Make native group reorder discriminate singleton fallback

Prescribe inspected and pressed Card C after reverse membership selection. A singleton C drop is unchanged while the group changes order; preserve prior evaluator scope and test the unchanged negative outcome explicitly.

crates/oa-core/examples/process_multiselect_native.rs

@@ -322,7 +322,7 @@ fn generate(out: &Path) -> Result<()> {
             "fixture": "process-multiselect-native-20260923", "ids": ids, "source_entry": bundle.entry,
             "original_oa_steps": ["oa_a", "oa_u", "oa_b", "oa_v", "oa_c"],
             "reordered_oa_steps": ["oa_b", "oa_u", "oa_a", "oa_v", "oa_c"],
-            "gesture": "Select Card C then Shift-select Card A; drag selected card to After Card B",
+            "gesture": "Select Card C then add Card A; Inspect Card C without changing membership, then drag Card C to After Card B",
             "fixed_slots": {"1": "oa_u", "3": "oa_v"},
             "read_only_trial": "02 Read-only preview trial has two qualified tiles of reused_leaf through distinct references",
             "receipt": "Pin baseline.json, manifest.json and generation command externally before interaction. Never replace baseline with a later saved snapshot.",
@@ -435,8 +435,12 @@ mod tests {
         assert!(error.contains("immutable original"), "{error}");
     }
     #[test]
-    fn global_splice_reversed_block_and_primary_only_results_are_rejected() {
+    fn global_splice_reversed_block_and_singleton_c_results_are_rejected() {
         let before = fixture().unwrap();
+        // Native primary/pressed C is already after B, so a singleton C move
+        // is unchanged. Group {C,A} instead puts B before both selected cards.
+        // If A were primary, its singleton result could equal the group result.
+        mismatch(&before, &before);
         for order in [
             ["oa_u", "oa_b", "oa_a", "oa_c", "oa_v"],
             ["oa_b", "oa_u", "oa_c", "oa_v", "oa_a"],

harness/multiselect-process-native-design-20260923.md

@@ -6,7 +6,7 @@ The independent evaluator is `crates/oa-core/examples/process_multiselect_native
 
 Generate a fresh directory with deterministic UUIDs, `baseline.json`, source bundle and `manifest.json`. Generation refuses an existing output directory; every write is create-only. The checker also compares the loaded baseline with its deterministic original fixture, so a reordered snapshot cannot silently become the baseline. Pin the generated files and command in the native receipt before interaction; these checks do not authenticate external evidence by themselves.
 
-Open the generated source, choose Behavior and **01 OA group order**. Its source steps are `[Card A, Downstream U, Card B, Downstream V, Card C]`. Explicit links A→U and B→V produce one column containing A/B/C and another containing U/V. A and C are distinct Action occurrences sharing the same reusable Activity; B is a Choice control. Select C, then Shift-select A, and drop after B. Literal expected source steps are `[B,U,A,V,C]`, retaining U/V in indices 1/3 and A/C in their original internal order despite reverse selection.
+Open the generated source, choose Behavior and **01 OA group order**. Its source steps are `[Card A, Downstream U, Card B, Downstream V, Card C]`. Explicit links A→U and B→V produce one column containing A/B/C and another containing U/V. A and C are distinct Action occurrences sharing the same reusable Activity; B is a Choice control. Select C, add A, then use **Inspect this element** on C without changing membership. Drag C after B. C is both pressed member and primary: a singleton C reorder would leave the original order unchanged, whereas the group moves A before C. With A primary, a singleton A reorder could accidentally produce the expected group order; that weaker trial is insufficient. Literal expected source steps are `[B,U,A,V,C]`, retaining U/V in indices 1/3 and A/C in their original internal order despite reverse selection.
 
 The checker has `unchanged` and `reordered` modes. It modifies only the expected OA owner's steps with that literal list, then compares the complete Project. It never calls a desktop planner, renderer, selection helper or inferred pointer geometry. Links/guards, reused work, occurrence bodies, all SA records, trace baseline and unrelated processes must remain exact. JSON and source roundtrips are also checked; completeness warnings are permitted, source errors are not.
 
@@ -27,6 +27,6 @@ The manifest identifies the emitted source entry. Native windows/load paths and
 
 ## Falsifiers and limits
 
-Five evaluator tests exercise deterministic/create-only generation; real validated `SetSteps` output; unchanged/reordered distinction and replaced-baseline refusal; wrong global splicing, reversed block and primary-only results; link guard/endpoint drift, reusable Activity changes, SA semantic/order changes, reused-definition and cross-layer baseline corruption; source compile/roundtrip and valid source drift. Negative Project mutations are asserted core-valid before checker rejection, distinguishing oracle sensitivity from trivial malformed-input rejection.
+Five evaluator tests exercise deterministic/create-only generation; real validated `SetSteps` output; unchanged/reordered distinction and replaced-baseline refusal; wrong global splicing, reversed block, and the unchanged singleton-C result for the prescribed gesture; link guard/endpoint drift, reusable Activity changes, SA semantic/order changes, reused-definition and cross-layer baseline corruption; source compile/roundtrip and valid source drift. Negative Project mutations are asserted core-valid before checker rejection, distinguishing oracle sensitivity from trivial malformed-input rejection.
 
 Native acceptance must separately establish Shift/focus delivery, selection painting/count, selected-anchor no-op, actual Before/After zones, cancellation, context menus, whole-set mixed/qualified refusal, one Undo/Redo, source inspection, stable camera/layout and responsiveness. Whole-Project equality does not establish those interactions or exact source-byte preservation. This fixture does not test aggregate deletion, Allocation or Scenario semantics. `reordered` is specifically the OA operation above; the SA fixture is a preservation sentinel, not an accepted SA native reorder run.