    evidence("button", "Cancel", Vec::new(), 1),
+                    Vec::new(),
+                    true,
+                    None,
+                )
+                .with_source_child_index(0),
+                ObservedSubtree::new(
+                    evidence("button", "Save", Vec::new(), 1),
+                    Vec::new(),
+                    true,
+                    None,
+                )
+                .with_source_child_index(2),
+            ],
+            true,
+            None,
+        )],
+        ObservationSource::Window {
+            window: fixture_window(),
+            surface: crate::SnapshotSurface::Window,
+            renderer_accessibility_forced: false,
+        },
+        LocatorStats::default(),
+        true,
+    )
+    .expect("the fixture observes");
+    let root = window(vec![named("button", "Cancel"), named("button", "Save")]);
+
+    assert_eq!(flags(root, &observed), [true, true]);
+}

crates/core/src/snapshot/snapshot_ref.rs

@@ -80,7 +80,8 @@ pub fn run_from_ref_with_context(
         path_prefix,
         observed,
     } = capture;
-    let capture_proof = crate::refs::ref_capture_proof::CaptureProof::new(&observed);
+    let capture_proof =
+        crate::refs::ref_capture_proof::CaptureProof::new(&observed).rooted_at(&path_prefix);
 
     let source_app = entry.source.source_app.as_deref();
     let source_window_id = entry.source.source_window_id.as_deref();