ARCADIA-Studio/harness/allocation-group-app-20260924.md

# Allocation group App and native checkpoint - 2026-09-24

At source `495464e84b5bae8ddad93e9fc69ef353e7f1c884`, Allocation group assignment, explicit Arrange and ordinary performer movement are wired through the desktop input lifecycle and have passed the bounded Windows native workflows below. This supersedes the App/native-pending status of the [assignment](allocation-assignment-planner-20260923.md) and [Arrange](allocation-arrange-planner-20260923.md) planner checkpoints for these exercised workflows. Required behavior remains in the [multiselect contract](multiselect-contract-20260923.md), [Allocation v2](release-activity-allocation-drag-contract-v2-20260911.md) and [Arrange amendment](allocation-arrange-amendment-20260923.md). No user-owned specification or source schema changed.

## Implementation and automated evidence

App admission binds the actual typed press target, exact selection snapshot, accepted Document and gesture lifetime. Unsupported sets refuse as a whole; selecting a nonprimary anchor does not promote it. Assignment, explicit Arrange and ordinary performer movement preserve their distinct policies while sharing owned press/preview/release handling. Bare saved-move paths cannot bypass that ownership. Release recomputes the intended edit and commits through one Document operation; complete equality preserves the existing history branch.

Review found and corrected two consequential gaps: dirty route controls now use the same 8/zoom hit domain as clean controls, and ordinary off-grid performer movement returning exactly to its captured anchor produces zero displacement. Mounted property-Name focus/caret and isolated geometry tests cover the control-ring regression. These do not independently establish a native dirty source-editor or attachment-ring workflow.

The seven final gates all exited zero with unchanged captured inputs and exact source proofs for the named commit (754 paths; map SHA-256 `dba5bc7789a56998fe9b877af26ab8a442b31de55443aaaea23930d58c8610ed`):

| Gate | Command/result |
| --- | --- |
| `app-full-1` | `cargo test -p oa-desktop --bin arcadia-studio --message-format=json -- --test-threads=1`: 1,362 passed, 6 ignored, 0 failed |
| `gui-1` | `cargo build -p oa-desktop --bin arcadia-studio --message-format=json` |
| `native-build-1` | `cargo build -p oa-core --example allocation_multiselect_native --message-format=json` |
| `final-format-1` | `cargo fmt --all -- --check` |
| `app-lint-2` | `cargo clippy -p oa-desktop --all-targets --message-format=json -- -D warnings` |
| `native-evaluator-4` | `cargo test -p oa-core --example allocation_multiselect_native --message-format=json -- --test-threads=1`: 5 passed |
| `native-lint-1` | `cargo clippy -p oa-core --example allocation_multiselect_native --message-format=json -- -D warnings` |

Windows used Rust/Cargo 1.98.1, `stable-x86_64-pc-windows-gnullvm`, LLVM-MinGW 20260826, one build job and incremental compilation disabled. The exact captured environment/tool versions and commands remain in the gate receipts. Some historical receipt HEAD fields predate the tested edits; the separate full input-inventory/Git-blob proofs establish the source identity. Earlier maps are not attributed to the final commit.

## Observed native workflows

Each accepted run opened a fresh generated 16-file source bundle in the built GUI, performed the operation through real controls, saved, and exercised exactly one Undo and one Redo as observed by the owner, Codex-9e8r6t /root. Independent review checked captures, literal source diffs, complete-Project checker reports and byte-history relationships. Additive selection used the observed context-menu Add to selection action.

| Run | Accepted scope | Captures / passing snapshots | Reopen |
| --- | --- | --- | --- |
| 3 | OA X/Y assignment from A/B to C; Y remains primary; truthful 2-of-2 feedback | 15 / 5 | In-process |
| 4 | SA exact work-plus-typed-input-port whole-set refusal, then X/Y assignment to C; Y remains primary | 19 / 6 | Not exercised |
| 5 | OA mixed P/V ordinary refusal, explicit Arrange of P, contained unselected U and V; arm consumed; 2 selected/3 placements | 26 / 6 | In-process |
| 6 | SA mixed P/V refusal and explicit Arrange; V anchor with P primary; arm consumed; 2 selected/3 placements | 21 / 5 | Not exercised |
| 7 | Ordinary OA A/B performer movement from off-grid originals; A anchor, B primary; contained X/Y and route move once | 14 / 4 | Not exercised |

Assignment changes only the respective `oa/participants.arcadia` or `sa/participants.arcadia` and `views/diagram_<layer>_assign.arcadia`: allocation sources A/B -> C, X/Y x80 -> 560 and route pins x340 -> 820. OA/SA Arrange each changes only its corresponding `views/diagram_<layer>_arrange.arcadia`, moving P/U/V and both pins by y+240. Ordinary performers change only `views/diagram_oa_assign.arcadia`, translating A/B/X/Y and both pins by exactly (77,43). Relation identities, metadata, inactive diagrams and every other source byte remain unchanged.

For every accepted run, fixture==baseline==undo, including recorded unchanged refusal snapshots; changed==redo and, where exercised, ==reopened. Whole-directory inventories match, final working bytes match the final history state, and each file retains its exact leading fixture comment including newline. This is bounded comment preservation, not a general claim about arbitrary internal comments or formatting. All seven GUI lifetimes ended with exit 0 and empty pinned app streams.

Totals are **102 captures, 27 snapshots, 26 positive checker reports and 5 successful history reports**. Accepted runs3-7 account for **95 captures and all 26 positive snapshots**; the other seven captures and failed snapshot remain failure/preflight evidence.

Owner observation detail: launch PIDs/window IDs were respectively 3932/786628, 2376/1901592, 6984/11994140, 3648/88540156 and 6380/2818912 for runs 3-7; the actual process main-window handles matched the returned Computer Use targets. Run 3 pressed nonprimary X and moved it +480 world x. Run 4 first added Y's visible input port and observed its Port inspector before the refused X drag; it then selected Y's body and repeated the assignment. Run 5 used the Arrange control and pressed P, with V primary. Run 6 armed with Alt+A and pressed nonprimary V, with P primary. Both Arrange movements were +240 world y. Run 7 pressed A with B primary and ordinary mode unarmed; snapping from A=(43,47) produced the literal (77,43) delta. After each changed save the owner sent one Ctrl+Z, saved, sent one Ctrl+Y, and saved. Runs 3/5 reopened through Home/recent models within the same process; their automatic fit changed framing, so unchanged camera across reopen is not claimed.

## Failures, warnings and limits

Preserved gate predecessors explain the repair sequence: `app-1` failed test compilation; `app-2` passed 130/failed 1 because the zero-delta assignment fixture could hit an overlapping empty performer, repaired with deterministic placement ordering and explicit press/candidate assertions. `native-evaluator-1/2` exposed SA fixture routing `NoClearPath`; fixture geometry was corrected before final evaluator/build acceptance. Historical passes `app-lint-1` and `native-evaluator-3` retain their earlier maps; evaluator 3 is a test harness, not the native checker executable.

Native run 1 is an aborted chooser preflight with original helper bytes retained. A discovered rooted-Windows-path guard defect was corrected before fresh run 2. Run 2 retains its unchanged source and failed baseline checker exit 3221225781; the owner diagnosed missing toolchain DLL search PATH. Neither run earns operation acceptance.

The fixture intentionally retains 18 advisory model warnings: 8 `work_without_behavior_context`, 4 `exchange_without_behavior_context`, 2 `unallocated_leaf` and4 `empty_port_contract`. These describe incomplete behavior/payload coverage and the independent Arrange leaves, remain unchanged through the operations, and are distinct from runtime or routing failures.

No native held-Shift, held-preview, interruption/Escape, out-and-back/no-op or compact-window acceptance is claimed. Run 7's historical `compact-*` labels describe a failed resize attempt; images remain 1442x932. Native readability/feedback observations apply to that normal viewport. Automated off-grid no-op regressions and successful native off-grid movement are different evidence. No SA reopen occurred. Screenshot metadata does not independently bind a window to a PID or count physical Undo/Redo actions; those facts rely on owner observation. No separately saved executed capture script exists; its manifest field remains null rather than reconstructed.

## Evidence, replay and delivery boundary

Portable evidence belongs under [allocation-group-app-evidence-20260924](allocation-group-app-evidence-20260924/): `checks/` preserves 13 gates (four recorded failures, seven final source proofs); `native/` preserves all seven raw run trees, historical helpers, fixtures, captures, logs, snapshots and build provenance; `reviews/` preserves the relevant independent review notes. Each manifest gives exact members and hashes. Archive verifiers inspect bytes/receipts without extracting or executing archived code; they do not replay the GUI or Rust checker. Native build capsules are retained once within that package, with source-commit proofs in sibling checks.

From the delivered repository, using a working Python interpreter:

```powershell
python -B harness/allocation-group-app-evidence-20260924/checks/verify.py
python -B harness/allocation-group-app-evidence-20260924/native/verify.py
```

Both use package-local files and require no original machine paths. The Cargo commands above describe fresh build/test reruns from the named source with a compatible Windows toolchain; a fresh native replay additionally needs the [helper usage notes](allocation-group-app-evidence-20260924/reviews/native-replay.md), DLL PATH and explicit observed gesture workflow. Historical receipts are preserved, not relabeled as new runs. Negative verification rejects missing/corrupt members, swapped source proofs and repinned wrong history modes, intended paths or sentinel inventories.

Archive SHA-256: checks `789a18e1a1f302e89275a69b12efb5218df17e2166a9349709cb3eb36252ceb5`; native `6c4fb3151d46141b56e0e5df24d8ded0c644fa01bf6b2b575952eea55ae3c61e`. The observed GUI SHA-256 is `5775dfd7327c77b936290a3dc4cb0cd827cd3f8d23fc00f337622c56911d1281`; checker is `1b060346b367afd6dd447919fbd3483aad9d5740f3d36c05fbb05266bff0c3e1`. The archives hold build receipts and source, not those executable binaries.

This is a contribution-source milestone. Publishing its report/evidence does not by itself establish remote-default integration, a tested installer/runnable release, Linux acceptance or completion of every multiselect/input requirement. Integration and versioned release claims require their own identified commit, packaged-launch verification and confirmed Gitea publication.