Integrate release recovery, semantic review, coverage and Windows packaging

This commit is contained in:
Codex
2026-09-06 16:31:55 -07:00
parent c091f80e6e
commit 2b2d2bc18b
174 changed files with 27635 additions and 127 deletions
+134
View File
@@ -0,0 +1,134 @@
# Current milestone native QA — deterministic fixture, 2026-09-06
Root is the sole native operator. This plan performs no native input and does not
declare UI acceptance. Fixture and validator are ignored local test artifacts,
not user data or production code.
## Fixture and production oracle
Pristine input: `.local/native-fixtures/state-actions.arcadia`.
Project UUID: `f0060906-0000-4000-8000-000000000000`.
Use a copied file under `.local/native-fixtures/runs/` for every destructive or
crash trial. Do not overwrite the pristine fixture or use a real project.
Expected current-source5 graph: 14 elements, 10 relations, one saved state view,
8 placements, no artifacts or traces. The production validator lives at
`.local/native-fixtures/validate-state-actions.rs`; it decodes through
`persistence::decode_with_report`, validates, proves canonical parse/model
equality/idempotence, and asserts the counts and projection geometry. It writes
`state-actions.canonical.arcadia` as a model oracle. Its exact run output and
pristine SHA256 are recorded in `state-actions.validation.txt` and
`state-actions.sha256.txt` when validation completes. An old source3 example was
used only as syntax reference; the fixture itself is new source5 with fixed IDs.
Production validation completed successfully using a separate direct-rustc helper
linked to the built core (no Cargo/shared-target writes): schema5, 14 elements,
10 relations, 1 diagram, 8 placements, 0 artifacts/traces, **0 issues**;
8 projected nodes and 3 routed edges; Ready y180 and nested region y430;
canonical parse equality and idempotence passed. Pristine SHA256:
`9CDE82608110E56AA9E14C9E33EB38976F53AED74AB013145D411D5743A0EC26`.
Open SA → Behavior → **Pressure operation** and its existing **Pressure operation
— saved state view**. All IDs below share `f0060906-0000-4000-8000-` with the listed
12-digit suffix. The System owner is Pressure controller (`000000000001`), machine
`000000000002`, Ready `000000000004`, nested Monitoring region `000000000005`.
| Visible Ready content, top to bottom | Selection / exact model oracle |
|---|---|
| `entry / Retained entry notes` | Existing prose on Ready, not a StateAction relation |
| `entry / Restore settings` | Entry work link `000000000030`, Entry, target function `000000000010` |
| `do / Monitor pressure` | Do work link `000000000031`, Do, target function `000000000011` |
| `exit / Release resources` | Exit work link `000000000032`, Exit, target function `000000000012` |
| `INTERNAL · Refresh status` plus its typed trigger/guard/effect summary | Internal transition `000000000033`, Ready→Ready, Sample tick Event `000000000013`, guard `pressure_valid`, effect work Monitor pressure |
| Monitoring region containing Start monitoring and Sampling | Actual semantic nested region; its top must be below all preceding rows |
Ready reserves 232 world units of header (64 basic +28 prose +84 typed actions
+56 internal row). There are exactly three projected/routed transition edges;
neither typed actions nor the internal transition are graph edges. The referenced
functions have actual Allocation to Pressure controller and no state-view node
placements. They are not Ready's contained children.
## Typed action and saved-view trial
1. At 1440×900, use Fit, inspect all content above, then use readable zoom. Click
each typed action row: corresponding relation and phase/target appear in
Properties, with selected-row highlight. Right-click resolves the same action
identity. Click Internal: inspect the actual transition. Selection must not
dirty the model, move nodes or display a phantom contained Function.
2. Repeat at supported minimum 1100×700, including scrolling/pan and opening the
inspector. Rows must remain independently selectable; source/target/phase and
Create/Cancel/Apply controls must be reachable with no overlap or clipped
essential controls. Capture visible evidence at a readable scale, not only Fit.
3. Follow/select target Monitor pressure through normal model navigation and
rename it `Monitor pressure QA`. Return to the state view: Do row follows the
new name, its relation/target IDs remain `...031`/`...011`. Undo restores the
original text; Redo restores QA text. Other phases and legacy prose stay exact.
4. Fold Ready: all typed/internal content and nested region disappear without
semantic deletion. Unfold: content, phases, reference IDs and child order return.
Save to a trial source file and reopen the actual file through the native UI.
Verify stored collapse choice, current name and all fixed IDs/positions. Use
source/core parsing for the saved model, not an object-count-only oracle.
5. Restore the original fixture for other trials. Record binary hash, viewport,
platform, saved file and serious runtime output. Desktop tests passing does
not substitute for these gestures; Linux and Windows evidence are separate.
## Explicit recovery trials
Run each from a fresh trial copy unless a combined case is explicitly desired.
Wait for the application's checkpoint completion signal/storage evidence before
the root deliberately terminates the fixture app to simulate a crash. Reopen and
choose the offered snapshot explicitly. A normal discard/close has a different
meaning and is not a crash test. Restore must reopen a detached unsaved project;
the original source file bytes must remain unchanged until an explicit new Save As.
| Draft surface | Authored state before crash | Restore oracle |
|---|---|---|
| Numeric property | Data → Retry budget (`...014`), change Integer minimum from `0` to raw `-`; attempt Apply to demonstrate rejection | Exact `-` survives in its field; accepted minimum remains 0, maximum4, default none, unit attempts. Repair to1 applies only after user action; undo returns accepted0. |
| Source | Textual model, append `// SOURCE_DRAFT_KEEP_ME` and an unterminated declaration/string; preserve an actual newline in raw text | Same raw bytes/lint location return, while graphics still show accepted fixture; no auto-Apply or generated-text replacement. Revert/repair is explicit. Include an additional dirty detached buffer in a separate trial if the UI offers it. |
| State behavior | Configure Ready→Idle transition; name `BEHAVIOR_DRAFT_KEEP_ME`, guard `pressure.pending`; enable timed trigger but leave its expression as three spaces. Submit rejects with time-expression guidance | Pending form remains on Pressure operation with name, guard, timed choice, whitespace and endpoints retained. No Event/transition created. Repair expression to `2 s` and explicitly submit only after confirming restored raw state. |
| General workflow | Start a relationship from Pressure controller; set name `WORKFLOW_DRAFT_KEEP_ME`, leave required target unset (or clear it), and demonstrate blocked submission | Same selected relationship kind, source, exact name and missing target remain. No relationship silently created by restore. Complete target/submit is an explicit new action. |
| Combined accepted+raw | Commit target rename `Monitor pressure QA`, then create invalid source draft with the marker above | Restored accepted graph has QA name with same IDs, plus exact unapplied invalid source bytes. It must not restore the pristine graph or apply the bad draft. |
| Semantic workflow | Use the root's separately validated OA/SA semantic fixture; stage a Candidate numeric `-`, a literal multiline Annotation expression and unfinished reference pair | Decisions, raw values and unfinished pair survive against the exact accepted model fingerprint; no restored commands execute. A snapshot with mismatched accepted model must reject visibly. This state-only fixture intentionally has no fake counterpart traces. |
For every restore: selection/owner/perspective must expose the retained draft;
changing page must not erase it; Cancel returns to the accepted model; failure to
decode one version/path must not overwrite source files. Verify a successful Save
As writes only the chosen new destination and no hosted credentials/destination
were resurrected. Recovery checkpoints are user-local and separate from model
files; no auto-recovery into the original file is accepted.
## Evidence completion
Append actual results with exact scope after root operation: fixture decoder
output, Windows normal/minimum, Linux normal/minimum, saved core/source comparison,
property/source/behavior/workflow/semantic recovery, and unchanged original-file
hash. Leave unoperated scenarios marked pending rather than inferring them from
adjacent successful tests.
## Native finding: a saved state view opened in Architecture
Root observed the fixture open on Architecture with the generic renderer: Ready
reserved the 232-unit header but omitted typed/internal rows, and the toolbar
offered function/boundary exchange tools. The dedicated Behavior canvas already
rendered the correct content. This was a workspace-routing defect, not missing
StateAction semantics or a reason to create a second renderer.
Bounded fix routes a StateMachine projection chosen during model open, diagram
selection, reveal or other navigation into the existing Behavior workspace, with
the exact saved view and its machine owner. Selection/raw property Draft survive;
the model/source are untouched. Existing pending-behavior guards remain in force.
Explicit Architecture navigation chooses a normal same-layer view, or an empty
Architecture workspace when none exists, so the user can create an architecture
view and is not bounced back to Behavior. The architecture chooser can still open
a saved state view explicitly.
Regression coverage includes constructor and actual source Open; selecting a
second saved view; revealing a transition into a named state view; no history or
source mutation; explicit Architecture navigation with/without a normal view;
raw invalid properties and pending behavior retention. The three focused routing
tests passed, and the full current desktop suite passed **435/435** on 2026-09-06
(`.local/state-routing-desktop.log`), including the latest restored-checkpoint
Home-list regression. The older fallback-owner first-move test now starts with
a deterministically preferred Allocation view; its captured-context and first
drag transaction assertions remain intact. Native recheck of the rebuilt binary
remains pending until recorded by the responsible operator.