ARCADIA-Studio/harness/TASK_LEDGER.md

Task Ledger — first release

Updated 2026-09-06 evening after corrected reverse-transition native acceptance, teaching source/history/reopen and Linux server/HTTP restart passes. STATE.md owns current execution/evidence and leases. PLAN.md owns the release plan; DECISIONS.md preserves architectural rationale. Full pre-consolidation contents, including superseded requirements interpretations and evidence, remain archived byte-for-byte.

Goal and success criteria

The authoritative user objective is C:\Users\User\.codex\attachments\10b0f701-1743-4de7-9ee1-225920e19649\goal-objective.md. Deliver a usable, substantially complete OA/SA engineering tool in Rust/Iced on Windows and Linux; equivalent graphical, strict textual/reST and REST workflows; practical artifact traceability; navigable offline guidance; recoverable drafts; reproducible deployment. Completion requires native engineering task evidence and fresh independent end-state review, not implementation or passing tests alone. Later Arcadia layers remain future scope.

Given facts and constraints

• User prioritizes Capella domain fidelity, useful containment/nesting and explicit typed ports, while avoiding clutter, persistent action overload and awkward navigation. Study real domain workflows rather than mechanically copying Capella classes.
• Both-layer transitions and reviewed counterpart reconciliation must be intuitive and precise. Behavior/scenario diagrams must be directly editable and preserve selection/camera/task context.
• Human/AI/Git-friendly modular source, comments/includes, complete graphical/source/API parity and clear rejection are required. One validated model/history boundary must govern every representation.
• User permits autonomous reversible engineering, experiments, independent agents and authorized native work. Root is the sole native operator in this collaboration. Do not run concurrent shared Cargo writers. No remote push, usage reset, broad target deletion or host restart is implied by current task authorization.
• User permits isolated Linux work. WSL remains unavailable on this host; a task-local QEMU core pilot completed and shut down cleanly, and a second bounded server/application gate is active. Historical external worktrees/toolchains are not present on this machine.

Verified facts

• Branch/patch/tree audit established that direct state/scenario/process, data contracts, hosted editing and earlier semantic review are already integrated; no required production transplant was found. Branch evidence.
• Capella's function input/output exchange endpoints and component Standard/Flow ports are distinct; explicit allocation connects them. Preserve that domain distinction. Native benchmark.
• Current source-6 implements participant CommunicationMean, typed explicit transition endpoint decisions, saved exchange categories/view selectors, completeness warnings and presentation duplication. Older audit absence claims are superseded; native acceptance remains scoped by reports.
• Semantic review includes independent scalar/constructor/keyed/order/Child/Incident/artifact facets and multiple source rows. One frozen accepted base, explicit mappings, unique merged candidate slots and one atomic command preserve raw excluded/rejected drafts. Recovery replans; it never restores an unchecked serialized command. Batch design, artifact contract.
• Native Windows artifact MOVE/CREATE/DELETE passed exact complete Save/Undo/Redo oracles, nine first-attempt saves. MOVE invalid raw optional state and CREATE exclusion/reserved identity survived controlled-stop recovery exactly. Destination-only retention is automated evidence, not separately native-applied in that run. Native report.
• Native batch, Child/Incident and source-5 checkpoint workflows have scoped exact source/recovery/history evidence. Dense views have persistence/duplicate/hide and bounded readability evidence. Current counts, binaries and remaining cases are in STATE.md; these are not universal usability claims.
• Native communication means drawing, explicit create/reuse ports and reverse Call/Reply pass independent complete model/source and exact Undo/Redo checks. The reverse navigation/overlapping-placement defect is fixed and reverified against a distinct oracle:10newUUIDs,zero implicit placements, correct Behavior owner and preserved Architecture. Exact evidence.
• Windows semantic108desktop+2core/full527desktop passes remain scoped. Subsequent guide/home and behavior navigation slices passed focused tests/strict Clippy/build; the latter compiled535desktop tests without claiming a full535run. A separate semantic navigation correction is under current verification. Keep counts scoped until final full-workspace verification.
• Native Scenario ordered review passed ambiguity rejection, explicit retained-local final order and complete Save/Undo/Redo source oracles at1100×700. Current guide binary passes related-topic heading reset, same-topic search scroll retention and Git auto-selected-topic reset without dirtying the model. Branch/fragment order variants and revised artifact diagnostic rendering remain separate gates. Native ordered evidence, guide/diagnostic implementation.
• Windows user-local GNU/LLVM builds and isolated clean-PATH native launch work. Actual Ubuntu24.04.4/Rust1.90 core/journal tests pass on hashed snapshots. Actual Linux server build and real HTTP modular import/invalidPUT/cleanrestart exact source/model/ETag pass on the older28-source lesson snapshot. Full server tests are running; current desktop/Linux package remain unverified. Linux evidence.
• Corrected30-source/37-file teaching project passes minimum-size Home/guide/dirty-source guard, located initial warning, reviewed NameTake and complete exact source/Undo/Redo/reopen checks. The review revealed a separate layer/canvas mismatch; the process workspace is cramped at minimum size. These findings and remaining tutorial tasks are explicit in native evidence.
• Scope reconciliation established two real semantic gaps using concrete OA/SA models: caller-context links into repeated/nested reusable chains (S1) and a maintained interface-operation selection for parameterless messages (S2). Existing sequence/functional-refinement workarounds change the intended engineering facts. Contracts/probes/independent critiques exist; production additions are pending. Scope reconciliation.

Decisions and candidate designs

Retain three Rust crates, one typed Project and validated atomic Command. Keep semantic ownership, reference/allocation/order relationships and diagram placement separate. Forms remain a closed typed adapter, not a second metamodel. Persistent additions require model validation, references/deletion, transition, parser/updater, API/schema and reachable graphical editing parity.

Semantic reconciliation uses finite typed facets and separate member/presence/order decisions. Compare actual destination slots before constructing the core's complete candidate; two rows never become sequential Apply. Missing identities are not inferred by names. Raw constructor/numeric/keyed/optional drafts survive rejection, exclusion and checkpoint recovery. Artifact Presence means attachment to the reviewed owner; an identified source moved away can delete the destination, whereas a source key of None preserves destination-only membership. No invented tombstone or silent seed acknowledgment.

Source updates preserve lexical ownership/comments/includes and exact history. Checkpoint source-5 upgrade admits only the established token/typed migration contract, validates old base fingerprints and resets transient approvals; it does not silently rebase authored drafts. Hosted saves remain explicit and conditional on the resource/ETag; credentials stay in memory.

For Linux journal publication, ordinary rename lost the empty-target ownership invariant in a real ext4 probe. Selected renameat2(RENAME_NOREPLACE) through existing locked libc with no fallback; syscall errors fail before model writes. Alternative overwrite fallback was rejected by that falsifier. Windows native no-replace/retry behavior is retained; other OS behavior is explicit. Contract, alternatives and measured limits.

Root selected F1, a complete source-6 teaching-project example. Corrected model/replay tests and bounded native onboarding/review/history pass; the full process/scenario/state/data/evidence lesson remains open. F2, faithful behavior-canvas SVG export, is deferred: current export scope is architecture-only, not a claim of faithful scenario/process/state export. Record this as an explicit scope decision rather than an accepted behavior-export result.

Behavior-root transition Apply should focus the explicitly requested counterpart and its nearest behavior owner. Without an explicit destination diagram it must preserve unrelated architecture presentation. Ordinary architecture transitions retain their existing path; explicit destination remains honored. This decision follows the independently reproduced reverse scenario placement/navigation failure, not a semantic change to the core transition.

Assumptions and open questions

• Nested source and contextual editors should reduce authoring effort; additional shorthand/grouping must justify grammar or interaction complexity through real tasks. Dense-view path overlap is not itself a failure when every actual identity remains accessible; arbitrary crossing-free layout is not promised.
• Remaining native variants must establish useful engineering workflows: CM transitions, advanced OA process/SA chain/scenario reuse/fragment/order, typed state actions, compact/Linux/hosted cases, and uncovered saved-view lifecycle combinations. Do not expand or shrink required OA/SA scope merely to fit implementation convenience.
• Latest diagnostic/reserved-label corrections have independent review and completed semantic/full-desktop/Clippy/build checks; their new-binary artifact rendering still needs native verification. Latest native process9672/GUIF5ECAE…9246 closed cleanly for the semantic-navigation rebuild; its exact scope is in STATE.md.
• Current Linux evidence includes x86_64/glibc2.39/ext4 core/MSRV and server/HTTP runtime. Full current desktop, packaging and GUI acceptance remain required. Syscall failure tests do not establish power-loss durability, network-filesystem behavior or cross-process model CAS.
• Earlier Windows QA packages include runtime/notices and verified archive contents; final accepted-tree optimized distributions and exact provenance/checksums remain a release gate. Packaging evidence.

Current strategy

Finish the semantic-review navigation correction and native replay. Freeze the independently critiqued S1/S2 contracts together, including exact old5/6 checkpoint/message compatibility, before coordinated source7/core implementation and graphical/source/REST parity. Complete the remaining tutorial/artifact/view/process/state/hosted workflows while bounded Linux validation progresses. Then run full-workspace, complete Linux and optimized/MSRV/REST/docs/package gates and fresh independent end-state review. Preserve exact revision/binary/platform scope; successful slices and architecture-only SVG export do not complete the broader goal.