ARCADIA-Studio/harness/release-current-native-verification.md

Current Windows lifecycle and keyed-review verification — 2026-09-06

This is current-machine evidence on codex/release1-continuation, integrated baseline c091f80 plus the uncommitted continuation. It does not supersede unrelated historical Linux checks or claim first-release acceptance.

Build and automated checks

User-local Rust 1.98.1 stable-x86_64-pc-windows-gnullvm, LLVM-MinGW 20260826 UCRT. cargo build --locked -p oa-desktop -p oa-server passed. Shared normal-user manifests allow installer-like GNU test filenames to run without elevation. cargo test --locked --workspace passes 840 tests, with the existing routing benchmark ignored; .local/current-workspace-tests-final.log is the full log. Strict all-target workspace Clippy passed in .local/current-clippy.log (8m24s).

Initial failures were corrected at their causes: typed action test double-applied the camera transform; invalid Binding fixture reused one local lifeline; core Annotation/Binding replacement reordered retained rows; a hosted timeout test incorrectly assumed a 30ms deadline guaranteed server admission. The held-response test now permits pre-admission timeout while preserving outcome uncertainty and no-retry checks. Independent recovery review also found and fixed write/restore workspace limit disagreement, preserving the prior usable checkpoint on rejection.

Isolated native lifecycle trial

The actual debug GUI runs with LOCALAPPDATA redirected to .local/native-qa/appdata; no user recents or recovery store was used. Captures and input use the Computer Use skill's native Sky API. Root is sole native operator. Default client size is 1440×900; minimum client size 1100×700 was reached through native border resizing. No screenshot or unit test substitutes for this run.

1. Home starts empty, offers New/Open/example/guide and clear recent-file guidance. Loading the rescue example displays the existing OA architecture and 21-file source project. This does not create a file destination.
2. Inserted unfinished_recovery_draft after arcadia 5;. Apply rejected it at project.arcadia:1:12, preserved the exact raw source and left the 41-element, 26-relation accepted model intact. Architecture remained inspectable and explicitly blocked property editing until source drafts were resolved.
3. Observed a completed private checkpoint containing that exact token, then forcibly stopped only the trial's verified Studio process. After restart, Home offered the retained project. Recover restored the source draft, located error and unsaved-copy status. Undo history was absent as specified.
4. Reverted the intentional source error, then Save as chose .local/native-qa/recovered/project.arcadia. All 21 saved files compare exactly with the checkpoint's accepted bundle (zero mismatches). Both retained recovery entries were retired, no checkpoint remained, and stderr was empty.
5. Home displayed the saved project in Recents. At 1100×700 the action rows, current-project card, recent Open/Remove and guide entry remained readable and reachable. Recent Open loaded the source project with its identities intact.
6. Replaced the project UUID property with raw -. Apply rejected it without changing the model. After observing its completed checkpoint, a second forced trial-process stop/restart recovered exactly - in the identity field. Origin is displayed as context on Home; restore still opens a copy without a save destination. Save & continue rejected the raw UUID and retained the draft. Open's discard decision then allowed moving to the next isolated fixture.

Local forensic artifacts: source-draft-before-crash.json, property-before-crash.json, the 21-file recovered directory and per-process stdout/stderr logs under .local/native-qa. These contain synthetic example data.

State-action trial and open finding

Production-parser-validated .local/native-fixtures/state-actions.arcadia has 14 elements, 10 relations, 1 saved state view, 8 placements and no issues. In Behavior & scenarios, Ready shows legacy Entry prose, typed Entry/Do/Exit work rows, an Internal transition and a nested region without overlap. Each of the three typed rows selects its actual StateAction relation; the inspector confirms the corresponding phase, Ready source and Restore settings / Monitor pressure / Release resources target. Selection does not mutate the saved model.

Open native finding: opening a file whose first diagram is a StateMachine lands in Architecture's generic graph renderer, with blank action-header space and functional/boundary exchange tools. The dedicated Behavior canvas renders and selects correctly. A bounded routing correction is being investigated; do not call the state-view entry workflow accepted before it is fixed and rerun.

Still required for this milestone: updated-binary preflight/routing checks, pending behavior/workflow crash recovery, state-row compact/fold/edit/save checks, Annotation/Binding native Take/Candidate/history/source oracles, fresh independent review closure and strict checks. Linux and complete release acceptance remain separate required gates.

Semantic review in progress

The validated semantic-keyed.arcadia fixture opens in Traceability and exposes the Navigation message review. Members/rows can browse OA and SA origin Record fields separately, choose their nested latitude fields and stage the exact pair. Take Operational shows proposed latitude_deg + 0.25, one decision, three reference pairs and zero additional changes. A completed checkpoint contains this pending semantic workflow and Take decision; .local/native-qa/semantic-before-crash.json preserves it. The trial process was then forcibly stopped, leaving the executable unlocked for the routing build. Restore/Apply/source-oracle comparison is next.

Several immediate captures during heavy compilation preceded the app's next paint; fresh captures showed the intended picker menus. This was not an empty-choice defect. Native dialogs also sometimes needed focus and input retried after a fresh observation; folder navigation completed fixture opening. These observations do not justify changes to model or field-picker semantics.

Recovered semantic review and Save-as history finding

Updated routing binary SHA256 70069D6CBBE1917E1597794B3E190FF9CF23664D458F794B3270DDBE6EE683A2 launched as isolated PID7580. Home recovered the pending Annotation review, retaining one Take decision and three explicit reference pairs. Regenerated validated preview showed latitude_deg + 0.25; Apply succeeded with zero additional changes. Save as .local/native-qa/semantic-accepted.arcadia exactly matched the independent after-take source oracle (SHA256 9AB573C92BE66E3BAE659DD826923BA6066979B1651EDDA7BD469056632CD77E), including comments, typed history, sibling value and order. Checkpoint retired after Save.

Native history check found a production defect: changing the entry basename through Save as creates an extra Document transaction. First Undo only restores the prior entry name; saving it preserves after-take content and clears redo through another entry rename. Second Undo reached the real semantic transaction and saved exact initial source (SHA256 49214BE2CA9C8BB6195C3B39737C053847021839F70F0BB2921D35A1FBD2AC83). Root assigned non-history Save-as adoption/preflight correction and meaningful history tests to state_contract. One-step Undo/Redo after renamed Save remains unaccepted until rebuilt native recheck. Current Linux runtime is prepared and checksum verified but has not booted.

Binding rejection, crash recovery and repair accepted

On routing binary70069D6C, the paired Rendezvous binding was explicitly staged. Candidate SA Rendezvous extra local rejected with duplicate_lifeline_binding: Scenario-use lifeline bindings are one-to-one. Apply was disabled. Switching Reference pairs / Properties retained the decision and error. A completed checkpoint preserved the exact after-Take accepted source and invalid local UUID; forensic copy binding-invalid-before-crash.json.

Forced stop of isolated PID7580 and restart PID796 recovered the same candidate, presence and two reference pairs, regenerated the same error and kept Apply disabled. Repair to SA Rendezvous alternate produced a valid preview and zero additional changes. Native Apply + Save as into a new folder retaining the entry basename matched the complete after-repair oracle exactly (SHA256 E3CE0347746584F503B825A8B6BD23A7EEBF0827940112EF8F36D500C1D0A043). One Undo + Save matched after-Take exactly; Redo + Save matched after-repair. Saved copies are under .local/native-qa/binding.

A new UI finding is clipped Use pair / Remove pair controls on Reference pairs at the normal1440x900 window. Semantic worker constrained the panel widths; rebuilt native inspection remains. The debug gnullvm executable needs .local/toolchain/env.ps1 PATH during launch: a launch without it exited before a window with no app log. Packaged GNU runtime dependency closure must be checked explicitly; this does not change prior successful toolchain-environment runtime evidence.

State-view routing and pending behavior checkpoint

Routing binary70069D6C opened the saved state fixture directly from Home/Recents into Behavior, exact machine and diagram selected with state tools. Explicit Architecture remained reachable with an empty architecture view, and selecting the saved state view there routed back correctly. At1100x700, toolbar/inspector remained usable, zoomed Exit action selected its StateAction relation, direct State placement into Main region created one state/placement, and one Undo restored the original14elements/10relations and clean document. The initial fixture file is unchanged.

Right-clicking the Internal row opened Edit transition. Authored name Unfinished timed refresh with a checked new timed trigger and empty expression retained the existing trigger/effect/guard, showed the required-expression message and disabled Apply. The form scrolls at1100x700. Completed checkpoint behavior-before-crash.json contains exact unchanged accepted fixture plus the authored pending behavior draft. Isolated process796 was forcibly stopped for rebuild/recovery testing; no native GUI is currently running.

Packaged clean-PATH smoke — 2026-09-06 continuation

QA package ArcadiaStudio-qa-debug-20260906-a-x86_64-pc-windows-gnullvm (older binary SHA25670069D6CBBE1917E1597794B3E190FF9CF23664D458F794B3270DDBE6EE683A2) launched as process5452 with PATH exactly C:\Windows\System32;C:\Windows, working directory .local/package-clean-smoke, and separate app metadata there. The packaged libunwind.dll resolved the development-PATH dependency: actual Home rendered, Explore rescue example showed41objects/26links with nested architecture, and the offline Engineering guide rendered16topics. Alt+F4 closed the app normally; the next native window inventory no longer contained it; process5452 was absent and both stdout/stderr were zero bytes. This launch did not open or modify the pending behavior checkpoint in the other QA appdata directory.

The guide search Clear button was partially clipped at1440width. Root added explicit Fill constraints to the search, content and step rows; updated native acceptance is pending. The old package does not include complete Rust dependency notices, identified by independent review; it remains QA evidence, not a distributable release. This smoke does not establish final-binary portability or fresh package Save/reopen acceptance.

Recovered timed transition and corrected Save-as history

2026-09-06, process10896, staged desktop SHA256 660BECC8DB96B218D12805B39661B46C9F48DF4F8F07CB3B7D42C1F803BE089F, system-only PATH, isolated native-qa/appdata. Home Recover opened checkpoint 5a81ce27-e331-4165-9eab-8f190493f376 in Behavior with the exact raw name Unfinished timed refresh, Internal Ready-to-Ready endpoints, Sample tick, pressure_valid guard, Monitor pressure effect and Update status display notes. Timed event remained enabled with empty expression and the time-expression error; the accepted properties still said Refresh status. Enter30 s made Apply available. One Apply created Event49044cb7-5f91-408a-86fc-1cc012eb2972 and edited only the existing transition, leaving15elements/10relations and expected3coverage warnings.

Native Save-as selected a different entry basename, state-recovered-renamed.arcadia. Accepted entry SHA256AD8FD359CE7B0BE4F3AE0F55424EEB4EE032DEFB359F2F5AD89C00A79B62DADF includes sa/model.arcadia, whose sole new Event body is Time(After,30 s), SHA256 8FB649F8ABB93CF4C321F2D847A1A9F1A1551E0F713E938C46EF11E24DC58801. One Ctrl+Z removed the Event and restored Refresh status. Ctrl+S produced entry bytes exactly equal to pristine state-actions.arcadia, SHA256 9CDE82608110E56AA9E14C9E33EB38976F53AED74AB013145D411D5743A0EC26. Ctrl+Shift+Z remained available after that save, restored the same Event and transition, and Ctrl+S reproduced the accepted entry exactly. Both saves retired all private recovery JSON files. Oracles are retained under .local/native-qa as state-after-timed-repair.arcadia, state-after-timed-repair-event.arcadia and state-after-undo.arcadia. Full reopened bundle parsing remains a follow-up check; entry byte equality alone is not claimed as independent whole-model comparison.

Home Continue editing returned to the same Behavior owner/view and camera. Native resize to1100x700 retained all9navigation pages. The Engineering guide at that minimum size showed the entire Clear control and wrapped readable article text, closing the observed clipping finding for that size. Ordered review and reference-pair modal native acceptance remain pending.