10 KiB
Process multi-selection evidence — 2026-09-23
This slice implements exact multi-selection and topology-preserving order for OA Process and SA Functional Chain. Desktop, independent-source and corrected Windows native checks pass within the scopes below. This is branch-specific evidence, not a release, combined integration or completion of multi-selection issue #29. Combined release publication remains with the integration owner.
The adapter design owns the selection, planning and lifecycle contract. The native evaluator design owns the independent fixture/oracle and discriminating gesture. Detailed evidence is separated into checks, source identity, render feedback, native trials, reviews and preparation failure.
Implementation and integration seams
Selection is transient and owner-scoped, preserving local occurrence/link and qualified path/preview-link identities. Primary controls Properties; qualified subjects stay read-only. Shift toggles, stationary member clicks collapse, and contextual membership/inspection is explicit. Feedback preserves canvas bounds. Visible reconnect handles win hit testing; groups cannot fall through to singleton mutations. Mixed/qualified movement refuses the whole set unchanged.
Local occurrences in one column move in source order into Before/After slots, preserving other-column indices and all ranks. [A,U,B,V,C], C then A After B, becomes [B,U,A,V,C]. Singleton order shares the planner. One SetSteps transaction records a change; invalid/no-op results create no history. Facts are captured once per press; plans cache destinations without pointer-time Project clones/Graph rebuilds. Feedback shows slot/count and source-order numbers.
Integration uses app::multiselect, Process App handlers, topology direct_selection.rs/group_reorder.rs, existing menus/transactions and shared Viewport modifier retention. Mounted tests split press/motion/release across App rebuilds and check snapshots, reconnect precedence, intermediate source/history and final order/Undo/Redo. Scenario has a shared-modifier regression, not multi-selection implementation.
Exact-subject failure and correction
Native run 1 on b153451... exposed a blocking identity defect: Back restored caller/camera but showed editable outer-reference Properties alongside qualified-leaf highlighting (frame 26). Baseline/mixed/qualified refusal saves passed three independent complete-Project unchanged checks, which could not detect UI identity. The run stopped before order/history/reopen acceptance. It exited 0 with empty logs and unchanged pinned binaries/fixture; it has no successful history-bytes receipt.
The correction remembers the requested qualified address, including nonprimary menu invocation. Back selects its validated leaf and refreshes read-only inspection. Select/EditProperties clears obsolete context after admission, including same-ID defining-leaf navigation; ordinary Open saves a local frame. Tests assert path, subject, draft, camera, source/history and ordinary return. Back restores the invoked singleton. Review 2 found no concrete regression; protective-test suggestions remain notes rather than claimed coverage.
Run 3 confirms current/nonprimary Open/Back, exact read-only caller subject, and Explorer navigation to outer reference and same-ID leaf with editable local Properties. Parent observations and the independent native review establish these UI results separately from saved-Project checks.
Source and test evidence
Gates retain commands/logs, artifact/helper hashes and unchanged 742-file maps/archives, including 71 vendored files and compile-time fixtures. Source receipts compare bytes with named Git blobs; captured HEAD alone cannot identify uncommitted source.
| Source | Matching evidence and result |
|---|---|
Historical 1711bff650dabb1df3a9bc37f19060d5db297feb, map d5acfcf6... |
full-desktop-1: 1,317 passed, 6 ignored; format-1 passed. Historical implementation, before final navigation corrections. |
b15345123a7feaf630ef24d45f591c76c6715778, map 7f5b3de4... |
desktop-3: 147 passed; strict lint-2, format-2, feedback-1 passed; core-2: 5 passed. Matching checker/GUI builds passed. Native run 1 failed as recorded above. |
Production correction ff712b24190342363d0275467e96f181872da6ad, map 1ba4ed41... |
desktop-6: 150 passed; full-desktop-2: 1,320 passed, 0 failed, 6 ignored. Strict core/desktop all-target lint-3 and format-3 passed. |
Evaluator clarification b743a10d51032dc1655b94fed5e49fbbbcee83f4, map f3fd180a... |
core-3: 5 passed; example-scoped lint-4, format-4, windows-build-2, native-build-2 passed. Production desktop/core library unchanged from ff712...; this is not a second full-desktop run. Matching GUI/checker used for native run 3. |
Failures remain preserved: desktop-1 94 passed/8 failed; desktop-2 104/1; lint-1 failed before the payload-size correction. desktop-4 rejected invalid Cargo filter placement before tests. desktop-5 ran 147/1 because the new fixture toggled already-expanded references closed, yielding an empty initial group; corrected setup/navigation pass in desktop-6. Preparation run 2 failed while generating its fixture with missing toolchain DLL environment (exit 3221225781); no GUI trial occurred. Run 3 corrected the environment and used a fresh directory.
Independent semantics, rendering and native history
The core checker compares complete Projects against immutable baseline/literal expected OA order without invoking the desktop planner. SA/reuse/trace are preservation sentinels. Primary A would be ambiguous: singleton-A After B equals the group result. The clarified evaluator adds unchanged-C rejection and a discriminating trial: membership [C,A], Inspect C, drag C After B. Group output is [B,U,A,V,C]; singleton primary/pressed C leaves the original order.
The native observer performed that sequence in run 3: click C, context Add A, Inspect C, verify two selected/primary C, then drag C After B. The visible column became B,A,C with U,V unchanged. One Ctrl+Z restored baseline; one Ctrl+Y restored reordered output; an in-process reopen retained it. The trial also observed mixed-set refusal and selected-anchor no-op. Run 3 closed normally at 2026-09-23T13:43:54Z, exit 0, empty stdout/stderr and unchanged pinned checker/GUI/fixture.
Routing remains visibly imperfect. In the reordered frame, A→U and B→V share portions of their orthogonal paths, obscuring endpoint connectivity. The independent review confirms this defect; unchanged link records do not establish readable routing. It is related to the intersection concerns in issue #32, whose original scope is Auto Arrange; this trial exercises Process order instead. No source-level attribution or routing fix is claimed here.
All eight saved snapshots passed the independent complete-Project checker: baseline, qualified-navigation, mixed-refusal, anchor-noop, reordered, undo, redo and reopened. The history-byte gate passed for all ten source files: baseline == undo == qualified-navigation == mixed-refusal == anchor-noop and reordered == redo == reopened, also checking immutable fixture equality for the baseline group. Only oa/behavior/process_oa_process.arcadia differs between groups. This lexical proof complements observed one-step history; equality alone cannot prove the user actions.
Actual headless WGPU App feedback covers OA/SA at 1440×900 and 100% zoom: stable source/selection/camera, legible insertion slot/count and source-order numbers. Raw RGBA, lossless PNG readback and parent inspection are preserved. These split-batch renderings establish actual production pixels, not a paused native drag or other DPI/window sizes. Native membership used context actions; held Shift-click is mounted-test evidence. Reopen is in-process, not cold restart. Aggregate removal, Allocation/Scenario adapters, native SA reorder, Linux/DPI and full accessibility remain outside this slice's acceptance.
Reproduction and package verification
From the named source checkout, use the documented project toolchain. Captures used Windows GNU LLVM, Cargo/rustc 1.98.1, one build job and incremental compilation disabled. Multiple test filters belong after --:
cargo test -p oa-core --example process_multiselect_native -- --test-threads=1
cargo test -p oa-desktop -- topology process_ canvas_workspace repeated_process menu --test-threads=1
cargo test -p oa-desktop -- --test-threads=1
cargo clippy -p oa-core -p oa-desktop --all-targets -- -D warnings
cargo fmt --all -- --check
cargo build -p oa-core --example process_multiselect_native
cargo build -p oa-desktop
Portable evidence checks use Python; feedback PNG verification also needs Pillow. They do not build or execute archived sources. From repository root:
python -B harness/multiselect-process-evidence-20260923/checks/verify.py
python -B harness/multiselect-process-evidence-20260923/source/verify.py --repo .
python -B harness/multiselect-process-evidence-20260923/feedback/verify.py --checks harness/multiselect-process-evidence-20260923/checks
python -B harness/multiselect-process-evidence-20260923/native/verify.py
python -B harness/multiselect-process-evidence-20260923/preparation-run-2/verify.py
The source check requires named commits locally; omit --repo . for offline receipt consistency. Before publication, all five verifiers and review pins passed against a fresh export of the exact 47 staged evidence files; exported bytes matched the working files. The first staging attempt omitted the two ignored empty preparation logs; inventory validation caught that omission before verification or publication, and they were explicitly staged. Package READMEs cover native reproduction with fresh fixtures and matching GUI/checker receipts. Preserve failures and immutable baselines. Package consistency, semantic equality, lexical history, rendered feedback and observed interaction remain distinct claims.