ARCADIA-Studio/harness/experiments/native-child-continuation-865483b-20260911/native-open-pending-diagnostic.md

Old packaged 865 Open operation: recovered cancellation

Scope: read-only review of main-checkout App and cached rfd 0.15.4 Windows sources, for packaged GUI SHA-256 BF9C2E618D4A4AC55E6A7EBB3738736659FC35A6465522C7B5AB975238938808 / source 865483b4c6. No UI, compiler, process inspection, source changes, or Linux work performed by this reviewer.

Observed outcome (root-transcribed native evidence)

After Open53 activation, main window 5702564 became visible but Working… persisted. Cached Open394304 accessibility/screenshot disagreed with its sometimes 16x16 current bounds; failed cache-property access and rejected coordinates are automation observations, not application completion. No SA path was entered. Root subsequently freshly observed Open394304 and sent keyboard Escape: the picker disappeared from list_windows and the main footer explicitly became Open cancelled. This is a recovered pending native Open, not an established application deadlock. Reopen remains unproven; unchanged OA grandchild source bytes alone cannot establish a load.

Code evidence and interpretation

• crates/oa-desktop/src/app.rs:3495,3509,3533-3552: Windows Open sets busy before awaiting rfd::AsyncFileDialog::pick_file(). Only a returned file starts spawn_blocking(read_snapshot); no file produces Ok(None). There is no task timeout or application cancellation handle here.
• app.rs:3127-3155: every delivered Loaded result first clears busy; None sets Open cancelled, a source snapshot calls open_source_project, errors show their message. Root's observed cancellation therefore proves the dialog future and Loaded receipt path completed for this attempt. It provides no evidence that read_snapshot ran. At most, before this receipt the pending seam could have been native Show/result return, async handoff, or subsequent file loading; current cancellation evidence points to the still-pending picker rather than a completed file load.
• app.rs:1181-1200: while busy, Save, new Open, Escape and Pending::Close are rejected; Loaded/Saved/SavePath receipts are admitted. Thus ignored Ctrl+S/Open and Alt+F4 were expected, not independent deadlock evidence. main.rs:54 disables automatic close; app.rs:1034 routes window close through that gate. Escape must target the actual native picker, not the app. views.rs:264-265 explicitly masks status with Working… while busy; the saved-state indicator is not a task-completion indicator.
• Cached rfd path: .local/toolchain/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rfd-0.15.4/src/backend/win_cid/. file_dialog.rs:46-49 constructs the single-return future; file_dialog/dialog_future.rs:11-26 runs COM initialization, blocking dialog.show, result extraction, then publishes Some(path) or None on error. thread_future.rs:25-34,46-66 uses a worker thread, shared result and waker. file_dialog/dialog_ffi.rs:115-117 calls native IFileDialog::Show; utils.rs:21-36 initializes an STA. App does not set_parent, so Show receives no owner HWND. Main-window exposure does not establish Show returned; native ownership/focus and stale automation state are plausible explanations, not proven causes of the capture failures. Native cancellation and backend errors both collapse to None, so Open cancelled alone does not distinguish every native HRESULT; the root's deliberate Escape supplies the cancellation context.
• app.rs:4294 reads/loads only after a selected path; app.rs:3640-3685 distinguishes a valid Source project opened result from a repair workspace that retains the previous graphical model. These states must not be conflated in acceptance.

Concrete next native evaluation (root-owned)

1. Keep the original OA first/sibling/grandchild carriers and saved grandchild-redo files unchanged. No kill/relaunch is needed after the successful cancellation.
2. Open a fresh picker, acquire its current identity/bounds, focus the observed file-name input and enter the exact intended entry path. Use keyboard activation in that fresh native dialog; do not reuse cached Open53 coordinates or the former 16x16 handle. If observation fails again, stop input and record the incomplete attempt; cancel only a freshly identified picker.
3. Require the picker to disappear and a non-Working footer with Source project opened. Included files and comments are preserved.. Inspect the expected OA project/diagram and 7 objects / 6 relations, transferred responsibilities and geometry. An error, Open cancelled, repair workspace, or unchanged disk alone does not pass reopening.
4. Save the successfully reopened OA source, wait for the save completion status, and run the existing child-work native contract compare ENTRY ORIGINAL_GRANDCHILD_CHECKPOINT plus the complete physical-directory hash comparison already used by root. This checks the loaded model/source through a real subsequent save; retain the original stage identity carriers. Record screenshots and checker exits separately. Only then move to untouched SA work. A canceled OA picker is not an SA attempt.

Limits: no new runtime instrumentation or native observation by this reviewer; root supplied the Escape outcome. No assertion about the exact Windows dialog internals, capture-timeout cause, or a new-source a57 fix. A separate early model_menu gate (app.rs:1138-1155) does not admit Loaded, but normal busy gating prevents opening that menu during this operation and no such menu was reported; it is not an evidenced cause here.