Model and limits¶
AccessibilityFrame::new checks finite top-left local logical rectangles. Origins,
extents and far edges are within +/-16384; width/height are positive. AppKit derives
screen frames from the actual attached view/window, including original flipped
coordinates. Consumers supply actual geometry; page CSS/transforms/device scale
are not guessed. The example obtains bounded rectangles from its own trusted page.
AccessibilityNode::new copies a nonzero u64 ID,1..1024-byte UTF-8 label, frame,
enabled/hidden availability and AccessibilityKind. Static text owns0..4096-byte
text; button has no value; slider owns finite minimum/value/maximum/increment,
with minimum <= value <= maximum and increment >0. Slider steps are consumer-owned;
the native companion sends discrete intent and never silently clamps host values.
Labels/text cannot contain NUL. Visible disabled nodes remain readable but refuse
actions. Hidden nodes are excluded from native child/navigation order.
AccessibilitySnapshot::new checks1..64 distinct nodes and at most65536 combined
panel-label/node-label/static-text UTF-8 bytes, then copies them. Its optional
focused ID must name an enabled/unhidden button or slider. It reports consumer
focus; it does not move OS/page focus or make a window key. The model is flat;
tree/table/editable-text/range selection and arbitrary native roles are excluded.
Construction and publication allocate on UI/worker threads, never on audio.
The declared bounds do not bound AppKit/WebKit/global layout or allocator work,
notification delivery or elapsed time; general process allocation failure is not
a recoverable result guarantee.