harness/release-current-coverage-20260906.md

# Current first-release coverage audit — 2026-09-06

Read-only production audit of `codex/release1-continuation`, HEAD `c091f80`,
including the current uncommitted Home, checkpoint, typed StateAction display and
semantic Annotation/Binding changes. This is a release acceptance map, not a claim
that the current working tree has passed its build or native gates. Root owns those
gates. The original objective was reread from the supplied goal-objective.md.

The objective requires a usable, substantially complete OA/SA engineering tool,
strict graphical/text parity and a deployable REST service. It does not require
every Capella implementation class, LA/PA/deployment, execution, or native Capella
file compatibility. The current scope's explicitly unfinished requirements cannot
be silently reclassified as future work to obtain a release claim.

## Evidence rules and reconciliation

**Implemented** means a current typed contract and reachable code path exist.
**Verified** below identifies the actual bounded historical/native evidence; it
does not transfer an old executable's acceptance to changed production code.
**Missing** means a concrete code/contract/workflow gap, rather than an untested
feature being called absent. No new Cargo or native execution was performed here.

The direct scenario/process/state branches are already incorporated in this
baseline; see release-branch-integration-20260906.md. Earlier notes saying these
surfaces are static/unimplemented are historical. The initial
release-semantics-audit.md R1–R6 findings are largely implemented now. Its selective
view and completeness-diagnostic recommendations remain materially open.

## Measurable acceptance table

| Engineering outcome | Implemented now | Verified evidence and remaining acceptance |
|---|---|---|
| OA responsibility and SA boundary modeling | Entities/actors/roles, independent work decomposition, leaf allocation, role assignment/realization; one SA System and external actors; nesting/summary distinction | Existing core/source/API and architecture native evidence. Final worked OA→SA fixture must preserve identities, allocations, independent semantic parents and view placements through save/reopen and undo. No new LA/PA structure is needed. |
| Missions and capabilities | OA/SA missions, participation, exploitation, capability involvement, include/extend/generalization with validation | R2 is implemented; do not reopen it as an absent concept. Final native proof should create the same mission map in each layer, reuse an included capability, reject a cycle and retain an incomplete extension condition as a warning. |
| OA entity communication means | Activity Interaction exists. Legacy OA ports plus BoundaryExchange and ExchangeAllocation→Interaction can preserve an approximation | **Missing ordinary authoring and an accurate OA semantic contract.** Capella's entity-level CommunicationMean is absent. New Port creation redirects users to SA typed port actions; OA permits only Legacy. Existing allocation support must be preserved, not called SA-only. See task 1. |
| SA boundary/data contracts | Typed input/output and component ports, item declarations, allocation, provided/required interfaces, protocols; data nature/mechanism, bounds/defaults, record/enum/inheritance/association and qualified message values | release-data-verification.md records Windows normal/compact advanced field work and Linux default bounds/recursive-field save/reopen. Linux association/protocol allocation and minimum layout remain unverified. Use the same fixtures to exercise data defaults, item inheritance and typed boundary allocation in desktop/source/REST. |
| Process/functional-chain contextual behavior | Direct creation/insertion, work/exchange contributions, Choice/Merge, Fork/Join, Loop, same-context links/guards, reconnect and sequence reuse | release-process-editing.md: Linux simple guarded insertion, Windows camera/owner behavior. The compact pending-form fix still needs native acceptance. Test one OA branched process and one SA chain with parallel/control/reuse contributions, reconnect/cancel, first-exchange insertion, repeated referenced work, undo/save/native reopen. Do not duplicate global work/exchange definitions. |
| Scenario authoring | Direct messages at captured sequence/operand slots, call/reply correlation, ordered occurrences, actions/timers/state observations, ALT/PAR/LOOP/OPT and bound reuse | release-scenario-editing.md: Windows ALT/default+minimum, order rejection and viewport preservation; Linux middle call/reply and save/reopen. Linux compact ALT/reuse/reorder/cancel and an operational-entity scenario remain a bounded acceptance set. New-selection auto-reveal is absent but is a usability improvement, not absent scenario semantics. |
| Modes/states and typed actions | Persisted state views, nesting/folding, state kinds/pseudostates, direct edges/reconnect, typed events and external/local/internal distinction. Current changes render/select typed Entry/Do/Exit actions without fabricating work containment | release-state-editing.md has scoped Windows/Linux acceptance. Current action rows/header changes await root's build/native checks: select all three phases, coexist with internal transition and nested region, fold, rename target, save/reopen. Linux minimum view and representative typed-event/local-transition paths still need coverage. |
| Readable saved engineering views | Multiple projection views, placements, nesting/folding, manual routes/labels and computed summary edges | **Missing persisted selective relation/category/coverage views.** Diagram currently stores only id/alias/name/description/layer/projection/nodes/routes. No named exchange category exists. Test two saved views of the same crowded model with different filters and identical semantic identities; see task 2. |
| Engineering completeness feedback | Unallocated leaf, unsupported capability, missing System, sequence/message/binding/trigger and interface-contract warnings already exist | **Missing** exchange-on-non-leaf and behavioral-context coverage diagnostics, plus mission-without-capability coverage. An allocated leaf with no process/scenario can currently look complete. Add actionable nonblocking warnings and navigable coverage; see task 3. Do not reimplement interface warnings already in ports.rs. |
| Bidirectional counterpart review | Source-v5 semantic facts, structural/scalar/constructor/member reconciliation, mapped references and historical decisions. Current Annotation/Binding row and recovery adapters present | Known open work remains ordered/attached/artifact/multi-source GUI facets, current-tree tests and native constructor/keyed-row acceptance. This audit does not duplicate that assigned slice. Literal expressions and candidate-parent lifeline choices had verified review findings, now fixed with tests awaiting integration. |
| Source/API/artifact equivalence | Normative language.rst v5; exact accepted multi-file source, identity/trivia-preserving updates, strict JSON/migration, artifacts, syntax/lint tooling and shared command validation; hosted REST transactions/source/model routes | Prior workspace, real HTTP/OpenAPI and migration evidence is recorded in STATE.md and data/semantic ledgers. Every *new* persisted category/filter/communication construct needs GUI edits, source+JSON roundtrip, REST create/edit/reject/reidentify/delete, unchanged state on reject, and restart persistence. Final gate must run on the actual integrated revision, including stale ETag and invalid-local-open destination isolation. |
| Learnability and safe reopening | Searchable offline help already exists. Current Home/recents, accepted-bundle/raw-draft checkpoints and explicit detached restore changes are present | Current Home/recovery is root-owned work, not accepted solely from code. **Documentation drift is verified:** scope.md says arcadia4 and names/descriptions-only review; guide.rs says existing counterpart review is prose-only and no unsaved recovery exists. Final instructions must match actual controls and accepted recovery semantics; see task 4. |

## Prioritized next release tasks beyond already assigned review/recovery

### 1. Close ordinary OA communication-means authoring (P1)

Capella defines CommunicationMean as communication between operational entities,
with entity endpoints, rather than SA function ports. This is a real OA need
observed in the installed Capella OAB palette and defined in the authoritative
[OperationalAnalysis schema](https://raw.githubusercontent.com/eclipse-capella/capella/master/m2/plugins/org.polarsys.capella.core.data.def/model/OperationalAnalysis.ecore).

Current seams: `model.rs::RelationBody/RelationKind`,
`validation.rs::validate_relation`, `ports.rs::validate_port` and
`validate_exchange_allocation`, `app.rs::add_element`, and
`workflow.rs::Relationship`. The current core accepts Interaction allocation,
but all OA ports are compatibility-only and warnings ask for typed SA resolution,
which is impossible in OA. `language.rst`'s allocation table incorrectly says
SA-only. A preserved legacy representation is not a usable new-project workflow.

Freeze a small explicit contract first: named OA participant-to-participant
communication carrying items and allocating operational Interactions, with
same-layer ownership/performer validation. A direct CommunicationMean relation is
one candidate; extending BoundaryExchange with explicit endpoint semantics is
another. Avoid making OA engineers create fictitious typed SA ports. Preserve
legacy input as legacy and never infer conversion from names.

Acceptance: start with an empty OA project; create two entities, their allocated
activities, an Interaction and a named communication means; allocate the
Interaction, edit carried items, navigate both levels, reject wrong-performer
allocation; save/reopen, undo/reidentify/delete safely and exercise equivalent
source/REST. Review its mapped SA boundary counterpart explicitly. This is a
bounded addition, not a demand to duplicate every OA package/configuration class.

### 2. Persist selective views and named exchange sets (P2, release usability)

Arcadia explicitly recommends representational synthesis and exchange categories;
Capella supports named categories with multiple exchange members. See the
[Arcadia Q&A on leaf functions and exchange synthesis](https://mbse-capella.org/arcadia-qna.html)
and [FunctionalAnalysis category definition](https://raw.githubusercontent.com/eclipse-capella/capella/master/m2/plugins/org.polarsys.capella.core.data.def/model/FunctionalAnalysis.ecore).
This directly addresses the user's clutter complaint and remains explicitly
unfinished in scope.md. Existing view projections/folding do not supply a saved
selection among multiple exchanges between the same visible endpoints.

Bound the slice to named same-layer exchange sets, per-diagram relation-kind and
set membership filters, and a coverage view/filter for selected capability or
behavior context. Define combination semantics explicitly. Start with original
edges; optional aggregate rendering must expose its actual members and may never
create fake semantic exchanges. No hierarchical category subsystem is necessary.

Seams: `model.rs::Diagram/ProjectionKind`, projection edge selection, typed forms,
source syntax/writer/updater, schema/API and reference lifecycle. Acceptance:
one interaction belongs to two named sets; two views show distinct subsets;
filtering hides no semantic content and deleting a set preserves its exchanges;
placement/route identities survive toggling; source/API/GUI persist identical
filter definitions and all members remain navigable.

### 3. Add bounded engineering completeness checks (P2)

The official Arcadia Q&A states that finalized behavior belongs on leaf functions
and ideally each leaf and exchange participates in a chain or scenario. This is
method guidance, so incomplete drafts must remain saveable. Current validation
already enforces leaf allocation and many local contracts; do not turn this slice
into a new general rules engine.

Add located advisory checks for (a) work with children carrying an Interaction/FE,
(b) leaf work/exchanges not involved in a process/chain/scenario, and (c) a mission
without a MissionCapability. Report capability support separately: participant
involvement alone is already enough to remove unsupported_capability but is not
evidence that the capability's behavior is described. Decide/document whether a
contextual work action/state observation counts as behavioral coverage; traverse
reuse without double counting or recursion hazards.

Seams: `validation.rs` and checks UI/context navigation, plus shared server lint
output. Acceptance fixture has one covered leaf, one uncovered leaf, a parent
exchange, an unsupported mission and repeated/reused occurrences. Each warning
locates the right record, disappears after the matching repair, reappears on Undo,
and never rejects Apply/Save or invents an allocation.

### 4. Correct release-facing scope/help and provide one complete walkthrough (P1)

Rewrite stale current claims in scope.md and guide.rs after the respective
integrations; append clear superseding state in PLAN/TASK_LEDGER rather than
letting an old narrative decide current acceptance. The normative reST should
continue to describe one contract; correct the OA ExchangeAllocation discrepancy.
Keep historical native evidence's revision/platform limits explicit.

Use one worked engineering story: OA mission/roles/communication and alternative
process → reviewed SA responsibility boundary → typed boundary/data contracts →
scenario and degraded mode → artifact evidence → graphical edit reflected in a
commented source module → REST edit/reload and an intentionally rejected stale
update → local crash checkpoint restore. Help steps must name actual controls and
explain containment versus allocation versus occurrence reuse. Search should find
each topic, and contextual links must respect drafts. This is authoring/navigation
acceptance, not a request for another tutorial framework.

### 5. Close current native and final release gates (P1)

Use the bounded table fixtures on Windows and Linux at default and minimum size,
including the changed current actions, compact process form, keyed review and
recovery flows. Record exact build hash, model/source oracle, undo/reopen result
and serious runtime output; a prior test count is not fresh proof. Then run strict
workspace tests/clippy/fmt, optimized desktop/server, supported compiler/platform
checks, reST/OpenAPI/examples/migrations and real HTTP rejection/restart contracts.
Finish with fresh independent semantic, workflow and packaging review. Root's
current builds/native trials may discharge rows after this report was written.

## Explicit bounds and unresolved interpretation

Do not add LA/PA components, deployment, a simulator, native .capella/.aird import,
or the full SysML metamodel to close this audit. Generic constraints already carry
descriptive engineering constraints; this audit has not established that every
Capella duration/time-constraint class or capability-configuration class is a
necessary new first-release primitive. Reusable process references are implemented;
links into their internal contributions remain a separately recorded semantic
extension, not something current same-context SequenceLink should silently infer.
If an acceptance story requires that extension, freeze occurrence/path identity
and control-flow rules before implementing it. These boundaries preserve the
objective's OA/SA focus without calling known required work complete.