Save complete restart handoff for user-requested reboot

2026-09-11 06:47:37 -07:00
parent 03d20ec296
commit 8d55d2d2eb
5 changed files with 190 additions and 0 deletions
@@ -1,5 +1,8 @@
 # First release execution plan
 **User-requested reboot pause:** [resume instructions](REBOOT_HANDOFF_20260911.md).
 Do not start builds or agents until the user returns after reboot.
 Updated 2026-09-11. [PROJECT_GOAL.md](../PROJECT_GOAL.md) is the authoritative
 current objective. [STATE.md](STATE.md) records exact execution/evidence and leases;
 [TASK_LEDGER.md](TASK_LEDGER.md) separates facts, assumptions and decisions.
@@ -0,0 +1,121 @@
 # User-requested reboot checkpoint — 2026-09-11
 Codex-956atf `/root`. The user will install Ubuntu26.04 in WSL2 and reboot, and
 explicitly requested progress preservation and a safe-reboot signal. Work is
 **paused**, not completed. Resume only after the user returns. All three local
 agents stopped and saved their work; root stopped its sole Cargo build. No machine
 restart, installation, Windows feature change or credential change was performed.
 ## Saved source and ownership
 - Main checkout `codex/behavior-authoring-20260910`: numeric foundation7d14bd0,
  CLIbc311bc, corrected external evidence dc0f2e1, instructions ancestryc7ed894,
  chooser/workspace7f081ad, staged prerequisites c0e66f9 (externaldf6f595), numeric
  evidence/decoder review03d20ec, followed by this reboot checkpoint. Remote branch
  is `codex/release1-956atf`. New desktop source is **uncompiled/unaccepted**.
 - Isolated `.local/analysis-core-worktree-20260911/`, local branch
  `codex/analysis-core-20260911`, remote `codex/analysis-core-956atf-20260911`:
  Checkpoint `b96ff3935ab3f36b7144566e46559a05a29292a5`: WIP actual schema8
  definitions/Expr/records, commands/references/migration and
  static admission, based at7d14bd0. Its
  `harness/release-analysis-core-schema8-wip-20260911.md` inventories20 code/test
  paths and22 prepared, unexecuted tests. No source8/evaluator/transport closure.
 - Isolated `.local/behavior-canvas-worktree-20260911/`, local branch
  `codex/behavior-canvas-20260911`, remote `codex/behavior-canvas-956atf-20260911`:
  WIP shared camera/viewport, based atc0e66f9. Checkpoint
  `e511c4153fb5bb484652434340e0e4c7000c93d0` is deliberately
  not compile-coherent: missing test module, missing App Camera handlers and old
  production Scrollables still active. Its
  `harness/release-behavior-canvas-reboot-handoff-20260911.md` lists exact paths
  and ten remaining steps. Do not merge it as a finished canvas implementation.
 Both WIP branches are independent of the main branch. Preserve them, finish their
 bounded slices and review before integration. No worker may run Cargo/native or
 edit the root checkout without a new root lease. Separate-host9e8r6t owns incoming
 prerequisite-form refinements; ytr83r owns B4/lifecycle/Linux work. Re-read Gitea
 issues1/2 and current Wiki before resuming; their progress may have changed.
 ## Verified gates and interrupted build
 - Numeric26/26 at7d14bd0,0.29s execution; strict core all-target Clippy with
  warnings denied passes11m49s. Exact162-input/binary/log provenance is in
  [the numeric gate](release-analysis-numeric-gate-20260911.md).
 - Local `cargo test --locked -p oa-cli -- --test-threads=1`:12/12 integration
  tests, zero failures/ignored,3.00s execution after42.86s compile. The initial
  `--bin arcadia` invocation ran zero tests and counts only as compilation.
  Full log: `.local/logs/source-cli-full-local-20260911.log`.
 - Previous desktop676/676, formatting and strict Clippy passed at2cc4d11.
  No acceptance transfers to new7f081ad/c0e66f9 source.
 - `cargo test --locked -p oa-desktop --bin arcadia-studio --no-run` was deliberately
  stopped for this reboot while compiling oa-core after renderer dependencies.
  Cargo exit101 follows the explicitly stopped owned rustc process (`0xffffffff`);
  no source diagnostic or test failure was reported, and no desktop tests ran.
  Preserve `.local/logs/desktop-chooser-contextual-first-20260911.log`. Root
  verified no Cargo/rustc/Clippy processes remained after stopping its process tree.
 ## Two new focus findings to fix first
 [Paused independent integration review](release-chooser-contextual-integration-review-20260911.md)
 contains16 source hashes and two source-derived, unexecuted P2 findings:
 1. Initial parent FormShown consumes its one-time focus. Child source Open removes
   that parent widget tree; Back/Use remounts it without a new focus intent.
 2. FormShown validates context before creating a global NAME_INPUT focus Task,
   but the delayed operation is not bound to the still-current mount/session.
   It can act on a replacement parent or clear current child/Review input focus.
 Implement a live-session/mount-scoped focus operation covering initial mount and
 source→parent return. Add actual mounted regressions for Open→Back/Use, changed
 document/owner/modal/session between Task creation and execution, raw/source/history
 preservation, and then continue the combined compile/focused/full/Clippy/native
 gates. Do not misstate the popup search-input counterexample: the root Popup
 operation traverses its ordinary content; the separate picker input is excluded.
 ## Native session and exact private backup
 Immutable GUI80cf197 remains the native test binary; SHA256
 `A5ED6DF334B1BFB620425AFDF3E863F0B522990E6FB47C6C401A71CF4443954A`.
 All four OA create/history checkpoints and final reopen pass. Separate SA Action
 Save/Undo/Redo passes, with63 accepted objects. Working entry:
 `.local/native-qa/scenario-20260911/sa/project.arcadia`.
 The current **unapplied** State draft has literal name `SA native state`, captured
 by clicking SA A inspector at the inner chosen operand before SA Inner anchor.
 Its lifeline is preselected, but SA Ready is not chosen and Create was not pressed.
 It must not be described as a passed SA State checkpoint. Old GUI again required
 scrolling its new form back upward to find Name; new fixes have not run natively.
 Private backup `.local/reboot-20260911-1344/` contains the complete accepted SA
 source directory, exact64,935-byte recovery JSON, build/CLI logs and hash manifest.
 Recovery id `30511014-b831-47e3-afd2-6c4e44835a8f`; copied recovery SHA256
 `5C7B90BE613AF35463C563B9AA85A7AB1F8D48561EA935ABC6FC1E79549DF0E8`.
 Root verified its project/origin and raw draft name before copying. The original
 checkpoint remains under `%LOCALAPPDATA%/ArcadiaStudio/recovery/`. The saved-model
 backup passes `check sa-action` and exact `same` against sa-action-verified.
 No private recovery data is committed or sent to Gitea.
 After reboot prefer the application's Home recovery entry to resume this raw draft.
 If needed, preserve any newer checkpoint before restoring the exact private backup
 to that same recovery directory. Use the independent scenario oracle for subsequent
 State/Reuse/Fragment/history/reopen checks. Old window handles/screenshot ids and
 process ids are invalid after reboot; select the actual returned Studio window.
 ## Linux and resumption
 Before installation, this account had WSL2.7.13/kernel6.18.33.2-2 and default2 but
 no registered distribution or Ubuntu Appx package. VirtualMachinePlatform was
 enabled, hypervisor present, common reboot flags absent; elevated feature detail
 was unavailable. No Linux startup/build pass follows from those checks.
 On return, inspect `wsl --list --verbose` and actually execute `uname -sr` inside
 the installed Ubuntu. Verify the user's installed distribution/version, then set
 up the project's Linux dependencies and perform real Linux build/test/runtime
 gates. Keep Windows compilation serialized using `.local/toolchain/env.ps1`.
 The isolated core's first proposed gate is its22 prepared analysis tests, plus
 numeric regressions, after review of its WIP handoff. Full depth128 JSON decoding,
 allocation/lifecycle/output caps and exact save/readback remain required; see
 [the decoder review](release-analysis-decoder-review-20260911.md).
 Continue the original complete OA/SA release goal, preserving issue2's modern
 canvas requirement and analysis/library/source/REST/GUI parity. This reboot pause
 does not alter completion criteria or authorize marking the project complete.
@@ -1,5 +1,10 @@
 # Progress Ledger — first release
 **Paused for the user's Ubuntu26.04/WSL2 installation and reboot.** Read
 [the reboot handoff](REBOOT_HANDOFF_20260911.md) first. It supersedes active-build
 and active-agent statements below. The build is stopped; both WIP worktrees and
 the open raw SA State draft are preserved. Wait for the user's post-reboot return.
 Updated 2026-09-11, coordination through Gitea #245 and issue2. This ledger describes the
 Codex-956atf checkout; external-host evidence is labeled separately. The entire
 previous ledger is preserved [byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md).
@@ -1,5 +1,9 @@
 # Task Ledger — first release
 **Current state: paused for the user's reboot.** The authoritative restart state
 is [REBOOT_HANDOFF_20260911.md](REBOOT_HANDOFF_20260911.md); it supersedes running
 process/agent claims below without changing the full product goal.
 Updated 2026-09-11. [STATE.md](STATE.md) owns current execution/evidence;
 [PLAN.md](PLAN.md) owns capability milestones. The entire former Task Ledger is
 [preserved byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/TASK_LEDGER.md).
@@ -0,0 +1,57 @@
 # Chooser and contextual-source integration review — paused checkpoint
 Codex-956atf `/root/semantics_critic`, 2026-09-11. **Paused/incomplete at the user's reboot checkpoint.** Root supplied combined commit identity `c0e66f94e3412b5c3495e96f7934ae94116505c9` (chooser/workspace `7f081ad` plus staged-source prerequisites `df6f595`). This reviewer inspected the working files listed below; no Git command verified their association with that commit. No production edits, Cargo, rustc, native UI, or test execution occurred. Only this new report was written. Gitea issue 1 coordination: #263; existing source review and relevant later fixes were read before this pass.
 Two concrete focus gaps were sent to root before the pause. They are **source-derived, unexecuted counterexamples**, not observed native failures. Their corrections and regression execution remain outstanding; this is not an approval of the complete integration.
 ## I1 — P2: returning from the source child does not restore parent focus
 `behavior/scenario/workspace.rs:346–358` replaces the parent editor/sensor tree with the source child. The parent-only sensor is at `:640–644`; its name input is at `:362`. Initial `FormShown` consumes `form_focus_pending` in `behavior/scenario.rs:472–475`.
 Minimal sequence: start a Lifeline form, process its first FormShown, open Create new source, then Back; repeat with a valid source and Use. The child disappears and the parent is newly mounted, but both successful source-event paths leave the consumed flag unchanged (`scenario.rs:638–687`). App focuses only a closed-to-open source transition (`app.rs:2398,2415–2423`). The remounted parent's FormShown therefore returns no focus task. Escape returns through `source_back()` and `Task::none()` (`app.rs:1813–1817`, `scenario.rs:315–316`), with the same missing return intent. The raw parent draft remains intact, but the user returns to an unfocused name field. A recovered child differs: its parent focus flag can still be pending, so recovery alone would be a misleading positive control.
 Recommended resolution: create an explicit source-to-parent focus intent for the current parent session and mount, including Back, Use and Escape. Do not rotate semantic/source identities or rewrite raw text to achieve focus. Mount a normal parent, consume initial focus, open the actual child, return by each route, then verify the current parent target and unchanged recovery/project/history. The current workspace test at `workspace/tests.rs:217–322` checks first focus and repeated/stale FormShown messages, not these child-return transitions.
 ## I2 — P2: accepted FormShown tasks lose their session guard before execution
 `app.rs:1401–1408` checks document, scenario, revision and form session before returning `operation::focus(scenario::NAME_INPUT)`. The returned operation carries only the global constant widget ID. It has no current-session or mount check when subsequently operated on the widget tree. The chooser's return path does carry its session/generation/path and checks the current root form owner (`app/reference_authoring.rs:181–196`, `forms/reference_chooser/trigger/focus.rs`); merging that path does not protect this separate global operation.
 Minimal deterministic acceptance case to run: obtain a valid FormShown task for session S1 without executing its widget action; cancel S1 and start S2; mount S2 with another input focused; now execute the saved S1 action. Both parents expose the same NAME_INPUT, so the stale action can focus S2 despite its different session. Also test S1 task after its child opens and after a Review modal acquires a legitimate input. A target-absent global focus operation can disturb other focusables it traverses. Native event timing is unmeasured; the regression must test the delayed operation itself, not merely reject a stale FormShown before producing a task.
 Recommended resolution: validate an exact live parent mount/session at operation execution, including active modal ownership, and keep a missing/replaced target inert. Use that mechanism for I1 as well. Existing `workspace/tests.rs:229–253,318–322` validates stale dispatch; `:266–295` executes a current task against a generic two-input tree. Neither is the delayed-task falsifier above. This report does **not** claim a global operation reaches the chooser's separate search input: `Popup::operate` (`widget.rs:252–264`) traverses its content, not that separate input.
 ## Bounded checks completed before pause
 - The merge keeps source child versus parent branches separate; only the parent receives the scenario FormShown sensor. Parent editor scrolling is keyed by its form session (`workspace.rs:746–763`). Parent scroll/focus retention across child remount was not executed.
 - `Behavior::has_pending` includes the contextual parent drafts; the reference chooser's availability guard excludes pending behavior (`behavior.rs:948–956`, `app/reference_authoring.rs:68–89`). Chooser browsing returns without a setter/planner (`reference_authoring.rs:140–143`), and exact host/document/revision/generation checks remain visible. This is a bounded readback, not a repeat of the full earlier chooser audit.
 - Scenario and Work Source admission and final preparation compare the captured owner with the actual parent's owner ID and Project identity (`scenario.rs:655–672,1392–1409`; `topology.rs:202–219,595–609`). Token-only Back stays available before semantic validation. The unavailable-owner card precedes the ordinary workspace and preserves repair/cancel (`behavior.rs:1036–1067`). The full existing 23-case source audit was not duplicated.
 - All discovered `created_selection` callsites supply the Project. App obtains the override before `Document::execute` and uses it only after success (`app.rs:856–884`). Active staged source selection requires exact prepared-command equality (`scenario.rs:514–535`, `topology/direct.rs:209–230`). The source combiner flattens the parent batch before reserving created identities (`source_draft.rs:256–285`). No runtime selection/Undo/Redo assertion is claimed.
 - Source events stage through private parent clones; Use does not return a model command. Explicit parent submission executes and acknowledges only success (`app.rs:2403–2413`). Local Save intentionally calls `apply_behavior` first (`:3049–3056`); its raw-editor guard remains at `:892–914`. Thus Save after Use is an adoption path, not a valid staged-only unchanged-model observation, consistent with Gitea #248.
 - The `.gitattributes` preservation entries and behavior module declarations were read; the guide contains contextual source creation and the retained direct scenario/state gestures. No additional concrete conflict loss was found before this pause.
 Known later changes are separate: short-host source layout correction (#2/249) and staged machine-owner caption correction (#1/259). They are not claimed present or newly discovered here. In particular the caption handoff is later than imported df6f595. Old 52DE82 native evidence and old focused test artifacts cannot establish the new combined source's behavior. Root owns the combined build, 23 contextual-source tests, 14 chooser host tests, workspace gates and native acceptance; their terminal status was not established by this reviewer.
 ## Inspected source fingerprints
 SHA-256 of actual bytes observed during this pass; paths below the desktop source root unless stated otherwise. Later fixes require new fingerprints and their own evidence.
 | File | SHA-256 |
 | --- | --- |
 | `app.rs` | `38CE0EDBB7AFDE0DBBE03213B8273FFE669C5AA5C4A1A4927A904F0BF52ED587` |
 | `app/reference_authoring.rs` | `A97F75640001048A12703CEF5A2D3140B0AEDFDB526B94B057C965C8B56361B4` |
 | `behavior.rs` | `2D1EEFC9F86FB2696C3EBCBB944FDE0C4C960346460DE84B8172794D59286843` |
 | `behavior/scenario.rs` | `FB807B8A2FBC5EB6E80E09D106A6BC0DF9F600F37E3E19793CA62EBBAC5BC256` |
 | `behavior/scenario/workspace.rs` | `D8C13898890AB9A60A9826BEB5C968289462ED895A9F965CDC6C51275F6DB478` |
 | `behavior/scenario/workspace/tests.rs` | `57562288182114C3DD085B85895B657EC2BEC5DD818912C51F6F93DE4B3EC0B9` |
 | `behavior/source_draft.rs` | `08190823090BD8B0305809099ABADCC0DE431175F7044F1D5ABDCEDA52612EE1` |
 | `behavior/creation.rs` | `33AE9AAF4BA90DE9432870CC8E99708EF39E3638AE8283A9253C333785C91299` |
 | `behavior/topology.rs` | `D06B2F0FC39B4814E94200297E148F1D4D97E04CB167766030AC9DF18689E3B0` |
 | `behavior/topology/direct.rs` | `413AA2009EE4CBA0941836B43E41F16A04C8FC8568B6E92DB5BB08516E95C287` |
 | `forms/reference_chooser/trigger.rs` | `AFEDD3DECB9CA0FD80ED83F778CEF6F6E00AC9CE229079FEEDC7B95799B0BBAB` |
 | `forms/reference_chooser/trigger/focus.rs` | `D489FA00F445BC603B3326CAD8721E2B608456ECF543954538904BF188C6C5FA` |
 | `forms/reference_chooser/widget.rs` | `D66CC17AF7A48BB8598BE683F084BB08FA7AF7304F9636F0A1BEA94C5CF6C727` |
 | `semantic_review/batch.rs` | `8301432527A027F1A0252F0192E0A56863CB92F7ABD2337A6AC3AEC9129B720F` |
 | `guide.rs` | `EE57F8847FF1692AC566D19A66CAA7BB77AD49B5F4E30C562B93117C59BC2671` |
 | repository `.gitattributes` | `0FC674218171AE324CE259C328856F0F60AF5C63360701D866DB3128FE001231` |
 Post-reboot continuation: root decides/implements the two bounded focus corrections; independently read back the corrected source and run the delayed-task/child-return gates through root's sole compiler lease, then finish the remaining mounted/modal/scroll integration acceptance. This report stays frozen as the pre-reboot checkpoint.