ARCADIA-Studio/harness/review-correctness.md

Independent correctness review — 2026-09-05

Scope: current core model, language parser/printer, JSON/text persistence, transaction history, and desktop source/property/save/navigation state. Read the attached goal and normative language specification. No implementation edits or Computer Use were performed by this reviewer.

Material findings

1. P2: invalid property draft could trap the user in Getting started. Previously Message::Page(Guide) skipped apply() while the guide hid the inspector. Select an element, enter invalid as X, enter Getting started, then attempt Architecture or another selection: validation rejected every return action and the correction/revert controls were inaccessible. Root changed app.rs to apply property drafts before opening help when there is no source draft. A temporary compiled update harness subsequently observed that the invalid-X attempt stays on Diagram, preserving the draft and its accessible controls. Resolved in the inspected code; retain a regression test and exercise the UI. Invalid source still needs access to help.

2. P2: accepted name strings could not all be authored graphically. validation::valid_text permits LF, CR and tab, and language tests explicitly use these in names. Project, element and relationship names use Iced text_input in views.rs; the installed Iced 0.14.2 implementation filters control characters on paste (text_input.rs:970–975) and typing (1022–1023). Thus a valid text-authored name was outside the graphical editor's authoring capability. Root accepted the finding and is adding an explicit exact-string inspector mode. Resolved by the focused follow-up review: compiled state tests authored CR/LF/tab/quotes/backslashes/Unicode in project, element and relationship names and element descriptions; toggled both presentations; checked canonical source; executed the actual Save tasks to .arcadia and .json; and loaded both files with complete model equality. Invalid JSON literals and XML-forbidden decoded characters in all four property cases preserved model, draft and mode, blocked Save, and remained recoverable through Revert. Real-app visual verification remains the lead's check.

3. P2: noncanonical exact literals remain falsely dirty after Save/navigation. In exact-string mode, type "\u0041" as the project name and Save. The file correctly contains the model name A, and the saved model baseline is current; however, project_name retains its noncanonical spelling while draft_dirty() compares it with display_string(model.name), which yields "A". Save does not call sync_selection() after successful apply(), so the UI continues reporting unsaved work and may show an unnecessary discard guard. The same path affects element/relation names and descriptions. Root now calls sync_selection() after a successful property command, while leaving failed drafts intact. Resolved and reverified: the compiled harness saved noncanonical literals in project, element and relation names and descriptions, observed clean saved state in each case, then edited another noncanonical literal and navigated to Text with clean property state and matching canonical model. Before the fix this same real-Save-task harness failed its clean-state assertion.

Additional verification

• Compiled a focused parser harness against the current built core. Mutated the valid document at every Unicode character boundary with punctuation, quotes, escapes, comments, line breaks, control characters and extreme exponents; also supplied 3,000 deterministic arbitrary Unicode strings. All returned diagnostics or structurally valid models without panics, and every accepted model round-tripped through the canonical printer.
• Compiled a focused Iced content harness: LF, CR, CRLF, trailing line endings, U+2028 and U+0085 descriptions round-tripped through text_editor::Content exactly. This potential description-normalization defect was not reproduced.
• Inspected duplicate-identity handling, forward reference resolution, strict unknown-field rejection, UUID collisions, kind/endpoint edits, process step references, failed replacement history, atomic persistence, and save guards. No additional material correctness defect was established in these areas.
• Correction to the earlier review: treating identity entry as an explicit-only action did not satisfy the specification's property-draft rule. The final implementation treats IDs as ordinary property drafts: they contribute to unsaved state, apply on Save/navigation, and commit atomically with the other properties. The requirements reviewer identified and closed this gap.
• Temporary reproduction sources/binaries are outside the repository under D:/CodexBuilds/Capella2-01a06e2e/review-*. Whole-workspace regression and real-app verification remain the lead's integration checks; this report does not claim those were independently rerun here.
• Follow-up complete: recompiled the current desktop modules in the isolated harness and ran all 18 tests (15 repository desktop/diagram tests plus the three independent exact-string tests); all passed. This covers real Save task execution to private test files but does not replace Computer Use.
• Final identity follow-up: inspected EditElement(old, record), EditRelation(old, record), EditProject(id, name), the shared reference update helper, identity-aware draft detection, and action remapping after Apply. Recompiled the current modules and ran five focused identity tests; all passed. Four repository tests cover failure preservation, references, navigation, source parity, process actions, Delete and pending-ID movement. An independent test executes real Save tasks for project, element and relationship ID-plus-name drafts, reloads equal models, observes clean saved state, then verifies one Undo restores both properties together. No material issue was established in this bounded change; native drag verification is assigned to the runtime reviewer.

No unresolved material correctness finding remains from this review.