ARCADIA-Studio/harness/release-behavior-creation-native-20260911.md

Behavior creation cancellation — native Windows check, 2026-09-11

Codex-9e8r6t /root/palette_finish. Root assigned exclusive native input; all input used the Computer Use skill's @oai/sky through node_repl. This is a bounded cancellation/layout check, not acceptance of new behavior objects or the complete creation workflow. No Rust/Cargo work occurred.

Exact candidate and isolated state

Waited for the author's post-lint immutable GUI rather than substituting the earlier build. Copied .local/behavior-creation-20260911/gui-verified/{arcadia-studio.exe,libunwind.dll,manifest.json} to .local/native-qa/behavior-20260911-v4/bin.

File	Bytes	SHA256
arcadia-studio.exe	111163904	d4d9c2bd937e301ff1009d7cb93a34ee5aa6dfc837ff7e87d468c85371b20c31
libunwind.dll	190976	f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4

The copied author manifest records the source snapshot and narrow post-lint difference. This reviewer did not rerun its automated gates. GUI started at 08:50:49 UTC, PID 5184, with LOCALAPPDATA and APPDATA redirected to fresh v4/profile/local and v4/profile/roaming. Runtime PATH contained only the staged bin and Windows/System32 directories. launch.json records the executable, environment and timestamp. No existing recents/recovery store was copied.

Copied the entire preserved .local/native-qa/palette-20260910-v3/checkpoint-transition-reopen into v4/work/basic-rescue; pre-open comparison required all six source files to match exactly. Opened this copy through Studio's native Open dialog. Main returned window 6095570, exact staged process path; Open dialog 3277858. A file-dialog set_value attempt reported Requested property was not in the CacheRequest (0x80070057). Fresh observation plus coordinate focus/type successfully entered the full authorized path. No user-stop, helper timeout, security prompt or unsupported UI automation occurred.

Actual window sizes and supported sizing procedure

Initial capture was 1442×932, corresponding to the configured 1440×900 client. Minimum capture was actually observed as 1102×732, corresponding to the supported 1100×700 client; no screenshot scaling or source setting alone substitutes for this observation.

Direct corner/bottom drag attempts did not resize the window. The working native sequence was:

1. Alt+Space; inspect the returned System menu and select Size.
2. Press Right, then drag the right edge inward. The capture became 1102×932, with width clamped at the supported minimum.
3. Repeat Alt+Space → Size, press Down, then drag the bottom edge inward. Capture became 1102×732.

Each input used the current returned window and was followed by a fresh observation. The evidence supports this alternative sizing procedure; it does not identify an underlying defect in the initial direct-drag attempts.

Observed bounded matrix

Every draft below was canceled; Create and open was never pressed. The accepted model count remained the baseline display of 10 objects / 2 links. Source equality was independently checked after the final Save, as recorded below.

Check	Observed result
Wide OA family chooser	New shows three cards: Operational process, Scenario, State machine, with short purposes. Cancel remains at the bottom of the creation card.
Wide OA process naming	Choosing Operational process focused the name field automatically; typing worked without another field click. A long name containing 雨 and an em dash stayed within the single-line input and horizontally scrolled to the caret. Create/Cancel remained visible.
First Escape from focused process name	One Escape removed the whole draft/card, restored All changes saved, and showed Behavior creation cancelled. It did not merely unfocus the input.
Minimum OA family/scenario	All family cards and actions fit. Choosing Scenario focused its name input. Two explicit viewpoints were shown, neither initially selected. Selected Participants · interactions. Ownership text explicitly said OA layer root.
Minimum optional context	Initially collapsed. Opening it showed search/results in the scrolling field area; Create/Cancel stayed below that area. Search capability produced one result, Rescue capability, with kind/alias/OA-root context. Selected it and collapsed the picker; the summary retained name, kind, alias and layer. Long scenario name stayed inside the input. Explicit Cancel · Esc restored the clean saved state.
Minimum machine owner	Choosing State machine focused its name input. Search rescue_team reduced two existing OA participants to the intended Rescue team. Candidate and selected summary showed Entity / rescue_team / OA root. Selected this owner.
Minimum first-view option	Create the first state view was initially unchecked; toggled it on as draft state. The explanation that the machine starts without regions/states and both actions remained visible. Refocused the retained long name, then one Escape canceled the machine and optional-view draft together. Clean saved state returned.
Minimum SA family/chain	After cancellation, switched to SA. New correctly offered Functional chain, Scenario and State machine. Functional-chain naming autofocused; a long Unicode draft stayed within its input. First Escape canceled it and returned to the existing SA state-machine workspace.
Save after all cancellations	Save all completed with All source files saved and a clean title. No confirmation or recovery dialog remained.

Typed long drafts deliberately exercised horizontal input bounds, not multiline text wrapping. The fixture's candidate labels are short root names; this run does not establish wrapping of long ancestor chains, same-name nested-owner discovery, six-result pagination, or large-catalog performance. The optional context's unfiltered list did require scrolling at minimum size; fixed actions remained visible and filtering removed the overflow. No actionable creation defect was found within the exercised matrix.

Independent source preservation check

At 08:58:59 UTC, compared complete file inventory, length and SHA256 after all cancellations and native Save against the pre-open baseline: 6/6 files PASS; no added or missing files. Exact machine-readable records are v4/baseline-source-manifest.json and v4/cancel-save-verification.json.

Relative source	Bytes	SHA256 before and after
project.arcadia	4844	b35a3f63f223cc4fe2760d6308e87b016ed1eadfbef0a3a4bd051b52c9080958
rationale.arcadia	57	c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f
traceability.arcadia	395	f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0
oa/participants.arcadia	403	094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b
oa/activities/activity_assess_incident.arcadia	376	ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8
sa/participants.arcadia	124	fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8

stderr.log was 0 bytes. Screenshots were inspected directly in Computer Use results; no separate screenshot archive is claimed.

Handoff and remaining gates

Native-input lease returned explicitly to root at approximately 08:59 UTC. PID5184 was left running at minimum size, SA Behavior / States & modes, displaying the baseline Decoy operating modes selection. All drafts were canceled, all source saved, no dialog open. This reviewer performed no further native input after handoff.

Actual creation and command-correlated opening, model/source Undo/Redo, recovery of a pending creation, modal-priority Escape, source-write rejection during creation, long nested labels, and crowded picker pagination remain separate acceptance gates. Automated evidence for some of them exists in the owner's report; it is not relabeled as native evidence here. Root owns the independent accepted-object oracle and next native work.

Follow-up: accepted creation, history and reopen

The section above records this reviewer's earlier cancellation-only session. Root subsequently performed the following native model-producing sequence in the same D4D9C2BD…1B20C31 candidate, at the actually observed 1100×700 client. Root retained exclusive native input; the reviewer independently reran the existing v2 checker against immutable checkpoints at 09:18:19–09:18:23 UTC. No live work model, profile or UI was accessed during that readback, and no Cargo/compiler ran. UI observations below are attributed to root; checkpoint assertions are this reviewer's independent execution of the previously specified oracle.

1. In OA Behavior → New → Operational process, type Coordinate rescue, then Create and open. The new process opened. Save and preserve checkpoint-process; Undo once, Save and preserve checkpoint-process-undo; Redo once, Save and preserve checkpoint-process-redo.
2. In OA Behavior → New → Scenario, type Rescue coordination conversation, explicitly select Participants · interactions (ParticipantInteraction), expand optional context and select Rescue capability (b451c000-0000-4000-8000-00000000001f). Create and open opened the scenario. Save as checkpoint-scenario; separately perform one Undo/Save and one Redo/Save, preserving checkpoint-scenario-undo and checkpoint-scenario-redo.
3. Switch to SA, then Behavior → New → State machine. Type Rescue team operating modes, select the existing SA Rescue team SystemActor (c0629449-1209-4b50-afac-f558a9a0fc7f), and check Create the first state view. Create and open selected the expected machine/view. Save as checkpoint-machine; separately perform one Undo/Save and one Redo/Save, preserving checkpoint-machine-undo and checkpoint-machine-redo.
4. Open the saved project through the actual native file picker, then Save again and preserve checkpoint-creation-reopen. Root reported a dialog-target retry: typing against the parent window did not fill the dialog, and a bounds error required fresh dialog observation/retargeting. The subsequent dialog Open succeeded. The final model/source checkpoint proves the resulting reopen, not the failed input attempt.

All ten named checkpoints are whole-directory snapshots under .local/native-qa/behavior-20260911-v4. Root reported the same running PID5184/window6095570 and zero-byte stderr at completion; this consolidation did not poll or control that live process.

Independently rerun contract and exact file checks

13/13 commands passed, including the checker's falsifier self-check and pinned baseline check. Every first-commit checkpoint was its own fresh-role carrier; its original role identities were then reused for Redo and final reopen. Each Undo used the preceding first-commit stage as expected state and the corresponding creation's first-commit snapshot as explicit UNDO_FROM. Thus Redo is not allowed to pass by borrowing newly substituted identities from itself.

Checkpoint	Complete semantic and source result	Exact physical source files
Process / Process Redo	Predicted OA process and all previous data; 7 reachable sources	7
Process Undo	Exact initial baseline model/identities and 6 reachable sources	7, including 1 proven retained file
Scenario / Scenario Redo	Cumulative process plus explicitly qualified/contextual scenario; 8 reachable sources	8
Scenario Undo	Exact original Process checkpoint; 7 reachable sources	8, including 1 proven retained file
Machine / Machine Redo	Cumulative objects plus owned machine and opt-in first view; 9 reachable sources	9
Machine Undo	Exact original Scenario checkpoint; 8 reachable sources	9, including 1 proven retained file
Reopen	Full Machine contract using original machine identities, plus exact Machine Redo equality	9

The complete predicted Project and SourceBundle comparisons cover root ownership versus scenario context, explicit viewpoint, exact names/defaults, retained unrelated records, and the new machine's SystemActor parent. The optional view is Rescue team operating modes · states, SA StateMachine projection with exactly one machine placement at 60,60, size 336×104, no states or regions and default options. These are the independently specified fixture expectations, not values inferred wholesale from the produced model.

In addition to the oracle, the runner compared every physical file's actual bytes between checkpoint-machine-redo and checkpoint-creation-reopen: 9/9 equal, with identical path inventory. All eleven input directories (baseline plus ten checkpoints) retained the same complete inventory, lengths and SHA256 values before and after execution. No checkpoint source files were copied into the tracked evidence directory.

The durable runner, every command argv/stdout/stderr/exit code/timing, all checkpoint file hashes, and candidate/oracle/screenshot provenance are in harness/experiments/behavior-creation-native-20260911/:

Artifact	SHA256
verify.py	4921c4615071240c3ac3bbe1223c0db3bf472fe5e3eec2ae5dac12f95b1674df
commands-results.log	f5bfbee185f7064419b1bd9fe33ec6a48526b5bbe3f818c006feb74eddf8e189
manifest.json	356dfbb27dec04764a4b3f2372602f39953b472baac0a3de3e72acd9c1d76b8a
Existing v2 executable	056eefd444924916bf6ac3c4897ab2ff4a8a4bb892e1dbc16adad32e59bf6a36
Oracle source	51ab2ffa1826dd949b79f3a9690042a2f9e38daf9ed91517cade3861482117ba

Reproduce without building: run python harness/experiments/behavior-creation-native-20260911/verify.py with the preserved existing executable, checkpoints and staged runtime. The script verifies the expected executable/source hashes before executing. It prepends the staged bin to its child runtime PATH. Its JSON records absolute executed arguments and repository-relative input manifests.

Harness correction: oracle v1 incorrectly required every disk file to remain reachable after Undo. Studio's documented safe saver retains newly detached files instead of deleting them. V2 accepts only the exact previously committed retained paths/bytes proven by the explicit Undo origin, while still demanding complete model and reachable-source equality. Unknown, missing or modified retained files fail. This is a correction to the test's disk contract, not a product regression or a relaxation for arbitrary orphan files; see harness/release-behavior-creation-oracle-20260911.md.

Actionable empty-workspace finding and limits

Root observed that the newly created Process presented a blank white canvas with Tools / Selection details / Fit overview but no visible first action. The empty Scenario likewise showed no first-lifeline action; its helper instructed selecting/reordering a lifeline or occurrence when none existed. Both require the engineer to infer that hidden Tools begins modeling. Root retained v4/scenario-empty-saved.png (SHA256 b03fb33d3f4cf1e5f95e7ac4198a4dee30ffd9af5e250d481e0d5dc2a2a0f90c) and v4/machine-created-saved.png (SHA256 1e7af3d6219c430eaafb0de5afd8df4c51b4efeb80de3f642084188633dcb65b); their hashes are also in the manifest.

The bounded recommendation and falsifiable acceptance cases are in the contextual-source creation plan: a semantic empty-state Add first activity/function contribution or Add first lifeline action opens the same contextual authoring form, preserves explicit viewpoint, and offers staged creation of missing sources. This is an open usability finding; successful object creation does not resolve it.

This follow-up establishes the stated three creation/one-step-history/saved-reopen paths, in conjunction with root's native observations. It does not establish pending-draft recovery, camera/scroll restoration, modal-priority Escape, write-failure behavior, large-model/long-ancestry usability, or complete release readiness. Earlier cancellation evidence remains intact. No additional native lease was acquired for consolidation.

Follow-up: pending SA machine recovery, autofocus and cancellation

Root supplied this additional native recovery slice; this reviewer independently verified only its immutable JSON, launch record and saved cancellation checkpoint. The earlier 13-command manifest is preserved byte for byte. This section closes the specific pending-creation recovery case described here, superseding only that portion of the preceding open-gate statement.

After the nine-file saved reopen, root started an SA Machine draft named exactly Recovery — secours Δ «operating modes», selected the existing SA Rescue team SystemActor, and checked the first-view option. Root verified the persisted private checkpoint and preserved v4/recovery-evidence/before-interruption.json. Root then force-terminated only the verified isolated PID5184 and relaunched the same executable/profile/runtime. v4/recovery-launch.json records launch at 09:17:07.8245552 UTC, new PID 1284, the original staged GUI SHA256, isolated AppData directories and clean staged-bin/Windows PATH. Root's newly returned native window was 6161106.

Actual Home → Recover restored the SA creation form, selected owner, checked first-view option and name caret. Root typed · resumed without clicking a field, directly demonstrating recovery autofocus, and preserved after-recovery-and-typing.json. Root then pressed Escape once from the focused input: the draft disappeared and status read Behavior creation cancelled. Actual Save As to a new checkpoint-recovery-cancel/project.arcadia succeeded. The recovered machine/view draft was never accepted. Root reported zero-byte recovery stderr and a saved recovered copy left open at wide 1442×932; this reviewer did not inspect the running UI or log. Root also compared the original live work copy with the nine-file baseline; this consolidation independently checks the immutable saved recovery copy only.

Independent immutable readback at 09:22:33–09:22:34 UTC passed 19/19 explicit checks, including one existing v2 same command (exit 0, 0.147209 s):

• Exact literal Unicode name before interruption and exact deliberate suffix afterward; SA Machine family, original SystemActor UUID and first_view: true.
• Complete behavior JSON equality after removing only the deliberate suffix. No other draft fields were normalized or dropped. Reserved element c6f559f5-401e-4e0d-af93-91faee68d3f5, diagram 11ad8f0a-73aa-416a-bbeb-9b886bf39854, and placement 171f7d7e-3a8f-4200-86f6-a9e2efd87610 IDs remained exact.
• Complete accepted, workspace, property, workflow and selected JSON values each remained exactly equal. The accepted source snapshot also matched the preceding immutable saved checkpoint's complete nine-file byte map.
• V2 same checkpoint-creation-reopen/project.arcadia checkpoint-recovery-cancel/project.arcadia passed complete Project, identity and nine-file SourceBundle equality, with nine exact disk files and zero retained exceptions. Separate direct-byte comparisons passed 9/9 files, with identical complete path inventories. None of the three reserved draft IDs appeared in any saved file.
• All input checkpoint inventories, preserved evidence hashes and the original 13-command manifest remained unchanged during verification.

The wrapper metadata (origin, checkpoint identity and modification time) is not asserted equal: recovery opens a distinct unsaved copy. More importantly, persisted Undo history is not restored; the UI explicitly explains that limitation. The evidence establishes pending draft/value/identity restoration, native autofocus, first focused Escape cancellation and saved-source preservation. It does not claim Undo/Redo continuation across recovery, accepted creation from the recovered draft, other creation families, or camera/large-model recovery coverage.

Separate durable evidence under harness/experiments/behavior-creation-native-20260911/:

Artifact	SHA256
verify-recovery.py	3546b4fe68d3e1a2474015be1b652a665af238e5fcf63e04bac3f25df3d35e90
recovery-commands-results.log	1dc3e89aa46660bfad796e7b6bf821bebd7e5bc5a7902a826021d461a3e74c68
recovery-manifest.json	68e2fcf653f7a59037c9eb0b31f6c9e629dc0ab88af545d5b78a2bbf8c980a72
Preserved before-interruption.json	0c355aa3c7b9be623d767ff35c4b85cf7b2907eb9bc3be39d619aa610c989692
Preserved after-recovery-and-typing.json	fafa7a884275bac09afab365f8ab0063f998ca56c5ffc70be596db6f78a10103
Root's restored-draft.png	8ae0fe8957d5a935b6e2605a6ffb68934bd0e8840f3594c43e63865ab89d03c9

Reproduce with python harness/experiments/behavior-creation-native-20260911/verify-recovery.py using the preserved files and existing oracle/runtime. It reads only the explicit immutable inputs, never the live work or profile paths mentioned inside JSON. No native input, production changes or compilation occurred during this consolidation.