ARCADIA-Studio/harness/release-semantic-artifacts.md

Artifact lifecycle semantic GUI

The artifact review slice is implemented. Its full desktop checkpoint passed 518/518; the corrected artifact picker rerun passed 6/6; strict all-target workspace Clippy passed. MOVE, CREATE and DELETE passed native complete-source Save/Undo/Redo, with nine saves succeeding first attempt. MOVE invalid raw/optional state and CREATE excluded row/reserved identity also passed exact controlled-stop recovery. Later forged-recovery tests and diagnostic/display changes have separate evidence and are not included in these checkpoint counts.

Contract

• Name, Description, Owner, Relation, URI, Revision and Fragment have independent Keep/Take/Candidate decisions. Raw invalid Owner/URI input and deselected or excluded drafts remain retained. Optional revision/fragment store presence separately from retained text, distinguishing None, Some(""), and a disabled nonempty draft.
• Creation chooses an existing source link, explicitly reserves a destination identity/alias, then requires Presence and all seven metadata decisions. Reservation creates no accepted record. The request supplies one complete merged ArtifactLink candidate; copying seed values never silently reviews them.
• Deletion takes Presence from an explicitly identified link absent from its source owner. The source link may still exist under another owner. A missing source key means destination-only retention. No fake missing identity or record-shaped tombstone is invented. Fully new both-sides-absent metadata belongs to ordinary artifact creation, outside this semantic-review contract.
• Owner Candidate is authorized on the immutable initially attached owner trace. All core-admissible owner identities remain selectable. After Apply, further metadata review requires an appropriate trace at the new owner; the old trace is never silently rebound.
• Presence and Owner constrain the same actual Owner slot. Deleted records contribute NotApplicable to all seven destination metadata slots, so conflicting kept metadata or presence blocks the combined transaction. All included sources use one accepted base and one command.
• Exact artifact history resets are enabled. Reset-only changes observations, not link metadata; pairing uses exact identities rather than names or string inference.

semantic_review/artifacts.rs owns closed raw values, exact-facet drafts, pairs, provisional seeds, lifecycle proposals and typed recovery. artifacts_view.rs provides named pairs, reservation, description, owner and optional-text controls. Row/session events retain their source/target/trace/facet address. Composition installs reserved candidates before comparing/writing actual slots. Recovery v1/v2 gain a default-empty artifact payload; no commands or proposed projects are serialized. No core production contract was changed.

Automated and independent evidence

• Full desktop 518/518: .local/source6-artifact-inspector-desktop-tests2.log, including six artifact tests and the diagram-inspector correction. The initial owned-Value closure compile error was corrected before this run.
• The fresh-editor picker regression first failed in .local/source6-artifacts-final-tests.log (5 passed, 1 failed). Project::layer_of follows elements/relationship endpoints, so filtering artifact IDs hid every ordinary artifact. Existing selected/history entries had masked the error.
• Corrected picker 6/6: .local/source6-artifacts-final-tests2.log. It classifies by the artifact owner’s layer, admits neutral project/diagram owners, and shows current owner plus absence from the reviewed owner. A fresh empty Editor test proves same-side moved-link availability, opposite-side exclusion, and neutral-owner availability.
• Strict all-target workspace Clippy passed: .local/source6-artifacts-final-clippy3.log, after an equivalent .map(RelationChoice) cleanup.

The six artifact tests pin direct-core creation/all-metadata, deletion/history, candidate-tombstone refusal and both-absent metadata refusal in both directions; GUI reservation/recovery; Owner/Presence conflict; None/empty and retained disabled text; invalid excluded raw recovery; moved-source deletion versus destination-only retention; and exact App source/history Apply/Undo/Redo/reset. These counts are separate evidence points, not a recomputed whole-workspace total.

Independent state-contract and behavior reviews confirmed source-absence semantics, actual-slot comparison, record-candidate equality, immutable initial-owner authorization, raw optional recovery and owner admissibility. Both diagnosed the picker layer error. After its correction, no further material lifecycle defect was found in their bounded reads. The behavior reviewer identified adversarial forged-recovery admission as a useful additional test slice; those tests are separately owned.

The native lifecycle report records the actual Windows executable hash, usable owner/optional controls at 1440×900 and 1100×700, None versus empty preview, explicit Presence/Owner conflict rejection, and recovery of invalid Owner - with retained disabled Fragment text. Creation retained all eight decisions, seven metadata drafts and its exact reserved UUID while excluded through recovery; Presence alone could not apply. Deletion used an explicitly identified source link moved to another owner and removed only the destination. Each workflow's Apply/Save, one Undo/Save and one Redo/Save matched complete independent source oracles, covering metadata and review history. These runs predate the subsequent conflict-diagnostic and reserved-label corrections; revised presentation still requires current-binary verification. Destination-only retention remains automated evidence rather than a separately applied native case, and these fixtures do not establish every possible owner/type or Linux graphical acceptance.

Preserved fixtures and reproduction

The tracked fixture directory is fixtures/release1-native/artifacts. It contains the source-6 move/delete/create bases, exact after source/JSON, full requests, identity/count manifests, relative-filename SHA256 inventory, native instructions and generate-semantic-artifacts.rs. No executable is committed.

The generator requires OUTPUT_DIRECTORY [RESERVED_CREATION_UUID]. Both modes were compiled directly against the existing workspace core and validated without Cargo. Fresh generation checks all three variants. UUID mode reads the existing creation JSON and exact original source, preserves both base files byte-for-byte, and generates exactly the requested new artifact with eight acknowledged facts. The checked Windows compilation command is in the fixture README.

For a copied native trial directory, regenerate the creation oracle using the GUI’s actual reserved identity:

. .local/toolchain/env.ps1
.local/native-fixtures/generate-semantic-artifacts-preserved.exe .local/native-fixtures/artifacts-session <UI_RESERVED_UUID>

Move keeps two links and reviews three facets. Moved-away-source deletion reduces two links to one with eight acknowledged and zero retired facts because source metadata still exists. Creation adds one link with eight reviewed facts. All three have zero additional impacts. The generator validates direct core preparation and exact source-project round trips; it does not simulate native input. Work on copies and never regenerate initial identities after starting a native trial.