ARCADIA-Studio/harness/reviews/prerelease37-native-gui-20260924.md

Native GUI evidence admission review — 2026-09-24

No new material admission finding. The published evidence supports the bounded Windows packaged workflows and saved-state claims, with the observational limits below. This is an independent read-only evidence review, not a new native execution or full application acceptance.

Identity and method

Read README, independent-review and manifest through Gitea MCP at 8a82c0da1fd7130807878cc74598545ef38b5904:harness/prerelease37-windows-gates-20260924/native-gui. Downloaded only its capped manifest/archive. Manifest SHA256 acc5a1f1add9bc8be0711372224d8941ac14dfdc6018f7f6cc38b5bb798cc0b1; archive 10,357,627 bytes, SHA256 f18c21d262ca78bc9c2d8a339c3389fa31c50a81187cc53cc472f3253cda2815. Independently checked all 351 unique exact members, lengths, SHA256 and CRC against manifest. Original stage manifest SHA256 c90371bee1c2b2ae850b5d8e64ab9f1368f541ef51104e3b888a721e05d49c13 matches.

Reproducible local data inspector: inspect_native_gui.py, output native-gui-inspection.log, adjacent to this report. Run using Python with assertions enabled (python -B inspect_native_gui.py). It reads ZIP/JSON/Git blobs, extracts only explicitly allowed evidence text/data/images into native-gui-inspection, and never imports or executes archived recipes or binaries. No candidate edits, Cargo, product launches or remote writes were performed. The first extraction refused JPEG files absent from the local inspector allowlist; adding JPEG as evidence data resolved that local inspector-only omission. No original evidence was changed.

Independently reconciled

• Frozen source is 715036e132677dd2bc2fb37ed316d93dc9987aec. Entire stage source inventory equals the archived final04 inventory already independently checked against all 3709 immutable Git input blobs in FINAL04-COMPLETE-REVIEW.md. The baseline fixture was additionally read from this exact local Git commit and byte-compared: B SHA256 2dae785d63a940094d8052f3dcddcb988c024b38df9780e026bccd516264dbfe. P is exactly B minus the single predefined Shutdown complete placement source line.
• Independently deep-copied complete expected B: removing only Activate's unique (500,310) waypoint yields complete C; removing only placement ea202922-0033-4000-8000-000000000216 for element ...000000000037 yields complete P. All frozen typed-validation outputs equal their expectations. Expectations are bound in the staged immutable manifest before launches; no GUI edited result was used to construct an oracle.
• All ten complete actual Project JSON objects exactly equal expected B/C/B/C/P/P/P/P/C/P, using strict canonical JSON. Each receipt binds the exact stage manifest/source, accepted=true, no failure, unchanged original before/after inventory, actual output digest and exact archived source bytes. Each converter/snapshot receipt has successful exit, expected helper/runtime hash, matching argv, input/output digests, and empty stderr. All five P source inventories match checkpoint04; all three C inventories agree, including reopened08. Final working C/P bytes match those checkpoints.
• Rehashed actual local release ZIP 5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d and every one of its 565 member lengths/digests against stage package inventory. GUI identity remains individual-build 2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399; runtime aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a. Snapshot 6a1f438ab8f122251846f46cf1c5440ec7b0362b34fd61b97286d470bad11b74 and supplemental converter c318ea38111688b6ce0d878b3e9e7dfebe0b3732d0c094bb4580fb39dbcc3d26 match already reviewed source/build provenance in PACKAGE-SERVER-REVIEW.md and FINAL04-COMPLETE-REVIEW.md.
• run01 PID6516 and run03 PID2044 bind the admitted extracted executable, exact argv, stage manifest and archived launcher hashes. Both close receipts match PID and exit0, package_unchanged=true, with empty raw stdout/stderr. Child environments are exactly equal: private LOCALAPPDATA and PATH limited to package plus System32; run03 changes only unrelated cwd among these launch settings. All 44 capture metadata records identify the admitted executable and include an actual full-size image member.

Original refusal and recipe boundary

Read stage/check recipe, PLAN, both launcher versions, observations and cwd incident. The stage/check algorithm compares entire model objects and closure fingerprints; its success is not inferred from screenshots. The frozen recipe's historical “prepared/unexecuted” text is retained preparation provenance, not the current execution report.

run02 is explicitly a pre-Popen refusal at the original launcher's empty-cwd assertion. reviews/cwd-incident.json retains the assertion/attempt record and original inventory, including literal %SystemDrive%/ProgramData/Microsoft/Windows/Caches with three file digests. It is not counted as a successful launched process. Independently versioned v2 launcher SHA256 09ba3aad00643d9915453797656347ba1084a3b9a75187964587a733ea19fc4b requires fresh run>=3 cwd, preserves the original incident and verifies its old inventory before launch and after exit. Raw run03 inventories equal the incident. Cache-writer attribution remains unproven. There is no evidence substitution or need to discard the original refusal.

Visual review and limits

Viewed 18 full-size archived screenshots: 03,04,06,08,10,12,14,26,27,29,30,31,32,35,36,41,42,44. They corroborate the populated example and guide/return, authored square disappearing/restoring/disappearing, armed source/target status reverting to Select/move, Dispatch query and filter surviving popup dismissal, dialog cancellation restoring clean canvas, reopened cleared State and Show-unplaced offering Shutdown complete, and final all-changes-saved feedback. State labels remain tiny/congested at the shown 56% view; #36 remains open scope, not accepted as fixed.

Images establish visible states, not the causal input between captures. The published operator observations supply the Escape/outside-click/Alt+F4 sequence and fresh-process Open actions; mechanical receipts independently establish saved contents and process identities. Exit0 alone does not establish normal-close cause, and full Project equality does not expose transient focus/undo internals. No broader accessibility/DPI/performance, held-drag/reconnect, physical network disconnection, Linux or full specification claim is warranted. Independent downloaded-package runtime QA and release-owner synthesis remain separate.

For parent visual review, all full paths start C:/Users/User/Documents/Git/ARCADIA-Studio/.local/prerelease37-integration-review-20260924/native-gui-inspection/native/captures/. Selected exact filenames: 08-activate-selected-1.jpg, 10-clear-bends-1.jpg, 12-undo-1.jpg, 14-redo-1.jpg, 26-source-armed-1.jpg, 27-source-escape-1.jpg, 31-filter-open-suggested-1.jpg, 32-filter-escape-dialog-retained-1.jpg, 35-first-escape-all-retained-1.jpg, 36-second-escape-cancelled-1.jpg, 41-run3-state-cleared-bend-1.jpg, 44-run3-saved-before-normal-close-1.jpg. Index0 is often a 16x16 auxiliary surface; use index1 for those captures.