ARCADIA-Studio/harness/release-source-alias-rename-validation-20260912.md

Text alias rename — branch validation

Codex-9e8r6t /root, Windows, 2026-09-12. This records uncommitted branch work over be7a8cd8d7d63aa18e0196bbd36f9e646764c761; it is not an integrated release or native acceptance claim. Issue 9 owns the current task. The design and transaction critique define the intended behavior and evaluators. Linux/WSL remains user-paused.

Verification method

Root coordinates one Windows compiler job. The local toolchain environment is .local/toolchain/env.ps1; CARGO_BUILD_JOBS=1. Commands use --locked --offline and the Windows GNU LLVM development profile. The attempt helper .local/source-rename-integration-20260912/gate.py preserves each attempt in an exclusive directory, including raw input ZIP, complete scoped file membership, per-file hashes, compiler/environment records, raw logs and stage receipts. It verifies the same file membership and bytes before and after each command. Its scopes include the workspace manifests, crates, build support, Cargo config, documentation, examples and harness fixtures. These private evidence directories are not yet published artifacts; preserve them until final evidence packaging.

The serial gates are strict Clippy for all desktop targets, the complete desktop binary test suite, an explicit ignored representative timing experiment and the matching desktop build. Attempts 1–5 ran tests before Clippy; attempt 6 moves Clippy first to catch lint failures before the longer suite. A failed stage stops the attempt. Native checks use a separately identified executable only after these gates pass.

Earlier findings and verified results

The isolated Document/query trial initially omitted build/windows_manifest.rs from its reconstruction and failed before tests. Its corrected v2 capture passed 8 alias-transaction, 13 existing Document and 20 query tests, finishing at 11:20:55 UTC. This establishes those isolated seams only. The combined cargo check --locked --offline -p oa-desktop --tests subsequently passed; unused preview range accessors were removed after its warning.

Attempt 1 failed compilation on two mounted-test calls that attempted mutable widget operations through as_widget(). Correcting those test calls to as_widget_mut() allowed execution. Attempt 2 passed 791 tests, failed one and ignored two. Its sole failure used an invalid property-field key, name instead of /name, so it had never created the intended dirty draft. The fixture was corrected and strengthened to assert retention of the exact /name draft value. Neither finding justified a production behavior change.

Attempt 3 passed 792 tests, zero failed, two ignored, finishing at 11:49:39.273922 UTC (165.53 seconds of test execution). Its captured inputs remained unchanged. Raw stdout SHA-256: 392379b23ca446ad1d617da25c640f2911a9ab643fd61d6b8fc15a72d346f92b; stderr: f5b640295276418cb45226fe82f3dfdfe5f7ee018c1777516784f80d562620a3. The subsequent strict Clippy stage stopped on five diagnostics: a collapsible search conditional, two constant platform/profile assertions in the timing experiment, a test-case type-complexity diagnostic and field reassignment after Default in a query test. The correction uses a let-chain, scopes the manual timing module to Windows debug tests, names the case type and initializes the query limit directly. The platform-specific experiment does not prevent other platforms or release profiles from compiling their applicable tests.

No timing or desktop-build stage ran in attempts 1–3. Passing attempt 3 does not cover the subsequent paste guard described below.

Attempt 4 passed 792 tests, failed the newly added normal-paste assertion and ignored two, finishing at 12:03:16.113761 UTC (167.39 seconds of test execution). The rejection cases reached their expected outcomes before the normal-paste case failed. The attempt's captured inputs remained unchanged; no subsequent gate ran. Its stdout SHA-256 is 62cc9471678fabe08fc32db0e46665f1b9babd1d70f814371995c96a6b5de430. Root and the implementation owner independently traced the failure to the test fixture: Iced calls the test operation's selection callback before its focus callback, and focus() moves the cursor to the end. Thus the fixture erased its own selection before pasting. The correction must focus and select separately, assert a real nonempty selection and retain the exact replacement oracle. This is an evaluator defect, not a reason to change valid-paste production behavior.

Clipboard finding and correction

Root inspected the actual dependency source, Iced iced_widget 0.14.2 src/text_input.rs, whose paste path filters char::is_control before invoking either input callback. Consequently, a pasted foo\nbar could silently become the valid alias foobar. Merely validating the callback value or adding an on_paste callback would miss the original input. This contradicted the design's prohibition on silent replacement normalization.

The alias field now has a narrow widget adapter that checks the actual paste shortcut before the child input handles it. It rejects the whole paste if it contains control characters, retaining field text and selection, displaying feedback and invalidating the previous preview approval and pending intent. An occupied worker remains occupied until its matching completion. Permitted first-paste input uses one captured clipboard value passed to the child; normal Iced editing, focus and key-repeat behavior remain with the child widget. No dependency, vendor or cached Iced source was changed.

Mounted evaluator cases cover newline, tab, CRLF and NUL refusal; unchanged selection through feedback/rebuild; normal valid paste; exactly one actual clipboard read; and refusal of an old confirmation. Independent review checks the wrapper against the cached Iced implementation, with particular attention to stored modifiers, focus, pending workers and repeated paste.

That review found another production counterexample: the wrapper initially reset its modifier state on KeyPressed.key == Escape, whereas the child uses its effective dispatch, including modified_key and earlier shortcut returns. For key=Escape, modified_key=Home, the wrapper could clear Command while the child retained it, allowing a following paste to bypass rejection. The correction observes the child's actual focused-to-unfocused transition after forwarding a key press instead of guessing its dispatch. Mounted tests must exercise mismatched key fields, pending worker retention and the relevant focus/enabled/modifier conditions. Held-key paste may reuse the child's earlier admitted cache; the single-read claim applies to fresh clipboard reads.

The final bounded static review found no remaining concrete paste defect and bound the corrected adapter, wrapper tests and controller tests to exact hashes in .local/source-rename-controller-independent-review-20260912/paste-resolution-bindings.json. The focused source_rename:: run then passed 32 tests, zero failed, one ignored, finishing at 12:08:16.497392 UTC (3.20 seconds of test execution). This includes the actual-selection correction, valid paste, the 20-condition focus/enabled/modifier matrix, divergent key fields, held-key cache release and pending-worker rejection. Raw logs and the command receipt are retained under .local/source-rename-integration-20260912/focused-paste-v2.

Remaining acceptance

Attempt 5 passed the full desktop suite: 796 passed, zero failed, two ignored, finishing at 12:11:20.769886 UTC (147.44 seconds of execution). Inputs remained unchanged. Stdout SHA-256: 38e9413b678de73fdc1e277be5313193002c81326f32e29bafdd4e45701fe322; stderr: 43c2d65557dd4392177fcb91e097ca375acfc796928e92a51b129c69892fb66d. Its Clippy stage subsequently found a preview helper used only by tests and an obsolete expect(dead_code) on the now-used authored identity accessor. The helper is now test-only and the obsolete expectation removed. Attempt 5 stopped at 12:12:23.924779 UTC without timing/build execution; its Clippy stderr SHA-256 is 87a4858cf1d4116b1938268db07095c17b301e64a1e115f42a4020da633ea58f. Before attempt 6 the edited guide and generated HTML were aligned to the repository's LF policy; no frozen evidence or fixture bytes were normalized. Attempt 6 captures these final inputs, with lint first. The native launch helper checks this same required gate order; its behavior otherwise remains the independently reviewed launch protocol.

Attempt 6 passed strict all-target Clippy at 12:14:39.585030 UTC, then the full suite (796 passed, zero failed, two ignored) at 12:18:12.718483 UTC (172.07 seconds of test execution). The explicit timing experiment also passed its complete-model/source/identity/history assertions at 12:18:36.171758 UTC. All three stages verified unchanged captured inputs. The desktop build also passed at 12:21:39.274814 UTC. Its preserved executable is 113,854,464 bytes, SHA-256 d1ec63050e95513064155e9d04f443d95667b1e468dcdbb3b810dad379504814. The 513-file raw input ZIP SHA-256 is 03b5a9e3f4e9e220421320c09f1ecf46f811edf2e3c6c45dcd9522c6d78b8255. All four gates verified unchanged captured membership and bytes.

For the 30-file, 78,414-byte, 258-identity walkthrough, five measured Windows debug trials after one warmup reported these median/range values in milliseconds:

Phase	Median	Min–max
Mint Document request	0.092	0.052–0.170
Worker Document preparation	282.259	165.302–298.259
Worker preview and origin	13.429	10.763–23.969
Guarded Document commit	0.0109	0.0082–0.0229
Application synchronization	495.499	472.030–610.017
Actual Confirm update	571.893	433.909–1122.241

The phases and full Confirm use separate fresh fixtures with alternating trial order; their values must not be added or subtracted as simultaneous timings. Task polling, layout, GPU work and first paint are excluded. Fast snapshot adoption does not establish a responsive UI: application refresh still takes roughly half a second in these samples. Native assessment and a discriminating refresh-phase diagnosis are needed before making a responsiveness claim. The timing log SHA-256 is a063b67755b972e7f0b6a42c4af7fb9e1a41ecbda9775e1f40b031b8dd0c9a5c.

Native fixtures in .local/source-rename-native-20260912 preserve independent baseline/work/expected trees for a four-source project and the 30-source engineering walkthrough. Their expected edits were authored by literal role-specific replacements, preserving every physical supporting file. Preparation-only oracle passes do not establish future GUI correctness.

Native acceptance must inspect complete preview access, focus and bounded layout, cancellation, confirmation, model Undo/Redo, Save and reopen, comparing the full saved Project, identities and source bytes against the authored oracle. The reviewed launch helper preserves the identified executable and runtime, uses a private profile and retains the child process handle until exit to record the actual exit code and final logs.

First native transaction trial and blocking findings

The identified attempt-6 executable ran in a private profile as PID 9108 from 12:22:14 UTC, with actual process exit zero recorded at 12:45:42.336483 UTC. Both logs were empty; the executable and runtime DLL remained unchanged. The private profile initially lacked a Desktop directory, causing a file-picker notice. Creating that private directory resolved the harness setup issue.

The four-source Unicode-path project exercised F2 on the typed reference, invalid alias feedback, Enter to preview, Enter again without confirmation, both changed-file previews, minimum 1100×700 client layout, Escape cancellation, explicit confirmation, Save, persistent model Undo/Save, Redo/Save and reopen. The new alias was selected at the original typed reference after confirmation; the same spelling in prose remained unchanged. Reopen showed the expected assess_damage alias. Five independent saved-disk oracle runs passed: cancelled baseline, renamed save, undone save, redone save and reopened result. Each compared the complete Project, identities and all four exact physical files. The representative 30-source native workflow and immediate Undo Rename button were not exercised in this trial.

Native preview acceptance failed: screenshot trial-attempt-6/screenshots/032-simple-preview-minimum-bottom-0.jpg shows the final brace of the longer After declaration occluded by the vertical scrollbar. Independent image/source review confirmed default Shrink width and a floating scrollbar, plus inadequate wrapping for unbroken fragments. Byte-complete preview indexes and rectangle-only layout checks did not catch this defect. The correction must reserve scrollbar space, wrap unbroken fragments, and add actual shaped-glyph/paint visibility checks before a new native trial.

Publication also needs byte-reproducible source. The provenance review verified all 513 captured files but identified 13 Git-clean baseline files whose live CRLF bytes differ from the LF bytes in HEAD. These are strict newline-only differences, distinct from intentional alias changes. After closing the native trial, root verified each current hash, Git-clean status and strict newline-only equivalence, then aligned exactly those 13 ordinary files with their HEAD LF bytes. The receipt is aligned-reviewed-lf.json in the integration evidence directory. New checks/builds use new captures; attempt-6 and all earlier raw archives remain unchanged and bound to their original bytes.

The new real-paragraph visibility evaluator compiled against the old layout and failed as intended at 12:57:38.285740 UTC. It identified the exact native declaration's final brace (UTF-8 cluster 92–93) at x591.398 with width6.598, crossing the actual scrollbar boundary x587.996. Captured inputs remained unchanged. This is a demonstrated regression falsifier, not a passing gate. Receipt/logs: clipping-negative-1 in the integration evidence directory; stderr SHA-256 2ac214f31252edeef4f33b64a46b11fb42dbf0c04848d38bb8730978d9d5ce10. The reviewed correction fills the preview width, reserves the scrollbar's actual width plus spacing, and uses glyph-fallback wrapping. It leaves source indexing and the transaction unchanged. A positive check is separate.

The corrected layout then passed all 33 focused rename tests, zero failed, one ignored, at 13:05:52.950223 UTC (11.89 seconds of test execution). That capture included disabled-by-default temporary timing instrumentation; the geometry and transaction tests did not enable it. Inputs remained unchanged. Stdout SHA-256 307bd915536983fc19102fcff39535df950cee06841d968f5be2092c091ccc76.

The independently reviewed nested diagnostic subsequently passed the existing full Project/source/identity/history/origin assertions in all warmup and measured trials, finishing at 13:07:20.854282 UTC. It measured the same real Confirm message path, with fixed-capacity timestamps enabled only around direct sync or Confirm. In the whole-Confirm arm, five measured samples gave these medians: actual update 1039.0 ms, source Content assignment 996.7 ms (814.4–1182.2), validation 26.4 ms, property refresh 6.3 ms, and Workspace acceptance 0.28 ms. Each nested phase belongs to that same arm; earlier runs have different absolute timings and are not a paired performance comparison. Source Content assignment includes construction and destruction of the previous editor. Layout, highlighting during draw and native paint remain excluded. The raw log SHA-256 is a98877362ca52a024942803e0ab698a1fd84703d4512fcf7137c147a28817039. The temporary instrumentation was removed afterwards, restoring both exact production baselines before implementing any candidate.

This evidence justifies a bounded display-refresh experiment: retain the laid-out editor and apply complete, preflighted same-line changes only after the existing Document commit succeeds. Every ordinary synchronization step remains shared; incompatible line endings, stale display bytes or a failed exact final readback fall back to reconstruction from accepted source. A review found that deleting an entire line body could introduce a greedy LFCR boundary; both before and after preflight now refuse that representation. The candidate resets highlighting from line zero without changing text, and restores the same approved origin. It passed cargo check --locked --offline -p oa-desktop --tests at 13:25:02.235871 UTC, with unchanged captured inputs. Execution, first subsequent layout/highlighting cost, native behavior and final gates remain separate acceptance requirements.

The user's new Text UX issue 13 also rules out adding permanent command clutter. The new separate Undo Rename row has been removed; the existing model Undo control uses the guarded rename action while it remains available. Broader compact-editor work is owned in that issue and is not claimed complete by this local adjustment.

The completed native trial is preserved in the attempt-6 evidence archive, with archive receipt and independent verification. Its 284 members occupy 3,221,627 compressed bytes; SHA-256 77adda5a33eb1def6dab23352ca0ab172300ea65fc21d2c215d545d7fcce0d08. The archive retains all original captures, complete fixture trees, five saved verification receipts, helper sources and clean-exit logs; executable/DLL bytes are externally hash-bound. The gate inputs and provenance evidence are preserved separately below. This archive describes the first trial only; later corrections and execution do not turn its clipping failure into a passing native result.

Corrected editor refresh execution

The next-layout evaluator initially failed to compile because its new focus call lacked Iced's Focusable trait import. The failed editor-patch-tests-1 capture is preserved unchanged; no runtime result is claimed for it. After adding that test-only import, editor-patch-tests-2 passed 38 focused tests, zero failed, two ignored, at 13:51:44.023824 UTC. This includes exact editor text and line endings, the LFCR refusal, retained-tree highlighter reset, real Confirm/history checks and normal synchronization fallback. All captured inputs stayed unchanged. Stdout SHA-256: a25dd49c669c09936d1da7ddeba4f7d3d6b6a918b72cd39dde4df6f75d201344.

On the same source, editor-patch-timing-1 passed both ignored experiments at 13:54:04.503303 UTC. The real App Confirm update had median 46.0 ms (23.0–206.1 ms, five measured samples); ordinary app_sync deliberately retains the reconstruction path and is not the same operation. The paired editor trial used one warmup and five alternating fresh trials per arm, the 29,506-byte traceability source, a retained widget tree, a 640×350 viewport, 14px monospace font and 16px padding. Replacement plus next layout plus draw/highlighting had median 35.5 ms with reuse (13.6–73.4), versus 2782.7 ms with reconstruction (2697.7–3994.6). Exact source/line-ending/cursor checks and accepted alias attributes, shaped glyph colors and visible glyph bounds passed after every arm. This measures real text layout and highlighting, but excludes GPU/native paint and is not an end-to-end production latency guarantee. Source inputs stayed unchanged; stdout SHA-256: ae8d57e0d65084d71d92815c093607c7cd4d9d9166c562cec33a061b2fcba74c.

Independent static review of the App seam found no actionable defect: commit authority, ordinary synchronization order, fallback, metadata, histories and guarded reveal remain intact. Native focus/reveal, the next text edit, corrected preview rendering and full gates still require their own evidence.

The earlier completed gates and experiments are preserved separately in the historical evidence archive with its independent review. All 77 members, five nested source archives, eight receipt/log pairs and 73 original readbacks passed verification. ZIP SHA-256: 2282e4e755bb03ab3ecb079391909f3978297ad307e76306ef7eb5a87a9437cf. That archive intentionally ends at the earlier check-only candidate; the newer focused execution and timing captures are separate.

Full corrected Windows gates

Attempt 7 completed unchanged at 14:15:41.805763 UTC: strict desktop Clippy with all targets and -D warnings, 802 desktop tests passed (zero failed, three ignored), the required isolated Confirm experiment passed, and the GUI build passed. The repeated Confirm median was 71.9 ms (43.2–101.8); the separate paired layout experiment above remains the rendering-cost evidence. Formatting of all changed/new Rust files passed with rustfmt --edition 2024 --check --config skip_children=true; git diff --check also passed.

The identified GUI is 113,879,552 bytes, SHA-256 2486eecc00d8de9160ecd930f69394e00b1a1ce102d76fb776b978db33414ed3, built with the Windows GNU LLVM development profile, no optimization/debuginfo, and debug assertions enabled. All 516 captured input files match the preceding focused test and paired timing inputs byte for byte.

Corrected refresh evidence preserves those three complete captures, receipts, raw logs and independent App and execution reviews. Its independent archive review verified all 37 members, three nested source snapshots, six command receipts and original bindings. ZIP SHA-256: d46aacbba1dfccec64b195482e2857c97ceefecad6b0176c62c73c50964e18ba. This is a source-verification checkpoint, not a released or fully native-accepted milestone. The corrected native trial is separate and must retain its actual workflow coverage and limitations.

Closed native trial on dfb6102

The corrected trial used the identified GUI above and source commit dfb6102ba5aec9e26a48cc5472b51a4b349459fd. Its original 516 build inputs were verified against the raw committed blobs. The native process closed normally with exit code 0 at 22:20:26.337292 UTC; stdout and stderr were empty, and the executable and runtime DLL remained unchanged. The long interruption between the afternoon and evening captures is not a responsiveness measurement.

Both the four-file Unicode fixture and the representative 30-source fixture passed explicit rename, restoration of the selected original reference, the first subsequent text edit, Text Undo, Save, whole-model Undo/Redo and native reopen. Eight saved-state checks passed complete model, identity and reachable source equality plus every physical file: four in the small fixture and 37 in the representative fixture, including support files. Confirm alone left the saved baseline unchanged. These oracles inspect saved disk state; they do not independently inspect unsaved GUI memory.

At the minimum 1100-by-700 client size, the previously clipped declaration brace and all six changed lines in the larger fixture were readable. Native multiline paste after a valid preview explicitly rejected the whole paste, retained the alias, removed the preview and disabled confirmation. Re-entering a valid alias required fresh Preview. This caret-only trial does not prove selection-range preservation during rejection; the separately executed mounted tests cover it.

Two recoverable usability findings remain separate from transaction correctness: preview page/file changes retain the previous vertical scroll position, and an OS system-menu sizing sequence invalidated an apparently valid alias field. The latter's exact input bytes and event cause remain unproven. No accidental confirmation or model/source corruption was observed. A subsequent scroll correction requires its own source-bound tests and native evidence; this trial does not verify later code.

The closed native archive and independent review preserve and verify all 355 members, 351 original readbacks, eight oracle receipts, the final 41 physical files and 516 raw committed build inputs. ZIP SHA-256: abff68aeb2bd893577d4226c9ec4b6b0823b4ec22895a273ab2d22f344354207; size 6,449,971 bytes. Screenshot 023's unrelated occluding window image is excluded; its hash and exclusion reason are retained. This remains a prerelease preparation checkpoint, not full OA/SA acceptance. Linux verification remains paused by the user.