ARCADIA-Studio/harness/state-multiselect-native-design-20260923.md

State multiple-selection native fixture and invariant evaluator

Implementation candidate: crates/oa-core/examples/state_multiselect_native.rs, based on the existing ordinary fixture CLI. Written on branch codex/multiselect-state-9e8r6t-20260923 after 7e348d9. Compilation, unit tests and native inspection have not been run for this candidate. Parent owns these gates and a fresh oracle review.

Entry and targets

The generator refuses an existing output directory and writes baseline.json, manifest.json, and canonical source under source/. All object IDs derive from the fixed UUID-v5 namespace c1192026-0923-5000-8000-000000002929 and the aliases in the manifest, except state_view, fixed to 00000000-0000-0000-0000-000000290101. It is the smallest diagram ID, and is a dedicated State-machine view rather than Architecture. The fixture does not persist a transient selection; select A, then Shift-click B in the native application.

Alias / target	Authored world geometry / purpose
node_a / state_a	A – Processing: (0,0), 340×450; click header near (40,35)
node_b / state_b	B – Ready: (410,30), 210×150; click header near (450,65)
node_c / state_c	C – Complete: (410,330), 210×140; must remain fixed
node_inner / inner	A nested Region: (25,220), 290×200
node_leaf / state_leaf	A.1 – Classify: (60,290), 180×90
node_entry / entry	Authored (-210,280); State projection attaches symbol X to A's left boundary
node_exit / exit	Authored (870,350); State projection attaches symbol X to A's right boundary

The outer machine/Region are unplaced in the main view to keep these targets readable after Fit at a 1442×932 native window. Readability is a proposed layout until visually verified. World header coordinates are not screen coordinates; account for the actual camera and canvas origin.

A and C contain StateAction rows referencing the same shared_work Activity. A has the refresh InternalTransition row. The Activity has a refinement trace, including recorded baseline properties, to an unrelated SA Function. A second State view and SA view provide preservation sentinels. Main-view routes have authored hard pins, explicit attachment sides/fractions and relative label offset/fraction; between also has a guard and multiline label.

Expected mutations and limits

moved infers a common displacement from the saved A placement. The generated baseline puts A at authored (0,0), so its saved f32 position is the original f32 delta without lossy subtraction of a nonzero anchor. All main-view placements and route pins were translated equally by (-30,-100); sizes, relative geometry, route label offsets, other State/SA views and IDs are unchanged. Use that externally pinned origin baseline for moved checks, not an already-moved baseline. Positive command candidates include (0.01f32,10) and (0.1f32,-0.2f32) to expose nonbinary-delta rounding regressions. It independently enumerates exactly six moved placements: A, B, nested Region, nested State, entry and exit. It translates only between (A→B), entry_route (entry→leaf), and exit_route (leaf→exit) pins. external (B→C) pins remain exact. No production movement, descendant or routing helper contributes to the expected Project.

The delta must be finite, have length at least 0.01 and each axis at most 300 world units in magnitude. Fractional values are accepted without a 10-unit grid requirement. This is a bounded native-evidence acceptance threshold, not a new movement/product limit. All comparison is complete Project equality after explicit edits to a baseline clone; JSON/source roundtrips are also required.

hide removes exactly node_a and node_b, leaving their descendants' placements, all authored routes, engineering objects, shared activities, StateAction/InternalTransition records, other views, opposite-layer objects and refinement baseline intact. unchanged requires complete model equality. Authored external route equality does not require its recomputed path or labels to stay at identical screen positions.

The checker accepts JSON or .arcadia inputs, rejects source errors, and allows ordinary engineering-completeness warnings. Pin the generated baseline, manifest, generator source version and generation command in an external evidence receipt before native interaction. Project identity alone does not authenticate the baseline. A moved output passing this checker cannot prove pointer intent, focus, stationary-click behavior, selection paint, exact original source bytes or single-step history; observe those independently in the native workflow.

Parent verification commands

cargo test -p oa-core --example state_multiselect_native
cargo run -p oa-core --example state_multiselect_native -- generate FRESH_DIR
cargo run -p oa-core --example state_multiselect_native -- check unchanged FRESH_DIR/baseline.json FRESH_DIR/source/project.arcadia
cargo run -p oa-core --example state_multiselect_native -- check moved FRESH_DIR/baseline.json SAVED_MOVED_JSON_OR_ARCADIA
cargo run -p oa-core --example state_multiselect_native -- check hide FRESH_DIR/baseline.json SAVED_HIDE_JSON_OR_ARCADIA

For Hide performed after movement, use the externally pinned moved snapshot as that operation's baseline. Unit positives use the validated production command only to generate candidates; the oracle remains explicit. Negative tests require valid-model corruption where applicable and cover missing/double movement of each descendant, internal/boundary pins left behind, external pin drift, attachment/label metadata, StateAction phase, internal guard, shared work, fixed C, other views, trace metadata/baseline, destructive Hide and malformed source. Source-file positives and valid unexpected source edits exercise the same complete-model check.