ARCADIA-Studio/harness/navigation-validation-20261002.md

Navigation validation checkpoint — 2026-10-02

Source checkpoint: 6018ae30b9296b9f6b37d7fc038175080d15fafb, Follow accepted placement relocation without losing inspection context. The production checkout was clean when the final gates and native build launched; subsequent changes add only documentation and evidence. The completed Windows workspace, strict Clippy and binary-build receipts support this bounded navigation contribution. This is not acceptance of the complete project, a combined Save/Help build, or a new release.

This record supports #41, #42 and #43. Their live status and integration ownership remain in Gitea. Required behavior and scope are defined in projection/navigation and the draft/Draw/relocation contract; historical “pending” statements there describe their earlier checkpoints. This record supplies later results without rewriting those original outcomes.

Source and behavior boundary

Source	Attribution
715036e132677dd2bc2fb37ed316d93dc9987aec	Shared base of navigation and the delivered Save/Help contribution.
6520a89dc042dd433454f6cc63cb23b0e6df7911	Reviewed peer projection/navigation/icon contribution, including its test-setup correction. Independent review subsequently found F1/F2.
c7065db76ecca3faa733ccb5f09b87fd0a0958be	Corrects ordinary property-Apply canvas retention (F1), contextual Draw admission (F2), and stale-click feedback. Its later full workspace run failed an existing placement-relocation regression.
6018ae30b9296b9f6b37d7fc038175080d15fafb	Corrects explicit placement relocation without undoing ordinary inspection retention. Final source for the completed gates below.

Ordinary string projections filter the authored diagram without deleting latent opposite-layer placements, routes or visibility choices. Ordinary views render their declared layer; returning to Traceability restores eligible content. Missing/wrong references and typed StateMachine/Scenario membership remain invalid. Frozen source/JSON versions 1–6 retain their historical admission rules before migration. No new version-7 field/wire shape was introduced; older version-7 readers may reject newly admitted latent records.

F1 distinguishes inspection from navigation. Visible canvas selection, Properties and ordinary accepted property edits retain the saved Architecture surface. Invalid drafts remain recoverable and uncommitted. A click made stale by the accepted edit is refused with reselect feedback. Explicit semantic navigation, accepted active-diagram identity/layer edits, and actual placement Diagram changes retain their deliberate destination behavior.

Relocation is determined from actual pre-edit and accepted post-edit placement owners. A different owner follows the accepted destination, including same-layer moves or a simultaneous placement UUID change. A same-owner placement edit retains the current canvas even when it differs from the placement owner. No extra semantic transaction or broad identity-repair policy was added.

F2 admits contextual Draw according to the visible semantic source and current saved view, including OA-in-SA and SA-in-OA Traceability. Menu enabledness and Begin share admission; dirty drafts, stale menus/contexts, hidden targets and semantic validators remain effective. The perspective palette retains its own tool family. Architecture-page Model explorer sidebar Draw is supported; the dedicated Model explorer page does not offer it. Palette glyphs distinguish tool families, but native activation is not proof of universal symbol recognition.

Completed Windows gates

Evidence locations below are logical original paths relative to .local/. The packet mapping described later preserves those paths; they are not assumed to be physical directories in the packet.

Logical evidence	Tested inputs and recorded result
navigation-gates/test-baseline/ and test-baseline-refusals/	At peer source plus explicit test additions: five draft failures and four real-menu Draw failures; reordered old-hit assertions established two behavioral selection failures before feedback checks. The populated projection test first failed compilation for a missing ViewIndex import, then passed after that test-only correction.
navigation-gates/repaired-targets/	Frozen dirty inputs on peer HEAD, later committed as c706: formatting, 20 canvas-selection and five contextual-Draw tests passed. Independent review checked all 554 archived source inputs.
navigation-gates/repaired-workspace/	c706: workspace exit 101; desktop 1552 passed, one failed, seven ignored. The original cross-layer placement-relocation assertion failed. Server/doctests/Clippy were not reached; this remains a failed stopped prefix.
navigation-gates/relocation-test-baseline/	c706 plus new tests: two controls passed, three relocation cases failed. Failing loops stopped at their first failing combination, not every later combination.
navigation-gates/relocation-repaired-targets/	Frozen correction on c706 HEAD, later committed as 6018: formatting, all five relocation tests, 20 canvas-selection tests and five contextual-Draw tests passed; all 555 input files unchanged.
navigation-gates/relocation-workspace/	Clean 6018: formatting exit 0; complete workspace exit 0, 2236 passed / 0 failed / 8 ignored across 67 summaries; strict all-target workspace Clippy exit 0. Desktop: 1557/0/7; server unit group: 56/0/0. Final closure and unchanged inputs recorded.
navigation-gates/relocation-native-build/	Clean 6018: cargo build --workspace --bins --locked exit 0; final closure and unchanged inputs recorded.

The latest workspace result SHA-256 is 625dde2d94c593d7b6d338469ae8866d2e4c42a5c502329744cdc607f3bc7c3a; binary-build result is 337a5821e61db167e411c4d997f2a1f5ab5fe3042123a9b387b801cc3fed8e88. Aggregate counts are sums of Cargo result groups, not unique user workflows. Eight ignored tests remain ignored.

The populated core test exercises both OA/SA ordinary projections with authored routes, port anchors, nesting/collapse, selectors and traces, complete Project/source/JSON round trips and one-step history. Desktop relocation tests compare independently expected complete Projects and explicit core-command source bundles, including same-layer destinations, UUID changes, invalid destinations and queued old hits. Those automated cases complement, rather than replace, native interaction.

The original navigation-gates/attempt01/ on 6520 records four successful commands but lacks the later runner's top-level final timestamp and input ZIP. Preserve its explicit historical gap; no archive was reconstructed. Earlier peer failed/interrupted runs remain scoped in the linked projection note.

Reproduce the recorded build and focused checks

Recorded environment: Windows x86-64, Rust 1.98.1 stable-x86_64-pc-windows-gnullvm, LLVM-MinGW 20260826 UCRT, clang.exe linker, jobs=1 and incremental=0. The runner used the existing toolchain environment below and shared C:/Users/User/Documents/Git/ARCADIA-Studio/.local/target-gnullvm. Reproduction elsewhere requires the same installed toolchain/runtime and dependency lock; the evidence packet does not install them.

From the source checkout, after selecting the identified revision and checking local changes:

. 'C:/Users/User/Documents/Git/ARCADIA-Studio/.local/toolchain/env.ps1'
$env:CARGO_BUILD_JOBS = '1'
cargo fmt --all --check
cargo test --workspace --locked -- --test-threads=1
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo build --workspace --bins --locked

Run each command separately and retain its exit status and streams; later successes must not conceal an earlier failure. The environment script sets CARGO_INCREMENTAL=0, CARGO_TARGET_DIR, the gnullvm toolchain and linker. Targeted reproductions used:

cargo test -p oa-core --locked --test populated_projection_switching -- --test-threads=1
cargo test -p oa-desktop --locked canvas_selection_tests -- --test-threads=1
cargo test -p oa-desktop --locked connection_begin_regressions -- --test-threads=1
cargo test -p oa-desktop --locked placement_relocation -- --test-threads=1

Exact plans, source manifests/patches, input ZIPs, timing and streams are retained with each gate. Test-only baseline inputs are deliberately different from the repaired inputs; do not run the old failure plan against a newer source and describe it as the original reproduction.

Native observations and saved-state evidence

All seven native cases have closed process records, exit 0, empty actual stdout/stderr, and unchanged copied binaries/original fixtures. Each used its own copied executable, profile and recorded system-only PATH with libunwind.dll beside the executable. Concurrent compiler work means these are not responsiveness benchmarks.

Case under navigation-native/	Exact executable scope and supported observation
baseline01	Delivered Release9 desktop source 0e83157e09d52e6152df91208e41693b62da2d46: reproduces prior selection/projection problems with the synthetic eight-card fixture. No Save or full accepted-state export; not candidate acceptance.
peer01	6520: clean opposite-layer inspection retains the view, but a valid Name Apply switches to OA/preferred view. The original failure, undo observation and unchanged imported file are preserved.
fixed01, fixed01-reopen	c706: real OA relation inspection/Properties, explicit and click-away Name Apply, projection switch, saved Undo/Redo, fresh reopen/reverse projection, and deliberate Open source endpoint navigation. Full saved Project/source expectations pass.
draw01	c706: opposite-layer contextual SA exchange and OA Interaction creation on retained canvases; incompatible endpoint refusal, restart/Escape/cancel, sidebar/palette activation and disabled feedback. Exact saved cancellation/history and independent complete typed creation deltas pass.
relocation01	6018: OA placement Diagram plus explicitly chosen UUID change follows the empty SA Traceability destination; saved relocation delta and Undo/Redo pass.
relocation01-reopen	Fresh 6018 process: relocated membership persists; subsequently opens Draw result, inspects its OA Interaction from the SA view and clean-Applies with “Nothing to undo”; saved comparisons are exact.

The eight-card fixture is a documented synthetic approximation, not recovered user source: 94 elements, 62 relations, 68 traces, six diagrams; its mixed view has eight placements and no authored routes. The separate populated core test supplies authored-route coverage. Draw begins with four work elements/two views; SA creation adds one exchange/two precisely derived ports, and OA creation adds one Interaction. The relocation fixture preserves that full final Project and adds one independently derived empty SA Traceability diagram. Existing populated destinations remain duplicate-placement-invalid.

For fixed01, complete admitted baseline/inspection/Undo equality covers 31 raw source files. The Name evaluator allows only its nominated relation name and unique exact declaration-header replacement; implicit Apply uses the parameterized helper. Projection comparison permits only diagram 00000000-0038-4000-8000-000000000001 changing Traceability to Allocation and its compiler-indexed source token; every other Project field and source prefix/suffix is exact. Fresh reopen equals switched state, and reversing projection equals the original baseline.

For Draw, independent expectations construct every relation and port field: exact endpoints, owners, names/aliases, empty carried items/contracts, legacy null, UUIDv4 relation and UUIDv5 generated ports. Full pre-existing Project equality is required. Cancellation and each saved Undo/Redo use separate exact Rust comparisons across seven source files. Forward creation source changes are an inventory, not an independently specified insertion-byte oracle.

For relocation, the predeclared move is placement 371bfc51-edcc-5770-aad1-11b84772d2c8 from OA owner a60ffb09-36c2-5abc-bec5-6eab563c8cb8 to empty SA owner 59eb4f9d-e6d5-570b-903d-b1b0a7fdcb4d, with explicit new placement UUID 5a8083e2-55ea-5fa3-94b4-3e5aafc1922f. Semantic OA Activity, alias, position (60,60), size (224,94), collapse and all other records remain exact. The independent reviewer reconstructed the entire fixture and after Project. Prepared→Undo, applied→Redo, applied→fresh reopen, Draw-final→corrected reopen, and Draw-final→clean inspection all have separate exact Project/raw-source pass receipts. Forward relocation inventories one changed source file; it does not prove exact intended edit bytes.

Native GUI SHA-256: c706 a9d8b2fe2eecb66e17cd16ab2efe6c270e70588d0282fe2ac5d30e50f827b8d8; 6018 f86b29555d1e512538ff3f7ee75619b0286add5aa2d60cdc724e8c27cc931165. DLL: f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4. Full process/capture identities are in each case's started/finished/observations and original JPEG/state manifests.

Evaluator independence, preserved failures and limitations

The isolated Rust oracle recompiles all reachable saved sources, binds the embedded complete Project and diagnostics to compilation, and compares full model plus exact raw path/byte sets, with only an explicit nominated projection exception when requested. Runtime executable SHA-256 is bd2db2e177d9d21f44b45e5efa89071e00155d31509672bf5aea6a57915e09a6; build receipt SHA-256 is 1ed50fe9c42ff4a67084ed70ce934404f5549ca68bc54e6d2f1436e66ea8d22f. Its historical reviewed_core=6520… is a source-review pin, not the GUI build identity. The oracle was built at c706 with the exact recorded inputs.

Oracle attempt01 failed compilation (E0382) before tests. Attempt02 passed three tests and built successfully. A standalone launch then failed 0xC0000135; the same executable succeeded with the pinned adjacent DLL and system-only PATH. An intermediate recorder SystemRoot key-case error occurred before launch. The initial name helper's global-literal uniqueness assumption also failed before a result; the corrected header-specific manual helper and later parameterized implicit helper remain separately attributed. None of these failures is erased or counted as acceptance.

Independent source reviews challenged production and evaluator expectations; independent native reviews inspected original screenshots and performed read-only model/hash calculations. They did not rerun those GUI trials. Python delta helpers independently construct bounded expected Projects but share the admitted data and source contracts; they are not independent compilers. Historical snapshot-command receipts lack snapshot-payload hashes. Later reports/packet pins bind current bytes, not an invented historical signature. Saved-state equality does not inspect arbitrary unsaved RAM or prove every underlying history step.

The relocation UUID input initially became blank and required a documented retry. Undo left the destination view active but empty; Redo restored the card without selecting it. Fresh launch initially showed the OA view, followed by explicit destination selection. Do not claim camera/selection/view restoration beyond those observations. Optional reidentity is covered only for this known reference-free placement; general reference-bearing reidentity can require additional updates.

Same-layer relocation, queued stale hits and invalid relocation destinations have automated coverage; they were not separately exercised natively. The new empty destination name was shortened in the chooser, and invalid populated destinations were not shown to be prefiltered. Draw completion was not repeated on 6018; c706 evidence retains its original source, while corrected source tests and clean Draw reopen/inspection provide separate coverage.

Relation text remains ellipsized. Earlier clipping at 113% improved after Fit, but full-name readability did not. Expanded tools reduced canvas width and could clip cards until refit. UIA exposes little Iced control semantics; pointer/feedback and Escape/Undo/Redo were exercised, not complete keyboard/screen-reader accessibility. Crowded mixed-diagram reading, general layout quality, native Allocation/Boundary/Communication completion, and opposite-layer performer Add activity/function availability remain outside this acceptance. Typed Behavior views were not broadened.

Key independent logical review paths: applied-navigation-repair-review.md, placement-relocation-applied-review.md, navigation-oracle-review.md, native-name-evaluator-review.md, native-draw-evaluator-review.md, native-relocation-evaluator-review.md, navigation-native-subset-review.md, navigation-relocation-native-review.md and navigation-evidence-candidate-review.md. Each report's own source/time scope remains authoritative.

Evidence packet and portable verification

Published-source packet: harness/experiments/navigation-validation-20261002/. Actual helper schema is navigation-evidence-v2, superseding the original plan's v1 proposal. manifest.json entries map each logical original .local path (path) to exact size, sha256 and category; payload lives at objects/<sha256>. config.json retains original_source_local and the frozen whitelist. For example, logical navigation-gates/relocation-workspace/result.json maps to that exact receipt object, not a rewritten summary. Read original argv paths as historical metadata; do not execute them to reconstruct files.

The reviewed transport helper checks complete recorded gate plans/closure, source ZIP inventories, native closure and oracle runtime associations, exact frozen coverage, deduplicated bytes and its own pinned object. It never extracts source ZIPs or interprets adversarial QA paths as output destinations. The external manifest hash remains the authenticity boundary. This establishes transport integrity and closed-record consistency, not source correctness, source-to-binary reproducibility or product usability.

Recorded selftest: 52 cases passed; filesystem symlink/reparse creation was skipped with OSError, not passed. Result SHA-256 4ef9a80a3de9bc60e21804f2d2ed51d77a78474c5e23f855b06ea5ce25e7cebb. Candidate review found no remaining source blocker for the bounded freeze/build gate; actual root execution and the frozen-content review are recorded separately below.

Frozen config attempt02 has 934 logical files, SHA-256 1a19ffae0576ca245c889f3af9417fc1842269efcd4123d6e894ca5ccec99d03. It retains the entire selftest tree and the separately recorded execution result. The two literal QA includes preserve all existing requirements; the previous template and first freeze remain in the packet revisions. The historical candidate/handoff prose remains attributed to its unexecuted proposal stage.

The root independently reviewed the frozen contents and an independent critic verified all 934 original files and all nine source ZIP inventories. The create-new packet build and subsequent standalone offline verification both exited 0: 934 logical files, 625 deduplicated payloads, manifest SHA-256 3b6c8365121c86a61f02bf398c17a3f297aefd01466ac255ce75cb06ca222d5c. The packet contains 47,932,120 payload bytes. Actual transport execution record preserves the distinct scope and pins. Source ZIPs, failed historical trials, original reviews and every retained selftest control remain accessible through the manifest. The root additionally verified every physical packet and supplemental raw-review file against its actual Git-staged blob: 631 files matched byte for byte. Publication is the following delivery gate; no publication or combined-release result is inferred.

Portable offline verification with Python 3.11+ from the repository root is:

python harness/experiments/navigation-validation-20261002/navigation-evidence.py verify harness/experiments/navigation-validation-20261002

On the recorded Windows host, substitute the explicit bundled executable C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe for python because bare Python is not on PATH. Verification needs no Cargo, GUI, original absolute workspace or binary runtime. Require exit 0 and the returned manifest SHA-256 to match the externally retained value; an internal verifier plus replaced manifest is not sufficient authenticity.

Integration and delivery handoff

The next boundary is #48: integrate the accepted navigation source with delivered Save/Help, review the actual union and execute combined gates before a fresh coordinated release. navigation-save-union-review.md is prospective, not a performed merge. It identifies bc69c6d449641fc4395feae0d8373f62257c763c as the reviewed delivered documentation tip, distinct from Release9 desktop source 0e83157e09d52e6152df91208e41693b62da2d46, packaged documentation ef28f1784efe6717b0ca72c0eb3c97bc30ebfe47, release evidence target e144e32e9984477a258759a9dcc75f6e499fc224, and the old 715 server donor. Recheck current shared instructions and integration ownership before applying that plan.

Preserve Help's first-input-owner barrier and mounted draft/focus behavior; test Help around dirty opposite-layer Apply, Draw/restart/cancel and queued events. Preserve Save All versus Save As destination diagnostics, collision/external-change controls, existing source comments/includes and history. Retain both sides' regression modules and the precise Architecture-sidebar wording. Build desktop and server from the identified union; do not reuse Release9's old server for newly changed core admission. Then run combined workspace/strict checks, focused Windows native Save/reopen/Help/navigation cases, package/import/notice verification and fresh extracted-runtime checks under one release owner. Existing published artifacts remain immutable.

This source checkpoint and its bounded Windows evidence are useful milestones, not completion of PROJECT_GOAL.md. Linux remains explicitly paused by the user. Diagram readability/layout/accessibility and the broader product objective remain open; no issue closure, combined release or whole-goal completion is inferred from this document.