ARCADIA-Studio/harness/TASK_LEDGER.md

# Task Ledger — first release

Updated 2026-09-11. [STATE.md](STATE.md) owns current execution/evidence;
[PLAN.md](PLAN.md) owns capability milestones. The entire former Task Ledger is
[preserved byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/TASK_LEDGER.md).
Its old goal references, aggregate test claims and stopped-session directives retain
historical scope. New semantic decisions are recorded explicitly in DECISIONS.md;
prototype results retain their separate scope.

Current compiled checkpoint2cc4d11 includes external creation4bb4aaf as1516949,
isolated chooser13, and final baseline/library contracts. Local full676/format/
strict Clippy pass; native80cf197 now passes four OA creations, exact history and
reopen. Separate native SA Action/history also passes. Exact numeric foundation
is declared at7d14bd0 and passes26/26 unit tests plus strict core all-target Clippy.
Working workspace/production chooser changes remain outside compiled artifacts;
independent chooser source review closed three focus findings,14 new host tests
are prepared. Schema8 core implementation is isolated and uncompiled. External
results retain their host/source attribution.

## Goal and success criteria

Deliver the usable, feature-complete OA/SA first release specified in
[PROJECT_GOAL.md](../PROJECT_GOAL.md). It is the exact copy of the user's revised
`a49d1780-25d5-4778-ad68-6140c60e4207/goal-objective.md`, SHA256
`DD58F75C93D55FE16ED141A23D834898FB6EBC625AE7E7AE379DA552A8312435`.

Success requires coherent explicit semantics, practical engineering workflows,
equivalent graphical/textual/REST behavior, real Windows/Linux runtime evidence,
recoverable authoring, relevant automated evaluators, precise documentation,
reproducible packages and fresh independent cross-disciplinary end-state review.
No known blocker or high-impact finding may remain unresolved. Later Arcadia
layers remain future scope. Code, a passing slice or an attractive screen alone
cannot establish completion.

## Given facts

- Rust/Iced desktop and a deployable REST service serve system engineers. OA/SA
  transitions in both directions must be understandable, explicit and useful.
- The revised goal explicitly requires constraints/calculations, quantities/units,
  reusable model libraries, state/behavior modeling and strong standardized
  specification/API, as well as textual/graphical notation and artifact traceability.
- Human/AI/Git-friendly source and a concrete unambiguous reST specification must
  match graphical editing. The source editor needs highlighting/linting; help must
  be offline, concise and navigable.
- The newest explicit goal requires uncluttered notation that reduces cognitive
  load and supports development of complete small and large models using text alone.
- Direct behavior/scenario diagram authoring and reduced cognitive load are current
  priorities. Long homogeneous selectors and bloated persistent creation controls
  are rejected. Study actual Capella's useful domain workflows and nesting without
  mechanically copying its interaction problems.
- The user authorizes autonomous bounded engineering, native Capella/Studio
  evaluation and explicit independent delegation, exclusively with GPT-6 Astra
  at effort appropriate to the question. Root owns synthesis/integration.
- Project instructions require Gitea coordination, ownership preservation and
  durable handoffs. Current root reserves one Cargo/native operator per host.
  Updated AGENTS4b8465c8 requires coordinated runnable milestone prereleases and
  concise current shared maintenance with unique historical evidence preserved;
  user Gitea#178 authorizes programmatic existing-MCP-credential reuse for relevant
  Git/REST publication without printing/committing secrets. Restart and usage reset
  remain unauthorized.
- Gitea issue2 explicitly requires actual Process/Scenario canvases with the same
  interaction approach as architecture/state diagrams. Existing pointer edits
  inside scrollable projections do not by themselves satisfy that requirement.

## Verified facts

- The independent scenario checker compiled with warnings denied and passed its
  self-check, deterministic fixture generation and complete baseline check on this
  host. Its eight OA/SA checkpoints and exact UUID/source restoration comparisons
  are evaluator evidence, not native Studio acceptance. Exact inputs/hashes are in
  [the fixture instructions](fixtures/scenario-authoring/README.md).

- The historical native implementation is `80cf197` on `codex/behavior-authoring-20260910`, following
  baseline `1797516`. Local commits cover B1/B2/B3 authoring, nullable history cache
  (`b6b76ef`), external palette integration (`aed40d7`), cfg(test) lifecycle projection
  (`eb5161b`), history seed correction (`4ecad78`) and exact-identity native oracle.
  Later imports add focus recovery, exact packaging notices and scenario workspace/
  owner restoration. Root80cf197 fixes document/scenario viewport Sensor identity
  with a real mounted red-before/green-after regression.
- This fresh host has task-local Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW.
  The integrated2cc4d11 desktop suite passes676/676, zero failed/ignored, with a
  warning-free build; formatting and strict Clippy pass. History, pure lifecycle,
  creation and isolated chooser are included. New working code still needs its
  own gate. Native80cf197 evidence is separate. [Exact hashes/logs](STATE.md).
- Strict language HTML regeneration and the source7 OpenAPI checker passed locally:
  72 fixtures, 204 schemas and 90 scalar leaves. Actual isolated Capella scenario,
  activity/lifeline and LOOP creation was saved/inspected; this is reference study,
  not Studio acceptance. [Native benchmark](release-capella-scenario-benchmark-20260910.md).
- Core/source7 already implements substantial direct behavior, typed data/ports,
  contextual chain links, maintained message-operation identity, semantic reviews,
  artifacts, hosted source envelopes and recovery. Historical absence claims must
  be checked against code and newer scoped evidence, not copied forward.
- [Requirements audit](release-requirements-delta-20260910.md): Constraint and other
  expression strings are descriptive, with no calculation/binding/result evaluator;
  unit strings persist/inherit without dimensional compatibility or conversion;
  named types/sequence/scenario reuse and includes exist, but there is no maintained
  cross-project package/version/instance/update contract. These are explicit gaps.
- The same audit identifies concrete unbounded Constraint target choices and generic
  expanded collection editors. Explorer already has hierarchy/search/paging; the
  problem is targeted, not a claim that all selection is flat.
- Gitea #79's same-selected-ID/visible-owner defect is fixed in the imported
  scenario checkpoint; owner restoration and pending-draft guards pass current
  tests. B4 independent review #114 adds Scene integration requirements for actual
  lifetime extents, branch-local activation clipping, incomplete lanes and self arrows.
- Codex-9e8r6t and Codex-ytr83r have independent host-local Cargo/native leases.
  Named creation/workspace/palette/package integration is imported here.9e8r6t's
  coherent CLI/evidence checkpoint01b76a1 awaits import; it owns staged-source and
  the next runnable Windows prerelease. ytr83r owns production B4 and its native
  oracle.9e8r6t successfully reused existing credentials for direct push; this
  host is setting up the same authorized publication path.
- Current Linux acceptance is open; this host has no installed WSL distribution.
  Historical Linux core/server/cross-build results have exact older snapshot scope.
  The earlier denied guest workaround did not run and must not be bypassed.

## Assumptions

- Compact contextual tools and an adequately sized scenario workspace can reduce
  friction; only actual engineering tasks at minimum/wide sizes can validate this.
- The ratified bounded pure analysis and pinned-library architecture can satisfy
  real engineering work without full language/runtime adoption. This remains a
  product adequacy assumption until actual budgets, approximate calculations and
  two-project/source/API/native workflows pass; metadata is insufficient.
- Existing shared core/source/history boundaries remain suitable for additions;
  foundational examples and independent criticism must test that assumption.

## Open questions

- Do the ratified owned-value/shared-check/R6/R7 contracts meet real engineering
  budgets once implemented, including approximate numeric requirements? What
  measured ceilings keep work bounded without rejecting ordinary studies?
- Does actual package closure/canonical consumer typing/source preparation and
  three-way update preserve every stable identity and local engineering edit?
- What migration and OA↔SA treatment follows from those contracts without guessing
  executable meaning from old strings or silently changing old models?
- How can text-only creation establish library instance bases/maps, preserve
  compatibility across cosmetic package revisions, export subjectless cases, and
  transition mounted OA/SA data without hidden GUI normalization or silent forks?
- Will full evaluator and private-capture replay preserve effective-case and
  deterministic work-limit behavior across direct, REST and cache-warm execution?
- Which source-preserving refactoring/navigation and grammar changes reduce actual
  engineering effort while retaining stable identity and cross-file ownership?
- Do current real gestures, exact caller return, nested scopes and lifecycle markers
  remain usable and correct under minimum sizing, scrolling, zoom and dirty drafts?
- Which uncovered teaching, traceability, transition, saved-view, state/data, hosted
  and platform cases remain after current-binary acceptance? What supported Linux
  environment can complete the remaining actual runtime gate?
- Does "standardized" require any external conformance beyond the project's precise
  interoperable spec/API? Full OMG conformance is not inferred merely from comparison
  to SysML v2; explicit claims require a mapped and verified contract.

## Candidate hypotheses / designs

The [requirements delta](release-requirements-delta-20260910.md) compares metadata/
snippets, bounded pure engineering analysis with maintained pinned libraries,
external evaluators, and full standards adoption. Metadata alone fails the explicit
new semantics; external tools alone still need binding/result contracts. The report
recommends the bounded route for root synthesis, not as a ratified decision.

Independent maximum-reasoning tracks now compare owned engineering properties
versus analysis contexts; calculation definitions/applications; numeric/unit rules;
and copy, linked-definition, live-instance or pinned-definition/editable-instance
library architectures. Require concrete falsifiers, source/API migration effects,
identity/history/recovery behavior and independent critique before convergence.
These alternatives converged after concrete experiments and independent review:
B property bases/shared checks/full capture, R6/R7, exact pins with same-origin
typed compatibility and explicit portable normalization are now ratified. Complete
11-file proposed baseline and120-assertion finite library prototype remain distinct
from production admission. Independent292-check review exposed C1 dynamic-work
expansion and a C2 prototype threshold-unit gap; implementation must close both.
The text-only40-identity fixture and13 mounted chooser tests pass. Production
numeric foundation and inspector/review chooser are active, with gates pending.

The subsequent context experiment passed218 assertions: shared property baselines
and one-level overrides reduce repeated input maintenance while retaining explicit
independent freeze. Root selected that B direction for precise contract refinement;
quantity/library/source details remain open. [Decision](DECISIONS.md),
[experiment and limits](release-analysis-context-experiment-20260911.md).

## Decisions retained

- Keep explicit Rust crate responsibilities and one authoritative typed Project
  with validated atomic Commands. A thin source CLI reuses the shared core. Separate semantic identity/ownership, allocation/reference/order and
  diagram geometry. Forms are closed adapters, not a second metamodel. New persistent
  semantics require core/source/UI/API/reference/transition parity. [Decisions](DECISIONS.md).
- Preserve authored source ownership/comments/includes, exact identity and accepted
  model/source history. Source writeback must succeed before adoption. Raw invalid,
  excluded or rejected drafts survive; navigation/tools must not implicitly accept
  another editor. Recovery validates/replans rather than trusting serialized commands.
- Semantic reconciliation uses finite typed facets, frozen baselines, explicit
  mappings, actual destination slots and a single atomic candidate. Do not infer
  identity by name or apply reviewed rows as sequential independent edits.
  [Foundation](release-semantic-batch-foundation-design.md),
  [artifact contract](release-semantic-artifacts.md).
- Layer transitions are explicit engineering decisions, not automatic propagation.
  Behavior-root navigation must establish the requested owner while preserving
  unrelated architecture presentation. Ports/allocation and contextual occurrences
  retain their distinct domain meaning. [Source7 contract](release-source7-integration-decision-20260906.md).
- Hosted revision/source envelopes and ETag checks remain atomic; credentials stay
  out of persisted models and repository. Linux journal publication retains the
  selected no-replace invariant, with measured limits, not an overwrite fallback.
  [Journal decision](release-linux-journal-publication.md).
- Repair/evaluate the compact palette informed by native Capella evidence; do not
  return to the rejected horizontal toolbar. Lifecycle projection remains isolated
  under cfg(test) until coordinated Scene integration and actual acceptance.
- Preserve historical scope decisions as history. In particular, architecture-only
  SVG is implemented and behavior SVG was deferred; that is not proof of satisfying
  the revised release objective. Reassess older exclusions against current scope.

## Current strategy

Finish the new workspace/chooser compile and native loop; independently review
and measure the numeric foundation before expanding the ratified semantics.
Integrate coherent external CLI/staged-source/B4 checkpoints while preserving
ownership and source attribution. Use independent complete model/source oracles
and exact identity/history comparisons. Publish coordinated runnable milestone
prereleases; close actual analysis/library/source/API/native, cross-platform,
service/package and independent end-state gates before the final handoff.

The [archived Task Ledger](history/2026-09-10-ledgers-before-continuation-refresh/TASK_LEDGER.md)
and [archived STATE](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md)
preserve all older claims, decisions and evidence links exactly. Relative report
links inside those byte-preserved files resolve from their original `harness/`
context. Their historical test totals and process holds are not live status.