ARCADIA-Studio/harness/fixtures/basic-editing/README.md

# Basic editing native contract

Status: standalone `-D warnings` compilation, self-check, generation and exact baseline check passed on 2026-09-07. Native execution remains pending. This fixture does not establish acceptance by itself.

`harness/basic-editing-contract.rs` owns an independent UUID namespace. It generates six seed elements and four views, with **none** of the Entity/Actor/new Activity/counterpart the operator must create. The first view UUID is a valid SA StateMachine view with an actual machine, region and state; the next is SA Capabilities. The desired OA and SA Allocation views follow. Capabilities legitimately admits SystemActor, but is an unchosen nonpreferred view; the state view is the strong incompatible-destination counterexample. The unplaced OA Activity **Report status**, unrelated OA capability and SA function distinguish context filtering from global browsing. A second source retains a Unicode comment and CRLF bytes.

Build the standalone checker only after the root grants a brief direct-rustc lease; it does not write Cargo outputs. Use the currently verified matching `oa_core` and `serde_json` rlibs, the toolchain's clang linker, `--edition 2024 -D warnings`, and output `.local/native-qa/basic-editing-contract.exe`. Then:

```powershell
. .local/toolchain/env.ps1
.local/native-qa/basic-editing-contract.exe self-check
.local/native-qa/basic-editing-contract.exe generate harness/fixtures/basic-editing/base
.local/native-qa/basic-editing-contract.exe check baseline harness/fixtures/basic-editing/base/project.arcadia
```

Generation refuses an existing directory. Copy the **whole** generated base directory into a fresh native working directory. Preserve the base and all measured Save checkpoints. Do not edit an expected payload to match observed output.

## Minimal native sequence

Use the **Operational rescue architecture** view at 1100 × 700. Set 100% and note the camera and canvas origin. The selected redesign uses a **36 px contextual side palette**, explicitly expandable to **156 px**, with tooltips and selected-tool feedback. Entity, Actor, Activity and applicable connections belong here; advanced general inventory remains available elsewhere. Only explicitly expanding/collapsing the palette may resize the canvas. Arming a tool, choosing a point, editing a name, validation, commit and cancellation must retain its origin and camera. This interaction contract follows [the native benchmark and redesign decision](../../release-capella-basic-editing-20260907.md); it does not imply the new executable has passed.

1. Choose **Entity** in the palette, click the intended canvas point, type **Rescue team** in the in-place name editor and press **Enter**. No placeholder element is accepted before Enter. Observe the clicked position and stable origin through all four phases. Set its placement properties to **x=120, y=120** for the exact persisted oracle. Save a copy; `check entity ENTRY` must pass. Undo creation before changing properties, or capture the exact command boundary separately: creation itself must be one model+placement undo. A second cancelled creation must add nothing.
2. Choose **Actor**, click a blank canvas point, name **Control centre**, Enter; then use ordinary **Activity** creation for **Assess incident**, in that order. After each creation, explicitly set placement coordinates respectively **680,120** and **160,300**. These are ordinary root creations and remain unallocated. Do **not** use the participant's contextual **Add activity** in this oracle sequence: that separate action intentionally creates work plus an Allocation atomically and is covered by the supplementary matrix below.
3. Use Add existing from this view; find **Report status** by name/alias. The SA function and OA capability must not appear as suggested compatible choices. Place the existing Activity and set its placement to **680,300**. Its seeded identity `b451c000-0000-4000-8000-00000000001e` must remain unchanged. Showing already placed entries must offer Locate instead of a duplicate placement.
4. Explicitly create Allocation **Rescue team → Assess incident**, naming it **Performs** in the relationship form. Choose **Interaction** from the same contextual palette and draw **Assess incident → Report status**; retain its generated engineering name **Interaction: Assess incident → Report status**. Then select the Activity, press **F2**, enter **Assess rescue incident** in place and press **Enter**; its original alias and the authored Interaction name remain unchanged. Save; `check basic ENTRY` must pass.
5. Select **Rescue team**, create its SA counterpart, explicitly choose **SystemActor**, **Selected only**, and destination **System rescue architecture**. Apply must reveal this Allocation view, select the resulting **Rescue team** SystemActor and retain a typed trace. Both decoy views remain byte-for-byte unchanged. Save; `check transition ENTRY` must pass. The core's explicit destination placement starts at **60,60**, size **224×94**; no observed geometry is imported into the prediction.
6. Undo the whole transition and Save: `check basic ENTRY`. Redo and Save: `check transition ENTRY`. Reopen that entry and run the same check. Reopening counterpart creation should expose the existing counterpart, not silently create a duplicate.

Run one meaningful move at 100% and one with pan/zoom, restoring the declared coordinates before the final oracle. Check one rejected raw property or creation draft: typing Delete/arrows must stay inside its focused text field; attempted unrelated selection/action must retain its raw text and a reachable correction/cancel route. These camera, focus and click-position observations are separate native evidence, not implied by saved JSON.

## Supplementary redesign acceptance

Run these on fresh copies or restore the preserved main-sequence state afterwards. The existing checker remains unchanged. **Supplementary accepted model changes need their own independently prepared expected model and source bundle before any exact-data claim.** UI observations and before/after byte equality for a cancelled action are narrower evidence; they do not prove a new model-producing workflow.

| Case | Native action and observable result | Exact-data boundary |
| --- | --- | --- |
| F2 and keyboard focus | Select an existing node, F2, edit its label, Enter; one rename undo. Repeat F2 with a long name, arrow/Delete editing and Escape; original label retained, no canvas deletion or movement. | Main step 4 covers the declared Activity rename. Additional committed names require a separate expected edit; cancellation must retain the prior model and source bytes. |
| Escape before and after point | Arm Entity then Escape before clicking; separately arm, click, type a partial name and Escape. Neither accepts a placeholder or placement; Select/move becomes reachable. | Compare each cancelled case with its complete pre-case bundle. No new expected object is allowed. |
| Explicit allocated work | On OA Entity/Actor choose **Add activity**; on SA System/SystemActor choose **Add function**. The editor names the performer; Enter creates root work, its graphical presence and an explicit Allocation as one undoable action. Compare with ordinary palette work creation, which stays unallocated. | These participant actions are **not** represented by the existing `basic` oracle. Prepare independent expected identities, relation metadata and placement policy before claiming exact Save/Undo/Redo. Do not silently substitute them for step 2. |
| Fixed canvas origin | At wide size and 1100 × 700, record canvas origin at idle, tool armed, point chosen, name edited/rejected, Enter and Escape. Repeat with the palette held at 36 px and at 156 px; only its explicit width toggle may resize the canvas. | Visual/pointer evidence must establish stable origin and clicked position. Existing final world coordinates stay literal; do not adjust them from observed rendering. |
| Long names and edge placement | Choose a point near each relevant canvas edge, type a long name and inspect editor clamping, readable text, Enter/Escape and access to the chosen point. | Cancellation compares against the pre-case bundle. Committed extra objects require a separate expected model, not the current fixture oracle. |
| Draft recovery | Before Enter, preserve a checkpoint with exact raw name, chosen point and intended tool; recover and inspect the reconstructed in-place editor. Also cover a pending F2 rename and explicit allocated-work draft if implemented. Recovery must not accept a placeholder or execute the pending command. | Independently specify/compare the full pending draft and accepted baseline first. A subsequent committed rename or allocated-work recovery requires its own expected model/source; no such supplementary recovery pass is claimed here. |

## What equality proves

The checker reads new UUIDv4 identities only through exact literal kind/layer/name, relationship endpoint, placement diagram+element and OA/SA trace roles. Each role must be unique, fresh relative to the fixture and distinct from every other role. It constructs every other field through typed core commands, independently fixed names/coordinates/default sizes and an explicit core transition request. The complete Project **and** complete two-file SourceBundle must match, including unused seed records, all placements, aliases, trace baseline, source ordering and included comment bytes. Final equality also rejects any unclaimed extra object or UUID.

No geometry is normalized. Explicit final placement properties make the full persisted comparison reproducible without pretending that coordinates copied from the actual model prove a correct click transform. Separate visual evidence must establish the original clicked spot and stable camera. Save/Undo/Redo checks must preserve distinct copies; checking only the final state does not prove history.

## Frozen seams / review boundaries

The existing oracle pins ordinary root creation: raw name retained exactly, whitespace-only refused, core `make_element` alias, parent `None`, one CreateElement+default CreateNode batch, no insertion layout or implied allocation, exact world point and stable camera. The redesign changes its interaction order to tool → point → in-place name → Enter, not these expected records. Its additional explicit participant Add activity/function action has a separate atomic-allocation contract and must not alter this oracle's ordinary-creation expectations. Existing placement adds only a node. The transition oracle requires the explicit core destination request, not first-UUID fallback. No native pass for the redesign is claimed here.

The self-check supplies deliberately false role-carrier geometry/metadata, verifies the oracle does not adopt it, verifies complete basic and transition source fixed points, rejects an unrelated metadata edit, and checks the actual incompatible state-view counterexample. It also pins the legitimate Capabilities participant admission rather than weakening the core to match an incorrect test assumption. A native placement alias collision uses the UUID-derived suffix predicted from the proven new placement identity; the observed alias is never copied.

Final compilation took 6.691 seconds. Checker SHA256: `EFB96BD5C96F4346474F9DDFA053C53584D5F75E984258E9B8F48DB4837D3FBA`; harness source SHA256: `9AB6C2D0CDED28A7F94A24F01D5E91709BCCE5D6B648C188DA62A7EB66D890F8`. `manifest.json` pins all three generated baseline files. Logs: `.local/native-qa/basic-editing-contract-build5.log` and `basic-editing-contract-selfcheck5.log`; earlier failed attempts remain preserved (missing explicit imports, missing seed Region, temporary-UUID alias collision and the incorrect Capabilities-refusal expectation were harness-only corrections).