# R5 core state/event milestone — 2026-09-05

Status: core implementation frozen for independent review and desktop integration.
This is the bounded R5 milestone, not a declaration of release completion. R3,
R6, native interaction review and final migration remain separately owned work.

## Concrete model and editing behavior

- `Kind::ALL` has 38 kinds. `StateKind` has 13 vertices: State, Mode,
  Initial, Final, Choice, Junction, Fork, Join, ShallowHistory, DeepHistory,
  EntryPoint, ExitPoint and Terminate. `is_state()` means vertex family;
  `is_stable_state()` restricts behaviors, availability and composite ownership.
- Shared `EventBody` is Signal `{ items }`, Time `{ kind: After|At, expression }`,
  or Change `{ expression }`. Time/change expressions are engineering annotations;
  they are checked for valid text and missing content, never evaluated.
- StateTransition retains exact trigger/guard/effect prose and adds
  `transition_kind: External|Local|Internal`, `triggers: Vec<Id>` and
  `effects: Vec<Id>`. Triggers are same-layer Event/work alternatives; effects
  are same-layer work. External participants' work may trigger a machine.
- Existing constructor/serde defaults remain External and empty typed lists.
  `Project::relate` (therefore `Command::Connect`) and `can_connect` infer Local
  for EntryPoint routing. Explicitly authored relation constructors remain exact.
- Empty trigger references with nonblank trigger prose warn `unresolved_trigger`;
  they are not reinterpreted as completion. Removing the last typed trigger keeps
  a descriptive replacement prompt naming the removed trigger, unless authored
  trigger prose already exists. All reference cleanup is part of the undoable edit.

## Validation and ownership

`state_validation.rs` is one private structural-rule module called by the existing
validator; it introduces no new graph, framework or execution state. Existing
reference visitors handle Event payloads and transition trigger/effect lists.

The adopted contract in `release-state-contract.md` is implemented: same-machine
hierarchy, stable Internal/External self transitions, proper-descendant Local
routing, region-owned boundary points, strict pseudo triggers/directions,
upper cardinalities, literal Choice else uniqueness, per-region shallow/deep
history, and Fork/Join orthogonal arms measured at their nearest common composite.
Incomplete connections, guards, default entry and structural reachability warn.
Reachability includes nested default entry and conservatively ignores guard
evaluation and stored history. It does not claim machine execution.

State-machine Subtree transition closure now includes its state transitions and
typed StateActions; Required edge closure includes referenced Events, items and
work. Matching new vertices and Events get typed State traces in both directions.
Unrelated Availability relations are not pulled into a machine transition.

Demo still has no validation diagnostics. It now has 41 elements: the two added
Events resolve the existing timeout/report transition prose without rewriting it.

## Verification actually performed

Target directory: `D:/CodexBuilds/Capella2-01a06e2e`.

- `cargo check -p oa-core --all-targets --locked` passed.
- `cargo test -p oa-core --locked` passed **102 integration tests**:
  language 16, language limits 4, process diagnostics 1, capabilities 7,
  topology 6, scenarios 14, states 11, review regressions 15, workflows 28.
- After strengthening all-vertex OA↔SA coverage and atomic rejection assertions,
  `cargo test -p oa-core --test release_states --locked` passed all 11 again.
- `cargo clippy -p oa-core --all-targets --locked -- -D warnings` passed after
  the final focused test edits.

The 11 new tests cover every vertex as an editable draft, stable-only behaviors,
typed Event/transition refs and invalid refs, last-trigger cleanup/reidentify/
delete/undo, local/internal hierarchy, terminal/initial rules, Choice/Junction,
history, deep orthogonal Fork/Join, boundary routing and candidate filtering,
nested reachability, and complete typed transition closure in both directions.
R4 scenario regression tests remain passing. No native UI/Computer Use was
performed by this core worker; the lead owns native verification.

Initial broad regression found only the old demo element-count expectation (39);
it was corrected to 41 after adding the two typed Events. The no-diagnostics
assertion still passes. No failed check is being left unexplained.

## Handoff

Core signatures are frozen. Source/API integration owns `language.rs`, persistence,
OpenAPI, normative reST and schema migration. Desktop owns the state editor,
Event controls, distinct symbols and runtime interactions. Independent review
should check structural boundary/orthogonal edge cases against the adopted
contract, not infer simulation support from enum names.