ARCADIA-Studio/harness/release-current-native-plan.md

Current milestone native QA — deterministic fixture, 2026-09-06

Root is the sole native operator. This plan performs no native input and does not declare UI acceptance. Fixture and validator are ignored local test artifacts, not user data or production code.

Fixture and production oracle

Pristine input: .local/native-fixtures/state-actions.arcadia. Project UUID: f0060906-0000-4000-8000-000000000000. Use a copied file under .local/native-fixtures/runs/ for every destructive or crash trial. Do not overwrite the pristine fixture or use a real project.

Expected current-source5 graph: 14 elements, 10 relations, one saved state view, 8 placements, no artifacts or traces. The production validator lives at .local/native-fixtures/validate-state-actions.rs; it decodes through persistence::decode_with_report, validates, proves canonical parse/model equality/idempotence, and asserts the counts and projection geometry. It writes state-actions.canonical.arcadia as a model oracle. Its exact run output and pristine SHA256 are recorded in state-actions.validation.txt and state-actions.sha256.txt when validation completes. An old source3 example was used only as syntax reference; the fixture itself is new source5 with fixed IDs.

Production validation completed successfully using a separate direct-rustc helper linked to the built core (no Cargo/shared-target writes): schema5, 14 elements, 10 relations, 1 diagram, 8 placements, 0 artifacts/traces, 0 issues; 8 projected nodes and 3 routed edges; Ready y180 and nested region y430; canonical parse equality and idempotence passed. Pristine SHA256: 9CDE82608110E56AA9E14C9E33EB38976F53AED74AB013145D411D5743A0EC26.

Open SA → Behavior → Pressure operation and its existing Pressure operation — saved state view. All IDs below share f0060906-0000-4000-8000- with the listed 12-digit suffix. The System owner is Pressure controller (000000000001), machine 000000000002, Ready 000000000004, nested Monitoring region 000000000005.

Visible Ready content, top to bottom	Selection / exact model oracle
entry / Retained entry notes	Existing prose on Ready, not a StateAction relation
entry / Restore settings	Entry work link 000000000030, Entry, target function 000000000010
do / Monitor pressure	Do work link 000000000031, Do, target function 000000000011
exit / Release resources	Exit work link 000000000032, Exit, target function 000000000012
INTERNAL · Refresh status plus its typed trigger/guard/effect summary	Internal transition 000000000033, Ready→Ready, Sample tick Event 000000000013, guard pressure_valid, effect work Monitor pressure
Monitoring region containing Start monitoring and Sampling	Actual semantic nested region; its top must be below all preceding rows

Ready reserves 232 world units of header (64 basic +28 prose +84 typed actions +56 internal row). There are exactly three projected/routed transition edges; neither typed actions nor the internal transition are graph edges. The referenced functions have actual Allocation to Pressure controller and no state-view node placements. They are not Ready's contained children.

Typed action and saved-view trial

1. At 1440×900, use Fit, inspect all content above, then use readable zoom. Click each typed action row: corresponding relation and phase/target appear in Properties, with selected-row highlight. Right-click resolves the same action identity. Click Internal: inspect the actual transition. Selection must not dirty the model, move nodes or display a phantom contained Function.
2. Repeat at supported minimum 1100×700, including scrolling/pan and opening the inspector. Rows must remain independently selectable; source/target/phase and Create/Cancel/Apply controls must be reachable with no overlap or clipped essential controls. Capture visible evidence at a readable scale, not only Fit.
3. Follow/select target Monitor pressure through normal model navigation and rename it Monitor pressure QA. Return to the state view: Do row follows the new name, its relation/target IDs remain ...031/...011. Undo restores the original text; Redo restores QA text. Other phases and legacy prose stay exact.
4. Fold Ready: all typed/internal content and nested region disappear without semantic deletion. Unfold: content, phases, reference IDs and child order return. Save to a trial source file and reopen the actual file through the native UI. Verify stored collapse choice, current name and all fixed IDs/positions. Use source/core parsing for the saved model, not an object-count-only oracle.
5. Restore the original fixture for other trials. Record binary hash, viewport, platform, saved file and serious runtime output. Desktop tests passing does not substitute for these gestures; Linux and Windows evidence are separate.

Explicit recovery trials

Run each from a fresh trial copy unless a combined case is explicitly desired. Wait for the application's checkpoint completion signal/storage evidence before the root deliberately terminates the fixture app to simulate a crash. Reopen and choose the offered snapshot explicitly. A normal discard/close has a different meaning and is not a crash test. Restore must reopen a detached unsaved project; the original source file bytes must remain unchanged until an explicit new Save As.

Draft surface	Authored state before crash	Restore oracle
Numeric property	Data → Retry budget (...014), change Integer minimum from 0 to raw -; attempt Apply to demonstrate rejection	Exact - survives in its field; accepted minimum remains 0, maximum4, default none, unit attempts. Repair to1 applies only after user action; undo returns accepted0.
Source	Textual model, append // SOURCE_DRAFT_KEEP_ME and an unterminated declaration/string; preserve an actual newline in raw text	Same raw bytes/lint location return, while graphics still show accepted fixture; no auto-Apply or generated-text replacement. Revert/repair is explicit. Include an additional dirty detached buffer in a separate trial if the UI offers it.
State behavior	Configure Ready→Idle transition; name BEHAVIOR_DRAFT_KEEP_ME, guard pressure.pending; enable timed trigger but leave its expression as three spaces. Submit rejects with time-expression guidance	Pending form remains on Pressure operation with name, guard, timed choice, whitespace and endpoints retained. No Event/transition created. Repair expression to 2 s and explicitly submit only after confirming restored raw state.
General workflow	Start a relationship from Pressure controller; set name WORKFLOW_DRAFT_KEEP_ME, leave required target unset (or clear it), and demonstrate blocked submission	Same selected relationship kind, source, exact name and missing target remain. No relationship silently created by restore. Complete target/submit is an explicit new action.
Combined accepted+raw	Commit target rename Monitor pressure QA, then create invalid source draft with the marker above	Restored accepted graph has QA name with same IDs, plus exact unapplied invalid source bytes. It must not restore the pristine graph or apply the bad draft.
Semantic workflow	Use the root's separately validated OA/SA semantic fixture; stage a Candidate numeric -, a literal multiline Annotation expression and unfinished reference pair	Decisions, raw values and unfinished pair survive against the exact accepted model fingerprint; no restored commands execute. A snapshot with mismatched accepted model must reject visibly. This state-only fixture intentionally has no fake counterpart traces.

For every restore: selection/owner/perspective must expose the retained draft; changing page must not erase it; Cancel returns to the accepted model; failure to decode one version/path must not overwrite source files. Verify a successful Save As writes only the chosen new destination and no hosted credentials/destination were resurrected. Recovery checkpoints are user-local and separate from model files; no auto-recovery into the original file is accepted.

Evidence completion

Append actual results with exact scope after root operation: fixture decoder output, Windows normal/minimum, Linux normal/minimum, saved core/source comparison, property/source/behavior/workflow/semantic recovery, and unchanged original-file hash. Leave unoperated scenarios marked pending rather than inferring them from adjacent successful tests.

Native finding: a saved state view opened in Architecture

Root observed the fixture open on Architecture with the generic renderer: Ready reserved the 232-unit header but omitted typed/internal rows, and the toolbar offered function/boundary exchange tools. The dedicated Behavior canvas already rendered the correct content. This was a workspace-routing defect, not missing StateAction semantics or a reason to create a second renderer.

Bounded fix routes a StateMachine projection chosen during model open, diagram selection, reveal or other navigation into the existing Behavior workspace, with the exact saved view and its machine owner. Selection/raw property Draft survive; the model/source are untouched. Existing pending-behavior guards remain in force. Explicit Architecture navigation chooses a normal same-layer view, or an empty Architecture workspace when none exists, so the user can create an architecture view and is not bounced back to Behavior. The architecture chooser can still open a saved state view explicitly.

Regression coverage includes constructor and actual source Open; selecting a second saved view; revealing a transition into a named state view; no history or source mutation; explicit Architecture navigation with/without a normal view; raw invalid properties and pending behavior retention. The three focused routing tests passed, and the full current desktop suite passed 435/435 on 2026-09-06 (.local/state-routing-desktop.log), including the latest restored-checkpoint Home-list regression. The older fallback-owner first-move test now starts with a deterministically preferred Allocation view; its captured-context and first drag transaction assertions remain intact. Native recheck of the rebuilt binary remains pending until recorded by the responsible operator.