Finalize integrated Windows prerelease notes and validation

harness/prerelease-integrated-20260924-release-notes.md

@@ -0,0 +1,58 @@
+# Integrated modeling and text authoring — Windows development preview
+
+This preview brings together changes made since the September12 rename preview:
+
+- Text workspace and preview-state fixes, plus source-preserving Tab/Shift+Tab
+  indentation with Undo/Redo.
+- Saved Scenario arrangements, occurrence-specific Details and editable service
+  values, with clearer draft recovery and inspector actions.
+- Multiple selection in ordinary and State diagrams; supported Process sibling
+  reordering and exact read-only navigation into reused Process contents.
+- Allocation group assignment and explicit Arrange, plus direct OA/SA Allocation
+  drawing between a performer and compatible unallocated leaf work.
+- Ordinary edge attachment controls, State bend editing and semantic port
+  presentation controls.
+- Traceability-view guidance and cross-layer placement, transition review counts
+  and conflict guidance, and picker-first Escape handling.
+
+Download the Windows x86-64 (`x86_64-pc-windows-gnullvm`) Studio ZIP and its
+SHA256 companion. Verify the ZIP SHA-256, extract the entire folder and run
+`arcadia-studio.exe`, keeping `libunwind.dll` beside both executables.
+The package includes the optional REST server, examples, offline help and
+dependency notices. Read `START-HERE.txt`, `docs/windows-packaging.md` and the
+release's `VALIDATION.md`. Copy a complete example folder before editing; Save As
+alone is not a copy of every referenced source/evidence file.
+
+Use `docs/preview-human-checks.md` for feature checks. Supplemental State/
+Traceability and Allocation/Process model kits provide small examples for the
+new interactions. Their own README files identify their original fixtures and
+expected operations. Report the package version from `package.json`, the model
+and reproducible steps.
+
+Source: **715036e132677dd2bc2fb37ed316d93dc9987aec**. Combined Windows gates
+pass 2,200 tests with eight existing ignores and no failures, strict workspace
+all-target Clippy and the individual desktop/server builds. All 29 required
+regression cases passed. The distributed binaries come from the individual
+Cargo build commands recorded in the [reviewed build evidence](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/1a6f2e4f9e8e56a0b4eedd19723a0a0001260300/harness/reviews/prerelease37-final04-complete-20260924.md).
+The supplemental combined desktop/server build also passed, but produced
+different bytes; its binaries were not selected for this package. Individual
+dependency events show differing feature sets; a sole cause is not established.
+
+Verified Studio ZIP: **34,168,661 bytes**, SHA-256
+`5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d`.
+Independent downloads verify this exact archive and all packaged files. Reviewed
+Windows trials cover State bends and Undo/Redo, picker/tool cancellation, guide
+rendering, Save and fresh-process reopen. Packaged REST checks verify conditional
+writes, stale-write rejection and acknowledged-write persistence across an
+owned forced restart. The attached `VALIDATION.md` links the exact raw evidence
+and independent reviews, including a second Windows machine.
+
+This remains an unfinished development-profile prerelease. Crossed Process
+routes and multiline State labels can obscure text or endpoints. Aggregate
+model removal, remaining Scenario group adapters, full public source8 support,
+complete OA/SA acceptance and broad accessibility/DPI coverage remain unfinished.
+Native automation does not cover every held-input gesture. Linux/WSL builds stay
+deferred at the user's request. The private analysis-index work and post-freeze Scenario selection increment
+are excluded. In State Edit transition, Escape dismisses the dropdown; use
+explicit Cancel to close the form. See `VALIDATION.md` for bounded checks and
+retained harness failures/recoveries.

harness/prerelease-integrated-20260924-validation.md

@@ -0,0 +1,170 @@
+# Integrated Windows preview: validation record
+
+Release: `v0.2.0-preview.integrated.20260924`.
+Source/tag target: `715036e132677dd2bc2fb37ed316d93dc9987aec`.
+Platform: Windows x86-64, `x86_64-pc-windows-gnullvm`, development profile.
+The application remains unfinished. Linux builds/checks are excluded from this
+prerelease at the user's request.
+
+## Obtain and launch
+
+Download the Studio ZIP and its SHA256 companion from this release. Verify the
+archive hash, extract the whole directory and run `arcadia-studio.exe`, retaining
+`libunwind.dll` beside both executables. Read `START-HERE.txt`,
+`docs/windows-packaging.md`, `docs/server.md` and `docs/preview-human-checks.md`.
+Copy a complete example folder before modifying it; Save As does not copy every
+referenced source/evidence file. State/Traceability and Allocation/Process
+companion kits are separate optional examples with their own README scope.
+
+ZIP: `ArcadiaStudio-0.2.0-preview.integrated.20260924-x86_64-pc-windows-gnullvm.zip`.
+34,168,661 bytes; SHA-256
+`5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d`.
+
+| Packaged file | Bytes | SHA-256 |
+| --- | ---: | --- |
+| arcadia-studio.exe | 119,396,352 | `2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399` |
+| arcadia-server.exe | 40,228,352 | `6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237` |
+| libunwind.dll | 190,464 | `aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a` |
+
+## Combined source and product builds
+
+Toolchain receipts identify rustc/Cargo 1.98.1 and Windows gnullvm. The reviewed
+input set contains 3,709 paths whose raw bytes and Git blob IDs match the exact
+source above. All before/after source manifests agree. These are recorded build
+provenance checks, not a claim of reproducible binary output or an authenticated
+build system.
+
+The complete native inventory has 61 harnesses and 2,208 test names. Actual
+workspace execution passes 2,200 with eight existing ignores and no failures;
+all 29 specifically required regression cases individually pass. Three additional
+doctest harnesses contain no tests. Strict workspace/all-target Clippy passes.
+
+```text
+cargo test --locked --offline --workspace --no-run --message-format=json-render-diagnostics
+cargo test --locked --offline --workspace --no-fail-fast -- --test-threads=1
+cargo clippy --locked --offline --workspace --all-targets -- -D warnings
+cargo build -p oa-desktop --bin arcadia-studio --locked --offline --message-format=json-render-diagnostics
+cargo build -p oa-server --bin arcadia-server --locked --offline --message-format=json-render-diagnostics
+```
+
+The package uses the preserved outputs of the two individual build commands.
+Raw Cargo executable events and preservation receipts identify their exact
+bytes. The supplemental literal `cargo build --locked --offline -p oa-desktop
+-p oa-server` also passes, but produces different binaries; its products were
+not substituted into this package. Individual dependency events show distinct
+feature sets, including serde_json/raw_value and Tokio macros/signal. The
+comparison does not establish a sole cause for differences or byte equivalence.
+
+Earlier compile failures, an interrupted inventory attempt and the failed
+State-picker fixture run remain recorded. The corrected fixture measures the
+actual picker slot instead of using canvas-relative coordinates, retains its
+captured-Escape assertion and exact model/source/history checks, and passes both
+targeted and combined tests. It does not change production Escape policy.
+
+- [Complete gate archive](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/206f3b969482241e01e2dfc6be955caf31747b89/harness/prerelease37-windows-gates-20260924/final04-complete)
+- [Independent complete-gate review](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/1a6f2e4f9e8e56a0b4eedd19723a0a0001260300/harness/reviews/prerelease37-final04-complete-20260924.md)
+- [Independent test reconciliation](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/25b2eeab14b5b513127aaefd58e32607592da7a4/harness/reviews/prerelease37-final04-tests-20260924.md)
+
+## Download and contents
+
+Fresh parent downloads verify both Studio ZIP and checksum bytes from draft
+assets25/26. All 565 packaged files match the recorded archive fingerprints;
+all 564 entries in SHA256SUMS.txt pass (the inventory does not hash itself). Paths have
+the expected single root without traversal/duplicates/symlinks, and the selected
+product/runtime hashes match the reviewed builds. All 66 previously reviewed
+documents/examples match source hashes. Companion kit uploads were independently
+downloaded and compared byte-for-byte. These are integrity checks; native behavior
+requires the separate trials below.
+
+- [Download/content review](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/2ee740c7/harness/reviews/prerelease37-downloaded-package-20260924.md)
+- [Reproducible inspector and captured output](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/2ee740c7/harness/experiments/prerelease37-package-integrity-20260924/README.md)
+
+## Packaged server
+
+Builder package/server evidence is published at `c82eca1eca204dd28994f5c2e8595d8acd2e148e`:
+`harness/prerelease37-windows-gates-20260924/package-server`. The
+[independent raw-evidence review](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/c599538ce12f0e505d9f222bddf8e8713900fe43/harness/reviews/prerelease37-package-server-20260924.md)
+passes. Its admitted scope is 16 server requests covering
+full current-schema source/model preservation, comment-only revision2 editing,
+stale-write 412 rejection, and exact revision/ETag/source/model persistence across
+an owned forced restart. The failed first trial expected schema5 bytes despite
+explicit migration; the corrected trial supplies schema7 before its request.
+This does not claim graceful shutdown, in-flight crash or power-loss durability.
+
+Both runs launch the extracted server from an unrelated working directory with
+PATH restricted to the package and Windows directories. Pre/post fingerprints
+match. Both recorded exit1 outcomes result from deliberate Windows termination
+after acknowledged writes. The incomplete REST fixture retains its expected
+`sequence_gap` warning; stderr contains expected listening/store messages.
+
+## Packaged desktop and independent machine
+
+Builder GUI delivery `8a82c0da1fd7130807878cc74598545ef38b5904` contains the
+10,357,627-byte native evidence archive, SHA-256
+`f18c21d262ca78bc9c2d8a339c3389fa31c50a81187cc53cc472f3253cda2815`.
+All 351 members and the actual 565-file package binding were independently
+checked. Ten whole-Project comparisons establish baseline, Clear bends,
+Undo/Redo, source/target attachment-tool cancellation, picker cancellation and
+fresh-process reopening. All repeated saved-source inventories match within
+their intended states. Original screenshots and operator records support Home,
+example, guide, view independence, Show-unplaced dismissal and Add existing
+query/filter retention through dropdown Escape/outside click. A separate second
+Escape cancels that ordinary Add existing dialog.
+
+Both actual Studio runs closed after observed Alt+F4, exit0, empty logs and
+unchanged package inventories. The intervening run02 attempt refused before
+launch because its reused working directory was no longer empty. The original
+attempt/cache inventory remains preserved; a reviewed versioned launcher used
+a fresh unrelated directory and successfully reopened the same saved models.
+No particular cache writer or product crash is inferred from that incident.
+
+Independent-machine delivery `684061ec0f486825886c077a038f06d17896392e` contains
+the 3,425,348-byte QA archive, SHA-256
+`cb084be5f316f1b3be45bc5493fe0cbd6076052198c09f9dbac441b8f2588e63`.
+All 190 records were verified, including download/package/build linkage,
+process receipts, five complete saved-source snapshots and 11 HTTP exchanges.
+The actual downloaded package ran on a separate Windows11 build26200 machine
+with system-only PATH, unrelated cwd and its existing user profile. This is
+not a clean-OS/profile or physically disconnected-network test.
+
+That desktop trial loaded the bundled walkthrough, visually exercised State
+Add bend/Undo/Redo, and verified exact whole-source movement Undo/Redo, other-view
+preservation, explicit Cancel and fresh-process persistence. Only one Activate
+waypoint in readiness_view was added; every other source byte remained original.
+Both Studio runs exited0 with empty logs and unchanged binaries/runtime. The
+Engineering guide and State topic rendered in the packaged app.
+
+In the State Edit transition form, first Escape closed its dropdown; second
+Escape retained the form, and explicit Cancel closed it. Capture26's optimistic
+filename is not its outcome. This follows the existing surrounding form policy;
+it must not be generalized from the different Add existing dialog behavior.
+
+The separate packaged-server trial records 23 explicit checks and 11 HTTP
+exchanges: version/help, readiness/OpenAPI, exact CRLF/Unicode source import,
+conditional name-only revision1→2, stale ETag412 and exact model/source/envelope/
+store readback after an owned forced restart. Exit1 is deliberate termination
+after acknowledged writes, not a spontaneous crash or graceful shutdown claim.
+
+Independent raw-data replayers passed after their code was inspected. They are
+offline evidence reconciliation, not additional native runtime trials. Parent
+also inspected seven full-window originals. These finite workflows do not
+complete every human-checklist case or establish general editing usability.
+
+- [Builder GUI admission review](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/4aee179385aa3fefab22aecca668f3058d41024c/harness/reviews/prerelease37-native-gui-20260924.md)
+- [Independent-machine QA admission review](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/4aee179385aa3fefab22aecca668f3058d41024c/harness/reviews/prerelease37-independent-qa-20260924.md)
+- [Parent visual cross-check](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/4aee179385aa3fefab22aecca668f3058d41024c/harness/reviews/prerelease37-parent-visual-20260924.md)
+
+## Remaining product limits
+
+This is an unoptimized development prerelease with debug assertions. Crossed
+Process routes and multiline State labels can obscure content. Aggregate model
+removal, remaining Scenario group adapters, full public source8, complete OA/SA
+acceptance, maintained libraries and broad accessibility/DPI coverage remain
+unfinished. Native automation covers finite workflows, not every held-input
+gesture. The private analysis-index work and post-freeze Scenario selection
+increment are not part of this package. Linux remains untested for this release.
+
+Raw host clock discontinuities are retained in evidence; durations are not
+inferred by subtracting those timestamps. Issue37 is the authoritative live
+coordination record. The release tag and this validation identify delivered
+scope; they do not redefine the user-owned application specification.

harness/reviews/prerelease37-independent-qa-20260924.md

@@ -0,0 +1,80 @@
+# Independent release-37 QA delivery reconciliation
+
+2026-09-24. Reviewer `/root/mixed_index_source_review` (GPT-6 Astra). **No material contradiction or blocker found in this bounded evidence review.** The exact package, captured State presentation/picker/reopen workflow and acknowledged-write server restart evidence support the reported limited QA result. Release admission/publication remain parent-owned.
+
+This review fetched immutable delivery `684061ec0f486825886c077a038f06d17896392e`, inspected archived helper code before executing the two read-only portable evaluators, independently reconciled raw records, and viewed original full-window JPEGs. It did not launch the product, use local GUI automation, build/Cargo, modify source, post remotely or publish anything. Only local inspection artifacts were written.
+
+## Exact artifacts and reproducible inspection
+
+- Delivery branch: `codex/prerelease-package-qa-9e8r6t-20260924`; directory `harness/prerelease37-independent-9e8r6t-20260924` at the immutable commit above.
+- Evidence ZIP: **3,425,348 bytes**, SHA-256 **`cb084be5f316f1b3be45bc5493fe0cbd6076052198c09f9dbac441b8f2588e63`**, 190 unique members. Checked every member's size/hash against manifest, case-insensitive uniqueness and safe relative paths. All five detailed outer reports equal their archived copies.
+- Product source: **`715036e132677dd2bc2fb37ed316d93dc9987aec`**, not the documentation delivery commit.
+- Exact local Studio ZIP: `.local/prerelease37-assets/ArcadiaStudio-0.2.0-preview.integrated.20260924-x86_64-pc-windows-gnullvm.zip`, **34,168,661 bytes**, SHA-256 **`5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d`**. Independently rehashed those bytes and all 565 contained files against the QA download receipt. Also checked all 564 SHA256SUMS entries and all 559 package input hashes; packaged `package.json` equals the archived metadata.
+
+Local reproducible evaluator: `inspect_independent_qa.py`, SHA-256 `46326eef94461bc87166c47ca34f05486648c59d734417c139ec54283e4af4b4`. Structured output: `independent-inspection.json`, SHA-256 `848d3b0894d76b8ed17e82760516f509e7be298dbf3fdbe8ceb3a9ccfc5bccf5`. Both reside alongside this report. Run from repository root:
+
+```powershell
+& C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe .local/prerelease37-integration-review-20260924/inspect_independent_qa.py
+```
+
+Prerequisites are the fetched immutable delivery, the exact Studio ZIP above, and previously delivered local `final04-complete-715036e.zip` plus `final04-complete-manifest.json` in this review directory. The evaluator pins all their expected hashes. It extracts evidence only into `independent-684061e`, verifies data without executing launch/network/build helpers, then runs source-reviewed `native-check.py` and `server-readback-check.py` with Python `-B`. Both exit 0 with empty stderr and JSON equal to their archived result. All 190 extracted files remain hash-identical and no file appears during either replay. These are offline replays, not additional native/server runtime trials or 23 newly executed checks.
+
+## Package, build and process binding
+
+The actual ZIP contents independently match the native/server run pins:
+
+| Artifact | Bytes | SHA-256 |
+| --- | ---: | --- |
+| `arcadia-studio.exe` | 119,396,352 | `2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399` |
+| `arcadia-server.exe` | 40,228,352 | `6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237` |
+| `libunwind.dll` | 190,464 | `aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a` |
+
+Independently rehashed the retained final04 archive (`7cead0b6aa36a6af8fc9f8987186bfe0decd8fa2ebab094fc45387ae9daea632`) and all 462 members. All four package BuildEvidence pins match raw final04 summary/input/environment/relocation records. For each executable, the exact preserved **individual** build hash/size equals the ZIP bytes, the relocation record contains the literal Cargo artifact emitted in that build's raw output, the artifact is non-test, the output contains successful build-finished, the process exit is 0, and before/after source manifests equal the final04 manifest. Supplemental combined-build bytes are not substituted. This corroborates the supplied Cargo/source provenance; it is not an independent compiler rebuild or reproducibility claim.
+
+Native receipt download-proof/launcher pins match actual archived helper/receipt bytes, and executable/runtime pins match the exact ZIP above. All 37 capture receipts' timestamps fall inside their owning process interval and identify that executable path. Run 2 PID 8188 starts `22:02:26Z` and ends `22:11:16Z`; fresh run 3 PID 6904 starts `22:11:30Z` and ends `22:17:09Z`. Both record normal exit 0, unchanged binary/runtime and zero-byte stdout/stderr. Their child PATH is exactly `C:\Windows\System32;C:\Windows`, and cwd is the unrelated `C:\arcadia-package-qa-9e8r6t`. Existing user profile/recovery state remains; this is not a clean-OS/profile trial.
+
+## Native source and visual result
+
+The 9,662-byte native baseline, SHA-256 `2dae785d63a940094d8052f3dcddcb988c024b38df9780e026bccd516264dbfe`, equals the actual fixture inside the archived State/Traceability companion ZIP; that companion checksum passes. I independently located the unique Activate route waypoint needle inside `diagram readiness_view` and compared all five complete saved files against baseline with exactly one inserted waypoint object. No whitespace, number or newline normalization was used.
+
+| Saved snapshot | Added waypoint | Exact result |
+| --- | --- | --- |
+| `native-2/bend-saved.arcadia` | (530,385) | 9,705 bytes; `ea05d0e409687c7943dda0b93bc34036eb524f5f5033b912e71ad2eaf643a158` |
+| `native-2/move-undo-saved.arcadia` | (526,310) | 9,705 bytes; `7f1fc18265a79b7d452e4a3de3f17671684e38c0f727cbdec15833196f46f114` |
+| `native-2/move-redo-saved.arcadia` | (530,385) | Exact equality with bend-saved |
+| `native-2/after-cancel-saved.arcadia` | (530,385) | Exact equality with bend-saved |
+| `native-3/reopened-saved.arcadia` | (530,385) | Exact equality with bend-saved |
+
+The original (500,310) waypoint remains. All other source bytes—including semantic declarations, IDs, endpoints/attachments, node positions, labels, other routes and all other views—remain original. This is whole-source preservation evidence; I did not run a semantic parser or inspect an in-memory model/history stack.
+
+I viewed the full-window originals below, not their 16x16 icon companions. Paths are under `independent-684061e/` beside this report:
+
+- `native-2/09-add-bend-1.jpg`, `10-undo-added-bend-1.jpg`, `11-redo-added-bend-1.jpg`: visible selected-route square handles change two → one → two with corresponding Undo/Redo status. Add-bend Undo/Redo is visual evidence; no saved original/no-bend snapshot was invented.
+- `native-2/14-undo-bend-move-1.jpg`, `16-redo-bend-move-1.jpg`: added handle returns near the original, then moves downward again. The byte oracle establishes coordinates.
+- `native-2/19-reference-view-1.jpg`: distinct “04 Readiness — untouched reference” view, without the edited view's two bend handles. Full-byte comparison independently establishes its preservation.
+- `native-2/24-transition-source-picker-1.jpg`: dropdown open inside Edit transition. `25-first-escape-picker-only-1.jpg`: dropdown closed, form still present with retained fields.
+- **`native-2/26-second-escape-cancels-form-1.jpg`: form is still present.** I inspected this original at full resolution. The optimistic filename is false as an outcome description, and the delivery correctly overrides it in README/reports. It must not be cited as second-Escape cancellation.
+- `native-2/28-explicit-cancel-1.jpg`: form closed; edited route remains. The subsequent saved file is unchanged. No form fields had been changed, and no internal history-stack behavior is inferred.
+- `native-3/05-persisted-bend-selected-1.jpg`: fresh-process view 03 retains the downward bend and two square handles. `native-3/08-state-guide-topic-1.jpg` shows rendered States, modes & transitions guide content.
+- `native-2/04-walkthrough-loaded-1.jpg`: bundled water-pressure walkthrough visibly loaded from the unrelated launch cwd, with 94 objects/62 links/1 model check.
+
+Checked the actual immutable 715036e Escape branches (`crates/oa-desktop/src/app.rs:2742`, `behavior/states.rs:283`, `app/escape.rs:18`) and issue-35 contract. They preserve the ordinary transition form's explicit Cancel policy; there is no generic second-Escape state-draft cancellation branch. Thus observed retention is consistent with the selected requirement that later Escape follows the surrounding workflow's existing policy.
+
+At 56% Fit, the State fixture labels are visibly small/crowded, especially in the reference view. Its displayed 12 model checks are retained fixture incompleteness. The record does not establish broad editing usability, readability, accessibility or complete State behavior. Guide rendering does not establish a network-disabled environment.
+
+## Captured server reconciliation
+
+Read the archived runtime helper before evaluation; did not execute it. Independently checked all 11 request methods/paths, body Content-Lengths, response status sequence `[200,200,201,200,200,200,412,200,200,200,200]`, and JSON relationships rather than trusting `status: PASS` alone.
+
+- Readiness and served OpenAPI succeeded; response 2's JSON exactly equals `docs/openapi.json` from the actual pinned Studio ZIP.
+- Import request/GET/source GET preserve complete entry/file content, original CRLF, Unicode em dash/comment and stable model UUID. Allocated resource `230d7234-8150-4252-a4bd-85a3b7b2308c` differs from model UUID `93200000-0000-4000-8000-000000000001`.
+- Conditional PUT changes the single project-name string only, returns `changed: true`, increments revision 1→2 and returns a new strong ETag. Readback model equals the original complete model with only `name` replaced; exact edited source is preserved.
+- Stale PUT carries the original ETag and distinctive `STALE MUST NOT PERSIST` source. Response is 412/revision_conflict. Subsequent accepted GET/source output equals the intended version, excluding that rejected write.
+- Accepted GET equals fresh-process GET, archived accepted envelope and store JSON. Store bytes hash `c928995daf0c1ff3963850aba9ad533196423fa2112ad99554758825f73fc5af`; final ETag is consistent across edit, readback and reopened endpoints. Original/final revisions and ETags match the recorded result.
+- Runtime result has 23 distinct named checks, two distinct owned server processes (4176 and 2188), exact packaged executable/runtime identities and loopback-only bind `127.0.0.1:61860`. Reviewed stdout/stderr contain normal startup text and no reported crash diagnostic. Version/help exit 0; version prints `arcadia-server 0.2.0`.
+
+Both server exit-1 results are explicitly imposed Windows TerminateProcess after acknowledged requests. This supports persistence of acknowledged writes across that restart, not graceful Ctrl+C shutdown, in-flight-write recovery or power-loss durability. The 23 checks are the recorded runtime helper's checks, not 23 HTTP calls or 23 new trials in this review. Authentication, remote networking/TLS, concurrency/load, Linux and broad API semantics remain outside this evidence.
+
+## Final disposition
+
+The delivery's corrected, bounded conclusions are supported by raw package/build/process/source/HTTP records and selected original screenshots. No acceptance claim needs expansion. Preserve the explicit second-Escape correction, source715036e/package hashes, forced-server-stop limitation, existing-user-profile qualification and readability limitation in final release evidence. This review supplies additional independent evidence for release-owner judgment; it does not close the full human checklist, issue 37 or the user application goal.

harness/reviews/prerelease37-native-gui-20260924.md

@@ -0,0 +1,31 @@
+# Native GUI evidence admission review — 2026-09-24
+
+No new material admission finding. The published evidence supports the bounded Windows packaged workflows and saved-state claims, with the observational limits below. This is an independent read-only evidence review, not a new native execution or full application acceptance.
+
+## Identity and method
+
+Read README, independent-review and manifest through Gitea MCP at `8a82c0da1fd7130807878cc74598545ef38b5904:harness/prerelease37-windows-gates-20260924/native-gui`. Downloaded only its capped manifest/archive. Manifest SHA256 `acc5a1f1add9bc8be0711372224d8941ac14dfdc6018f7f6cc38b5bb798cc0b1`; archive 10,357,627 bytes, SHA256 `f18c21d262ca78bc9c2d8a339c3389fa31c50a81187cc53cc472f3253cda2815`. Independently checked all 351 unique exact members, lengths, SHA256 and CRC against manifest. Original stage manifest SHA256 `c90371bee1c2b2ae850b5d8e64ab9f1368f541ef51104e3b888a721e05d49c13` matches.
+
+Reproducible local data inspector: `inspect_native_gui.py`, output `native-gui-inspection.log`, adjacent to this report. Run using Python with assertions enabled (`python -B inspect_native_gui.py`). It reads ZIP/JSON/Git blobs, extracts only explicitly allowed evidence text/data/images into `native-gui-inspection`, and never imports or executes archived recipes or binaries. No candidate edits, Cargo, product launches or remote writes were performed. The first extraction refused JPEG files absent from the local inspector allowlist; adding JPEG as evidence data resolved that local inspector-only omission. No original evidence was changed.
+
+## Independently reconciled
+
+- Frozen source is `715036e132677dd2bc2fb37ed316d93dc9987aec`. Entire stage source inventory equals the archived final04 inventory already independently checked against all 3709 immutable Git input blobs in FINAL04-COMPLETE-REVIEW.md. The baseline fixture was additionally read from this exact local Git commit and byte-compared: B SHA256 `2dae785d63a940094d8052f3dcddcb988c024b38df9780e026bccd516264dbfe`. P is exactly B minus the single predefined Shutdown complete placement source line.
+- Independently deep-copied complete expected B: removing only Activate's unique `(500,310)` waypoint yields complete C; removing only placement `ea202922-0033-4000-8000-000000000216` for element `...000000000037` yields complete P. All frozen typed-validation outputs equal their expectations. Expectations are bound in the staged immutable manifest before launches; no GUI edited result was used to construct an oracle.
+- All ten complete actual Project JSON objects exactly equal expected B/C/B/C/P/P/P/P/C/P, using strict canonical JSON. Each receipt binds the exact stage manifest/source, accepted=true, no failure, unchanged original before/after inventory, actual output digest and exact archived source bytes. Each converter/snapshot receipt has successful exit, expected helper/runtime hash, matching argv, input/output digests, and empty stderr. All five P source inventories match checkpoint04; all three C inventories agree, including reopened08. Final working C/P bytes match those checkpoints.
+- Rehashed actual local release ZIP `5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d` and every one of its 565 member lengths/digests against stage package inventory. GUI identity remains individual-build `2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399`; runtime `aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a`. Snapshot `6a1f438ab8f122251846f46cf1c5440ec7b0362b34fd61b97286d470bad11b74` and supplemental converter `c318ea38111688b6ce0d878b3e9e7dfebe0b3732d0c094bb4580fb39dbcc3d26` match already reviewed source/build provenance in PACKAGE-SERVER-REVIEW.md and FINAL04-COMPLETE-REVIEW.md.
+- run01 PID6516 and run03 PID2044 bind the admitted extracted executable, exact argv, stage manifest and archived launcher hashes. Both close receipts match PID and exit0, package_unchanged=true, with empty raw stdout/stderr. Child environments are exactly equal: private LOCALAPPDATA and PATH limited to package plus System32; run03 changes only unrelated cwd among these launch settings. All 44 capture metadata records identify the admitted executable and include an actual full-size image member.
+
+## Original refusal and recipe boundary
+
+Read stage/check recipe, PLAN, both launcher versions, observations and cwd incident. The stage/check algorithm compares entire model objects and closure fingerprints; its success is not inferred from screenshots. The frozen recipe's historical “prepared/unexecuted” text is retained preparation provenance, not the current execution report.
+
+run02 is explicitly a pre-Popen refusal at the original launcher's empty-cwd assertion. `reviews/cwd-incident.json` retains the assertion/attempt record and original inventory, including literal `%SystemDrive%/ProgramData/Microsoft/Windows/Caches` with three file digests. It is not counted as a successful launched process. Independently versioned v2 launcher SHA256 `09ba3aad00643d9915453797656347ba1084a3b9a75187964587a733ea19fc4b` requires fresh run>=3 cwd, preserves the original incident and verifies its old inventory before launch and after exit. Raw run03 inventories equal the incident. Cache-writer attribution remains unproven. There is no evidence substitution or need to discard the original refusal.
+
+## Visual review and limits
+
+Viewed 18 full-size archived screenshots: 03,04,06,08,10,12,14,26,27,29,30,31,32,35,36,41,42,44. They corroborate the populated example and guide/return, authored square disappearing/restoring/disappearing, armed source/target status reverting to Select/move, Dispatch query and filter surviving popup dismissal, dialog cancellation restoring clean canvas, reopened cleared State and Show-unplaced offering Shutdown complete, and final all-changes-saved feedback. State labels remain tiny/congested at the shown 56% view; #36 remains open scope, not accepted as fixed.
+
+Images establish visible states, not the causal input between captures. The published operator observations supply the Escape/outside-click/Alt+F4 sequence and fresh-process Open actions; mechanical receipts independently establish saved contents and process identities. Exit0 alone does not establish normal-close cause, and full Project equality does not expose transient focus/undo internals. No broader accessibility/DPI/performance, held-drag/reconnect, physical network disconnection, Linux or full specification claim is warranted. Independent downloaded-package runtime QA and release-owner synthesis remain separate.
+
+For parent visual review, all full paths start `C:/Users/User/Documents/Git/ARCADIA-Studio/.local/prerelease37-integration-review-20260924/native-gui-inspection/native/captures/`. Selected exact filenames: `08-activate-selected-1.jpg`, `10-clear-bends-1.jpg`, `12-undo-1.jpg`, `14-redo-1.jpg`, `26-source-armed-1.jpg`, `27-source-escape-1.jpg`, `31-filter-open-suggested-1.jpg`, `32-filter-escape-dialog-retained-1.jpg`, `35-first-escape-all-retained-1.jpg`, `36-second-escape-cancelled-1.jpg`, `41-run3-state-cleared-bend-1.jpg`, `44-run3-saved-before-normal-close-1.jpg`. Index0 is often a 16x16 auxiliary surface; use index1 for those captures.

harness/reviews/prerelease37-parent-visual-20260924.md

@@ -0,0 +1,35 @@
+# Parent visual cross-check of packaged trials
+
+2026-09-24. Parent Codex-956atf independently opened seven original full-window
+JPEGs from the two published evidence archives. No application was launched or
+controlled on this machine. These observations supplement the separate raw
+source/model/process reconciliation; images alone do not prove persistence or
+history integrity.
+
+Builder delivery `8a82c0da1fd7130807878cc74598545ef38b5904`, archive SHA256
+`f18c21d262ca78bc9c2d8a339c3389fa31c50a81187cc53cc472f3253cda2815`:
+
+- `native/captures/31-filter-open-suggested-1.jpg` shows the Add existing dialog,
+  Dispatch query and open Suggested filter. Capture32 closes the dropdown while
+  retaining the dialog, query, filter and empty-result guidance.
+- `native/captures/36-second-escape-cancelled-1.jpg` shows the ordinary canvas,
+  no chooser, all changes saved and Cancelled/Select-move feedback.
+- `native/captures/41-run3-state-cleared-bend-1.jpg` shows reopened State view03
+  with Activate selected, endpoint circles and no authored bend square. The
+  displayed route labels are small and overlap nearby content at 56% Fit.
+
+Independent-machine delivery `684061ec0f486825886c077a038f06d17896392e`, archive
+SHA256 `cb084be5f316f1b3be45bc5493fe0cbd6076052198c09f9dbac441b8f2588e63`:
+
+- `native-2/26-second-escape-cancels-form-1.jpg` actually shows the Edit transition
+  form still open, source dropdown closed. Its intended-outcome filename is not
+  accepted as evidence that the form closed.
+- `native-2/28-explicit-cancel-1.jpg` shows the form closed, Activate selected and
+  its two square bend handles, including the lower added bend; all changes saved.
+- `native-3/05-persisted-bend-selected-1.jpg` shows the same two-handle route in
+  reopened view03 and source-opened feedback. Exact coordinates and source
+  preservation require the separately reviewed five-file byte oracle.
+
+The captures support the bounded described visual states. They retain the known
+State label crowding and do not establish general readability, accessibility,
+every intermediate input event or completion of the human preview checklist.