Bounded native verification plan for #46

Prepared by /root/ux_critique against private code commit 0e83157e09d52e6152df91208e41693b62da2d46. Read its app.rs presentation-only diff, app/save_as_tests.rs regressions, harness/save-as-diagnostics-20261001.md, the source integration contract and UI review criteria. This is a plan, not executed native evidence. No GUI input, launch, compilation, source edit or fixture creation was performed during preparation. #38 retains exclusive GUI ownership until the parent releases it.

Intended distinction

The same-root/new-entry case must still refuse existing included files. Only its diagnosis and recovery guidance change. Established observed-file conflicts must continue to say files changed outside Arcadia Studio. The native check must verify these two messages using real filesystem conditions, then exercise legitimate recovery without bypassing either guard.

Parent preparation and coordination

Supply exact source commit, executable/DLL hashes, prepared paths and readiness after the frozen build. Parent launches with watcher; reviewer discovers the unique returned native window. Preserve stdout/stderr/exit separately.
Prepare two complete, separate copies of the water-pressure multi-file example: collision/recovery copy A, and external-change copy B. Record full relative-path inventories and SHA-256 baselines. Originals and packaged examples remain read-only.
Reserve a non-existing entry beside A's current project.arcadia for the collision attempt, e.g. collision-copy.arcadia. Record that it is absent. Do not create it.
Prepare fresh destination C with zero .arcadia source files. If reopen completeness is desired, copy only the tutorial/evidence companion files first and distinguish these parent copies from files written by the app. Use a new entry path in C for successful Save As.
For B's later genuine external change, identify the existing dependency oa/activities/activity_oa_restore_work.arcadia. Preserve its exact bytes. After the reviewer confirms B is loaded, parent appends one valid source comment (for example // native #46 external-edit probe) without changing semantic facts, records its resulting hash, then tells reviewer the edit is complete. Do not edit while a Save is running. Restore exact original bytes only when the reviewer requests recovery.
Reviewer writes screenshots and a report under the parent-selected evidence directory; parent owns independent full-file comparisons. No whole-model equality or exit-code claim comes from UI counts alone.

Minimal actual UI sequence

1. Same-folder/new-entry collision and dirty-state preservation

Pointer Open A's exact project.arcadia. Verify OA Allocation, original Assess activity, saved state, 94 objects and 62 links. Record actual model-check count rather than using it as a model-equality oracle.
Select Assess pressure alarm; change only Name to the predeclared Assess pressure alarm QA46 and click Apply. This one semantic edit is justified because a clean model cannot show dirty-state recovery. Do not create raw-source drafts or any other authored change.
At normal size, Save As to the reserved new entry in A's same directory. Expect refusal, retained QA46 name/selection, unsaved state and original active entry. Capture the diagnostic and full tooltip/detail if the status is shortened.
Inspect the retained diagnostic at the minimum 1100x700 client size. The visible summary must identify an existing protected destination, without falsely alleging an external edit; the full message must expose the conflicting include and the actionable alternatives. Do not dismiss the error by triggering an unrelated command before this inspection. If resizing clears the status or makes it unreadable, record that observed limitation.

User-visible oracle: Source destination files already exist: ... Existing files are protected. with Choose a fresh directory for Save As, or use Save All to update the open project's current entry. It must not say changed outside. A visible failure and reachable recovery detail are required, not merely the presence of a string in source code.

Parent disk oracle before recovery: all A source and companion files remain baseline-identical; the requested new entry remains absent. Reviewer pauses Save actions until parent confirms this checkpoint. Never overwrite the protected destination to obtain a passing result.

2. Legitimate Save All recovery and fresh-folder Save As

Click Save all in the still-open A document. Expect All source files saved, saved state, and exact QA46 name. This establishes recovery followed the suggested current-entry route; the parent should verify A's existing entry remains the active destination through its file observations.
Parent verifies all files equal the baseline plus exactly the one declared Activity name literal. No additional rename is needed. Native Undo/Redo is already independently covered in the #39 package run; #46's automated tests cover history preservation, so do not repeat it unless the parent wants that additional gate or native state appears inconsistent.
Save As to C's exact fresh path. Expect saved state, exact QA46 name, and success feedback. Capture the result. Parent compares every emitted source byte and companion file to the explicit expected bundle; the entry relocation and single name change are the only permitted differences.

Failure stop: if legitimate Save All or fresh Save As fails, preserve the exact state/error and stop dependent mutation/reopen actions. Do not force a save, restore files speculatively or silently reinterpret the intended outcome.

3. Genuine external edit stays a different diagnostic

Pointer Open pristine copy B. No graphical or source edit is necessary here. Confirm loaded/saved state, then pause input and tell parent it is safe to append the predeclared valid comment to the observed dependency.
After parent's edit receipt, click Save all. Even an unchanged model must check all observed dependency baselines, as the integration contract requires. Expect external-change refusal naming that dependency. Capture visible status and complete detail at minimum size.
Parent verifies the external comment remains untouched, the entry and every other file remain identical, and no save output overwrote external work. The UI's accepted model and dirty state should remain as they were before Save (clean in this phase); no claim of unsaved model changes is required merely because disk diverged.
If Save All does not actually perform checks for a clean document, stop and report that observation. Do not add a second rename to make the experiment pass. Parent can then choose a separately declared dirty-state trial if needed.
Parent restores exactly the observed original dependency bytes, confirms restoration, then reviewer clicks Save all again. Expect success, saved state and unchanged original activity name. Close normally with Alt+F4 after the parent confirms no further native checkpoint is needed.

User-visible oracle: Source files changed outside Arcadia Studio: ... naming the edited dependency. It must not use destination files already exist, Existing files are protected, or recommend a fresh directory as if this were the new-destination collision. Both refused writes and the recovery must retain their genuine outcomes in the report.

Evidence and limits

Capture the collision message at normal/minimum size, its full detail, saved current-entry recovery, successful fresh Save As, genuine external-change refusal/detail, and recovered existing Save. Include exact paths chosen in native dialogs and the declared rename. Keep observations, parent hash receipts and automated-test evidence separately attributed. Existing error footers can truncate long paths; inspect their actual disclosure rather than assuming that source text is readable at minimum size.

No additional fixture mutation or code change is necessary for this plan. Pending logistical inputs are the parent's exact A/B/C paths, build/DLL pins, output directory and exclusive-GUI-ready signal. No user decision is needed.

8.1 KiB Raw Blame History