ARCADIA-Studio/harness/STATE.md

First release — current engineering state

Objective and phase

The first-release goal remains active and incomplete. Deliver usable Rust/Iced Operational Analysis and System Analysis/System Architecture, equivalent graphical, textual and REST semantics, artifact traceability, directly editable behavior, offline guidance, and Windows/Linux release evidence. Later Arcadia layers remain future releases. The full authoritative objective was reread on 2026-09-06: attachment10134df9-bea2-4c02-a820-67b53d6b86f7/goal-objective.md. PLAN.md retains the entire release scope; no subsystem acceptance completes it.

Direct state-machine editing is accepted through production316dc55. The main checkout was fast-forwarded to acceptance a8f451e. R6 data/interface contracts are now being implemented in a separate checkout; they are not accepted or released. Meaningful implementation and runtime progress continues; no external blocker exists.

Accepted foundations

• Core typed OA/SA semantics, validated atomic commands and ordinary history are shared by three Rust crates. Typed ports, explicit unresolved migration and original Capella observations: release-port-{contract,core,migration}.md and release-capella-workflow-benchmark.md.
• Explorer/port discovery d364d3c: Add port on participants, grouped roots, focused children, breadcrumbs, contextual paging/search and full-depth outline. Actual Windows creation,251-root/12-level trials,1100x700 and Linux reopen/font fixes: release-explorer-usability.md.
• Routing23535b4, viewport366ce44, labels65fa9ab: authored bends/labels, group movement, fold restoration, Undo/Redo, save/reopen and SVG, including minimum-size native trials. Dense full solve measured119ms; arbitrary crossings remain possible. See release-routing-verification.md and release-routing-linux.md.
• Source4e8575b: nested lexical ownership/includes, provenance-aware token writes, exact accepted source/model history, retained drafts, Save All/recovery and coupled hosted source/model revisions. Windows/Linux native and actual REST restart, stale ETag, comment-only edit and cross-file reparent passed. Full422 Windows / 425 Linux tests at that checkpoint. See release-source-integration.md.
• Direct drawing fef2e0d plus tooltip ad7feb5: OA Interaction, SA Functional and Boundary Exchange by palette click-click or drag; compatible highlights, automatic function ports, four-side draggable anchors, contextual menus and source folders. Independent pointer/tooltip findings fixed and native retested. Windows193 desktop and Linux189+4 focused tests followed earlier full485/488 suites. Scoped native Windows/Linux acceptance: release-port-drawing.md and release-context-menus.md.

Newly accepted state workspace

Production316dc55 includes typed machine views, shared persisted geometry, atomic region/symbol/state creation, group movement, direct transitions and reconnection, Internal rows, Local edges, typed detail forms, folding, placement and navigation. Architecture and Behavior view selections are separate. Drafts survive rejected source/model commits; passive camera events never apply a form.

Independent/native findings fixed: covered GPU shapes, pseudo-label/edge collision, selection-relayout drag displacement, missing typed form access, folded-content access, wrong-view placement Apply, and camera/tool leakage on machine navigation. An actual owner/view change resets gesture state and fits; returning to the same view preserves camera/tool. Exact evidence and limitations: release-state-editing.md.

Verification: full551 Windows /554 Linux workspace tests and strict workspace Clippy at e0b2210. Final316dc55:241 desktop tests, strict all-target desktop Clippy, and desktop builds on each platform; five new navigation tests included. Two guide tests passed after help changes. Source/reST/API state contracts and actual HTTP rejection/revision/source/restart tests passed earlier in the integration.

Root and independent Windows native trials covered1440x900 and1100x700 creation, nested movement, first-drag transition, endpoint/menu reconnect, invalid target, Escape, timed Internal, Local/EntryPoint, placement Apply, Undo/Redo and save/reopen. Linux native covered1440x900 creation, first transition/move, Undo/Redo, fold and saved collapsed reopen. Final316dc55 native on both platforms proved same-view camera/tool preservation and different-machine Fit/Select reset. Logs are empty.

Active R6 implementation and next actions

Checkout D:/CodexBuilds/Capella2-data-integration; branch codex/data-contract-integration, base5ce3eef+plan2bf4c54+navigation9118218. Dedicated target D:/CodexBuilds/Capella2-data-target. Contract freeze is schema/source4 with full data payload and dictionary slices together; existing typed ports remain. See release-data-implementation.md and release-data-contract.md in that checkout.

Core is committed0b58107; source/migration1230ab8. Root API/docs are integrated on the same working tree; desktop remains in flight and R6 is not accepted. Core15 R6 +28workflow tests passed again after final allocation-arrow suppression. Linux0b58107 full core307 tests passed (one explicit probe ignored by default), with strict all-target core Clippy. Earlier13ports/14scenarios and115 source/lib tests also passed. Desktop final257 tests and strict all-target Clippy pass; optimized Windows desktop build b403039 passed. Its SHA256 is recorded in the R6 verification note; native acceptance remains pending.

Root41 server tests passed; a fourth R6 HTTP workflow now also passes, alongside all4 data HTTP tests and strict server Clippy. The original3 actual HTTP workflows for the published data example, protocol/artifact identity, atomic rejected defaults, query/export, reidentify/delete/restart, source3 bundle migration reports and old coupled3 envelope upgrade without write/revision. Tests exposed dropped bundle reports and rejected legitimate old source/model pairs; both root fixes passed retest. Strict reST HTML generation and81 OpenAPI schema definitions passed. Actual frozen server32033FFE imported the published example; its complete Project/StoredProject responses passed served/current JSON Schema validation and obsolete shapes rejected. Evidence: api-r6-contract and r6-server-tests-after.log under the release directory.

Independent core review found association transition closure pulling unrelated types and missing empty-enum warning; both corrected and focused tests passed. Repeated per-ancestor full scans were simplified to one scan per helper call. Explicit optimized inheritance timings250/500/1000: Windows21.070/89.088/391.590ms, Linux22.381/111.662/408.129ms. These single-run empty-chain fixtures measure core validation, not general UI latency. A1000-deep chain remains a pathological cost.

Independent desktop review fixes now pass tests: a focused dictionary with24-row pages replaces unbounded inherited rows; recursive paths support explicit drill-down and imported finite paths; same-phase styles/same-exchange reselection preserve valid drafts. Read-only follow-up found no new path/style defect. Paging resets only on actual layer/document changes; its regression failed before and passes now. Root found another unresolved scale issue: scenario creation still enumerates every carried field into both a dropdown and individual input rows. A bounded focused value editor is now implemented and under automated/independent review; actual native operation remains required before R6 acceptance.

Current ownership: drawing_correctness owns desktop except root-owned guide.rs and the dedicated Windows Cargo target. state_architecture_review independently reviews R6 spec/API consistency; its data_view.rs ownership has ended. data_core runs an isolated R3 typed-baseline experiment; Linux R6 core checkout is idle and verified. Root owns API/OpenAPI/reST, docs, integration and native input. No concurrent writers.

1. State evidence is committed and main fast-forwarded to a8f451e; DATA received the same evidence in c5276b1. Finish native data-authoring acceptance and bounded scenario-value authoring, then full integrated Windows/Linux verification.
2. Finish R6 core/source/desktop, integrate actual REST/schema/reST, independent semantic/correctness/UX review, Windows/Linux checks and real data authoring.
3. Integrate the verified R3 core/source checkpoint from the isolated semantic-review checkout, then complete desktop/server and native/platform acceptance. The closed typed per-facet representation (C) and its immutable-proposal rule are recorded in release-semantic-review-implementation.md; this is not release acceptance.
4. Complete direct scenario/process gestures, persistent coverage/filters, Home/recent/recovery, hosted desktop ETag workflows and offline guidance.
5. Fresh final requirements/domain/correctness/native UX/architecture review; full Windows/Linux/MSRV checks, real runtime, reproducible docs and release packaging.

Environment and native ownership

R3 is authorized in D:/CodexBuilds/Capella2-semantic-review, branch codex/semantic-review, baseab661f2, dedicated target Capella2-semantic-target. Core owns typed facets/catalog/drift/mapped review and atomic preparation; source worker owns schema/source5 compatibility and language integration. Both preserve data4 and the existing Command boundary. The 11-case C proof and independent critic justified direct typed facts instead of carrier masks/order shadows; more adapter code is accepted for fewer persisted invariants. This is an active implementation checkpoint, not R3 acceptance. Root owns concurrent R6 native work.

R3 core/source frozen checkpoint (2026-09-06)

The isolated semantic-review tree now contains the complete 84-scalar/13-family catalog, keyed member/order/annotation/binding/child/incident/artifact facts, bounded linked-definition drift, typed historical reference/remap/admission, and bidirectional mapped review through one ordinary prepared Command batch. Source and strict schema1–4→5 compatibility are committed in ab960cb; this core checkpoint adds the closed review implementation. Desktop/API integration and Windows/Linux native/platform acceptance remain root-owned work. No native input was used here.

Every source derives proposals from one immutable initial project. Reset old selectors before scope derivation, compare the union of selected canonical target slots (including constructor removals), materialize once, then audit every desired value before and after command preparation. Same-target constructor reconciliation preserves target-only members; induced cleanup needs exact explicit review and cannot override an independently selected Keep/Take. Historical facts may outlive former record families/deleted UUIDs; new resolutions still require current family and leaf applicability. DECISIONS records why these are distinct admission rules.

Independent review's original five findings and four residuals are covered by these passing cases in crates/oa-core/tests/r3_semantic.rs:

Finding	Closure regression
Repeated unequal constructor Keep hides bound drift	repeated_keep_of_unequal_constructor_pair_cannot_swallow_bound_drift
StateKind change fails legacy mapping preflight	changed_state_kind_remains_reviewable_in_both_directions
Artifact metadata writes collide through different owner traces	artifact_metadata_is_attached_and_cannot_last_write_through_two_owner_traces
Constructor retirement overrides another source's Keep	constructor_retirement_cannot_override_other_sources_kept_bound_in_either_order
Partial review falsely rolls up as unchanged	semantic_rollup_does_not_claim_unchanged_when_only_unit_is_reviewed
Another source's introduced member escapes constructor removal agreement	constructor_union_conflicts_with_another_sources_new_member_in_either_order
Source constructor history causes target-only member loss	same_target_constructor_preserves_local_members_and_reset_precedes_expansion
Reset old mapping selector reappears during group expansion	same_target_constructor_preserves_local_members_and_reset_precedes_expansion
Artifact Owner cannot explicitly move the attached link	artifact_owner_candidate_moves_link_and_conflicts_with_kept_attachment

The additional combined_ordered_membership_commutes_or_requires_agreed_anchors case verifies both request orders: independent removals preserve the local member; contradictory inferred insertion anchors reject. Coverage includes atomic rollback, one undo/redo, stale plans, no-op replanning, explicit cleanup acknowledgement, partial Keep/Take, qualified rows, mapping resets and historical deleted refs.

Final bounded follow-up extends those same Owner/reset findings: target_only_artifact_move_records_owner_and_metadata_in_either_order covers an unpaired target link, Owner alone and Owner+Name in either order, actual resulting typed owner history, and rejected future metadata review through the former owner. retired_source_branch_retains_historical_member_pair_in_both_directions preserves the established pair after a branch disappears instead of adding a colliding one-sided projection. The opposite appearance case still needs an explicit reset. The independent read-only re-review found no remaining concrete defect within the nine findings and these two subsets, including the immutable proposal/union/audit structure. That is scoped core review closure, not UI/API/spec release acceptance.

Final Windows core evidence in D:/CodexBuilds/Capella2-semantic-review:

cargo test --package oa-core --all-targets --locked --offline --config target/semantic/cargo.toml --target-dir D:/CodexBuilds/Capella2-semantic-target --no-fail-fast
cargo clippy --package oa-core --all-targets --locked --offline --config target/semantic/cargo.toml --target-dir D:/CodexBuilds/Capella2-semantic-target -- -D warnings

Both exit0: 345 passed, 0 failed, 1 intentionally ignored inheritance scaling probe across 33 test executables; strict all-target Clippy has no warnings. Logs: target/semantic/core-final-all-tests.log and core-final-clippy.log. Focused immutable-proposals-artifact-focus.log contains 28 semantic and 7 source tests; the source suite includes real prepared writeback and included-file save/reopen. The catalog coverage unit checks every current model payload field's closed capture and write scope. These logs use the distinct semantic-target and vendored config.

Native input remains paused following the user's physical stop. Root must handle resumed native authorization and integrated acceptance; the broader goal is active.

Native input is paused after physical Escape; no R6 native trial has run. Root exclusively owns native input. Latest saved Windows trial is window1706782, ui-state-navigation-windows,49objects/28links/1 expected missing-owner warning. Linux navigation trial3148598 closed normally, exec46107 exit0; baseline Linux trial721472 also closed normally, exec72680 exit0. Independent Windows3672536 is saved at1100x700. Older root drawing windows are saved. Re-inventory before input. Protected user7210312/6228978 were absent; do not reset/save/close if they return.

Evidence: D:/CodexBuilds/Capella2-release1-01a06e2e. State source checkout/target: D:/CodexBuilds/Capella2-state-integration and -target. Linux source/target: D:/CodexBuilds/Capella2-state-linux-review and -target. Use distinct Cargo targets per checkout; shared-cache results were previously caught and excluded.

Windows: cargo test --locked --workspace; cargo clippy --locked --workspace --all-targets -- -D warnings; cargo build --locked -p oa-desktop -p oa-server. WSL Ubuntu24.04 uses target/linux-cargo.toml and Mesa software Vulkan for native WSLg. No remote push or usage reset authorized. No broad recursive target deletion.