Document integrated prerelease source handoff and human checks

docs/preview-human-checks.md

@@ -0,0 +1,55 @@
+# Testing the integrated Windows preview
+
+Extract the complete published ZIP and run `arcadia-studio.exe`, keeping its DLL
+beside it. Copy a complete example folder before editing, including all source
+includes and evidence files. When reporting a problem, include the preview
+version, example and steps that reproduce it. These checks describe expected
+behavior; the release's VALIDATION document records what was actually verified.
+
+1. **Text and diagrams together.** Select a source block and use Tab/Shift+Tab,
+   then source Undo/Redo. Apply, return to a saved graphical view, move a
+   placement, Save all and reopen. Both accepted edits should persist. In a
+   Scenario view, choose S/Select and 100% before dragging a lifeline header.
+2. **Scenario arrangements.** Rename one saved arrangement in Properties,
+   switch to another, and check that its name and layout remain independent.
+   Select a call and switch arrangements: that call should remain selected when
+   both contain it. Return through Details to the intended editable properties.
+3. **Draft recovery.** Change a service-call value without applying it, switch
+   Properties to Connections and back, and confirm the draft remains. Revert
+   should restore the accepted value. Incompatible operation/field choices
+   should explain the problem and retain the draft. Check that Apply/Revert
+   remain reachable after resizing the window.
+4. **Attachments, bends and ports.** Move an ordinary edge attachment, add and
+   move a State bend, and move an SA semantic port. Check Undo/Redo and reopen.
+   A second saved view should remain independent, and endpoint identities should
+   not change merely because their presentation moved.
+5. **Multiple selection.** In ordinary and State diagrams select a group, move
+   it, and use Undo/Redo. In Process views reorder supported sibling cards and
+   inspect exact reused occurrences with Open/Back. In Allocation views exercise
+   group assignment and explicit Arrange; an unsupported mixed selection should
+   be refused as a whole. Aggregate semantic deletion remains unavailable.
+6. **Direct Allocation drawing.** Choose Allocation, click a performer and a
+   highlighted unallocated leaf activity/function. Check the intended relation
+   and nesting, then Undo/Redo. An occupied or incompatible target should be
+   refused; Escape should cancel the pending drawing action.
+7. **Traceability.** Open a mixed OA/SA Traceability view, use Add existing
+   elements and place both ends of a correspondence. The selected mixed view
+   should remain active. Review layer traces for correspondences whose endpoints
+   are not represented as cards in that view.
+8. **Counterpart review.** Explicitly choose an existing counterpart and inspect
+   its Name/Description conflicts. Keep target should preserve the target's
+   engineering text. Scroll the review in a shorter window: counts, unresolved
+   guidance and Apply/Cancel should remain reachable. Cancel once, repeat and
+   Apply, then Save/reopen. An unchanged subsequent Apply should not duplicate
+   the target or its trace.
+9. **Picker Escape and Text navigation.** Open a picker inside a pending form:
+   the first Escape should close the picker and retain the form. A subsequent
+   Escape should follow the form's ordinary cancellation behavior. Also exercise
+   source declaration/reference navigation, Back, Find and alias-rename preview;
+   cancel once before confirming a rename on the copied example.
+
+Inspect the known limitations in the release notes. In particular, crossed
+Process routes and multiline State labels can be crowded. Report these as visual
+readability problems even if the saved connection records remain correct. This
+preview does not imply complete OA/SA, source8 or accessibility acceptance.
+Linux builds remain deferred at the user's request.

docs/windows-packaging.md

@@ -2,6 +2,10 @@
 
 The standard build target is x86_64 MSVC. The optional gnullvm build uses LLVM-MinGW UCRT and currently needs `libunwind.dll` alongside both executables. Packaging is a separate operation on already-built inputs; it neither builds nor launches applications and does not confer release acceptance.
 
+For feature checks after extracting the integrated preview, use the
+[human testing checklist](preview-human-checks.md) alongside the release's exact
+validation record and known limitations.
+
 Run from a Git checkout with Windows PowerShell 5.1 or PowerShell 7 and Python 3.11+ (standard library only). Build and test first using the [README](../README.md). Select the actual output directory explicitly; a native-host Cargo build normally uses `target/release`, while an explicit `--target` uses `target/<target>/release`. `-Python <executable>` selects Python when it is not named `python` on PATH; it collects/checks the package-local documentation closure without running binaries.
 
 Packaging also needs the build's matching `cargo` and `rustc` on the packaging process PATH, the locked dependency sources/archive cache, and installed Rust target libraries and copyright reports. The script invokes only read-only `cargo metadata --locked --offline --filter-platform <target>` and Rust version/sysroot queries. It does not download dependencies or build. These tools are packaging prerequisites; the extracted application does not require them.

harness/prerelease-integrated-source-20260924.md

@@ -0,0 +1,88 @@
+# Integrated Windows prerelease candidate
+
+This is the source handoff for Gitea issue37, owned by Codex-956atf. Reserved
+version: `v0.2.0-preview.integrated.20260924`. Remote branch:
+`codex/prerelease-integrated-956atf-20260924`. This checkpoint does not claim
+combined compilation, native acceptance, packaging or publication of a release.
+The exact candidate commit and subsequent validation belong in issue37.
+
+## Integrated contributions
+
+- Base `1006b496ae5db4d850a6b7f3f5b59bf4ca99a3f8` combines the earlier e34
+  Scenario/Text/attachment/State work with ordinary/State multiple selection and
+  actual Text Apply stale-action tests.
+- Merge `c1b78acb9aa8c5024a3178b890102712078fc226` adds Process and Allocation
+  group source `495464e84b5bae8ddad93e9fc69ef353e7f1c884`, including its Process
+  and pure planner ancestors. The new Allocation evaluator's Diagram literal
+  explicitly sets the combined schema's `layout: None`.
+- Merge `62d3ffe9` adds Allocation drawing/Traceability source
+  `301126f6098286bf440c1bd1b1ed685753984723` and picker Escape candidate
+  `3e916f623c7709d6c443552cd9ec95df5918eb00`. The latter includes a test-import
+  correction but has no standalone runtime acceptance.
+
+The single textual conflict was menu action dispatch in `app.rs`. Resolution
+retains exact group/Process dispatch first, then Traceability's captured-view
+placement, then State's exact placement and selection reconciliation. Independent
+source review found no confirmed defect in that resolution, the shared Escape
+wrapper, or direct Allocation drawing versus group-gesture precedence. This is
+source review, not a substitute for the combined tests below.
+
+Test-only successor `542b10ac587b932c0404580a98159bd497775ef0` adds real Text
+Apply followed by captured Process reorder and Allocation Press/Release replay
+in both OA and SA. It compares complete model/source, selection and primary,
+history, draft, status and newer gesture ownership. Allocation protects an actual
+new drag; an idle obsolete Press intentionally reports a stale-view explanation.
+Direct rustfmt and whitespace checks pass; these new tests remain uncompiled
+until the combined gate. The [independent source review](reviews/prerelease37-integration-20260924.md)
+records the inspected merge blobs and remaining discriminating checks.
+
+Peer evidence remains attached to its actual source, not relabeled as this
+candidate: Allocation group `57aec979f640ba1b8aa6fcbb7d9e26b29cf51596`, drawing
+`45605001f690ad9ee2ed786c3cd77ffbde8e10aa`, and e34 Windows gates
+`be7470afca4894c265d61800f9b94d31444e7234`. Drawing evidence has a separate
+ancestry and is linked rather than merged for source. Private mixed-parser work,
+unfinished Scenario group reordering and aggregate removal are excluded.
+
+## Combined gates and package handoff
+
+Codex-ytr83r owns the exact-candidate Windows build/package on its separate
+machine. Codex-9e8r6t owns independent source/seam review and a downloaded-package
+check. Codex-956atf remains the sole integration, tag and release publication owner.
+Retrieve the published candidate before starting; never build from an assumed
+matching local branch. Record the complete input membership, raw bytes, compiler,
+environment, literal command, exit, output and produced artifact hashes.
+
+With the existing locked Windows toolchain/cache, jobs1 and incremental0:
+
+```text
+cargo test --locked --offline --workspace --no-fail-fast -- --test-threads=1
+cargo clippy --locked --offline --workspace --all-targets -- -D warnings
+cargo build --locked --offline -p oa-desktop -p oa-server
+```
+
+Bind the actual test-name inventory and documented ignores to the final test
+artifacts. Preserve initial failures and corrections. Run format checks and
+distinguish inherited unrelated formatting from new changes. Validate the actual
+Text Apply stale-action tests for ordinary/State, Process and Allocation, picker
+overlay priority, Traceability placement and both Allocation interaction modes.
+
+Use [the established packaging recipe](../docs/windows-packaging.md) from the
+fixed candidate with the exact selected gnullvm runtime and BuildEvidence. A
+development-profile prerelease is acceptable when explicitly labeled. Package
+Studio and server, examples, offline guide and dependency notices; verify all
+archive entries and imports. Test a fresh extraction from an unrelated working
+directory, inspect real GUI editing/history/Save/reopen and picker Escape, and
+check server persistence through restart. Publish artifacts to the owner-created
+draft release only after its ID is supplied in issue37. Do not silently replace
+an existing published version.
+
+## Known limits for the human preview
+
+Process crossed routes can overlap and obscure endpoints after reordering.
+Multiline State labels can overlap. Aggregate model removal and remaining
+Scenario group adapters are unfinished. Existing native evidence omits some held
+modifier/drag, compact-window and SA-reopen cases; compilation cannot establish
+those interactions. Picker Escape is a candidate until the combined native gate
+passes. Full OA/SA feature completeness, broad accessibility/DPI coverage and
+public source8 support are not claimed. Linux/WSL remains explicitly deferred
+by the user. See the [human checks](../docs/preview-human-checks.md).

harness/reviews/prerelease37-integration-20260924.md

@@ -0,0 +1,52 @@
+# Prerelease 37 source integration review
+
+Read-only review by the parent's bounded independent critic, 2026-09-24. No Cargo, GUI, verifier execution, source/worktree mutation, or Gitea write was performed. The parent alone owns integration/release. This local report is not published peer evidence.
+
+## Examined identity
+
+- Original parent: `1006b496ae5db4d850a6b7f3f5b59bf4ca99a3f8` (ordinary/State selection plus real Text Apply rejection tests), clean at review start.
+- Process delivery: `6d99aacab8ca1a91c857a2179baa14d80a2901e9`; production correction `ff712b24190342363d0275467e96f181872da6ad`, evaluator successor `b743a10d51032dc1655b94fed5e49fbbbcee83f4`.
+- Allocation group: source `495464e84b5bae8ddad93e9fc69ef353e7f1c884`, evidence `57aec979f640ba1b8aa6fcbb7d9e26b29cf51596`.
+- Allocation drawing: source `301126f6098286bf440c1bd1b1ed685753984723`, evidence `45605001f690ad9ee2ed786c3cd77ffbde8e10aa`.
+- Picker Escape: `3e916f623c7709d6c443552cd9ec95df5918eb00`, production parent `e9167f5cc8509e3a4e3d4d1757ff801827a6b95a`; reported uncompiled candidate.
+- Actual merged bytes reviewed: parent commit `c1b78acb9aa8c5024a3178b890102712078fc226` with staged picker/drawing merge. Index blobs: app.rs `646b0415a156b3a4e8074847c5b2dadfea24b27c`; app/multiselect.rs `a4bbacf1dfb6960144192a2e6f631e94ce75b519`; app/allocation_drag.rs `b6c329496c1c935defee6f6cd85c281c3556e4a2`; app/escape.rs `8683f30aaf42fdac4235130a74d05a025d4dfef4`.
+
+Root/current/remote-default AGENTS and current PROJECT_GOAL/STATE were read. STATE still describes an earlier contribution; live issue37 ownership and release coordination remain with the parent.
+
+## Integration order and overlaps
+
+1. Merge Allocation group production `495464e` into the parent. Its ancestry already contains Process `6d99a`, Arrange planner `9b83f7c`, assignment planner `33e8801`, their evidence, and corrections. Do not cherry-pick the App tip alone without those ancestors. Parent completed this as `c1b78acb`, adding the new evaluator's required `Diagram.layout: None` for the existing integrated schema.
+2. Merge picker/drawing `3e916f`. It descends from drawing source `301126f` and includes traceability prerequisite commits `bfc25985`, `4fbdf6f3`, `17f1f89f` plus drawing implementation `cf37c36b`. `301126f` alone is a test-only correction, not the entire feature.
+3. Cite Allocation drawing evidence `45605001` separately: it is on `35b11eea`/`d6aabb5` evidence lineage, not the drawing source ancestry. Do not merge that evidence branch merely to obtain source. Group evidence `57aec` is a direct child of `495464e`; parent chose a linked-evidence delivery instead of copying its archives into the disk-tight worktree.
+
+High-overlap files are app.rs, app/multiselect.rs, model_menu.rs, views.rs, plus shared behavior viewport and Scenario fixture tests. Picker additionally changes vendored pick_list/menu and replaces captured-Escape subscriptions with a persistent root wrapper. The actual parent merge auto-combined Process/group; drawing/picker required the app.rs menu-execution resolution described below. Absence of conflicts does not establish behavioral compatibility.
+
+## Findings and preserved seams
+
+No new material code defect was confirmed in the bounded source review. This is not compilation, runtime or release acceptance.
+
+- app.rs:1351-1439 retains early exact selection/State/Topology rejection, no-op Process admission, captured Text handling, and Allocation bare-move rejection before shared reveal/allocation hooks. app/multiselect.rs retains ordinary/State handling and adds Process by surface, with snapshot equality still checking document, revision, epoch, generation, members and primary.
+- app.rs:2655-2720 resolved menu dispatch correctly retains validated DiagramSelection/exact Process early dispatch, then the new captured mixed Traceability Show handling, then the existing State placement branch and selection reconciliation. Do not replace this with either whole peer side.
+- app/allocation_drag.rs:636-652 requires `connection.is_none()` for Allocation ownership. diagram/multiselect.rs:158 exits when a connection tool is active; diagram/work_drag.rs:105-121 also excludes connection tools from the dirty-work shield. diagram.rs:905 handles connection endpoints before Allocation press. Thus the read source preserves drawing versus group-drag priority.
+- app.rs:1239-1255 places the Escape bridge outside existing source observer and Scenario/canvas focus roots. app/escape.rs:99-135 offers Escape to the current overlay first and only then translates captured base Escape. The vendored menu closes its shared owner flag and refuses later queued selection while closed. These are intentional changes to shared input behavior and still require combined mounted/native validation.
+- Parent's new evaluator `Diagram.layout` adaptation is necessary for compilation; source parity cannot be inferred from peer suite totals. No test execution was performed by this reviewer.
+
+## Focused combined acceptance checks
+
+1. Compile and run the exact integrated source, retaining all existing ordinary/State real-Text-Apply tests from `1006b49`. Extend the same concrete workflow to captured Process reorder and Allocation Press/Release: perform real Text Apply, deliver the old message, assert unchanged full Project/source/history/selection/status and newer input ownership. Peer Process tests mutate revision through an ordinary command; that is useful but not the same Text integration path.
+2. In an Allocation view with a retained group, arm direct Allocation drawing, select performer/work, and assert one intended relation with no movement/group fallback; cancel and then perform a valid group assignment/Arrange. Include dirty Properties and selected route/attachment control rings to ensure target precedence remains intact.
+3. On the combined root tree, open a picker in State and in an outer pending form/Find/rename context. First Escape closes only the picker; the next Escape follows existing modal priority. Cover open-and-Escape in one input batch and queued later clicks; retain dirty text and selection/caret. Existing candidate tests target these mechanisms, but have not been compiled on this combined source.
+4. Process qualified occurrence Open/Back must return to the exact read-only subject; ordinary Explorer selection of the same semantic ID must restore editable local Properties. Inspect membership/primary plus Undo/Redo and saved bytes separately.
+5. Recheck State attachment Escape, saved Scenario Details/focus/camera, Text indentation and source-draft retention on the packaged build. These are shared input seams, not implied by peer test counts.
+
+## Retained defects and evidence limits
+
+- Process reorder visibly overlaps orthogonal routes (A-to-U/B-to-V), obscuring endpoints. The Process evidence explicitly confirms this; unchanged connection records do not establish readable routing. Keep this known defect in prerelease notes unless independently corrected and verified.
+- Group model deletion remains unavailable; Process cards cannot use placement Hide. Do not advertise aggregate removal as complete.
+- Allocation group native evidence omits held Shift, held-preview, interruption/Escape, out-and-back/no-op and compact viewport acceptance; SA reopen was not exercised. Run7 compact labels were an unsuccessful resize, not compact acceptance. Automated no-op checks and native successful movement remain distinct.
+- Drawing native evidence is scoped to OA/SA Containment; mixed Traceability and other projections are automated/source evidence, not native coverage. Initial interrupted trial and failed compilation remain historical failures.
+- Picker production/evaluator source was delivered uncompiled. No fresh combined Linux/DPI/accessibility or cold-reopen claim follows from these contributions. User-paused Linux boundary remains unchanged.
+
+## Retrieval record
+
+All requested objects and picker successor were fetched and inspected locally. Initial unauthenticated remote fetch produced no output and was stopped; its temporary pack was retained. Authenticated five-object fetch used existing project credential handling without printing credentials. Its 90-second Python launcher timeout killed the immediate launcher while child Git continued receiving data and held captured pipes; after child transfer settled, the wrapper returned timeout, but `git cat-file -t` confirmed the requested objects. No remaining fetch processes were observed. Original temporary pack `tmp_pack_BRfqqX` (38,391,789 bytes) was not deleted. The completed transfer left approximately 243 MB free. Picker-only fetch with `--no-auto-maintenance` and longer bounded timeout then exited zero. No duplicate evidence archives were extracted. The local narrow fetch helper is retained in this directory; it contains no credential bytes.