Record Windows scenario and codec gates with shared handoff

harness/history/2026-09-11-ledgers-before-gitea-migration/PLAN.md

@@ -0,0 +1,99 @@
+# First release execution plan
+
+**Linux execution deferred by the user, 2026-09-11 at15:28 UTC.** Wait for the
+user's instruction that WSL2 networking is resolved before further Linux builds
+or checks. Continue Windows development/testing; preserve already completed Linux
+evidence. No WSL/network diagnosis, restart or cache transfer is currently planned.
+
+**Resumed 2026-09-11 after the user returned and authorized Ubuntu installation.**
+The [reboot handoff](REBOOT_HANDOFF_20260911.md) remains the frozen checkpoint.
+WSL2 registration, Ubuntu shell and verified offline toolchain setup now pass.
+The user's newest VirtioProxy probe still fails; no VPN inspection/change is allowed.
+Native Linux numeric26/26 and CLI12/12 passed before deferral. Current Windows
+desktop3c9e6ee passes720/720 and strict Clippy. Build
+the matching GUI and complete native focus/SA creation verification. Review/fix
+the isolated core codec and canvas candidates before integration. Root serializes
+all local compilation and native work.
+
+Updated 2026-09-11. [PROJECT_GOAL.md](../PROJECT_GOAL.md) is the authoritative
+current objective. [STATE.md](STATE.md) records exact execution/evidence and leases;
+[TASK_LEDGER.md](TASK_LEDGER.md) separates facts, assumptions and decisions.
+The complete previous plan is [preserved byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/PLAN.md).
+Its earlier goal paths, active-process claims and Escape pauses are historical.
+
+## Outcome and working principles
+
+Deliver usable, complete OA/SA engineering workflows on Windows and Linux, with
+one precise reST contract and equivalent graphical, textual and REST editing.
+Constraints/calculations, quantities/units and reusable libraries are explicit
+requirements alongside behavior/state modeling, traceability and navigable help.
+Small and large models must be practical to author entirely in uncluttered text;
+evaluate complete authored and stabilized models, not abbreviated grammar sketches.
+Later Arcadia layers remain future scope. Compilation, metadata fields and polished
+screens alone do not satisfy this outcome.
+
+Retain the shared typed core, stable identity, semantic ownership/allocation distinct
+from geometry, validated atomic commands and exact source/history. Persistent
+extensions need coherent references/deletion, transition, source/migration,
+API/schema and reachable graphical authoring. Define observable acceptance before
+broad downstream changes. Do not silently promote a design proposal to a decision.
+
+## Capability milestones
+
+| Milestone | Work and acceptance | Dependency/current limit |
+| --- | --- | --- |
+| 1. Reliable direct authoring | Exercise actual minimum/wide native creation, allocation, editing, rejection, cancellation and history without implicit draft application or placement drift. Integrate compact named behavior creation after its coherent external gate. | Named creation4bb4aaf is imported; combined desktop676/676, format and strict Clippy pass at2cc4d11. Native80cf197 passes all four OA creations/history/reopen; new workspace/production chooser/focus source compiles and its five parent-focus tests pass; full720/native gates remain open. Workspace/B3/palette/recovery/packages are imported. Root owns this host's Cargo/native lease. |
+| 2. Coherent process/scenario work | Interactive ordered/explicit process editing; clicked root/nested scenario insertion; exact reuse bindings and caller return; measured canvas/zoom/scroll; visible scoped Create/Delete lifetimes. Validate model/source/identity and no unintended edit during navigation, including stale/deleted/retargeted references and recovery. | B1/B2/B3 regressions pass in the full suite. Local B4 remains cfg(test); Codex-ytr83r owns production Scene integration and its independent native gate. Use the independently self-checked oracle for native checkpoints. |
+| 3. Precise engineering analysis | Compare owned properties, analysis contexts and existing-data/external alternatives; settle quantity kind/unit/value, numerical policy, calculation/binding and Boolean/error/unknown semantics through falsifying examples. Implement mixed-unit budgets and reusable calculation/constraint definitions with full UI/source/REST parity and exact history/recovery. | B/shared-check/full-capture and R6/R7 architecture ratified. Declared numeric foundation passes 26/26 and strict core Clippy. Isolated schema8 static analysis now passes depth128/129, analysis28, numeric26 and strict Clippy after correcting the first stack-overflow failure. Source8, bounded codec/lifecycle/output, evaluator, approximate profile and full parity remain required. |
+| 4. Maintained reusable libraries | Compare package/definition/instance alternatives. Establish pinned identity/version/dependency closure, local edits, import bindings, detach and explicit three-way updates. Demonstrate two projects, two independent instances, offline reopen, conflicting updates and stable unaffected identities. | Exact pins plus verified same-origin typed compatibility, explicit source preparation/acceptance and three-way editable updates are ratified. Finite120-assertion experiment is not production contract/archive/consumer implementation. |
+| 5. Understandable complete engineering tasks | Close teaching, OA↔SA transition/reconciliation, typed state/data/interface, artifact, saved-view and hosted workflows. Establish complete text-only creation/refactoring/modular maintenance with stable identity. Replace concrete long homogeneous selectors with contextual/searchable bounded choices; verify large models, keyboard access, minimum sizes and failure/recovery. Keep offline guide/examples aligned. | A complete warning-free text-only model probe passes source/identity/rename/reparent/file-move checks; measure usability separately. Chooser production integration and contextual source creation are present; their combined focus/workspace/compiler/native gates remain open. CLI is imported as bc311bc and passes 12/12 integration tests locally. Reassess current goal rather than copying historical scope exclusions. |
+| 6. Release confidence and delivery | Fresh current Windows/Linux suites, strict Clippy/format, normative reST/OpenAPI/migration/examples; actual GUI/service transport, optimized builds, runtime/notices/archive/provenance/checksums and clean-environment launch. Fresh independent requirements/domain/parity/architecture/UX/runtime review; resolve material findings, then final handoff. | Integrates all preceding capabilities. Linux runtime remains open; use an approved supported environment, preserving historical failed/denied experiments. Historical previews are not final distributions. |
+
+Milestones are capability gates, not a rigid serial schedule. Root can continue
+build/native acceptance while independent foundational investigations compare
+alternatives. Libraries and analysis share definition-resolution assumptions and
+must converge coherently before broad model/schema edits. User workflows and
+cross-representation evaluators guide implementation boundaries.
+
+## Immediate execution sequence
+
+1. Stage the matching Windows GUI after3c9e6ee passes720/720 and strict Clippy,
+   then verify real engineering tasks. Verify the retained SA
+   State draft, parent focus, creation/history, Reuse, Fragment and final reopen.
+2. Implement the user-required common canvas interactions for Process and Scenario
+   in issue2 after the bounded shared-viewport/domain-constraint design decision.
+   Treat this as direct-manipulation acceptance, not a tool-shelf restyle.
+3. Exchange exact verified commits with the separate host, preserving its workspace
+   ownership. Direct authenticated publication works. CLI01b and exact evidence2ec
+   are imported; next contextual-source and B4 handoffs retain their owners.
+4. Use the self-checked [scenario oracle](scenario-authoring-contract.rs), follow
+   its [native procedure](fixtures/scenario-authoring/README.md), and compare exact
+   whole snapshots for Undo/Redo/reopen at minimum/wide sizes.
+5. Exact numeric/unit/work-meter foundation26/26 unit tests pass at7d14bd0; complete
+   its strict gate while actual schema8 core work proceeds in an isolated worktree.
+   Extend actual model/source/API/GUI under the ratified
+   B/R6/R7/full-capture and exact-pin/typed-compatibility contracts. Preserve explicit
+   approximate numeric, complete consumer/archive and two-project release gates.
+6. Update current ledgers and durable decisions when evidence changes the plan.
+   Reassess unresolved assumptions before expanding downstream implementation.
+
+## Coordination and evidence rules
+
+Use Gitea issue #1 and Wiki for current ownership/handoffs; read before resuming.
+Codex-956atf, Codex-9e8r6t and Codex-ytr83r are distinct hosts. Cargo/native leases
+are host-local; shared source ownership is coordinated.9e8r6t owns the next runnable
+Windows named-authoring prerelease and contextual-source/CLI; ytr83r owns B4 Scene
+and its platform gates. Root owns local chooser/numeric/workspace integration.
+Updated AGENTS requires runnable milestone prereleases. User#178 authorizes existing
+MCP credential reuse for Git/REST; secrets must never be printed or committed.
+Direct branch publication replaces bundle work when available; old exact bundles
+remain valid evidence and transfer branches must not be merged.
+
+Record exact source/binary, command exit, test scope and native model/source oracle.
+Do not add focused reruns to full-suite totals or transfer old binary acceptance.
+Older denied Linux workaround instructions remain applicable to that action; do
+not bypass them. Older stopped native sessions do not prevent currently authorized
+native work. The [archived plan](history/2026-09-10-ledgers-before-continuation-refresh/PLAN.md)
+and [archived progress](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md)
+preserve all previous strategy and scoped evidence; archive report links resolve
+from their original `harness/` directory.

harness/history/2026-09-11-ledgers-before-gitea-migration/STATE.md

@@ -0,0 +1,259 @@
+# Progress Ledger — first release
+
+**User direction at15:28 UTC, 2026-09-11: defer Linux builds and checking.**
+Resume that work only when the user instructs us that WSL2 networking is resolved.
+All previous Linux commands are terminal; do not run guest checks, cache transfers,
+restarts or network diagnosis. Retain their completed evidence and current WSL
+configuration. Windows implementation, tests and native acceptance continue.
+
+**Resumed after the user's virtualization change and reboot, 2026-09-11.**
+The [frozen reboot handoff](REBOOT_HANDOFF_20260911.md) preserves source, evidence
+and the private raw SA State draft. Local boot is 13:57:52.500 UTC; clean starting
+HEAD is `8d55d2d`. Ubuntu26.04 installation, official image hash, WSL2 registration
+and actual Linux shell now pass; see [setup evidence](release-wsl-956atf-20260911.md).
+The user's newest issue1/comment328 VirtioProxy-only configuration is applied;
+its actual route/ping/GitHub DNS+HTTPS probe failed. It remains configured. The VPN
+is immutable, including no inspection; the earlier mirrored diagnosis is historical.
+Verified offline dependency/toolchain installation has completed; see
+[Linux dependencies](release-linux-dependencies-956atf-20260911.md). Native Linux
+numeric26/26 and CLI12/12 now pass from exact8d55d2d; the immutable ELF CLI also
+launches successfully. [Linux gate](release-linux-core-cli-gate-956atf-20260911.md).
+Root owns all Cargo/native. No worker may compile or restart WSL.
+
+The isolated schema8 checker's initial depth128 stack overflow is corrected with
+bounded iterative continuation frames. Exact depth128/129 and call32/33, full
+analysis filter28/28, numeric26/26 and strict core all-target Clippy now pass.
+[Execution evidence](release-analysis-core-iterative-gate-20260911.md) preserves
+the first failure and corrected inputs/binary/logs. `analysis_core_review` completed
+independent source review with no material new finding. The correction is committed
+and pushed as isolatedcdebb49. `analysis_core_resume` now owns its next bounded
+core codec/lifecycle implementation; language.rs remains reserved for 9e8's
+syntax-only outline seam. Source8/evaluator/end-to-end analysis remain open.
+
+The two parent-focus corrections and five mounted regressions are frozen and
+independently reviewed with no unresolved material source findings. Root scoped
+rustfmt and whitespace checks pass. After correcting12 installed-Iced API/test
+integration errors, the five actual parent-focus regressions pass; immutable
+275-input/binary/log evidence is in [the gate report](release-scenario-focus-gate-20260911.md).
+The full720 suite at8895dd2 finished716 passed/4 failed,0 ignored,377.91s. Its log
+SHA256 is `4A765FFAD4B08EC0B9D6B8399CF841E3C776051EA07B4433BB47C8E6BDC4C67F`.
+Root corrected session replacement retaining old scroll through same-length keyed
+children and mirrored the zero-reveal-axis guard in parent focus. The chooser
+worker corrected fractional focus drift and prepared valid rationale/attachment
+fixtures with exact assertions retained; [diagnosis](release-chooser-full-gate-diagnosis-20260911.md).
+The combined focused reruns now pass14/14 chooser and18/18 scenario-workspace,
+including all four former failures. The immutable512-input executable at80f2588
+now passes the full720 suite,0 failures/ignored,330.42s;
+[corrected gate](release-chooser-correction-gate-20260911.md).
+Independent root session/reveal follow-up review found no material new issue.
+Strict desktop Clippy found three cleanup/event-size findings; correction3c9e6ee
+now passes strict Clippy in2m52s and its own720/720 full suite in339.37s after
+4m09s warning-free compile. Root is building the matching Windows GUI. No post-reboot GUI acceptance
+is claimed yet. The isolated canvas correction review found three remaining P2
+issues in toolbar batching/lifetime admission and mounted runtime ordering;
+`behavior_canvas_resume` owns R1/R2/R3 correction with no compiler lease.
+See [current canvas review](release-behavior-canvas-corrections-review-20260911.md).
+Core codec/lifecycle source is frozen and uncompiled; independent source review
+found no confirmed material defect. Root owns its upcoming Windows subprocess/build gates.
+Gitea coordination: #1/328, #335, #337, #338 and issue2/332.
+
+Updated 2026-09-11, coordination through Gitea #245 and issue2. This ledger describes the
+Codex-956atf checkout; external-host evidence is labeled separately. The entire
+previous ledger is preserved [byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md).
+Historical dates, binaries, process IDs and stopped-session instructions in that
+archive are evidence history, not current status or authorization.
+
+## Current objective and source
+
+Deliver the complete, usable OA/SA first release in [PROJECT_GOAL.md](../PROJECT_GOAL.md),
+including graphical/source/REST parity, constraints/calculations, quantities/units,
+reusable model libraries, traceability, offline guidance and Windows/Linux release
+acceptance. Direct behavior/scenario authoring and reduced cognitive load remain
+immediate priorities. Complete small and large models must be practical to develop
+through uncluttered text alone. The release is incomplete.
+
+Local branch: `codex/behavior-authoring-20260910`. Current full desktop checkpoint
+is `3c9e6eeb64ce3efc03b29890b82199a42c21f335`:720/720 and strict Clippy passed.
+Earlier80f2588 also passed720/720;3c9e6ee fixes its three strict Clippy findings.
+Historical2cc4d11 passed676/676 and strict Clippy. Native evidence
+comes from immutable80cf197; no post-reboot GUI gate has run. Root's current
+workspace, production chooser, parent focus and editing-session fixes are in80f2588.
+This branch also includes exact numeric foundation7d14bd0, imported CLIbc311bc
+and evidence/nativedc0f2e1. Numeric26/26 unit tests and strict core all-target Clippy pass. Shared
+instruction ancestrycab01c3 is merged asc7ed894, retaining the exact uploaded goal.
+The authoritative goal was copied byte-identically from attachment
+`a49d1780-25d5-4778-ad68-6140c60e4207/goal-objective.md`; SHA256
+`DD58F75C93D55FE16ED141A23D834898FB6EBC625AE7E7AE379DA552A8312435`.
+See [Task Ledger](TASK_LEDGER.md) for knowledge/decisions and [Plan](PLAN.md)
+for capability acceptance. Older goal paths are superseded.
+
+## Completed work and evidence
+
+The creation bundle was fetched anonymously and verified at105022 bytes,
+SHA256 `0DEFAE91A56430076C432758F923BC0675911DA9FA7588C9961FF15F47EAEBF6`.
+Its coherent commit adds named Process/Chain/Scenario/Machine drafts, bounded
+owner search, recovery/selection guards, offline guide and measured textual
+examples. The duplicate Sensor correction was not reapplied. Both hosts' report
+additions and exact experiment bytes are retained; this host's goal and ledgers
+remain authoritative locally. External653-test/native evidence is attributed in
+[its integrated report](release-integrated-gates-20260910.md), not claimed as a
+local run. The separate isolated chooser at `c4e1580` passed13/13 mounted tests
+under cfg(test); it is not a production selector yet.
+
+| Scope | Current evidence and limits |
+| --- | --- |
+| Reproducible local toolchain | Ignored `.local/toolchain/env.ps1` selects Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW 20260908 (clang 23.1.1), with one Cargo job. First cold desktop test build completed in 58m03s; one unused import warning was corrected separately. |
+| B1 process authoring | `01bb52a` includes interactive empty/ordered/explicit topology and presentation-only inferred paths; first conversion preserves ordered adjacency atomically. All topology regressions pass within the current full desktop suite. Native acceptance is pending. |
+| B2 scenario authoring | Clicked root/operand/slot and optional lifeline feed Action/State/Reuse/Fragment adapters. Pointer-to-App, cancellation, stale-event, recovery and history tests pass within the current full desktop suite. |
+| B3 caller navigation and workspace | External `3978bbe` imported as `865cd55` fixes visible-owner restoration, pending-draft guards and remaining-height workspace. Root `80cf197` keys the viewport Sensor by document/scenario; a real mounted regression failed before the fix and now passes. The full suite is green; actual OA caller return and source-neutral navigation pass. Remaining native scope is explicit below. |
+| Architecture palette | External palette commit `7d1df4f` was cherry-picked as `aed40d7`, retaining local invariant tests. Captured Escape, stale Submit/raw retention and bounded card fixes are source-integrated. External native results do not transfer to this checkout. |
+| Typed stored-history F1 | `b6b76ef` fixes nullable constructor cache discrimination; `4ecad78` fixes NotApplicable seeding by checking actual enum alternatives. Thirteen focused tests passed and are included in the current full suite; core validation remains authoritative. |
+| Lifeline lifecycle B4 | `eb5161b` adds pure local/scope-aware lifecycle projection with ten tests, declared under `cfg(test)` only. It is not production Scene wiring or native acceptance. [Design](release-scenario-lifecycle-design-20260910.md). |
+| Native scenario oracle | [Independent checker](scenario-authoring-contract.rs) compiled/self-checked and verified the generated62-element/two-source baseline. Native OA Action/State/Reuse/ALT-fragment, each exact Save/Undo/Redo, and final native reopen pass at minimum size; caller identity/scroll return and source-neutral navigation pass. Remaining prescribed checkpoints are open. [Native scope](release-scenario-native-20260911.md), [oracle inputs](fixtures/scenario-authoring/README.md). |
+| Normative documentation | Strict Docutils 0.22.2 language HTML regeneration passed. `semantic_schema.py --check --validate` passed 72 source7 fixtures, 204 schemas, 14 families/90 scalar leaves. These are documentation/schema gates, not a Rust build or runtime pass. |
+| Comparable-product study | Actual isolated Capella 7.1 scenario/activity/lifeline/LOOP creation was saved and XML inspected, then closed normally. [Report](release-capella-scenario-benchmark-20260910.md). Current Studio native evidence is recorded separately. |
+| New requirement audit | [Independent delta report](release-requirements-delta-20260910.md) establishes that current expressions/unit labels are descriptive and source includes are not maintained cross-project libraries. Refined B/R6/R7 and exact-pin/same-origin compatibility contracts are ratified; current source7 does not implement them. |
+| Packaging integration | External `b98f135` imported as `6d2b961`; all 25 checked-in exact notices match the manifest. `scripts/test-package-artifacts.py` passes 11/11 and `scripts/test-windows-notices.ps1` passes synthetic package/runtime/source/font checks. Actual optimized distributions and clean-environment launches remain open. |
+
+## Active work, ownership and unresolved findings
+
+Root Codex-956atf owns this host's integration, serialized Cargo and native UI.
+The source2cc4d11 gate completed with exit0: **676 passed, zero failed/ignored**,
+tests611.24 seconds after warning-free compilation10m47s. Command:
+`cargo test --locked -p oa-desktop --bin arcadia-studio -- --test-threads=1`.
+Log `.local/logs/desktop-creation-chooser-20260911.log`. Immutable executable
+`.local/creation-chooser-20260911/tests-2cc4d11/arcadia-studio-tests.exe`, SHA256
+`8D7FB35071F155B3BD07CE1885A1136B2D2EF71C4FF8C704665202499C86A721`.
+Its manifest pins256 tracked input hashes. Format passed; strict all-target desktop
+Clippy passed7m18s after the isolated manual-clamp correction. Final logs are copied
+beside the immutable binary. These gates supersede the historical642 total, not the
+current uncompiled working changes. Focused counts are included, never additive.
+
+Actual native Studio remains `.local/native-qa/studio-80cf197/`, GUI SHA256
+`A5ED6DF334B1BFB620425AFDF3E863F0B522990E6FB47C6C401A71CF4443954A`.
+That GUI build passed3m28s. At1100x700, all four OA creation checkpoints and final
+reopen now pass complete Project/two-source prediction and exact UUID restoration.
+Preserved OA snapshots end in `oa-reopened/`; separate SA Action Save/Undo/Redo
+also passes complete oracle/history comparisons, ending in `sa-action-redo/`,
+63objects. The GUI is saved at SA A caller, no active form. SA State/Reuse/Fragment
+and final reopen remain. No new-fix acceptance is inferred.
+[Native report](release-scenario-native-20260911.md) records details and two real
+workspace findings: new forms retain downward scroll, and opening a form can hide
+its clicked marker below the reduced canvas. Root has written a fresh form-session
+key, guarded Name focus, one-time marker reveal and three meaningful mounted/App
+regressions. They are not yet compiled. The isolated chooser's corrected realistic
+typing/paste/IME gate passes13/13; production inspector/review integration is now
+source is now frozen, with exact row/facet/group/attachment guards. Independent
+review exposed and closed three focus defects at source level, including the
+legitimate Review rationale input. Fourteen new App/mounted tests await execution;
+the earlier isolated13 is separately scoped. [Review](release-reference-chooser-production-review-20260911.md).
+
+User [issue2](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2)
+requires Process and Scenario to behave as actual canvases like architecture/state
+diagrams. Current scrollable diagrams/tool shelves do not close that requirement.
+behavior_audit owns a bounded shared-canvas design; root re-observed the saved
+native scenario and its restricted viewport, without new model input.
+
+The [baseline contract](release-analysis-baseline-contract-20260911.md) supplies a
+complete17-UUID proposed model,11 exact fixtures, explicit ModelBaseline/Case,
+property bases and shared checks. Its transport fixtures are not parser/evaluator
+acceptance. The [library contract](release-library-compatibility-contract-20260911.md)
+has120 executed finite-prototype assertions, separate-process reopen and11 complete
+expected/reopened file comparisons. Final81-file manifest was independently
+verified; preliminary output is retained and labeled superseded. All166 experiment
+files retain exact Git bytes. Root ratified B/R6/R7/full private capture, nominal
+typed compatibility alongside exact pins, explicit source normalization and OA/SA
+dispositions in [DECISIONS](DECISIONS.md).
+
+The [independent refined review](release-refined-contracts-review-20260911.md)
+passes292 fixture/identity checks but finds C1:333 stored AST nodes can expand to
+over2billion calls. Request-local dynamic/numeric work accounting is mandatory;
+static depth/node limits alone fail. C2 is a finite-prototype threshold-unit gap,
+not a passing production type-checker. Exact arithmetic, unit/dimension operations
+and terminal work meter are declared/committed at7d14bd0; their26/26 unit gate has
+[exact source/artifact evidence](release-analysis-numeric-gate-20260911.md).
+requirements_delta now owns actual schema8 definitions, expressions, commands,
+references, migration and static admission in the isolated
+`.local/analysis-core-worktree-20260911/`, based at7d14bd0. It remains uncompiled.
+semantics_critic reviews the bounded decoder strategy separately; existing default
+recursion rejection stays until a full allocation/lifecycle gate is justified.
+Root owns compilation. Numeric/runtime and static-admission ceilings remain
+explicitly provisional pending measured gates. Approximate engineering calculations,
+full evaluator/model/source/REST/GUI parity and actual library maintenance are open.
+
+Codex-9e8r6t and Codex-ytr83r are separate hosts/teams. The former owns contextual
+prerequisite creation and source CLI. CLI01b76a1 is imported asbc311bc; exact
+corrected evidence2ec72d4 is imported atdc0f2e1, preserving root's separate native
+report. External675 staged-source and CLI12/183-assertion results remain externally
+attributed. Its runnable Studio/server preview release1 and standalone CLI preview
+release2 are published; see their release notes for exact source/runtime limits.
+Strict language/API HTML regeneration and the72-fixture source7 schema gate pass
+locally after that evidence import. Codex-ytr83r owns B4
+production Scene wiring, independent native oracle and local Linux route. Its
+rendering source has independent criticism but no passing build/native gate yet.
+Do not duplicate these changes. Preserve root's distinct scenario-scroll/focus hook
+when integrating other hosts' small App/behavior bridges.
+
+Updated AGENTS4b8465c8 adds concise shared maintenance to milestone releases. Gitea
+user#178 explicitly authorizes programmatic reuse of existing MCP credentials for
+Git/REST and relevant commits/tags/prereleases, without printing or committing them.
+Direct authenticated push/readback passed on this host, most recently publishing
+dc0f2e1. The subsequent owner's instruction commitcab01c3 has been fetched and
+merged locally; no force push or additional credentials are required.
+Historical verified bundle exchange remains reproducible: c6d296a bundle on
+`codex/behavior-transfer-20260910`,334830 decoded bytes, SHA256
+`526A80E2D32ED0E57A7B2372B5F02D4652E8751DFEBA81953C4F045225D6AACB`,
+prerequisite1797516. Both other hosts received it. Never merge transfer branches.
+Older bundles/logs retain historical scope in Git and the archived ledger.
+
+## Remaining gates and highest-value next actions
+
+1. Freeze and compile the new workspace/chooser integration, resolve focused
+   failures, then build an immutable GUI and verify both native workspace fixes.
+   The676-test gate is complete for2cc4d11; new changes require their own evidence.
+2. Publish coherent checkpoints directly; integrate9e8r6t's next staged-source
+   work, then ytr83r B4 only after its coherent handoff. CLI/evidence import is done.
+   Preserve ownership and distinguish every external versus local gate.
+3. Use the self-checked independent oracle to exercise current Studio at
+   minimum/wide sizes: named creation, direct process/scenario edits, nested reuse,
+   caller return, lifeline lifecycle, invalid/cancel/recovery, Save/Undo/Redo/reopen.
+   Compare complete model/source and exact identities, not screenshots alone.
+4. Compile/review/measure the numeric foundation, then implement the ratified
+   analysis/library contracts with shared-core/source/API/graphical parity. Use real
+   budgets, unit/kind failures, complete text-only and two-project update workflows.
+   Integrate the bounded chooser and run its actual keyboard/minimum-size gates.
+5. Complete current teaching, transitions, semantic review, state/data, saved-view,
+   artifact, hosted transport and migration acceptance. Historical scoped passes
+   remain useful references, never blanket current acceptance.
+6. Complete Windows/Linux build/test/native/runtime and optimized package gates,
+   notices, provenance and clean-environment launch. WSL has no installed distro
+   here; Linux acceptance remains open. Historical denied guest workarounds must
+   not be retried or split to bypass review. No host restart is authorized.
+7. Run fresh independent cross-disciplinary end-state review, resolve material
+   findings and reconcile specification/help/coverage before final handoff.
+
+## Reassessment
+
+Meaningful progress continues: concrete interaction defects have been found and
+corrected,676 desktop tests pass and all four OA native creation/history/reopen
+checks pass. Contracts have converged through independent falsification; numeric
+implementation now addresses the exposed dynamic-work risk. The revised semantic
+requirements are no longer hidden behind metadata.
+Passing older suites or accumulating prose would not close the user problem.
+Current highest information gain comes from actual build/native results and
+independently criticized foundational examples, while preserving existing identity,
+source and atomicity contracts. Replan when those results falsify a proposal.
+
+## Historical evidence access
+
+The [complete prior STATE](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md)
+retains exact historical binary hashes, counts, logs, process closure, bundle hashes
+and all report links. Links inside the byte-preserved archive retain their original
+`harness/` context; resolve those relative report paths from `harness/`.
+Useful direct entries: [source7 native](release-source7-native-acceptance-20260907.md),
+[teaching](release-teaching-native-20260906.md),
+[artifact native](release-artifacts-native-20260906.md),
+[coverage baseline](release-current-coverage-20260906.md),
+[Linux gate](release-source7-linux-gate-20260907.md),
+[Linux cross-build](release-source7-linux-gui-cross-build-20260907.md),
+[denied boot experiment](release-source7-linux-server-corrected-gate-20260907.md).

harness/history/2026-09-11-ledgers-before-gitea-migration/TASK_LEDGER.md

@@ -0,0 +1,251 @@
+# Task Ledger — first release
+
+**Given, newest user direction (2026-09-11,15:28 UTC):** Linux builds and checking
+are deferred until the user instructs us that WSL2 networking is resolved. No
+guest work is active. Preserve prior evidence and leave networking to the user;
+continue Windows development. This is a temporary acceptance deferral, not a
+removal of cross-platform requirements or permission to claim Linux release readiness.
+
+**Current state: resumed after the user's reboot, 2026-09-11.** The frozen
+[reboot handoff](REBOOT_HANDOFF_20260911.md) preserves the restart evidence.
+Given: the user enabled virtualization and explicitly authorizes installing
+Ubuntu26.04. Verified locally: boot 13:57:52.500 UTC, clean starting HEAD8d55d2d,
+no registered distro/Ubuntu package or installer/Cargo at preflight, official
+catalog offers Ubuntu26.04, and 27,652,579,328 bytes free at preflight. Installation,
+official image SHA256, WSL2 registration and actual Ubuntu26.04 shell now pass.
+The user's newest VirtioProxy-only configuration is applied and retained; its
+prescribed local route/ping/GitHub DNS+HTTPS check failed. Earlier mirrored
+recommendations are historical. The VPN is immutable, including no inspection.
+Verified offline APT/Rust/Cargo-cache installation has completed successfully.
+Root's native Linux numeric26/26 and CLI12/12 gate from exact8d55d2d passed; the
+copied ELF CLI also launches successfully. Desktop/WSLg and optimized release
+acceptance remain open. Current leases/evidence are in STATE.md.
+
+Updated 2026-09-11. [STATE.md](STATE.md) owns current execution/evidence;
+[PLAN.md](PLAN.md) owns capability milestones. The entire former Task Ledger is
+[preserved byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/TASK_LEDGER.md).
+Its old goal references, aggregate test claims and stopped-session directives retain
+historical scope. New semantic decisions are recorded explicitly in DECISIONS.md;
+prototype results retain their separate scope.
+
+Current full desktop checkpoint3c9e6ee passes720/720,0 failed/ignored in339.37s,
+and strict Clippy in2m52s. Earlier80f2588 passed720/720 in330.42s,
+including corrected chooser14 and scenario-workspace18;3c9e6ee fixes its three
+strict Clippy cleanup/event-size findings. The matching GUI build is running.
+Historical2cc4d11 passed676/format/strict Clippy; native80cf197 passes four OA creations, exact history and
+reopen. Separate native SA Action/history also passes. Exact numeric foundation
+is declared at7d14bd0 and passes26/26 unit tests plus strict core all-target Clippy.
+Workspace/production chooser and corrected parent-focus/editing-session changes
+are included in the full720 pass. Post-reboot native GUI acceptance remains open.
+Isolated schema8 static core now passes required-depth,
+analysis28, numeric26 and strict Clippy after the first real stack-overflow failure;
+source8/codec/evaluator/parity remain open. The codec/lifecycle candidate is now
+frozen and uncompiled, with no confirmed material finding from independent source review. The isolated canvas
+correction review found three remaining P2 findings in toolbar input lifetime and
+test runtime ordering; its author owns their bounded correction. External results retain
+their host/source attribution.
+
+## Goal and success criteria
+
+Deliver the usable, feature-complete OA/SA first release specified in
+[PROJECT_GOAL.md](../PROJECT_GOAL.md). It is the exact copy of the user's revised
+`a49d1780-25d5-4778-ad68-6140c60e4207/goal-objective.md`, SHA256
+`DD58F75C93D55FE16ED141A23D834898FB6EBC625AE7E7AE379DA552A8312435`.
+
+Success requires coherent explicit semantics, practical engineering workflows,
+equivalent graphical/textual/REST behavior, real Windows/Linux runtime evidence,
+recoverable authoring, relevant automated evaluators, precise documentation,
+reproducible packages and fresh independent cross-disciplinary end-state review.
+No known blocker or high-impact finding may remain unresolved. Later Arcadia
+layers remain future scope. Code, a passing slice or an attractive screen alone
+cannot establish completion.
+
+## Given facts
+
+- Rust/Iced desktop and a deployable REST service serve system engineers. OA/SA
+  transitions in both directions must be understandable, explicit and useful.
+- The revised goal explicitly requires constraints/calculations, quantities/units,
+  reusable model libraries, state/behavior modeling and strong standardized
+  specification/API, as well as textual/graphical notation and artifact traceability.
+- Human/AI/Git-friendly source and a concrete unambiguous reST specification must
+  match graphical editing. The source editor needs highlighting/linting; help must
+  be offline, concise and navigable.
+- The newest explicit goal requires uncluttered notation that reduces cognitive
+  load and supports development of complete small and large models using text alone.
+- Direct behavior/scenario diagram authoring and reduced cognitive load are current
+  priorities. Long homogeneous selectors and bloated persistent creation controls
+  are rejected. Study actual Capella's useful domain workflows and nesting without
+  mechanically copying its interaction problems.
+- The user authorizes autonomous bounded engineering, native Capella/Studio
+  evaluation and explicit independent delegation, exclusively with GPT-6 Astra
+  at effort appropriate to the question. Root owns synthesis/integration.
+- Project instructions require Gitea coordination, ownership preservation and
+  durable handoffs. Current root reserves one Cargo/native operator per host.
+  Updated AGENTS4b8465c8 requires coordinated runnable milestone prereleases and
+  concise current shared maintenance with unique historical evidence preserved;
+  user Gitea#178 authorizes programmatic existing-MCP-credential reuse for relevant
+  Git/REST publication without printing/committing secrets. Restart and usage reset
+  remain unauthorized.
+- Gitea issue2 explicitly requires actual Process/Scenario canvases with the same
+  interaction approach as architecture/state diagrams. Existing pointer edits
+  inside scrollable projections do not by themselves satisfy that requirement.
+
+## Verified facts
+
+- The independent scenario checker compiled with warnings denied and passed its
+  self-check, deterministic fixture generation and complete baseline check on this
+  host. Its eight OA/SA checkpoints and exact UUID/source restoration comparisons
+  are evaluator evidence, not native Studio acceptance. Exact inputs/hashes are in
+  [the fixture instructions](fixtures/scenario-authoring/README.md).
+
+- The historical native implementation is `80cf197` on `codex/behavior-authoring-20260910`, following
+  baseline `1797516`. Local commits cover B1/B2/B3 authoring, nullable history cache
+  (`b6b76ef`), external palette integration (`aed40d7`), cfg(test) lifecycle projection
+  (`eb5161b`), history seed correction (`4ecad78`) and exact-identity native oracle.
+  Later imports add focus recovery, exact packaging notices and scenario workspace/
+  owner restoration. Root80cf197 fixes document/scenario viewport Sensor identity
+  with a real mounted red-before/green-after regression.
+- This fresh host has task-local Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW.
+  The integrated2cc4d11 desktop suite passes676/676, zero failed/ignored, with a
+  warning-free build; formatting and strict Clippy pass. History, pure lifecycle,
+  creation and isolated chooser are included. New working code still needs its
+  own gate. Native80cf197 evidence is separate. [Exact hashes/logs](STATE.md).
+- Strict language HTML regeneration and the source7 OpenAPI checker passed locally:
+  72 fixtures, 204 schemas and 90 scalar leaves. Actual isolated Capella scenario,
+  activity/lifeline and LOOP creation was saved/inspected; this is reference study,
+  not Studio acceptance. [Native benchmark](release-capella-scenario-benchmark-20260910.md).
+- Core/source7 already implements substantial direct behavior, typed data/ports,
+  contextual chain links, maintained message-operation identity, semantic reviews,
+  artifacts, hosted source envelopes and recovery. Historical absence claims must
+  be checked against code and newer scoped evidence, not copied forward.
+- [Requirements audit](release-requirements-delta-20260910.md): Constraint and other
+  expression strings are descriptive, with no calculation/binding/result evaluator;
+  unit strings persist/inherit without dimensional compatibility or conversion;
+  named types/sequence/scenario reuse and includes exist, but there is no maintained
+  cross-project package/version/instance/update contract. These are explicit gaps.
+- The same audit identifies concrete unbounded Constraint target choices and generic
+  expanded collection editors. Explorer already has hierarchy/search/paging; the
+  problem is targeted, not a claim that all selection is flat.
+- Gitea #79's same-selected-ID/visible-owner defect is fixed in the imported
+  scenario checkpoint; owner restoration and pending-draft guards pass current
+  tests. B4 independent review #114 adds Scene integration requirements for actual
+  lifetime extents, branch-local activation clipping, incomplete lanes and self arrows.
+- Codex-9e8r6t and Codex-ytr83r have independent host-local Cargo/native leases.
+  Named creation/workspace/palette/package integration is imported here.9e8r6t's
+  coherent CLI/evidence checkpoint01b76a1 awaits import; it owns staged-source and
+  the next runnable Windows prerelease. ytr83r owns production B4 and its native
+  oracle.9e8r6t successfully reused existing credentials for direct push; this
+  host is setting up the same authorized publication path.
+- Current Linux acceptance is open; this host has no installed WSL distribution.
+  Historical Linux core/server/cross-build results have exact older snapshot scope.
+  The earlier denied guest workaround did not run and must not be bypassed.
+
+## Assumptions
+
+- Compact contextual tools and an adequately sized scenario workspace can reduce
+  friction; only actual engineering tasks at minimum/wide sizes can validate this.
+- The ratified bounded pure analysis and pinned-library architecture can satisfy
+  real engineering work without full language/runtime adoption. This remains a
+  product adequacy assumption until actual budgets, approximate calculations and
+  two-project/source/API/native workflows pass; metadata is insufficient.
+- Existing shared core/source/history boundaries remain suitable for additions;
+  foundational examples and independent criticism must test that assumption.
+
+## Open questions
+
+- Do the ratified owned-value/shared-check/R6/R7 contracts meet real engineering
+  budgets once implemented, including approximate numeric requirements? What
+  measured ceilings keep work bounded without rejecting ordinary studies?
+- Does actual package closure/canonical consumer typing/source preparation and
+  three-way update preserve every stable identity and local engineering edit?
+- What migration and OA↔SA treatment follows from those contracts without guessing
+  executable meaning from old strings or silently changing old models?
+- How can text-only creation establish library instance bases/maps, preserve
+  compatibility across cosmetic package revisions, export subjectless cases, and
+  transition mounted OA/SA data without hidden GUI normalization or silent forks?
+- Will full evaluator and private-capture replay preserve effective-case and
+  deterministic work-limit behavior across direct, REST and cache-warm execution?
+- Which source-preserving refactoring/navigation and grammar changes reduce actual
+  engineering effort while retaining stable identity and cross-file ownership?
+- Do current real gestures, exact caller return, nested scopes and lifecycle markers
+  remain usable and correct under minimum sizing, scrolling, zoom and dirty drafts?
+- Which uncovered teaching, traceability, transition, saved-view, state/data, hosted
+  and platform cases remain after current-binary acceptance? What supported Linux
+  environment can complete the remaining actual runtime gate?
+- Does "standardized" require any external conformance beyond the project's precise
+  interoperable spec/API? Full OMG conformance is not inferred merely from comparison
+  to SysML v2; explicit claims require a mapped and verified contract.
+
+## Candidate hypotheses / designs
+
+The [requirements delta](release-requirements-delta-20260910.md) compares metadata/
+snippets, bounded pure engineering analysis with maintained pinned libraries,
+external evaluators, and full standards adoption. Metadata alone fails the explicit
+new semantics; external tools alone still need binding/result contracts. The report
+recommends the bounded route for root synthesis, not as a ratified decision.
+
+Independent maximum-reasoning tracks now compare owned engineering properties
+versus analysis contexts; calculation definitions/applications; numeric/unit rules;
+and copy, linked-definition, live-instance or pinned-definition/editable-instance
+library architectures. Require concrete falsifiers, source/API migration effects,
+identity/history/recovery behavior and independent critique before convergence.
+These alternatives converged after concrete experiments and independent review:
+B property bases/shared checks/full capture, R6/R7, exact pins with same-origin
+typed compatibility and explicit portable normalization are now ratified. Complete
+11-file proposed baseline and120-assertion finite library prototype remain distinct
+from production admission. Independent292-check review exposed C1 dynamic-work
+expansion and a C2 prototype threshold-unit gap; implementation must close both.
+The text-only40-identity fixture and13 mounted chooser tests pass. Production
+numeric foundation and inspector/review chooser are active, with gates pending.
+
+The subsequent context experiment passed218 assertions: shared property baselines
+and one-level overrides reduce repeated input maintenance while retaining explicit
+independent freeze. Root selected that B direction for precise contract refinement;
+quantity/library/source details remain open. [Decision](DECISIONS.md),
+[experiment and limits](release-analysis-context-experiment-20260911.md).
+
+## Decisions retained
+
+- Keep explicit Rust crate responsibilities and one authoritative typed Project
+  with validated atomic Commands. A thin source CLI reuses the shared core. Separate semantic identity/ownership, allocation/reference/order and
+  diagram geometry. Forms are closed adapters, not a second metamodel. New persistent
+  semantics require core/source/UI/API/reference/transition parity. [Decisions](DECISIONS.md).
+- Preserve authored source ownership/comments/includes, exact identity and accepted
+  model/source history. Source writeback must succeed before adoption. Raw invalid,
+  excluded or rejected drafts survive; navigation/tools must not implicitly accept
+  another editor. Recovery validates/replans rather than trusting serialized commands.
+- Semantic reconciliation uses finite typed facets, frozen baselines, explicit
+  mappings, actual destination slots and a single atomic candidate. Do not infer
+  identity by name or apply reviewed rows as sequential independent edits.
+  [Foundation](release-semantic-batch-foundation-design.md),
+  [artifact contract](release-semantic-artifacts.md).
+- Layer transitions are explicit engineering decisions, not automatic propagation.
+  Behavior-root navigation must establish the requested owner while preserving
+  unrelated architecture presentation. Ports/allocation and contextual occurrences
+  retain their distinct domain meaning. [Source7 contract](release-source7-integration-decision-20260906.md).
+- Hosted revision/source envelopes and ETag checks remain atomic; credentials stay
+  out of persisted models and repository. Linux journal publication retains the
+  selected no-replace invariant, with measured limits, not an overwrite fallback.
+  [Journal decision](release-linux-journal-publication.md).
+- Repair/evaluate the compact palette informed by native Capella evidence; do not
+  return to the rejected horizontal toolbar. Lifecycle projection remains isolated
+  under cfg(test) until coordinated Scene integration and actual acceptance.
+- Preserve historical scope decisions as history. In particular, architecture-only
+  SVG is implemented and behavior SVG was deferred; that is not proof of satisfying
+  the revised release objective. Reassess older exclusions against current scope.
+
+## Current strategy
+
+Finish the new workspace/chooser compile and native loop; independently review
+and measure the numeric foundation before expanding the ratified semantics.
+Integrate coherent external CLI/staged-source/B4 checkpoints while preserving
+ownership and source attribution. Use independent complete model/source oracles
+and exact identity/history comparisons. Publish coordinated runnable milestone
+prereleases; close actual analysis/library/source/API/native, cross-platform,
+service/package and independent end-state gates before the final handoff.
+
+The [archived Task Ledger](history/2026-09-10-ledgers-before-continuation-refresh/TASK_LEDGER.md)
+and [archived STATE](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md)
+preserve all older claims, decisions and evidence links exactly. Relative report
+links inside those byte-preserved files resolve from their original `harness/`
+context. Their historical test totals and process holds are not live status.

harness/history/2026-09-11-ledgers-before-gitea-migration/manifest.json

@@ -0,0 +1,20 @@
+{
+  "migration_issue": "http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-412",
+  "files": [
+    {
+      "path": "STATE.md",
+      "bytes": 20828,
+      "sha256": "180F1724736B3FFE1B10420CB5D47E689FA4C728FD6B5F295E2FB643B5F59DC2"
+    },
+    {
+      "path": "PLAN.md",
+      "bytes": 9997,
+      "sha256": "886C76E741841D2F25804BACA9ED66ED05F7B00249DA3B97827B6BC5948FDD73"
+    },
+    {
+      "path": "TASK_LEDGER.md",
+      "bytes": 17466,
+      "sha256": "40BAEC46F3615B9BF674F17B88BC5BAC9B362E38B10C7E5130EC6B7B848D1ABF"
+    }
+  ]
+}