# Process multiple-selection native evaluator design

The independent evaluator is `crates/oa-core/examples/process_multiselect_native.rs`. This document describes its intended gates, not successful build/test/native evidence. It was prepared while the parent integrated the desktop adapter; no Cargo or formatting command ran during preparation.

## Fixture and expected operation

Generate a fresh directory with deterministic UUIDs, `baseline.json`, source bundle and `manifest.json`. Generation refuses an existing output directory; every write is create-only. The checker also compares the loaded baseline with its deterministic original fixture, so a reordered snapshot cannot silently become the baseline. Pin the generated files and command in the native receipt before interaction; these checks do not authenticate external evidence by themselves.

Open the generated source, choose Behavior and **01 OA group order**. Its source steps are `[Card A, Downstream U, Card B, Downstream V, Card C]`. Explicit links A→U and B→V produce one column containing A/B/C and another containing U/V. A and C are distinct Action occurrences sharing the same reusable Activity; B is a Choice control. Select C, add A, then use **Inspect this element** on C without changing membership. Drag C after B. C is both pressed member and primary: a singleton C reorder would leave the original order unchanged, whereas the group moves A before C. With A primary, a singleton A reorder could accidentally produce the expected group order; that weaker trial is insufficient. Literal expected source steps are `[B,U,A,V,C]`, retaining U/V in indices 1/3 and A/C in their original internal order despite reverse selection.

The checker has `unchanged` and `reordered` modes. It modifies only the expected OA owner's steps with that literal list, then compares the complete Project. It never calls a desktop planner, renderer, selection helper or inferred pointer geometry. Links/guards, reused work, occurrence bodies, all SA records, trace baseline and unrelated processes must remain exact. JSON and source roundtrips are also checked; completeness warnings are permitted, source errors are not.

The compact **SA chain - preserve** contains a matching five-card FunctionalChain fixture. Its complete records must remain unchanged during OA trials. **02 Read-only preview trial** has two local references to **Reusable request detail**. Their preview tiles show the same defining occurrence through different paths, permitting exact-identity/read-only refusal trials; saving after those refusal trials should satisfy `unchanged` against the original baseline.

## Proposed commands

Use the parent's established toolchain and gate receipts. From the repository root:

```text
cargo test --locked --offline -p oa-core --example process_multiselect_native -- --nocapture
cargo run --locked --offline -p oa-core --example process_multiselect_native -- generate FRESH_DIRECTORY
cargo run --locked --offline -p oa-core --example process_multiselect_native -- check unchanged FRESH_DIRECTORY/baseline.json SAVED_SOURCE_ENTRY
cargo run --locked --offline -p oa-core --example process_multiselect_native -- check reordered FRESH_DIRECTORY/baseline.json SAVED_SOURCE_ENTRY
```

The manifest identifies the emitted source entry. Native windows/load paths and executable hashes must be captured by the actual evaluator run. The example supports JSON saved inputs too.

## Falsifiers and limits

Five evaluator tests exercise deterministic/create-only generation; real validated `SetSteps` output; unchanged/reordered distinction and replaced-baseline refusal; wrong global splicing, reversed block, and the unchanged singleton-C result for the prescribed gesture; link guard/endpoint drift, reusable Activity changes, SA semantic/order changes, reused-definition and cross-layer baseline corruption; source compile/roundtrip and valid source drift. Negative Project mutations are asserted core-valid before checker rejection, distinguishing oracle sensitivity from trivial malformed-input rejection.

Native acceptance must separately establish Shift/focus delivery, selection painting/count, selected-anchor no-op, actual Before/After zones, cancellation, context menus, whole-set mixed/qualified refusal, one Undo/Redo, source inspection, stable camera/layout and responsiveness. Whole-Project equality does not establish those interactions or exact source-byte preservation. This fixture does not test aggregate deletion, Allocation or Scenario semantics. `reordered` is specifically the OA operation above; the SA fixture is a preservation sentinel, not an accepted SA native reorder run.