ARCADIA-Studio/harness/release-current-native-verification.md

Current Windows lifecycle and keyed-review verification — 2026-09-06

Ordered review, retained rejection and exact source — current continuation

The main OA→SA ordered fixture passed actual native editing on the corrected binary660BECC8DB96B218D12805B39661B46C9F48DF4F8F07CB3B7D42C1F803BE089F, then crash recovery and Apply/Save/Undo/Redo on reference-padding build D402F9B09A454B7AB1239DAB9102E6E20107BCC38AFA29740B1837592E98A04E. The latter build passed in .local/reference-padding-build.log (3m46s), staged with libunwind.dll under .local/native-qa/bin-reference-padding, isolated appdata and system-only PATH. Current native process8908/window853042; prior10896 stopped.

At1100×700, explicitly paired Request start, Verify interlock and Energize in Reference pairs. Taking Verify membership refused ambiguous ordered insertion. Set final value for Steps order seeded Request, Local self-test, Energize, Verify; one Up on Verify produced Request, Local self-test, Verify, Energize, zero impacts. Leaving the Verify membership decision unselected refused the exact-survivor contract while retaining that four-entry order. Checkpoint 41b850e8-faac-431c-b040-e016065452f6 is copied to .local/native-qa/ordered-before-crash.json. Forced process stop and native Home Recover restored all four reference pairs, the lone order Candidate, selected member address and same error. Navigating back to final order showed all authored positions plus “No longer included: SA Verify interlock”. Retaking Verify repaired the preview without editing the order. Apply was one atomic transaction.

Save As .local/native-qa/ordered-recovered-result.arcadia is byte-exact against .local/native-fixtures/semantic-ordered.after-order.arcadia, SHA256 65A6217F474B5085F37B511151185C2C08FF7A1998E924F1FE01F29C410F6CED. One Ctrl+Z and Ctrl+S restored the initial fixture byte-exact, SHA256 C59EC1233D5A9FBB8E386F6D9B13F398BE21BAF813BA215EFB51BFC1BB98DB36; copy .local/native-qa/ordered-undo.arcadia. Ctrl+Shift+Z survived Save and Ctrl+S restored the exact final oracle hash. Recovery folder then contained zero JSON checkpoints and current stderr remained empty. This single-file byte oracle also preserves the leading comment and all unselected source declarations.

Native found that Fill alone did not prevent the vertical scrollbar overlaying right-hand Reference pair actions. An18px content right gutter now visibly fixes Use pair and Remove pair at1440×900 and1100×700; both sizes passed native inspection. The same overlay affects Members identity actions and Order Down buttons; semantic session worker owns the consistent gutter correction. Reverse, scenario, branch-step and fragment variants retain automated fixture evidence but their new native runs remain pending. No complete-release acceptance is claimed.

This is current-machine evidence on codex/release1-continuation, integrated baseline c091f80 plus the uncommitted continuation. It does not supersede unrelated historical Linux checks or claim first-release acceptance.

Build and automated checks

User-local Rust 1.98.1 stable-x86_64-pc-windows-gnullvm, LLVM-MinGW 20260826 UCRT. cargo build --locked -p oa-desktop -p oa-server passed. Shared normal-user manifests allow installer-like GNU test filenames to run without elevation. cargo test --locked --workspace passes 840 tests, with the existing routing benchmark ignored; .local/current-workspace-tests-final.log is the full log. Strict all-target workspace Clippy passed in .local/current-clippy.log (8m24s).

Initial failures were corrected at their causes: typed action test double-applied the camera transform; invalid Binding fixture reused one local lifeline; core Annotation/Binding replacement reordered retained rows; a hosted timeout test incorrectly assumed a 30ms deadline guaranteed server admission. The held-response test now permits pre-admission timeout while preserving outcome uncertainty and no-retry checks. Independent recovery review also found and fixed write/restore workspace limit disagreement, preserving the prior usable checkpoint on rejection.

Isolated native lifecycle trial

The actual debug GUI runs with LOCALAPPDATA redirected to .local/native-qa/appdata; no user recents or recovery store was used. Captures and input use the Computer Use skill's native Sky API. Root is sole native operator. Default client size is 1440×900; minimum client size 1100×700 was reached through native border resizing. No screenshot or unit test substitutes for this run.

1. Home starts empty, offers New/Open/example/guide and clear recent-file guidance. Loading the rescue example displays the existing OA architecture and 21-file source project. This does not create a file destination.
2. Inserted unfinished_recovery_draft after arcadia 5;. Apply rejected it at project.arcadia:1:12, preserved the exact raw source and left the 41-element, 26-relation accepted model intact. Architecture remained inspectable and explicitly blocked property editing until source drafts were resolved.
3. Observed a completed private checkpoint containing that exact token, then forcibly stopped only the trial's verified Studio process. After restart, Home offered the retained project. Recover restored the source draft, located error and unsaved-copy status. Undo history was absent as specified.
4. Reverted the intentional source error, then Save as chose .local/native-qa/recovered/project.arcadia. All 21 saved files compare exactly with the checkpoint's accepted bundle (zero mismatches). Both retained recovery entries were retired, no checkpoint remained, and stderr was empty.
5. Home displayed the saved project in Recents. At 1100×700 the action rows, current-project card, recent Open/Remove and guide entry remained readable and reachable. Recent Open loaded the source project with its identities intact.
6. Replaced the project UUID property with raw -. Apply rejected it without changing the model. After observing its completed checkpoint, a second forced trial-process stop/restart recovered exactly - in the identity field. Origin is displayed as context on Home; restore still opens a copy without a save destination. Save & continue rejected the raw UUID and retained the draft. Open's discard decision then allowed moving to the next isolated fixture.

Local forensic artifacts: source-draft-before-crash.json, property-before-crash.json, the 21-file recovered directory and per-process stdout/stderr logs under .local/native-qa. These contain synthetic example data.

State-action trial and open finding

Production-parser-validated .local/native-fixtures/state-actions.arcadia has 14 elements, 10 relations, 1 saved state view, 8 placements and no issues. In Behavior & scenarios, Ready shows legacy Entry prose, typed Entry/Do/Exit work rows, an Internal transition and a nested region without overlap. Each of the three typed rows selects its actual StateAction relation; the inspector confirms the corresponding phase, Ready source and Restore settings / Monitor pressure / Release resources target. Selection does not mutate the saved model.

Open native finding: opening a file whose first diagram is a StateMachine lands in Architecture's generic graph renderer, with blank action-header space and functional/boundary exchange tools. The dedicated Behavior canvas renders and selects correctly. A bounded routing correction is being investigated; do not call the state-view entry workflow accepted before it is fixed and rerun.

Still required for this milestone: updated-binary preflight/routing checks, pending behavior/workflow crash recovery, state-row compact/fold/edit/save checks, Annotation/Binding native Take/Candidate/history/source oracles, fresh independent review closure and strict checks. Linux and complete release acceptance remain separate required gates.

Semantic review in progress

The validated semantic-keyed.arcadia fixture opens in Traceability and exposes the Navigation message review. Members/rows can browse OA and SA origin Record fields separately, choose their nested latitude fields and stage the exact pair. Take Operational shows proposed latitude_deg + 0.25, one decision, three reference pairs and zero additional changes. A completed checkpoint contains this pending semantic workflow and Take decision; .local/native-qa/semantic-before-crash.json preserves it. The trial process was then forcibly stopped, leaving the executable unlocked for the routing build. Restore/Apply/source-oracle comparison is next.

Several immediate captures during heavy compilation preceded the app's next paint; fresh captures showed the intended picker menus. This was not an empty-choice defect. Native dialogs also sometimes needed focus and input retried after a fresh observation; folder navigation completed fixture opening. These observations do not justify changes to model or field-picker semantics.

Recovered semantic review and Save-as history finding

Updated routing binary SHA256 70069D6CBBE1917E1597794B3E190FF9CF23664D458F794B3270DDBE6EE683A2 launched as isolated PID7580. Home recovered the pending Annotation review, retaining one Take decision and three explicit reference pairs. Regenerated validated preview showed latitude_deg + 0.25; Apply succeeded with zero additional changes. Save as .local/native-qa/semantic-accepted.arcadia exactly matched the independent after-take source oracle (SHA256 9AB573C92BE66E3BAE659DD826923BA6066979B1651EDDA7BD469056632CD77E), including comments, typed history, sibling value and order. Checkpoint retired after Save.

Native history check found a production defect: changing the entry basename through Save as creates an extra Document transaction. First Undo only restores the prior entry name; saving it preserves after-take content and clears redo through another entry rename. Second Undo reached the real semantic transaction and saved exact initial source (SHA256 49214BE2CA9C8BB6195C3B39737C053847021839F70F0BB2921D35A1FBD2AC83). Root assigned non-history Save-as adoption/preflight correction and meaningful history tests to state_contract. One-step Undo/Redo after renamed Save remains unaccepted until rebuilt native recheck. Current Linux runtime is prepared and checksum verified but has not booted.

Binding rejection, crash recovery and repair accepted

On routing binary70069D6C, the paired Rendezvous binding was explicitly staged. Candidate SA Rendezvous extra local rejected with duplicate_lifeline_binding: Scenario-use lifeline bindings are one-to-one. Apply was disabled. Switching Reference pairs / Properties retained the decision and error. A completed checkpoint preserved the exact after-Take accepted source and invalid local UUID; forensic copy binding-invalid-before-crash.json.

Forced stop of isolated PID7580 and restart PID796 recovered the same candidate, presence and two reference pairs, regenerated the same error and kept Apply disabled. Repair to SA Rendezvous alternate produced a valid preview and zero additional changes. Native Apply + Save as into a new folder retaining the entry basename matched the complete after-repair oracle exactly (SHA256 E3CE0347746584F503B825A8B6BD23A7EEBF0827940112EF8F36D500C1D0A043). One Undo + Save matched after-Take exactly; Redo + Save matched after-repair. Saved copies are under .local/native-qa/binding.

A new UI finding is clipped Use pair / Remove pair controls on Reference pairs at the normal1440x900 window. Semantic worker constrained the panel widths; rebuilt native inspection remains. The debug gnullvm executable needs .local/toolchain/env.ps1 PATH during launch: a launch without it exited before a window with no app log. Packaged GNU runtime dependency closure must be checked explicitly; this does not change prior successful toolchain-environment runtime evidence.

State-view routing and pending behavior checkpoint

Routing binary70069D6C opened the saved state fixture directly from Home/Recents into Behavior, exact machine and diagram selected with state tools. Explicit Architecture remained reachable with an empty architecture view, and selecting the saved state view there routed back correctly. At1100x700, toolbar/inspector remained usable, zoomed Exit action selected its StateAction relation, direct State placement into Main region created one state/placement, and one Undo restored the original14elements/10relations and clean document. The initial fixture file is unchanged.

Right-clicking the Internal row opened Edit transition. Authored name Unfinished timed refresh with a checked new timed trigger and empty expression retained the existing trigger/effect/guard, showed the required-expression message and disabled Apply. The form scrolls at1100x700. Completed checkpoint behavior-before-crash.json contains exact unchanged accepted fixture plus the authored pending behavior draft. Isolated process796 was forcibly stopped for rebuild/recovery testing; no native GUI is currently running.

Packaged clean-PATH smoke — 2026-09-06 continuation

QA package ArcadiaStudio-qa-debug-20260906-a-x86_64-pc-windows-gnullvm (older binary SHA25670069D6CBBE1917E1597794B3E190FF9CF23664D458F794B3270DDBE6EE683A2) launched as process5452 with PATH exactly C:\Windows\System32;C:\Windows, working directory .local/package-clean-smoke, and separate app metadata there. The packaged libunwind.dll resolved the development-PATH dependency: actual Home rendered, Explore rescue example showed41objects/26links with nested architecture, and the offline Engineering guide rendered16topics. Alt+F4 closed the app normally; the next native window inventory no longer contained it; process5452 was absent and both stdout/stderr were zero bytes. This launch did not open or modify the pending behavior checkpoint in the other QA appdata directory.

The guide search Clear button was partially clipped at1440width. Root added explicit Fill constraints to the search, content and step rows; updated native acceptance is pending. The old package does not include complete Rust dependency notices, identified by independent review; it remains QA evidence, not a distributable release. This smoke does not establish final-binary portability or fresh package Save/reopen acceptance.

Recovered timed transition and corrected Save-as history

2026-09-06, process10896, staged desktop SHA256 660BECC8DB96B218D12805B39661B46C9F48DF4F8F07CB3B7D42C1F803BE089F, system-only PATH, isolated native-qa/appdata. Home Recover opened checkpoint 5a81ce27-e331-4165-9eab-8f190493f376 in Behavior with the exact raw name Unfinished timed refresh, Internal Ready-to-Ready endpoints, Sample tick, pressure_valid guard, Monitor pressure effect and Update status display notes. Timed event remained enabled with empty expression and the time-expression error; the accepted properties still said Refresh status. Enter30 s made Apply available. One Apply created Event49044cb7-5f91-408a-86fc-1cc012eb2972 and edited only the existing transition, leaving15elements/10relations and expected3coverage warnings.

Native Save-as selected a different entry basename, state-recovered-renamed.arcadia. Accepted entry SHA256AD8FD359CE7B0BE4F3AE0F55424EEB4EE032DEFB359F2F5AD89C00A79B62DADF includes sa/model.arcadia, whose sole new Event body is Time(After,30 s), SHA256 8FB649F8ABB93CF4C321F2D847A1A9F1A1551E0F713E938C46EF11E24DC58801. One Ctrl+Z removed the Event and restored Refresh status. Ctrl+S produced entry bytes exactly equal to pristine state-actions.arcadia, SHA256 9CDE82608110E56AA9E14C9E33EB38976F53AED74AB013145D411D5743A0EC26. Ctrl+Shift+Z remained available after that save, restored the same Event and transition, and Ctrl+S reproduced the accepted entry exactly. Both saves retired all private recovery JSON files. Oracles are retained under .local/native-qa as state-after-timed-repair.arcadia, state-after-timed-repair-event.arcadia and state-after-undo.arcadia. Full reopened bundle parsing remains a follow-up check; entry byte equality alone is not claimed as independent whole-model comparison.

Home Continue editing returned to the same Behavior owner/view and camera. Native resize to1100x700 retained all9navigation pages. The Engineering guide at that minimum size showed the entire Clear control and wrapped readable article text, closing the observed clipping finding for that size. Ordered review and reference-pair modal native acceptance remain pending.

Reverse ordered review and transient Windows journal failure

On the same D402 reference-padding binary, at1100×700, opened semantic-ordered-reverse.arcadia and explicitly selected System changes in Operational. Added Request/Energize/Verify OA→SA reference pairs (plus existing owner pair). Chose both Verify step addresses and Take System. Native refused ambiguous insertion with the expected unique-anchor error. Set final Steps order, moved Verify once before Energize, retaining Request and Local self-test, then applied two decisions atomically with zero extra impacts.

Save As to .local/native-qa/ordered-reverse-result.arcadia initially failed before publishing its journal. Accepted model remained dirty, output absent. A retry to the same filename succeeded. Full saved source is byte-exact against semantic-ordered-reverse.after-order.arcadia, SHA25698020E048AC01F285C6AD8C10CE22BEF05E193B5BA0F5558BE1FB26A7BF82620. One Ctrl+Z restored three steps; Save initially hit the same failure while preserving prior accepted disk bytes, then succeeded on retry. Undo source matches pristine byte-exact, SHA2562B7C3694623BBEA3E36DCC6F674D4ADCD91E23C8E1005DED21E5A69648A048E5 (copy ordered-reverse-undo.arcadia). Ctrl+Shift+Z survived Save; final Save restored exact accepted hash. Recovery JSON count zero. Actual reverse Apply, retention after failed Save, Undo and Redo pass; failure-free save reliability does not yet pass.

Independent public-core reproduction got18successful/2failed fresh saves with Windows Access is denied (os error5) at journal-directory publication. Plain/canonical/forward-slash path probes rule out the initial slash hypothesis. Source fix retries only transient Windows5/32/33 errors with a390ms total bound and checks for competing journal ownership before each attempt. This fix and full footer-error tooltip are source-only, awaiting tests and new native build. Existing native binary has no retry. Native window now maximized2245×1232, Traceability, saved reverse result; process8908/window853042 unchanged.

Source-6 combined review native acceptance — 2026-09-06

Frozen GUI .local/native-qa/bin-source6/arcadia-studio.exe, SHA256 5D0734D9BD6A87CCCA8FFC8C007962AEAC573ACB82E2974211FA857E93C18A72, built with server after strict all-target Clippy. Isolated appdata and system-only PATH; libunwind.dll alongside. Initial process2452; controlled crash/restart process10236, window456983644. This binary precedes later Child/Incident and source5-checkpoint upgrades.

Opened semantic-batch.arcadia through native file dialog. Normal Minimum120 correctly rejects against Maximum100. Opening Emergency trace retains Normal draft; Emergency Maximum - stays invalid. Excluding Emergency keeps its raw input, and changing Normal Minimum to5 produces a valid included preview. Reopening excluded Emergency preserves -, inclusion=false, and enabled Apply for the valid included row. All retained-row selectors, inclusion, error, input and Apply controls fit at1440×900 and supported1100×700 content dimensions (captures1442×932 /1102×732).

Checkpoint c33eb911-7792-4f95-ad6f-f0676a733d21 captured both rows exactly; copied .local/native-qa/batch-before-crash.json. Forced exit then Home Recover restores included Minimum5 and excluded invalid Maximum-, with a valid combined preview. Found misleading recovered add-trace label “Deleted reference” for a live trace; source correction and its focused test subsequently passed in the92-test semantic run, but native recheck of that label requires the next build. Input150 needed refocus/retry once when the first tool text entry left the field blank; the confirmed second entry produced150. No application defect is inferred from that isolated input event.

Included repaired Emergency Maximum150 and set Normal Minimum120, then applied once. Save as .local/native-qa/source6-batch-result.arcadia matched the independent final source exactly: SHA256 D3315BBA762395205AE761E6E64029E8B4070C15A1299C6114075581DB7B0974. One Undo then Save matched the initial source exactly: 5E1F433E04621424EDAC43E53411624059E873F88DD531BFDB39093953485ED7; copied source6-batch-undo.arcadia. Redo after Save, followed by Save, restored the final hash exactly. All three saves succeeded first attempt; checkpoints retired; stderr remained empty. These source oracles include both trace observations and unchanged source records/comments, not merely a displayed numeric value. Dense views, CM direct authoring, latest attachments and source5 checkpoint native acceptance remain separate gates.

Dense saved view duplication and explicit hide — independently reopened

On the same source-6 native binary/process10236, root observed the default1440×900 Fit89% view with all40 labels readable and no overlap, and inspected actual exchange01/10/20/40 identities. Commands category filtering displayed10; one Undo restored All. At1100×700, Fit52% is a tiny overview, while99% working zoom plus blank-canvas pan allowed selection of all four named exchanges/aliases without a model edit. These observations do not establish a need for grouping.

Root then saved the Commands-filtered original and its duplicate, named Commands review, with explicit Hide on Service data05. Save succeeded first attempt. The actual saved entry is .local/native-qa/source6-dense-result.arcadia, SHA256 B91F2C4D9A9B1257B426F2F36F1A7948491390E0CF36B592244B925A93686DFD. It includes views/diagram_forty_exchange_view_copy.arcadia, SHA256 898E4E7C6B835D9CF1E1E6810F4BC25AC5AF93CABBF547ACABC9827DB2561343.

Independent read-only verification reopened both files through production source_files::load_project and source_project::compile_bundle, validated the result, and compared it against both pristine source and pristine JSON. The pristine source SHA256 is 00B87736B82C5AFD33B311DF7AEBE9A6C8C51B6DE66221181B5EA8BC8CA221A3; pristine JSON SHA256 is 5DD4F22453330CAB3ABC059881660190E689A22619853F77CF6D0B52735D97AD.

Exact whole-Project equality passed after constructing only these expected changes:

• Original diagram d4060906-0000-4000-8000-000000000fa0 changes only its Work categories to Commands (concern_1), retaining every other persisted field.
• New diagram d5841bc0-4c1a-494d-b79f-e3ad872d1f38, alias forty_exchange_view_copy, is named Commands review. It copies the filtered original's fields and adds exactly Service data05 to its explicit hide list.
• Its two fresh placement IDs are 6ce88797-657c-4b11-88af-119dea388be4 and f85547ce-f80b-4b4d-be76-77c5c84f0449, with the corresponding _copy aliases. Element references, positions, sizes, collapse, ports and persisted routes match their original placements/view exactly. All three new IDs are distinct and absent from the pristine model's complete identity set.

All46 elements,42 relations, traces, artifact links and other project facts remain exact. Production projection yields exactly exchanges01–10 for the original and 01–04 plus06–10 for the copy: 10 original /9 copy, with two nodes each. Automatic route/label positions were not compared: they are recalculated and labels repacked after hiding a line. No model or source file was written by this verification.

Reproduction helper .local/verify-dense-native.rs was compiled directly against the existing liboa_core-6c8da57367eec642.rlib (SHA256 21ED1DDBEDF881464E049C1A9A0D3C1A6479E3FD9372F85B23ECDEE6BC148842) with task-local Rust1.98.1/clang; no Cargo or server process was used. Its exact passing output is .local/dense-native-oracle.log. After dot-sourcing .local/toolchain/env.ps1, the invocation was:

rustc --edition=2024 .local/verify-dense-native.rs --extern oa_core=.local/target-gnullvm/debug/deps/liboa_core-6c8da57367eec642.rlib -L dependency=.local/target-gnullvm/debug/deps -C linker=clang.exe -o .local/verify-dense-native.exe
.local/verify-dense-native.exe .local/native-fixtures/dense-40/dense-40.arcadia .local/native-qa/source6-dense-result.arcadia .local/native-fixtures/dense-40/dense-40.json

New native finding, still open: switching from the saved copy to the original through the diagram selector changes the canvas/selector to the original's ten lines, but the inspector retains the copy's name, alias and property draft. Source review confirms Message::Diagram changes active_diagram without changing the previous diagram selection before rebuilding its draft. A guarded current-view inspector follow correction is proposed; no fix or new-binary acceptance is claimed by this record. Other selector/label/coverage combinations and fresh GUI reopening remain separate native cases.

Subsequent native reopen passed on .local/native-qa/bin-source6-recovery, desktop SHA256 DD5D01FA07B921F1A7B365C33867876A7AE1BCBD01815B4BB4206408D2012F95, process9716/window5702656: original10 includes05, copy9 excludes05, and the copy's new count reads9 shown /33 omitted. This verifies saved-view reopening and the count on that binary. It precedes the newly prepared diagram-inspector follow fix and Artifact implementation. The inspector correction has six focused tests in app/diagram_selection_tests.rs, and those tests passed in the later full 518-test desktop run. Strict all-target workspace Clippy also passed (.local/source6-artifacts-final-clippy3.log). Rebuilt native acceptance remains pending; automated results do not close this native finding.

Latest automated artifact evidence — native gate remains open

The later full desktop suite passed 518/518 in .local/source6-artifact-inspector-desktop-tests2.log. The artifact picker’s fresh-editor falsifier exposed an artifact-ID/owner-layer classification error; after correction its six-test filter passed in .local/source6-artifacts-final-tests2.log. Strict all-target workspace Clippy then passed in .local/source6-artifacts-final-clippy3.log. This automated evidence covers the implemented artifact lifecycle and the inspector correction; it does not establish native acceptance of either.

Artifact move, source-attachment-absence deletion and counterpart-creation fixtures, direct-core requests, exact source/JSON oracles and the reproducible generator are preserved under fixtures/release1-native/artifacts. Artifact native acceptance remains pending. The source-6 batch and dense-view native observations above retain their exact earlier-binary scope.

Scenario ordered-member variant — 2026-09-06 20:10 PDT

AB6ECD62 GUI process2540 at1100x700 opened the tracked schema5 semantic-ordered-scenario.arcadia. Import reported5→6 with0semanticdefaults/0interfaceallocations/0unresolvedvalueaddresses. Explicitly added Requeststart, Energize and Verifyinterlock OA→SA reference pairs. Members/rows Orderedsteps staged the exact Verifyinterlock occurrence pair; TakeOperational rejected with the expected no-unique-unchanged-anchor message and disabled Apply.

Reviewfinalorder→Setfinalvalue preserved the local self-test and appended Verifyinterlock. One Up placed it between Localself-test and Energize. Validated preview showed0additionalchanges and enabled Apply. One Apply followed by SaveAs .local/native-qa/source6-ordered-scenario-result.arcadia matched the complete original direct-core after oracle with only the format-header token changed5→6. One Undo/Save matched the similarly header-upgraded initial oracle; one Redo/Save restored the complete after oracle. No normalization of identifiers, fields, whitespace or history was performed. All3saves firstattempt; recoveryJSON0; no new stderr.

• Applied/Redo SHA256 C0781CD5E6B990405A6DE3A5325EE438F0BC21376AE7ABDF519CAD7B0D2BDE25.
• Initial/Undo SHA256 F6AF0341433FBE22BDECF32B15567B8568D3F338A38CC00E0A0F008C815EA0E1.

Both picker columns, explicit reference pairs, order rows/UpDown, error and footer actions were usable at1100x700. This extends exact native ordered review to the Scenario owner variant; Branchsteps/Fragmentbranches remain separate pending variants. No new crash/recovery cycle was executed for this variant. Clean AltF4 followed final saved state.