# Native behavior creation contract

Independent checker: `harness/behavior-creation-contract.rs`. The contract was
prepared before reading any created output on 2026-09-11. Its direct-rustc build,
self-check and unchanged-baseline comparison pass; native creation acceptance
is not implied.

Use a whole-directory copy of the preserved input:
`.local/native-qa/palette-20260910-v3/checkpoint-transition-reopen/project.arcadia`.
It contains 10 elements, two relations, four diagrams, one trace and six source
files. Do not edit or overwrite that baseline or an earlier checkpoint.

Perform these cumulative operations through Behavior → New, saving a separate
whole-directory checkpoint after each Create and open:

| Stage | Intended fields and exact result |
| --- | --- |
| `process` | OA **Operational process**, name **Coordinate rescue**. Root ownership, empty steps and description; no diagram or implicit work. |
| `scenario` | OA **Scenario**, name **Rescue coordination conversation**. Explicit **Participants · interactions** (`ParticipantInteraction`) viewpoint; optional context **Rescue capability**, UUID `b451c000-0000-4000-8000-00000000001f`. Root ownership is separate from context. Empty precondition, postcondition, steps and description; no lifelines/messages or diagram. |
| `machine` | SA **State machine**, name **Rescue team operating modes**. Existing **Rescue team** SystemActor owner, UUID `c0629449-1209-4b50-afac-f558a9a0fc7f`. Opt into **Create the first state view**. No regions or states. |

Before observing output, the first-view contract is fixed as **Rescue team
operating modes · states**, SA `StateMachine { machine: NEW_MACHINE }` projection,
empty description/routes, default view options, exactly one placement of the
new machine. Its initial position is 60,60 and size 336×104; the independent
shared-core Layout prediction retains those values. The machine's semantic
parent remains the SystemActor, not its diagram. Every previous object and
source byte is retained except the explicitly predicted additions/includes.

Build only within a coordinated direct-rustc writer window. This imports
`oa_core` and no desktop creation producer:

```powershell
. .local/toolchain/env.ps1
rustc --edition 2024 -D warnings --crate-name behavior_creation_contract harness/behavior-creation-contract.rs --extern oa_core=.local/target-gnullvm/debug/deps/liboa_core-3e81c616fea1d901.rlib -L dependency=.local/target-gnullvm/debug/deps -C linker=clang.exe -o .local/behavior-creation-oracle-20260911/behavior-creation-contract.exe
$oracle = '.local/behavior-creation-oracle-20260911/behavior-creation-contract.exe'
$base = '.local/native-qa/palette-20260910-v3/checkpoint-transition-reopen/project.arcadia'
& $oracle self-check $base
& $oracle check baseline $base $base $base
& $oracle check process $base PATH_TO_PROCESS_ENTRY PATH_TO_PROCESS_ENTRY
& $oracle check scenario $base PATH_TO_SCENARIO_ENTRY PATH_TO_SCENARIO_ENTRY
& $oracle check machine $base PATH_TO_MACHINE_ENTRY PATH_TO_MACHINE_ENTRY
```

After each creation, Undo once and Save into a fresh checkpoint; `same` must
compare that checkpoint with the preceding accepted stage (the initial baseline
for Process). Redo once and Save into another fresh checkpoint. For Redo and
reopen, pass the **first committed checkpoint** as the final role argument:

```powershell
& $oracle same PREVIOUS_ACCEPTED_ENTRY UNDO_ENTRY
& $oracle check machine $base REDO_ENTRY FIRST_MACHINE_ENTRY
& $oracle same FIRST_MACHINE_ENTRY REOPEN_ENTRY
```

Use the corresponding stage for Process/Scenario history. This pins original
UUIDs across history; using a redo file as its own role carrier would not prove
identity retention. A cancellation has no predicted addition: compare its
checkpoint with the accepted pre-cancellation checkpoint using `same`.

The checker borrows only unique fresh UUIDv4 values with exact literal
kind/layer/name, view projection/name, or diagram/element placement roles.
Descriptions, aliases, parents, viewpoint/context, body defaults and geometry
are independently constructed. It compares complete Project and SourceBundle,
rejects detached extra `.arcadia` files, and uses pinned six-file byte lengths
and FNV-1a fingerprints to refuse a substituted baseline. SHA-256 provenance
is recorded in `harness/release-behavior-creation-oracle-20260911.md`.

Self-checks use deliberately false metadata/geometry in the role carrier, then
reject changed scenario semantics, unrelated edits, extra objects/files and
source-only comment drift. Native focus, readable labels, minimum/wide layout,
selection of the new owner/view, and one-step Undo/Redo are separate observations;
saved equality alone cannot establish them.