Save reboot checkpoint with interrupted build and restart instructions

harness/PLAN.md

@@ -12,7 +12,7 @@ Updated 2026-09-11 for the published Codex-ytr83r B4 source checkpoint.
    CLI-only01b76a1 was reviewed and imported as023e3a8 without core/dependency
    changes. Preserve the new AGENTS maintenance instruction and exact goal bytes.
 2. Core433 and independent lifecycle-oracle admission passed before native output.
-   Finish the active desktop compilation and run focused lifecycle/direct-canvas,
+   After the user's reboot, follow RESUME.md to resume desktop compilation and run focused lifecycle/direct-canvas,
    authoring, scenario,
    creation, history and recovery checks, then appropriate full/strict/document
    gates. Root serializes writers and records exact source/binary/log/exit scope.

harness/RESUME.md

@@ -0,0 +1,64 @@
+# Resume after the user-requested reboot — 2026-09-11
+
+Codex-ytr83r /root. The complete first-release goal remains active and unfinished.
+Read AGENTS.md, PROJECT_GOAL.md, current Gitea issues1/2 and Wiki before resuming.
+This is a pause for the user's reboot, not a completed milestone or failed test.
+
+## Saved source and evidence
+
+Branch: codex/release1-ytr83r. Production source is B4 lifetime rendering52f6e17
+plus CLI01b imported as023e3a8. b96286e records exact core/oracle evidence and
+current harness index. d041212 preserves owner instruction-sync history and the
+byte-exact supplied PROJECT_GOAL. a9a5768 records the Linux trial and contextual
+source integration review. Later checkpoint commits add this resumption note.
+
+Core all-targets passed433 tests, one intentionally ignored probe; the optional
+probe separately passed. The independent lifecycle oracle and all six frozen
+baseline/rename files passed before any native GUI launch. See the harness index.
+No current desktop compile/test/native acceptance has been established.
+
+## Interrupted Windows build
+
+Cargo session93786 was interrupted at the user's request while compiling Iced
+dependencies (last log entry cc1.4.5). It exited1 from interruption; no final gate
+status JSON was emitted. A readback found no cargo.exe/rustc.exe process. Exact
+partial log and explicit interruption record are in
+experiments/lifecycle-native-ytr83r-20260911/. Preserve cached target outputs.
+
+Use the existing ignored task-local toolchain, one Cargo job, after checking no
+other writer is active. From the repository root in PowerShell:
+
+```powershell
+& '.local\run-gate.ps1' -GateName 'ytr83r-desktop-lifecycle-resume' -CargoArgs @('test','--locked','--offline','-p','oa-desktop','scenario_lifecycle','--','--test-threads=1')
+```
+
+The wrapper loads .local/toolchain/env.ps1. Then run appropriate direct-canvas,
+full/strict desktop, server/CLI and GUI build gates serially. Review the new
+typography report: wide Unicode Create labels can overflow the fixed capsule.
+The proposed clipping correction is not implemented; preserve existing fixtures
+and define separate expected Unicode cases before native output. Actual Windows
+wide/minimum/Fit/Save/Undo/Redo/reopen acceptance and B4 packaging remain pending.
+
+## Linux after reboot
+
+Recheck wsl --status and wsl --list --verbose. Before reboot, no distribution was
+installed; WSL reported virtualization unavailable and Windows had a pending
+reboot. Hardware virtualization must be available (firmware or nested VM host).
+No host setting was changed and no reboot was performed by the agent.
+
+Prefer a working WSL2 Ubuntu for real Linux build/runtime validation. The verified
+Ubuntu image and QEMU cache remain under .local/linux-host-ytr83r. Its bounded
+UEFI/TCG pilot ended without guest-ready evidence; all owned pilot processes
+stopped. Do not repeat failed delivery or infer Linux acceptance from the image.
+
+## Coordination and next integration
+
+Codex-9e8r6t owns contextual prerequisites; df6f5956 is available locally and has
+a reviewed minimal import path, with two B4-preserving merges. Later short-host
+layout and Save-procedure corrections are separate; inspect the current remote
+handoff before import. Codex-956atf owns chooser, shared constrained canvas design
+for issue2, and analysis/library contracts. Local audit agents have stopped their
+assigned work. They must recheck coordination before taking new tasks.
+
+The two published Windows authoring/CLI prereleases remain available. No B4
+release should be published until actual current tests/native acceptance pass.

harness/STATE.md

@@ -1,6 +1,9 @@
 # Progress Ledger — first release
 
 Updated 2026-09-11 by Codex-ytr83r /root for current execution.
+**Reboot checkpoint:** the user requested saving progress before reboot. The
+desktop Cargo session93786 was interrupted during dependency compilation; no
+desktop test result exists. Follow [resume instructions](RESUME.md) after reboot.
 **Release remains incomplete.** This is the new Codex-ytr83r Windows checkout.
 It started clean at `ff615d0`; no local compiled desktop or native acceptance
 is claimed for the combined source at this checkpoint.
@@ -38,8 +41,8 @@ The separate ignored probe also passed: 250/500/1000-record inheritance chains
 took6.670/19.166/38.063s in this unoptimized, contended run. These timings are not
 optimized/native latency; the bounded scaling diagnosis records a preexisting
 quadratic path and the next controlled measurement.
-Desktop `scenario_lifecycle` now compiles offline under one Cargo job, session93786,
+Desktop `scenario_lifecycle` was compiling offline under one Cargo job, session93786,
-log `.local/ytr83r-desktop-lifecycle.log`; focused/direct-canvas, full/strict,
+and was interrupted for the user's reboot; focused/direct-canvas, full/strict,
 server and CLI gates remain pending. Packaging11/11 and
 synthetic Windows notices passed. [Host setup/evidence](release-host-bootstrap-ytr83r-20260911.md).
 

harness/experiments/lifecycle-native-ytr83r-20260911/desktop-interrupted.json

@@ -0,0 +1,8 @@
+{
+  "tool_exit": 1,
+  "session_id": 93786,
+  "final_gate_status_emitted": false,
+  "desktop_tests_executed": false,
+  "outcome": "interrupted_by_user_for_reboot",
+  "note": "Dependency compilation interrupted; this is not a product test failure."
+}

harness/experiments/lifecycle-native-ytr83r-20260911/desktop-interrupted.log

@@ -0,0 +1,118 @@
+   Compiling syn v3.0.5
+   Compiling syn v2.0.119
+   Compiling libm v0.2.16
+   Compiling autocfg v1.5.1
+   Compiling num-traits v0.2.19
+   Compiling once_cell v1.21.4
+   Compiling bitflags v2.13.1
+   Compiling smallvec v1.16.0
+   Compiling log v0.4.34
+   Compiling windows-sys v0.61.2
+   Compiling pin-project-lite v0.2.17
+   Compiling bytes v1.12.1
+   Compiling futures-core v0.3.34
+   Compiling bytemuck_derive v1.12.0
+   Compiling bytemuck v1.25.2
+   Compiling thiserror-impl v2.0.20
+   Compiling cfg_aliases v0.2.2
+   Compiling windows_x86_64_gnullvm v0.52.6
+   Compiling thiserror v2.0.20
+   Compiling memchr v2.8.3
+   Compiling futures-sink v0.3.34
+   Compiling futures-channel v0.3.34
+   Compiling mio v1.2.3
+   Compiling socket2 v0.6.5
+   Compiling tokio-macros v2.7.2
+   Compiling tokio v1.53.1
+   Compiling windows-targets v0.52.6
+   Compiling synstructure v0.13.2
+   Compiling futures-macro v0.3.34
+   Compiling futures-task v0.3.34
+   Compiling futures-io v0.3.34
+   Compiling slab v0.4.12
+   Compiling futures-util v0.3.34
+   Compiling arrayvec v0.7.8
+   Compiling zerofrom-derive v0.1.7
+   Compiling libc v0.2.189
+   Compiling zerofrom v0.1.8
+   Compiling yoke-derive v0.8.2
+   Compiling raw-window-handle v0.6.2
+   Compiling zerocopy v0.8.56
+   Compiling stable_deref_trait v1.2.1
+   Compiling yoke v0.8.3
+   Compiling euclid v0.22.14
+   Compiling zerocopy-derive v0.8.56
+   Compiling khronos_api v3.1.0
+   Compiling core_maths v0.1.1
+   Compiling zerovec-derive v0.11.6
+   Compiling smol_str v0.2.2
+   Compiling rustc-hash v1.1.0
+   Compiling zerovec v0.11.8
+   Compiling half v2.7.1
+   Compiling windows-result v0.2.0
+   Compiling displaydoc v0.2.7
+   Compiling version_check v0.9.5
+   Compiling xml-rs v0.8.29
+   Compiling gl_generator v0.14.0
+   Compiling slotmap v1.1.1
+   Compiling windows-strings v0.1.0
+   Compiling font-types v0.10.1
+   Compiling font-types v0.12.4
+   Compiling windows-interface v0.58.0
+   Compiling windows-implement v0.58.0
+   Compiling parking_lot_core v0.9.12
+   Compiling rustc-hash v2.1.3
+   Compiling thiserror v1.0.69
+   Compiling web-time v1.1.0
+   Compiling lilt v0.8.2
+   Compiling windows-core v0.58.0
+   Compiling read-fonts v0.41.0
+   Compiling read-fonts v0.35.0
+   Compiling glutin_wgl_sys v0.6.1
+   Compiling lyon_geom v1.0.19
+   Compiling naga v27.0.3
+   Compiling libloading v0.8.9
+   Compiling thiserror-impl v1.0.69
+   Compiling equivalent v1.0.2
+   Compiling foldhash v0.2.0
+   Compiling scopeguard v1.2.0
+   Compiling hashbrown v0.17.1
+   Compiling glam v0.25.0
+   Compiling ash v0.38.0+1.3.281
+   Compiling bit-vec v0.8.0
+   Compiling unicode-width v0.2.2
+   Compiling serde_core v1.0.229
+   Compiling tinyvec_macros v0.1.1
+   Compiling foldhash v0.1.5
+   Compiling khronos-egl v6.0.0
+   Compiling hashbrown v0.15.5
+   Compiling tinyvec v1.13.2
+   Compiling codespan-reporting v0.12.0
+   Compiling bit-set v0.8.0
+   Compiling iced_core v0.14.0
+   Compiling indexmap v2.14.1
+   Compiling lock_api v0.4.14
+   Compiling hashbrown v0.16.1
+   Compiling lyon_path v1.0.19
+   Compiling skrifa v0.44.0
+   Compiling windows v0.58.0
+   Compiling tinystr v0.8.4
+   Compiling ttf-parser v0.25.1
+   Compiling http v1.5.0
+   Compiling futures v0.3.34
+   Compiling wgpu-hal v27.0.4
+   Compiling gpu-descriptor-types v0.2.0
+   Compiling spirv v0.3.0+sdk-1.3.268.0
+   Compiling gpu-alloc-types v0.3.1
+   Compiling unicode-segmentation v1.13.3
+   Compiling yazi v0.2.1
+   Compiling writeable v0.6.4
+   Compiling zeno v0.3.3
+   Compiling memmap2 v0.9.11
+   Compiling presser v0.3.1
+   Compiling find-msvc-tools v0.1.12
+   Compiling hexf-parse v0.2.1
+   Compiling shlex v2.0.1
+   Compiling litemap v0.8.3
+   Compiling icu_locale_core v2.3.0
+   Compiling cc v1.4.5

harness/release-lifecycle-typography-review-ytr83r-20260911.md

@@ -0,0 +1,191 @@
+# B4 Create capsule typography — read-only review, 2026-09-11
+
+Codex-ytr83r / server_audit. Owned output: this report only. No production,
+compiler, native, Git or frozen-fixture changes. Gitea ownership #255; issue #2
+and comments through #251 read. The user's #250 clarification permits sequence
+constraints; Codex-956atf retains the coherent canvas interaction design. This
+review concerns only B4 label containment and its existing hit shape.
+
+## Finding: fixed capsule does not bound its label
+
+**P2 presentation risk, confirmed missing containment; exact native overflow
+extent unmeasured.** `behavior/scenario_lifecycle/render.rs:96` fixes the birth
+capsule to 140×28 world units. At line 305 its label is drawn 8 units from the left
+and 6 from the top, at 12 px, using `short(&marker.name, 18)` and otherwise default
+canvas Text. The name is the local Lifeline name (line 100), not the Create
+occurrence's message name.
+
+`views.rs:25` collapses whitespace and limits Unicode **scalar count**: 18 or fewer
+scalars are returned intact; longer text gets 17 scalars plus an ellipsis. It
+measures neither glyph advances nor grapheme clusters. Thus there is 124 units of
+symmetrically padded width, or 132 to the outer right edge, but no corresponding
+text bound. An 18-scalar label whose shaped advance exceeds 132 units can extend
+beyond the capsule; wide Latin and CJK names are concrete candidate inputs. At
+12 px, even an average advance over 7.33 units crosses that outer-edge threshold.
+This is a threshold calculation, not a measured font result. Combining marks,
+ligatures, fallback fonts and glyph overhang also make scalar count unsuitable
+as an ink-bound guarantee. Splitting a grapheme is a secondary consequence of
+the same truncation strategy, not a separately verified native defect.
+
+Core name validation (`oa-core/src/validation.rs:54`, `:65`, element name check
+at `:275`) permits these ordinary Unicode characters. There is no model rule
+making a name fit a graphical capsule. Changing model names or source text to
+solve display width would therefore be inappropriate.
+
+Exact selection uses only `marker.capsule.contains(point)` at `render.rs:183`;
+the nearby-marker distance also uses the same rectangle at `:329`.
+`behavior.rs:1735`/`:1792` combines these shapes with bounded nearest-stroke
+tolerance. Text does not expand the marker hit shape. If visible text extends
+more than the screen tolerance outside the capsule, clicking it can miss the
+Create or select another nearby item. The capsule geometry and arrow endpoint
+remain mutually aligned; the potential mismatch is overflowing label ink.
+
+## Installed Iced behavior, not an assumed browser text model
+
+Desktop enables Iced 0.14 WGPU/canvas (`crates/oa-desktop/Cargo.toml:14`). Read the
+actual registry source under
+`.local/toolchain/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/`:
+
+- `iced_graphics-0.14.0/src/geometry/text.rs`: Text exposes `max_width`, documented
+  as line wrapping; its default is infinity. `draw_with` constructs a paragraph
+  with that width and infinite height. Default line height is 1.2×size.
+- `iced_wgpu-0.14.0/src/geometry.rs:306`: ordinary positive uniform scale follows
+  the cached-text path. It passes the text's width and infinite height, and clips
+  to `self.clip_bounds` (line 361), not the previously filled rounded rectangle.
+  Other transforms use glyph paths, also without an implicit capsule clip.
+- `iced_core-0.14.0/src/text.rs:134`: shaping can use font fallback; default Auto
+  selects based on ASCII/non-ASCII unless shaping features override it.
+  Font defaults to SansSerif (`font.rs:20`). No capsule-specific font is supplied.
+- `iced_graphics-0.14.0/src/geometry/frame.rs:141` provides `with_clip`, backed
+  by a fresh child frame (`iced_wgpu ... geometry.rs:412`). The child's transform
+  must be handled deliberately: Scene already scales the outer frame at
+  `behavior.rs:2057`.
+
+Therefore setting `max_width = 124` alone is **not** a one-line ellipsis fix. It
+can wrap into the fixed 28-unit capsule or below it; long unbroken words also
+depend on wrapping behavior. Default text has no capsule-height bound.
+Another scalar-count estimate, including the state-canvas approximation
+(`state_canvas.rs:298`), cannot guarantee Unicode containment either.
+
+## Two bounded corrections
+
+| Approach | Benefit | Cost / evidence needed |
+| --- | --- | --- |
+| A — clip the existing one-line display to the capsule interior | Smallest robust containment change; keeps capsule size, arrow endpoints, original hit IDs and all lifetime/layout semantics. Keep the current shortened display and unbounded single-line shaping inside a finite clip. | May cut a glyph or hide an existing ellipsis. Full authored name remains a separate lifeline property. Clip must use the actual screen transform; a naive world-space `with_clip` inside the scaled parent can regress zoom. |
+| B — fit a single-line, measured prefix plus ellipsis, with the same interior clip as a final bound | Gives a deliberate truncation signal and uses available width well for both narrow and wide names. Grapheme-safe prefix selection preserves user-visible characters. | Requires the same font/size/shaping measurement as drawing and bounded/cached work; a different platform text API is not authoritative. More implementation than A; wrapping or an average-character-width estimate is not an equivalent replacement. |
+
+Recommend **A as the smallest immediate B4 correction**, with B only if root
+chooses readable ellipsis as part of this bounded polish and can use Iced's
+actual text measurement. Neither requires enlarging capsules or changing lane
+spacing. Automatic width expansion would affect endpoint/hit/layout contracts
+and overlap the separately owned constrained-canvas design.
+
+Retain model/source names exactly. Verify screen-space clip placement at 0.5×,
+1× and 2×, plus minimum Fit for hit identity. The WGPU child frame does not inherit
+the parent's current transform; pass/restore the explicit scale and clip bounds
+through the narrow drawing bridge or use an equivalent renderer-supported
+bounded primitive. This report does not supply an uncompiled implementation.
+
+## Separate pre-native variation and falsifier
+
+Do not edit the six frozen source files or their baseline/OA-rename/SA-rename
+expectations. In a separate fresh typography checkpoint derived from baseline,
+prepare an exact expected Project/SourceBundle **before** native opening:
+
+1. Rename only OA root receiver Lifeline
+   `5ceab400-0000-4000-8000-00000000044e` to 18 `W` characters
+   (`WWWWWWWWWWWWWWWWWW`).
+2. Rename only SA root receiver Lifeline
+   `5ceab400-0000-4000-8000-000000000836` to 18 `界` characters.
+3. Preserve both Create occurrence IDs (`...0456`, `...083e`), lane identities,
+   all rows/scopes, the full remainder of the model and unchanged CRLF rationale
+   bytes. Prepare a separate later variation with a combining/emoji cluster
+   across the 17-scalar cutoff if truncation quality is being changed.
+
+Ordinary core/source admission of those exact variations is a pre-native gate;
+none was compiled or generated by this reviewer. A unit-renderer geometry test
+can establish unchanged capsule/endpoint/hit IDs, but it cannot establish native
+glyph width or clipping. Use actual Iced text measurement or captured WGPU output
+for that claim.
+
+At normal readable zoom, inspect each Create capsule with the actual runtime
+fonts and record screenshot/scale/DPI. **Current-code falsifier:** label ink
+crosses the right capsule border, and a point on that ink more than 8 screen px
+outside the capsule fails to select its Create (assuming no nearer overlapping
+item). A particular font keeping these names within bounds disproves that
+specific visual reproduction, not the missing containment in source; record
+the measured result rather than claiming overflow from character count alone.
+
+**Correction acceptance:** all label ink stays inside the padded capsule, no
+wrapped second line appears, exact capsule and near-stroke selection still
+returns the original Create at all tested scales, and passive open/zoom/select/
+Save leaves the whole prepared Project/SourceBundle unchanged. Native appearance,
+fallback coverage, antialiasing at minimum Fit and exact screenshot pixel extents
+remain pending. No additional model error, lifecycle semantic defect or general
+canvas redesign is asserted by this typography review.
+
+## Frozen implementation sketch and name access
+
+This is an uncompiled recommendation, not a production change. For the current
+Scene transform (positive uniform scale only, no camera translation), pass
+`self.scale` from `behavior.rs:2167` into `draw_markers`. Keep capsule fill/stroke
+and existing hit geometry unchanged. Replace only its label draw with:
+
+```rust
+// scale is the same finite positive value used by Scene's outer Frame.
+if scale.is_finite() && scale > 0.0 {
+    let inner = Rectangle::new(
+        marker.capsule.position() + iced::Vector::new(8.0, 4.0),
+        Size::new(124.0, 20.0),
+    );
+    let screen = Rectangle::new(
+        Point::new(inner.x * scale, inner.y * scale),
+        Size::new(inner.width * scale, inner.height * scale),
+    );
+    if let Some(clip) = screen.intersection(&Rectangle::with_size(frame.size())) {
+        frame.with_clip(clip, |child| {
+            // Child starts with identity transform. Coordinates stay absolute
+            // within this canvas; do not subtract the clip origin.
+            child.scale(scale);
+            child.fill_text(Text {
+                content: short(&marker.name, 18),
+                position: marker.capsule.position() + iced::Vector::new(8.0, 6.0),
+                size: 12.0.into(),
+                color,
+                ..Default::default()
+            });
+        });
+    }
+}
+```
+
+`Rectangle::intersection(&Rectangle)` exists in iced_core 0.14.0
+`rectangle.rs:199`; `Frame::size`, `with_clip` and `scale` are existing APIs.
+Intersecting the screen clip with the outer canvas size preserves the parent's
+viewport bound. The current uniform scale takes WGPU's cached-text path; no glyph
+mesh/background reordering is introduced by this sketch. Any future camera
+translation needs the same translation in both screen clip and child transform,
+under the separately owned canvas work. Do not widen the hit rectangle to hide
+an overflow defect. Measured ellipsis remains optional and separate from this
+minimum containment change.
+
+The capsule intentionally selects the original **Create occurrence**, not the
+Lifeline whose name it displays. Keep that identity unchanged. To inspect the
+full Lifeline name, select its neutral lane header/guide, then Selection →
+Properties. `scenario/workspace.rs:256` displays `p.named(app.selected)` without
+`short`, and `:270` sends that exact ID to EditProperties; `forms.rs:172` loads
+the selected project record. Native acceptance should confirm the full name in
+the Inspector and unchanged raw value after cancel. It must not expect clicking
+the birth capsule to rename the Lifeline.
+
+Add a separate combining/emoji display variation before native input, without
+modifying frozen fixtures: a name beginning with 16 ASCII characters followed by
+`e` plus U+0301, and another with a joined emoji sequence near the cutoff. Keep
+their complete source strings as the oracle. Missing installed glyphs are a
+recorded font-coverage limitation, not grounds to require another font; bounding
+and identity checks still apply to the actual fallback/tofu output. Long CJK,
+combining and emoji cases are proposed inputs, not tested screenshots.
+
+Frozen immediately for the user's reboot. No remaining owned compiler/native
+helper exists; read-only file-inspection commands completed. Root owns evidence
+commit, later correction ratification and execution.