ARCADIA-Studio/harness/release-behavior-creation-native-20260911.md

# Behavior creation cancellation — native Windows check, 2026-09-11

Codex-9e8r6t /root/palette_finish. Root assigned exclusive native input; all input used the Computer Use skill's `@oai/sky` through `node_repl`. This is a bounded cancellation/layout check, not acceptance of new behavior objects or the complete creation workflow. No Rust/Cargo work occurred.

## Exact candidate and isolated state

Waited for the author's post-lint immutable GUI rather than substituting the earlier build. Copied `.local/behavior-creation-20260911/gui-verified/{arcadia-studio.exe,libunwind.dll,manifest.json}` to `.local/native-qa/behavior-20260911-v4/bin`.

| File | Bytes | SHA256 |
| --- | ---: | --- |
| `arcadia-studio.exe` | 111163904 | `d4d9c2bd937e301ff1009d7cb93a34ee5aa6dfc837ff7e87d468c85371b20c31` |
| `libunwind.dll` | 190976 | `f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4` |

The copied author manifest records the source snapshot and narrow post-lint difference. This reviewer did not rerun its automated gates. GUI started at **08:50:49 UTC**, PID **5184**, with `LOCALAPPDATA` and `APPDATA` redirected to fresh `v4/profile/local` and `v4/profile/roaming`. Runtime PATH contained only the staged bin and Windows/System32 directories. `launch.json` records the executable, environment and timestamp. No existing recents/recovery store was copied.

Copied the entire preserved `.local/native-qa/palette-20260910-v3/checkpoint-transition-reopen` into `v4/work/basic-rescue`; pre-open comparison required all six source files to match exactly. Opened this copy through Studio's native Open dialog. Main returned window **6095570**, exact staged process path; Open dialog **3277858**. A file-dialog `set_value` attempt reported `Requested property was not in the CacheRequest (0x80070057)`. Fresh observation plus coordinate focus/type successfully entered the full authorized path. No user-stop, helper timeout, security prompt or unsupported UI automation occurred.

## Actual window sizes and supported sizing procedure

Initial capture was **1442×932**, corresponding to the configured **1440×900 client**. Minimum capture was actually observed as **1102×732**, corresponding to the supported **1100×700 client**; no screenshot scaling or source setting alone substitutes for this observation.

Direct corner/bottom drag attempts did not resize the window. The working native sequence was:

1. `Alt+Space`; inspect the returned System menu and select **Size**.
2. Press **Right**, then drag the right edge inward. The capture became 1102×932, with width clamped at the supported minimum.
3. Repeat `Alt+Space` → **Size**, press **Down**, then drag the bottom edge inward. Capture became 1102×732.

Each input used the current returned window and was followed by a fresh observation. The evidence supports this alternative sizing procedure; it does not identify an underlying defect in the initial direct-drag attempts.

## Observed bounded matrix

Every draft below was canceled; **Create and open was never pressed**. The accepted model count remained the baseline display of 10 objects / 2 links. Source equality was independently checked after the final Save, as recorded below.

| Check | Observed result |
| --- | --- |
| Wide OA family chooser | New shows three cards: Operational process, Scenario, State machine, with short purposes. Cancel remains at the bottom of the creation card. |
| Wide OA process naming | Choosing Operational process focused the name field automatically; typing worked without another field click. A long name containing `雨` and an em dash stayed within the single-line input and horizontally scrolled to the caret. Create/Cancel remained visible. |
| First Escape from focused process name | One Escape removed the whole draft/card, restored **All changes saved**, and showed **Behavior creation cancelled**. It did not merely unfocus the input. |
| Minimum OA family/scenario | All family cards and actions fit. Choosing Scenario focused its name input. Two explicit viewpoints were shown, neither initially selected. Selected **Participants · interactions**. Ownership text explicitly said OA layer root. |
| Minimum optional context | Initially collapsed. Opening it showed search/results in the scrolling field area; Create/Cancel stayed below that area. Search `capability` produced one result, **Rescue capability**, with kind/alias/OA-root context. Selected it and collapsed the picker; the summary retained name, kind, alias and layer. Long scenario name stayed inside the input. Explicit **Cancel · Esc** restored the clean saved state. |
| Minimum machine owner | Choosing State machine focused its name input. Search `rescue_team` reduced two existing OA participants to the intended Rescue team. Candidate and selected summary showed Entity / rescue_team / OA root. Selected this owner. |
| Minimum first-view option | **Create the first state view** was initially unchecked; toggled it on as draft state. The explanation that the machine starts without regions/states and both actions remained visible. Refocused the retained long name, then one Escape canceled the machine and optional-view draft together. Clean saved state returned. |
| Minimum SA family/chain | After cancellation, switched to SA. New correctly offered **Functional chain**, Scenario and State machine. Functional-chain naming autofocused; a long Unicode draft stayed within its input. First Escape canceled it and returned to the existing SA state-machine workspace. |
| Save after all cancellations | **Save all** completed with **All source files saved** and a clean title. No confirmation or recovery dialog remained. |

Typed long drafts deliberately exercised horizontal input bounds, not multiline text wrapping. The fixture's candidate labels are short root names; this run does not establish wrapping of long ancestor chains, same-name nested-owner discovery, six-result pagination, or large-catalog performance. The optional context's unfiltered list did require scrolling at minimum size; fixed actions remained visible and filtering removed the overflow. No actionable creation defect was found within the exercised matrix.

## Independent source preservation check

At **08:58:59 UTC**, compared complete file inventory, length and SHA256 after all cancellations and native Save against the pre-open baseline: **6/6 files PASS; no added or missing files**. Exact machine-readable records are `v4/baseline-source-manifest.json` and `v4/cancel-save-verification.json`.

| Relative source | Bytes | SHA256 before and after |
| --- | ---: | --- |
| `project.arcadia` | 4844 | `b35a3f63f223cc4fe2760d6308e87b016ed1eadfbef0a3a4bd051b52c9080958` |
| `rationale.arcadia` | 57 | `c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f` |
| `traceability.arcadia` | 395 | `f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0` |
| `oa/participants.arcadia` | 403 | `094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b` |
| `oa/activities/activity_assess_incident.arcadia` | 376 | `ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8` |
| `sa/participants.arcadia` | 124 | `fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8` |

`stderr.log` was **0 bytes**. Screenshots were inspected directly in Computer Use results; no separate screenshot archive is claimed.

## Handoff and remaining gates

Native-input lease returned explicitly to root at approximately **08:59 UTC**. PID5184 was left running at minimum size, SA Behavior / States & modes, displaying the baseline **Decoy operating modes** selection. All drafts were canceled, all source saved, no dialog open. This reviewer performed no further native input after handoff.

Actual creation and command-correlated opening, model/source Undo/Redo, recovery of a pending creation, modal-priority Escape, source-write rejection during creation, long nested labels, and crowded picker pagination remain separate acceptance gates. Automated evidence for some of them exists in the owner's report; it is not relabeled as native evidence here. Root owns the independent accepted-object oracle and next native work.

## Follow-up: accepted creation, history and reopen

The section above records this reviewer's earlier cancellation-only session. Root subsequently performed the following native model-producing sequence in the **same D4D9C2BD…1B20C31 candidate**, at the actually observed **1100×700 client**. Root retained exclusive native input; the reviewer independently reran the existing v2 checker against immutable checkpoints at **09:18:19–09:18:23 UTC**. No live `work` model, profile or UI was accessed during that readback, and no Cargo/compiler ran. UI observations below are attributed to root; checkpoint assertions are this reviewer's independent execution of the previously specified oracle.

1. In OA **Behavior → New → Operational process**, type **Coordinate rescue**, then **Create and open**. The new process opened. Save and preserve `checkpoint-process`; Undo **once**, Save and preserve `checkpoint-process-undo`; Redo **once**, Save and preserve `checkpoint-process-redo`.
2. In OA **Behavior → New → Scenario**, type **Rescue coordination conversation**, explicitly select **Participants · interactions** (`ParticipantInteraction`), expand optional context and select **Rescue capability** (`b451c000-0000-4000-8000-00000000001f`). **Create and open** opened the scenario. Save as `checkpoint-scenario`; separately perform one Undo/Save and one Redo/Save, preserving `checkpoint-scenario-undo` and `checkpoint-scenario-redo`.
3. Switch to SA, then **Behavior → New → State machine**. Type **Rescue team operating modes**, select the existing SA **Rescue team** SystemActor (`c0629449-1209-4b50-afac-f558a9a0fc7f`), and check **Create the first state view**. **Create and open** selected the expected machine/view. Save as `checkpoint-machine`; separately perform one Undo/Save and one Redo/Save, preserving `checkpoint-machine-undo` and `checkpoint-machine-redo`.
4. Open the saved project through the actual native file picker, then Save again and preserve `checkpoint-creation-reopen`. Root reported a dialog-target retry: typing against the parent window did not fill the dialog, and a bounds error required fresh dialog observation/retargeting. The subsequent dialog Open succeeded. The final model/source checkpoint proves the resulting reopen, not the failed input attempt.

All ten named checkpoints are whole-directory snapshots under `.local/native-qa/behavior-20260911-v4`. Root reported the same running PID5184/window6095570 and zero-byte stderr at completion; this consolidation did not poll or control that live process.

### Independently rerun contract and exact file checks

**13/13 commands passed**, including the checker's falsifier self-check and pinned baseline check. Every first-commit checkpoint was its own fresh-role carrier; its **original** role identities were then reused for Redo and final reopen. Each Undo used the preceding first-commit stage as expected state and the corresponding creation's first-commit snapshot as explicit `UNDO_FROM`. Thus Redo is not allowed to pass by borrowing newly substituted identities from itself.

| Checkpoint | Complete semantic and source result | Exact physical source files |
| --- | --- | ---: |
| Process / Process Redo | Predicted OA process and all previous data; 7 reachable sources | 7 |
| Process Undo | Exact initial baseline model/identities and 6 reachable sources | 7, including 1 proven retained file |
| Scenario / Scenario Redo | Cumulative process plus explicitly qualified/contextual scenario; 8 reachable sources | 8 |
| Scenario Undo | Exact original Process checkpoint; 7 reachable sources | 8, including 1 proven retained file |
| Machine / Machine Redo | Cumulative objects plus owned machine and opt-in first view; 9 reachable sources | 9 |
| Machine Undo | Exact original Scenario checkpoint; 8 reachable sources | 9, including 1 proven retained file |
| Reopen | Full Machine contract using original machine identities, plus exact Machine Redo equality | 9 |

The complete predicted Project and SourceBundle comparisons cover root ownership versus scenario context, explicit viewpoint, exact names/defaults, retained unrelated records, and the new machine's SystemActor parent. The optional view is **Rescue team operating modes · states**, SA StateMachine projection with exactly one machine placement at **60,60**, size **336×104**, no states or regions and default options. These are the independently specified fixture expectations, not values inferred wholesale from the produced model.

In addition to the oracle, the runner compared **every physical file's actual bytes** between `checkpoint-machine-redo` and `checkpoint-creation-reopen`: **9/9 equal**, with identical path inventory. All eleven input directories (baseline plus ten checkpoints) retained the same complete inventory, lengths and SHA256 values before and after execution. No checkpoint source files were copied into the tracked evidence directory.

The durable runner, every command argv/stdout/stderr/exit code/timing, all checkpoint file hashes, and candidate/oracle/screenshot provenance are in `harness/experiments/behavior-creation-native-20260911/`:

| Artifact | SHA256 |
| --- | --- |
| `verify.py` | `4921c4615071240c3ac3bbe1223c0db3bf472fe5e3eec2ae5dac12f95b1674df` |
| `commands-results.log` | `f5bfbee185f7064419b1bd9fe33ec6a48526b5bbe3f818c006feb74eddf8e189` |
| `manifest.json` | `356dfbb27dec04764a4b3f2372602f39953b472baac0a3de3e72acd9c1d76b8a` |
| Existing v2 executable | `056eefd444924916bf6ac3c4897ab2ff4a8a4bb892e1dbc16adad32e59bf6a36` |
| Oracle source | `51ab2ffa1826dd949b79f3a9690042a2f9e38daf9ed91517cade3861482117ba` |

Reproduce without building: run `python harness/experiments/behavior-creation-native-20260911/verify.py` with the preserved existing executable, checkpoints and staged runtime. The script verifies the expected executable/source hashes before executing. It prepends the staged bin to its child runtime PATH. Its JSON records absolute executed arguments and repository-relative input manifests.

**Harness correction:** oracle v1 incorrectly required every disk file to remain reachable after Undo. Studio's documented safe saver retains newly detached files instead of deleting them. V2 accepts only the exact previously committed retained paths/bytes proven by the explicit Undo origin, while still demanding complete model and reachable-source equality. Unknown, missing or modified retained files fail. This is a correction to the test's disk contract, **not a product regression or a relaxation for arbitrary orphan files**; see `harness/release-behavior-creation-oracle-20260911.md`.

### Actionable empty-workspace finding and limits

Root observed that the newly created Process presented a blank white canvas with **Tools / Selection details / Fit overview** but no visible first action. The empty Scenario likewise showed no first-lifeline action; its helper instructed selecting/reordering a lifeline or occurrence when none existed. Both require the engineer to infer that hidden Tools begins modeling. Root retained `v4/scenario-empty-saved.png` (SHA256 `b03fb33d3f4cf1e5f95e7ac4198a4dee30ffd9af5e250d481e0d5dc2a2a0f90c`) and `v4/machine-created-saved.png` (SHA256 `1e7af3d6219c430eaafb0de5afd8df4c51b4efeb80de3f642084188633dcb65b`); their hashes are also in the manifest.

The bounded recommendation and falsifiable acceptance cases are in [the contextual-source creation plan](release-contextual-source-creation-plan-20260911.md): a semantic empty-state **Add first activity/function contribution** or **Add first lifeline** action opens the same contextual authoring form, preserves explicit viewpoint, and offers staged creation of missing sources. This is an open usability finding; successful object creation does not resolve it.

This follow-up establishes the stated three creation/one-step-history/saved-reopen paths, in conjunction with root's native observations. It does **not** establish pending-draft recovery, camera/scroll restoration, modal-priority Escape, write-failure behavior, large-model/long-ancestry usability, or complete release readiness. Earlier cancellation evidence remains intact. No additional native lease was acquired for consolidation.

## Follow-up: pending SA machine recovery, autofocus and cancellation

Root supplied this additional native recovery slice; this reviewer independently verified only its immutable JSON, launch record and saved cancellation checkpoint. The earlier 13-command manifest is preserved byte for byte. This section closes the specific pending-creation recovery case described here, superseding only that portion of the preceding open-gate statement.

After the nine-file saved reopen, root started an SA Machine draft named exactly **Recovery — secours Δ «operating modes»**, selected the existing SA **Rescue team** SystemActor, and checked the first-view option. Root verified the persisted private checkpoint and preserved `v4/recovery-evidence/before-interruption.json`. Root then force-terminated only the verified isolated PID5184 and relaunched the same executable/profile/runtime. `v4/recovery-launch.json` records launch at **09:17:07.8245552 UTC**, new PID **1284**, the original staged GUI SHA256, isolated AppData directories and clean staged-bin/Windows PATH. Root's newly returned native window was **6161106**.

Actual **Home → Recover** restored the SA creation form, selected owner, checked first-view option and name caret. Root typed **` · resumed` without clicking a field**, directly demonstrating recovery autofocus, and preserved `after-recovery-and-typing.json`. Root then pressed **Escape once from the focused input**: the draft disappeared and status read **Behavior creation cancelled**. Actual **Save As** to a new `checkpoint-recovery-cancel/project.arcadia` succeeded. The recovered machine/view draft was never accepted. Root reported zero-byte recovery stderr and a saved recovered copy left open at wide 1442×932; this reviewer did not inspect the running UI or log. Root also compared the original live work copy with the nine-file baseline; this consolidation independently checks the immutable saved recovery copy only.

Independent immutable readback at **09:22:33–09:22:34 UTC** passed **19/19 explicit checks**, including one existing v2 `same` command (exit 0, **0.147209 s**):

- Exact literal Unicode name before interruption and exact deliberate suffix afterward; SA Machine family, original SystemActor UUID and `first_view: true`.
- Complete `behavior` JSON equality after removing only the deliberate suffix. No other draft fields were normalized or dropped. Reserved element `c6f559f5-401e-4e0d-af93-91faee68d3f5`, diagram `11ad8f0a-73aa-416a-bbeb-9b886bf39854`, and placement `171f7d7e-3a8f-4200-86f6-a9e2efd87610` IDs remained exact.
- Complete `accepted`, `workspace`, `property`, `workflow` and `selected` JSON values each remained exactly equal. The accepted source snapshot also matched the preceding immutable saved checkpoint's complete nine-file byte map.
- V2 `same checkpoint-creation-reopen/project.arcadia checkpoint-recovery-cancel/project.arcadia` passed complete Project, identity and nine-file SourceBundle equality, with nine exact disk files and zero retained exceptions. Separate direct-byte comparisons passed **9/9 files**, with identical complete path inventories. None of the three reserved draft IDs appeared in any saved file.
- All input checkpoint inventories, preserved evidence hashes and the original 13-command manifest remained unchanged during verification.

The wrapper metadata (`origin`, checkpoint identity and modification time) is not asserted equal: recovery opens a distinct unsaved copy. More importantly, **persisted Undo history is not restored**; the UI explicitly explains that limitation. The evidence establishes pending draft/value/identity restoration, native autofocus, first focused Escape cancellation and saved-source preservation. It does not claim Undo/Redo continuation across recovery, accepted creation from the recovered draft, other creation families, or camera/large-model recovery coverage.

Separate durable evidence under `harness/experiments/behavior-creation-native-20260911/`:

| Artifact | SHA256 |
| --- | --- |
| `verify-recovery.py` | `3546b4fe68d3e1a2474015be1b652a665af238e5fcf63e04bac3f25df3d35e90` |
| `recovery-commands-results.log` | `1dc3e89aa46660bfad796e7b6bf821bebd7e5bc5a7902a826021d461a3e74c68` |
| `recovery-manifest.json` | `68e2fcf653f7a59037c9eb0b31f6c9e629dc0ab88af545d5b78a2bbf8c980a72` |
| Preserved `before-interruption.json` | `0c355aa3c7b9be623d767ff35c4b85cf7b2907eb9bc3be39d619aa610c989692` |
| Preserved `after-recovery-and-typing.json` | `fafa7a884275bac09afab365f8ab0063f998ca56c5ffc70be596db6f78a10103` |
| Root's `restored-draft.png` | `8ae0fe8957d5a935b6e2605a6ffb68934bd0e8840f3594c43e63865ab89d03c9` |

Reproduce with `python harness/experiments/behavior-creation-native-20260911/verify-recovery.py` using the preserved files and existing oracle/runtime. It reads only the explicit immutable inputs, never the live `work` or profile paths mentioned inside JSON. No native input, production changes or compilation occurred during this consolidation.