Hosted desktop editing

Status: implementation, 24 focused tests, all 351 Windows desktop tests, strict desktop all-target Clippy, formatting and optimized build pass. Native and Linux integration acceptance remain with the lead. Base: 1086e54. The lead owns integration, Linux and native acceptance.

Contract and ownership

The optional desktop adapter uses the existing hosted envelope and source-project REST routes. Open compiles and checks the coupled source/model; Publish creates a resource; Save uses the captured opaque ETag. Document remains the sole accepted local history. Complete authored bundles retain comments/includes and Undo stays local until an explicit save. No server, metamodel, persistence or general synchronization framework was added.

A hosted handle is separate from disk ownership. Successful publication/open attaches it; successful source Save As switches to local ownership. Failed saves and JSON exports preserve the active destination. Requests carry a unique ticket, desktop document identity, local revision and exact compiled snapshot. Stale replies are ignored and late receipts cannot mark newer edits saved or close them.

Conflicts keep local content and fetch a separate server review. Reload is one undoable accepted change. Readback can acknowledge an uncertain write only when the exact submitted bundle matches; publication is never automatically replayed. Known publication IDs survive lost follow-up reads. Review and reconciliation carry their own connection, including when publishing to a different server. Corrected credentials replace only matching-base handles.

Credentials are masked, redacted from Debug/errors and kept in memory. URLs reject credentials/query/fragments; remote connections require HTTPS, with HTTP supported on loopback. Redirects/retries are disabled. Request, response, source and time budgets are bounded. The implementation reuses already locked reqwest/Rustls dependencies.

Owned code: hosted/{mod,client,view}.rs, transport tests, app/hosted.rs and lifecycle tests; narrow App/main/Cargo hooks. The lead explicitly authorized the three views.rs header hooks: hosted status, Hosted models action and active Save label. Other shared UI/property/harness files were untouched.

Focused evidence

Windows, dedicated target D:/CodexBuilds/Capella2-scenario-target:

$env:CARGO_TARGET_DIR='D:/CodexBuilds/Capella2-scenario-target'
cargo test --locked --offline -p oa-desktop hosted

24 tests pass: 13 transport tests and 11 lifecycle tests. Transport uses actual loopback sockets, production oa-server fixtures and bounded fault fixtures. The actual App test consumes Iced Tasks and routes real HTTP completions through App::update: Publish, graphical edit/Save, competing API edit/412, corrected credentials, direct review Reload, Undo/Save, uncertain-write Check, catalog/Open and Save & continue to New. These are runtime/model tests, not native GUI acceptance.

Fresh independent lifecycle review found stale captured credentials after reconnect. The production fix refreshes matching-base session, uncertain-write and review connections. The actual App regression fails when that refresh is removed and passes when restored; hosted-credentials-red.log records the expected failure. A restored-source timestamp initially reused Cargo's red binary; advancing the source modification time forced the verified rebuild. hosted-focused-test.log records the passing corrected suite. Reviewer re-review found no remaining production defect; its test-coverage suggestion was incorporated with separate direct Reload and uncertain Check paths.

A first build caught adapter visibility and test cursor API issues, both fixed. A network test originally required connection_failed for a closed Windows port; Windows can instead hit the bounded timeout. The assertion now accepts either certain read failure while checking that the result is not an uncertain mutation.

Remaining acceptance

The final Windows desktop test run passed 351 tests; strict all-target Clippy and formatting passed. Clippy caught an unnecessary test-only PathBuf allocation, which was removed. Hosted inputs now show their disabled state while requests run. The optimized desktop build passed in 2m 46s. Freeze a separate native trial executable with commit/hash. The lead must exercise default/minimum Windows and Linux dialogs, publish/open, graphical and textual save, API artifact changes, conflict/reload/Undo, offline recovery and local Save As. Update guide/server/scope claims that hosted desktop editing is unavailable after integration; this worker does not own those shared documents. Hosted editing remains explicit save/reload, without automatic merges, server history or collaborative synchronization.

Verified Windows artifact and commands

Production commit: 6fcc238c5240d35be5e2ef828b16fbf1bd01bdbd (feature 53a509553daa297a8f602262d0498142010829d4). The isolated worktree is D:/CodexBuilds/Capella2-hosted-desktop on codex/hosted-desktop.

From that checkout, the completed gates were:

$env:CARGO_TARGET_DIR='D:/CodexBuilds/Capella2-scenario-target'
cargo test --locked --offline -p oa-desktop
cargo clippy --locked --offline -p oa-desktop --all-targets -- -D warnings
cargo fmt --all -- --check
cargo build --locked --offline -p oa-desktop --release

The target contains hosted-desktop-test.log (351 passed, zero failures/ignored), hosted-desktop-clippy.log, hosted-fmt.log and hosted-desktop-build.log. The transport tests exercised local sockets only; no external deployment or native input occurred.

Frozen executable: D:/CodexBuilds/Capella2-release1-01a06e2e/ui-hosted-windows-6fcc238/arcadia-studio.exe.

SHA-256: 51E4C02F1265D3E9B140C2BCF34A8B11E25E5B0D1D32C83E987FEA4BEB4FC061.

The release output and frozen copy hashes match. A sibling manifest.json records the production commit, gates and pending acceptance. No existing trial artifact was replaced. The assigned scenario target and HOST index are idle and returned to the lead after this evidence checkpoint.

Windows native checkpoint — 2026-09-06

Root operated frozen6fcc238 (SHA51E4C02F1265D3E9B140C2BCF34A8B11E25E5B0D1D32C83E987FEA4BEB4FC061) at1440x900 and1100x700. Isolated loopback service127.0.0.1:8787 uses C:/Users/sorok/AppData/Local/Temp/capella2-hosted-native-20260906/store. Resource d28b2fc9-fbbd-456b-8ba8-a1195d1c8f33; no external deployment.

Native Open loaded the isolated74-element/13-link/three-file process model. Connect displayed an empty catalog. Publish created revision1; REST envelope comparison confirmed all three authored file strings exactly matched disk.
Edited project description graphically; Save to server applied its pending property draft and saved revision2. REST confirmed content and bundle counts.
Typed a source comment without its newline, making the header invalid. Save retained the draft, showed syntax lint and left server revision2 unchanged. Inserted newline; Ctrl+S saved valid source/comment as revision3.
Conditional REST CreateArtifact attached Navigation CAD contract to Request navigation, revision4. Native Check server displayed changed project.arcadia; read-only View server text preserved local state. Reload exposed the artifact with Implements, URI and revision. Undo removed the local attachment; Redo restored it and returned to the server-saved state, without network writes.
Entered a different local project description; competing REST EditProject created revision5. Native Save was rejected by stale revision protection and automatically loaded a separate review; the local description remained intact. Independent REST read confirmed server revision5 and server description.
At1100x700, conflict body scrolls while bottom actions remain visible; review, changed-file action and Reload are reachable. Reload adopted revision5 and Undo restored the exact competing local description as unsaved local content.

Evidence responses: published.json, graphical-save.json, textual-save.json, artifact-transaction.json and competing-transaction.json in the isolated directory. Root harness mistakes (wrong route prefix, PowerShell array-valued ETag) failed before successful corrected requests; these were not application failures. Current window2493046 remains open. Server11260 was identity-checked and stopped for the next offline-save trial; offline result/restart and Save as local/catalog Open/Linux acceptance are still pending at this checkpoint.

Integrated Windowsf08507a passed360 desktop tests, strict all-target Clippy, fmt and optimized build. Linuxba9c117 passed359 tests and the same gates before the compact form fix. DATA28ebbbb/Linux04210b3 now include independently reviewed core constructor-history/explicit-Port fixes; their full workspace gates are active. An initial Linux invocation selected unconfigured Ubuntu; corrected to Ubuntu-24.04.

Windows offline, local-copy and catalog completion

Native6fcc238 at1100x700: stopped only identity-checked isolated server11260. Save reported unreachable/interrupted service and retained the local model/source. Restarted same binary/store as20984; independent read found revision5 unchanged. Explicit Save retry succeeded revision6 with the restored local description and CAD attachment. No automatic replay was involved.

Save as local wrote a new .arcadia project under C:/Users/sorok/AppData/Local/Temp/capella2-hosted-native-20260906/local-copy. Header changed from Save to server/Hosted to Save all/All changes saved. All three disk file strings compared exactly equal to server revision6, including the comment and both includes. Evidence: offline-recovery.json and local-copy-equality.json. Connect/refresh then displayed the resource; selecting it and Open selected loaded the hosted revision6, restored Save to server and the authored model. Trial71940 closed normally, exit0, empty native.stderr.log. No user model was modified.

Native P2: after Publish/Save the catalog retained its initial empty result and misleading No models found text until manual refresh. A separate follow-up is pending. Code review then reproduced a high-impact destination defect with actual App/HTTP: opening invalid local source from hosted, repairing and saving could overwrite the old resource. The local repair-workspace branch needs to detach its previous hosted handle; true read failure/Cancel must retain it. HOST owns red/green fix; fresh review and native fixed-flow verification are required before hosted acceptance closes.

DATA28ebbbb/Linux04210b3 full workspace gates completed:767/770 tests respectively, one intentional ignored benchmark each, strict workspace all-target Clippy, fmt and optimized desktop/server builds pass. Logs hosted-core-{workspace-test,workspace-clippy, build}.log in dedicated data/data-linux targets. GUI constructors and help are now integrated at DATAcf04ff1/Linuxb5db730; desktop gates3782/6616 are active.

Destination and catalog correction checkpoint — 2026-09-06

b04c4b3 detaches a hosted handle when installing invalid local repair source; failed/cancelled Open retains the current document and destination. Actual-App HTTP regression failed before the fix and passed afterward; independent review closed.12e3020/e807086 identify stale catalogs after writes/changed heads, including empty filtered results with a bound resource outside the displayed rows. Fresh review reproduced that case red, then closed correction with negative unchanged- head and cross-service controls. Both fixes are integrated in DATA14b8e18 and Linux9c61d0d;392 desktop tests/platform and strict gates pass. Native correction checks remain pending. No polling, automatic overwrite or persisted token added.

12 KiB Raw Permalink Blame History