Integrate release recovery, semantic review, coverage and Windows packaging

harness/DECISIONS.md

@@ -1,5 +1,14 @@
 # Architectural and product decisions
 
+## Current continuation decisions — 2026-09-06
+
+- Saving under another source entry basename is destination bookkeeping, not an engineering edit. Adopt an exact current save receipt without adding Undo or clearing Redo; rebase uniform entry names across retained history after collision and compilation checks. Stale receipts cannot redirect newer raw source. Native discovery and eleven focused regression results are in release-save-as-runtime-packaging.md; updated native verification remains required.
+- Home Resume returns to the last actual workspace. A saved state diagram opens in Behavior with its dedicated renderer; entering Architecture explicitly remains possible. Constructor choice among UUID-ordered views is not a guarantee that an application starts in Architecture. Tests of architecture placement must enter that workspace explicitly.
+- Coverage warnings describe missing engineering context while structural errors remain rejecting. Mission/capability support and work/exchange behavior coverage use actual explicit links and occurrence membership, not inferred performer allocation or descriptive state notes. The shared core diagnostics are exposed equally to source, desktop and REST; see release-coverage-diagnostics-design.md.
+- Portable release contents need the selected binary's complete runtime and notice inventory. Adding the gnullvm libunwind DLL resolves its ordinary import, but the application MIT license does not replace linked dependency notices. Archive hashes and clean-PATH launch are separate checks; neither alone establishes full release acceptance.
+
+The following older decisions retain their historical scope. Newer first-release decisions and the normative language contract supersede prototype exclusions.
+
 - **One typed model, three Rust crates.** `oa-core` owns semantics, validation, transactions, history, references, language and projection. `oa-desktop` is an Iced editor; `oa-server` is an Axum transport/store. A second GUI/text model, event framework or runtime plugin ABI would introduce unnecessary synchronization and extension complexity.
 - **Bounded OA/SA profile.** Typed element bodies determine layer/kind; separate records describe relationships, diagrams, realization traces and artifacts. SA has one System and external Actors; LA/PA deployment and executable simulation are outside V2. The normative reST contract and scope document state exact semantics instead of implying full Capella/SysML conformance.
 - **Nesting derives from meaning.** Semantic containment and leaf allocation feed independent diagram projections. A placement drag changes geometry, never ownership. Shared projection drives canvas, Fit and SVG. Scenario/state graphics project the same behavior records and select them directly; numbered routes lead to full transition details.
@@ -131,3 +140,65 @@ while the diagram retains its own camera/scroll state. Nesting both under the pa
 scroll supplied infinite height and clipped the fields at the supported minimum.
 Real Iced layout tests verify finite field space; native recheck remains required.
 
+## Private recovery and integrated continuation — 2026-09-06
+
+The branch audit selects c091f80 as the integrated production baseline: side-branch
+state/process/scenario/data/hosted/semantic work is present or patch-equivalent.
+The stale checkout's duplicate investigation stays in its named stash. New work
+continues on codex/release1-continuation rather than replacing accepted editors.
+
+Unsaved recovery uses separate per-session, versioned private checkpoints. Store
+the accepted authored source bundle and raw source/property/behavior/workflow
+drafts; regenerate validation and command previews on restore. Never serialize
+credentials, destination handles or reusable executable plans. Restored work is
+an unsaved copy requiring an explicit destination. Undo history is deliberately
+not restored: retaining a coherent current model and rejected input is the useful
+recovery boundary, while persistent history would add a separate migration and
+storage contract. Exact accepted-source validation precedes replacement of the
+currently open document.
+
+Checkpoint writes and restoration share workspace admission limits. A failed
+checkpoint must retain the last usable file. Late completions are scoped to the
+document ID, and discard/close waits for an outstanding writer before retiring
+its result. Model-file Save and private recovery remain distinct operations.
+Native crash/restart and exact21-file Save as evidence is recorded in
+release-current-native-verification.md; larger recovery/history requirements
+would justify revisiting these explicit bounds.
+
+## Semantic rows and state-view entry — 2026-09-06
+
+Annotation and Binding keys identify independent rows; replacing an existing row
+preserves its position, an identical Keep does not modify it, removal deletes only
+that row, and a new row appends. GUI composition and core materialization agree
+without normalizing untouched records into a different order. Core regressions
+cover Keep plus an unrelated Header Candidate in both directions and both row
+families.
+
+A persisted StateMachine diagram has one editing canvas and tool set. Opening or
+selecting it routes to the existing Behavior workspace, preserving exact diagram
+identity, selected object and raw property input. Explicit Architecture navigation
+selects an ordinary view or its empty state. This fixes the native-observed blank
+state-action header and inappropriate architecture connection tools without adding
+a second state renderer. Pending drafts remain subject to the existing guards.
+
+## OA communication means: selected representation — 2026-09-06
+
+The existing OA Interaction describes activity exchange; ordinary participant
+communication is a verified first-release gap. Independent representation and
+adversarial reviews compared a new CommunicationMean, widened BoundaryExchange
+endpoints and a first-class OA port contract. Select explicit CommunicationMean
+with OA Entity/Actor endpoints, orientation and carried items, reusing identified
+ExchangeAllocation links to Interactions. Existing BoundaryExchange keeps its
+port contract; legacy OA data is preserved without automatic conversion.
+
+This choice matches primary Arcadia/Capella method evidence and avoids inventing
+technical OA ports. Known actual performer mismatches reject allocation; missing
+performers are incomplete work, not inferred through role responsibility. Scenario
+direction must resolve explicit lifelines, and correlated Reply reverses the
+actual Call direction. OA participant/SA port counterpart choices must be scoped
+explicitly per exchange rather than corrupting global participant correspondence.
+See release-oa-communication-design.md and the independent critique for sources,
+alternatives and falsification tests. This is a representation decision, not an
+implemented or accepted feature; versioning and view contracts remain to be
+integrated with it. Revisit if realistic OA workflows demonstrate separately
+identified operational endpoint contracts that a participant relation cannot carry.