Task Ledger — first release

Updated 2026-09-11. STATE.md owns current execution/evidence; PLAN.md owns capability milestones. The entire former Task Ledger is preserved byte-for-byte. Its old goal references, aggregate test claims and stopped-session directives retain historical scope. New semantic decisions are recorded explicitly in DECISIONS.md; prototype results retain their separate scope.

Current compiled checkpoint2cc4d11 includes external creation4bb4aaf as1516949, isolated chooser13, and final baseline/library contracts. Local full676/format/ strict Clippy pass; native80cf197 now passes four OA creations, exact history and reopen. Working workspace/production chooser changes and undeclared numeric files have no passing gate yet. External results retain their host/source attribution.

Goal and success criteria

Deliver the usable, feature-complete OA/SA first release specified in PROJECT_GOAL.md. It is the exact copy of the user's revised a49d1780-25d5-4778-ad68-6140c60e4207/goal-objective.md, SHA256 DD58F75C93D55FE16ED141A23D834898FB6EBC625AE7E7AE379DA552A8312435.

Success requires coherent explicit semantics, practical engineering workflows, equivalent graphical/textual/REST behavior, real Windows/Linux runtime evidence, recoverable authoring, relevant automated evaluators, precise documentation, reproducible packages and fresh independent cross-disciplinary end-state review. No known blocker or high-impact finding may remain unresolved. Later Arcadia layers remain future scope. Code, a passing slice or an attractive screen alone cannot establish completion.

Given facts

Rust/Iced desktop and a deployable REST service serve system engineers. OA/SA transitions in both directions must be understandable, explicit and useful.
The revised goal explicitly requires constraints/calculations, quantities/units, reusable model libraries, state/behavior modeling and strong standardized specification/API, as well as textual/graphical notation and artifact traceability.
Human/AI/Git-friendly source and a concrete unambiguous reST specification must match graphical editing. The source editor needs highlighting/linting; help must be offline, concise and navigable.
The newest explicit goal requires uncluttered notation that reduces cognitive load and supports development of complete small and large models using text alone.
Direct behavior/scenario diagram authoring and reduced cognitive load are current priorities. Long homogeneous selectors and bloated persistent creation controls are rejected. Study actual Capella's useful domain workflows and nesting without mechanically copying its interaction problems.
The user authorizes autonomous bounded engineering, native Capella/Studio evaluation and explicit independent delegation, exclusively with GPT-6 Astra at effort appropriate to the question. Root owns synthesis/integration.
Project instructions require Gitea coordination, ownership preservation and durable handoffs. Current root reserves one Cargo/native operator per host. Updated AGENTS d93cddac requires coordinated runnable milestone prereleases; user Gitea#178 authorizes programmatic existing-MCP-credential reuse for relevant Git/REST publication without printing/committing secrets. Restart and usage reset remain unauthorized.

Verified facts

The independent scenario checker compiled with warnings denied and passed its self-check, deterministic fixture generation and complete baseline check on this host. Its eight OA/SA checkpoints and exact UUID/source restoration comparisons are evaluator evidence, not native Studio acceptance. Exact inputs/hashes are in the fixture instructions.
The historical native implementation is 80cf197 on codex/behavior-authoring-20260910, following baseline 1797516. Local commits cover B1/B2/B3 authoring, nullable history cache (b6b76ef), external palette integration (aed40d7), cfg(test) lifecycle projection (eb5161b), history seed correction (4ecad78) and exact-identity native oracle. Later imports add focus recovery, exact packaging notices and scenario workspace/ owner restoration. Root80cf197 fixes document/scenario viewport Sensor identity with a real mounted red-before/green-after regression.
This fresh host has task-local Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW. The integrated2cc4d11 desktop suite passes676/676, zero failed/ignored, with a warning-free build; formatting and strict Clippy pass. History, pure lifecycle, creation and isolated chooser are included. New working code still needs its own gate. Native80cf197 evidence is separate. Exact hashes/logs.
Strict language HTML regeneration and the source7 OpenAPI checker passed locally: 72 fixtures, 204 schemas and 90 scalar leaves. Actual isolated Capella scenario, activity/lifeline and LOOP creation was saved/inspected; this is reference study, not Studio acceptance. Native benchmark.
Core/source7 already implements substantial direct behavior, typed data/ports, contextual chain links, maintained message-operation identity, semantic reviews, artifacts, hosted source envelopes and recovery. Historical absence claims must be checked against code and newer scoped evidence, not copied forward.
Requirements audit: Constraint and other expression strings are descriptive, with no calculation/binding/result evaluator; unit strings persist/inherit without dimensional compatibility or conversion; named types/sequence/scenario reuse and includes exist, but there is no maintained cross-project package/version/instance/update contract. These are explicit gaps.
The same audit identifies concrete unbounded Constraint target choices and generic expanded collection editors. Explorer already has hierarchy/search/paging; the problem is targeted, not a claim that all selection is flat.
Gitea #79's same-selected-ID/visible-owner defect is fixed in the imported scenario checkpoint; owner restoration and pending-draft guards pass current tests. B4 independent review #114 adds Scene integration requirements for actual lifetime extents, branch-local activation clipping, incomplete lanes and self arrows.
Codex-9e8r6t and Codex-ytr83r have independent host-local Cargo/native leases. Named creation/workspace/palette/package integration is imported here.9e8r6t's coherent CLI/evidence checkpoint01b76a1 awaits import; it owns staged-source and the next runnable Windows prerelease. ytr83r owns production B4 and its native oracle.9e8r6t successfully reused existing credentials for direct push; this host is setting up the same authorized publication path.
Current Linux acceptance is open; this host has no installed WSL distribution. Historical Linux core/server/cross-build results have exact older snapshot scope. The earlier denied guest workaround did not run and must not be bypassed.

Assumptions

Compact contextual tools and an adequately sized scenario workspace can reduce friction; only actual engineering tasks at minimum/wide sizes can validate this.
The ratified bounded pure analysis and pinned-library architecture can satisfy real engineering work without full language/runtime adoption. This remains a product adequacy assumption until actual budgets, approximate calculations and two-project/source/API/native workflows pass; metadata is insufficient.
Existing shared core/source/history boundaries remain suitable for additions; foundational examples and independent criticism must test that assumption.

Open questions

Do the ratified owned-value/shared-check/R6/R7 contracts meet real engineering budgets once implemented, including approximate numeric requirements? What measured ceilings keep work bounded without rejecting ordinary studies?
Does actual package closure/canonical consumer typing/source preparation and three-way update preserve every stable identity and local engineering edit?
What migration and OA↔SA treatment follows from those contracts without guessing executable meaning from old strings or silently changing old models?
How can text-only creation establish library instance bases/maps, preserve compatibility across cosmetic package revisions, export subjectless cases, and transition mounted OA/SA data without hidden GUI normalization or silent forks?
Will full evaluator and private-capture replay preserve effective-case and deterministic work-limit behavior across direct, REST and cache-warm execution?
Which source-preserving refactoring/navigation and grammar changes reduce actual engineering effort while retaining stable identity and cross-file ownership?
Do current real gestures, exact caller return, nested scopes and lifecycle markers remain usable and correct under minimum sizing, scrolling, zoom and dirty drafts?
Which uncovered teaching, traceability, transition, saved-view, state/data, hosted and platform cases remain after current-binary acceptance? What supported Linux environment can complete the remaining actual runtime gate?
Does "standardized" require any external conformance beyond the project's precise interoperable spec/API? Full OMG conformance is not inferred merely from comparison to SysML v2; explicit claims require a mapped and verified contract.

Candidate hypotheses / designs

The requirements delta compares metadata/ snippets, bounded pure engineering analysis with maintained pinned libraries, external evaluators, and full standards adoption. Metadata alone fails the explicit new semantics; external tools alone still need binding/result contracts. The report recommends the bounded route for root synthesis, not as a ratified decision.

Independent maximum-reasoning tracks now compare owned engineering properties versus analysis contexts; calculation definitions/applications; numeric/unit rules; and copy, linked-definition, live-instance or pinned-definition/editable-instance library architectures. Require concrete falsifiers, source/API migration effects, identity/history/recovery behavior and independent critique before convergence. These alternatives converged after concrete experiments and independent review: B property bases/shared checks/full capture, R6/R7, exact pins with same-origin typed compatibility and explicit portable normalization are now ratified. Complete 11-file proposed baseline and120-assertion finite library prototype remain distinct from production admission. Independent292-check review exposed C1 dynamic-work expansion and a C2 prototype threshold-unit gap; implementation must close both. The text-only40-identity fixture and13 mounted chooser tests pass. Production numeric foundation and inspector/review chooser are active, with gates pending.

The subsequent context experiment passed218 assertions: shared property baselines and one-level overrides reduce repeated input maintenance while retaining explicit independent freeze. Root selected that B direction for precise contract refinement; quantity/library/source details remain open. Decision, experiment and limits.

Decisions retained

Keep explicit Rust crate responsibilities and one authoritative typed Project with validated atomic Commands. A thin source CLI reuses the shared core. Separate semantic identity/ownership, allocation/reference/order and diagram geometry. Forms are closed adapters, not a second metamodel. New persistent semantics require core/source/UI/API/reference/transition parity. Decisions.
Preserve authored source ownership/comments/includes, exact identity and accepted model/source history. Source writeback must succeed before adoption. Raw invalid, excluded or rejected drafts survive; navigation/tools must not implicitly accept another editor. Recovery validates/replans rather than trusting serialized commands.
Semantic reconciliation uses finite typed facets, frozen baselines, explicit mappings, actual destination slots and a single atomic candidate. Do not infer identity by name or apply reviewed rows as sequential independent edits. Foundation, artifact contract.
Layer transitions are explicit engineering decisions, not automatic propagation. Behavior-root navigation must establish the requested owner while preserving unrelated architecture presentation. Ports/allocation and contextual occurrences retain their distinct domain meaning. Source7 contract.
Hosted revision/source envelopes and ETag checks remain atomic; credentials stay out of persisted models and repository. Linux journal publication retains the selected no-replace invariant, with measured limits, not an overwrite fallback. Journal decision.
Repair/evaluate the compact palette informed by native Capella evidence; do not return to the rejected horizontal toolbar. Lifecycle projection remains isolated under cfg(test) until coordinated Scene integration and actual acceptance.
Preserve historical scope decisions as history. In particular, architecture-only SVG is implemented and behavior SVG was deferred; that is not proof of satisfying the revised release objective. Reassess older exclusions against current scope.

Current strategy

Finish the new workspace/chooser compile and native loop; independently review and measure the numeric foundation before expanding the ratified semantics. Integrate coherent external CLI/staged-source/B4 checkpoints while preserving ownership and source attribution. Use independent complete model/source oracles and exact identity/history comparisons. Publish coordinated runnable milestone prereleases; close actual analysis/library/source/API/native, cross-platform, service/package and independent end-state gates before the final handoff.

The archived Task Ledger and archived STATE preserve all older claims, decisions and evidence links exactly. Relative report links inside those byte-preserved files resolve from their original harness/ context. Their historical test totals and process holds are not live status.

14 KiB Raw Blame History