ARCADIA-Studio/harness/multiselect-saved-view-20260923.md

# Ordinary saved-view multiple selection — verification report

**Verified branch contribution, not full issue acceptance.** This report covers the ordinary saved-view
subset of [issue 29](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/29).
Final source is `f6a6010baed9e6164a1fcc7ecd58256a562827d7` on
`codex/multiselect-9e8r6t-20260923`, based on the published State/attachment
checkpoint `b8685416f56e53e30bd11ecf93a54cea10ac8458`. The final Windows desktop
suite, strict lint, formatting, build and corrected-layout native run passed.
Integration with the release owner's later union remains separate work.

## Evaluated source and scope

Native run-1 used commit `12a7352ddef5f69a144ead8219a50916233d63a9` and the
729-file input map
`55a5f354bb5049a8c77ba9bafa833438ebf754649b0cf5d175d0c8dcfcedd7bb`.
Core-3, desktop-4, lint-2, format-1 and both native/checker builds share that
exact input map. Earlier test receipts record HEAD
`b8685416f56e53e30bd11ecf93a54cea10ac8458` because the feature was still
uncommitted; the captured source map, rather than HEAD alone, identifies their
tested contents.

The corrected layout verification uses a distinct 729-file input map,
`99dc46645236e674244e7c4867595a6000d3d85b54bcc9ab2b0c601923ecf66c`,
captured by desktop-5 at HEAD `12a7352ddef5f69a144ead8219a50916233d63a9`.
An exact Git-blob comparison subsequently confirmed the complete captured input
inventory equals commit `f6a6010baed9e6164a1fcc7ecd58256a562827d7`.
Results for the earlier map do not establish the changed layout's behavior.
Desktop-5, lint-3, format-2, native-build-2 and windows-build-2 all use the
corrected map. Native run-2 operated that Windows build; its 117,519,360-byte
executable has SHA-256
`49396ee5c24f749cbee54e1fd77e15f5d73b0e19cf246724216ce7464d3deba5`.

The implemented subset provides exact transient saved-view selection with a
primary Inspector target, Shift toggling and contextual Add/Remove, deferred
stationary-click versus group-drag behavior, simultaneous placement movement,
and group Hide that preserves model objects. The complete typed selection is
admitted or refused; ports/edges are not silently filtered from a group action.
Captured operations reject stale document, revision, surface and selection
generation. Ordinary property edits remain primary-only. Movement uses one
atomic transaction and the same pure plan for preview and commit.

Required behavior and remaining adapter families are defined by the
[contract](multiselect-contract-20260923.md). Design and detailed review evidence
remain in the [core review](multiselect-core-review-20260923.md),
[desktop review](multiselect-desktop-review-20260923.md),
[fresh review](multiselect-fresh-review-20260923.md), and
[native evaluator/layout review](multiselect-native-review-20260923.md).

## Closed gates

The closed receipts below report unchanged captured inputs and successful exit.
Windows used `stable-x86_64-pc-windows-gnullvm`, Cargo 1.98.1 and rustc 1.98.1,
locked/offline dependencies, and the supported headless desktop renderer.

| Gate | Command/result |
| --- | --- |
| core-3 | `cargo test --locked --offline -p oa-core --test group_movement --test state_diagrams --example multiselect_native -- --nocapture`: 7 movement + 13 existing State + 10 evaluator tests passed; zero failures. State test passage does not accept a State group UI adapter. |
| desktop-4 | `cargo test --locked --offline -p oa-desktop -- --nocapture`: 1,256 passed, zero failed, six ignored. Includes mounted focus, passive modifiers across I/O, selection/history and pointer-lifecycle regressions. |
| desktop-5 | Same desktop command, corrected layout: 1,257 passed, zero failed, six existing ignored. The added mounted regression preserves canvas bounds, fitted camera, complete Project, source and empty history across empty/single/group/mixed selection. |
| lint-2 | `cargo clippy --locked --offline -p oa-core -p oa-desktop --all-targets -- -D warnings`: passed. |
| lint-3 / format-2 | Strict all-target Clippy for core/desktop and `cargo fmt --all -- --check` passed on the corrected layout input map. |
| format-1 | `cargo fmt --all -- --check`: passed. |
| native-build-1 / windows-build-1 | Locked/offline checker example and Windows desktop executable builds passed, with matching input maps and recorded executable hashes. |
| native-build-2 / windows-build-2 | Both builds passed from final source `f6a6010`, with matching corrected-layout inputs and executable pins. |

Failures were retained and corrected, not counted as passing evidence:
desktop-1 exposed module visibility/menu-token compile errors; desktop-2
reported one Placement-properties selection regression (1,247 passed, one
failed, six ignored), corrected by recognizing the selected placement identity;
core-2 exposed the evaluator incorrectly rejecting ordinary fixture warnings;
oracle-2 then exposed an unqualified Severity type; lint-1 rejected an
unnecessary clone. Later closed gates above cover the corrected source.
Desktop-3's earlier 1,254/0/6 pass preceded the two passive-modifier suspension
regressions included in desktop-4. Full historical commands, inputs and logs
belong in the checks package, not this summary.

## Native behavior and saved-state evidence

The owning session operated each pinned Windows app through contextual Add for
A/B, one group drag, Save, movement Undo/Redo with Save, return to baseline,
group Hide, Hide Undo/Redo with Save, and reopening the hidden saved source.
These are actual Computer Use observations, not inputs independently replayed
by the evidence verifier. Run-1 retains 27 numbered native captures and run-2
retains 24. Each run has nine saved-source snapshots with evaluator receipts,
process/start/finish records and `history-bytes.json`.

Run-1 records PID 7540 / window 131836; run-2 records PID 5312 / window 20055002.
Each capture names the corresponding pinned executable path and consistent
window identity. Both closing receipts report exit zero, unchanged GUI/checker
binaries and fixture, and empty stdout/stderr. These are joined historical
records, not independent OS authentication of every captured input.

The independent checker compares the complete Project against explicit fixture
expectations and validates JSON/source roundtrips. All nine final snapshots
in each run (18 total) report PASS with stable source, baseline and checker pins:

| Saved state | Verified relationship |
| --- | --- |
| `baseline`, `move-undo`, `before-hide`, `hide-undo` | Equal to the complete baseline Project; all nine source files byte-identical to the fixture baseline. |
| `move`, `move-redo` | A, B and A's unselected child share delta `(100, 60)`; internal route pins translate once. C, one-ended pins, attachments, labels, semantic records, traces and other views remain exact. The two source inventories are byte-identical. |
| `hidden`, `hide-redo`, `reopened-hidden` | Only A/B placements are removed. The child placement, stored routes, model objects and other views remain exact. These three source inventories are byte-identical. |

Across both changed states, the only changed source file is
`views/diagram_oa_view.arcadia`; the other eight source files remain unchanged.
This supports precise saved-state restoration across the observed
one-step history sequence. Equality alone does not authenticate Undo button
presses or establish history behavior without those observations.

The fixture is deliberately incomplete engineering content. The parent observed
11 warnings: `missing_system` ×1, `unallocated_leaf` ×4,
`work_without_behavior_context` ×4, `exchange_without_behavior_context` ×1,
and `non_leaf_work_exchange` ×1. The native status shows 11 model checks; these
are not presented as new application defects or zero-warning acceptance.
The evaluator permits completeness warnings but rejects source errors and
compilation failures.

Run-1 also exposed a real layout issue: forming a group inserted a conditional
toolbar block, resized the canvas and shifted nodes without a geometry edit.
Independent inspection of captures 06 and 08 confirms the shift. The subsequent
correction reserves a fixed selection/status strip, adds a visible
Shift-click hint and includes a mounted bounds/camera regression. Run-1's pinned
binary is unchanged and cannot verify that correction. Desktop-5 passed, and
run-2 then confirmed the corrected behavior: captures 03/05/07 retain the same
canvas top (about y=341), 84% zoom, and node positions across empty/single/group
selection. The count, Hide/Clear controls, primary-only disclosure and Shift
hint are readable at the observed 1442×932 window size.

Run-2's drag was from `(405,533)` to `(489,583)` in window coordinates, an
84-pixel right / 50-pixel down movement at the displayed 84% zoom. The observed
geometry moves accordingly; the independent saved-model oracle finds the
grid-aligned common world delta `(100,60)`. One Ctrl+Z restores baseline, and one
Ctrl+Y restores the moved state. Save and complete-Project checks follow each.
Hide at `(377,287)` removes A/B placements while leaving the child and C at their
previous screen positions; Undo restores A/B without the former clipping or
viewport shift. Zoom remains 84% throughout those edits. Reopening the hidden
source performs the normal fresh fit (88%); camera is transient, and the saved
Project/source remain exact. Capture labels identify each stage.

The initial run-2 baseline checker invocation omitted the shell's GNU toolchain
runtime setup and exited `3221225781` with empty streams. The same checker and
byte-identical source passed after environment setup. The failed snapshot,
retry receipts and exact helpers are retained in the separate
[incident record](experiments/multiselect-20260923/incidents/README.md); it is not
counted as a successful checker attempt or an application crash.

## Reproduce and inspect

Use the repository's [Windows build/packaging guidance](../docs/windows-packaging.md)
and a configured Rust/GNU runtime environment. Captured runs used Rust/Cargo
1.98.1, LLVM-MinGW 20260826, one Cargo job and `CARGO_INCREMENTAL=0`.
`--offline` requires the dependency cache to be present. From the source checkout:

```text
cargo test --locked --offline -p oa-core --test group_movement --test state_diagrams --example multiselect_native -- --nocapture
cargo test --locked --offline -p oa-desktop -- --nocapture
cargo clippy --locked --offline -p oa-core -p oa-desktop --all-targets -- -D warnings
cargo fmt --all -- --check
cargo build --locked --offline -p oa-desktop --bin arcadia-studio
cargo build --locked --offline -p oa-core --example multiselect_native
```

Run the resulting desktop executable with the GNU runtime directory on PATH.
The built `multiselect_native` example accepts `generate NEW_DIRECTORY`; keep
the generated fixture unchanged, copy its `source` directory to a fresh working
directory, and open that copy's `project.arcadia` in the app. After saving each
observed operation, evaluate with:

```text
multiselect_native check unchanged FIXTURE/baseline.json WORKING/project.arcadia
multiselect_native check moved FIXTURE/baseline.json WORKING/project.arcadia
multiselect_native check hide FIXTURE/baseline.json WORKING/project.arcadia
```

Use the mode matching the table above. Preserve separate saved source copies
for the nine named stages and compare their exact inventories/bytes in the
three stated equality groups. Commands cannot substitute for the actual native
selection, movement, history and reopen actions.

Portable verification from a repository containing the named source commits:

```text
python -B harness/experiments/multiselect-20260923/checks/verify.py
python -B harness/experiments/multiselect-20260923/native/verify.py
python -B harness/experiments/multiselect-20260923/source/verify.py --repo . --checks harness/experiments/multiselect-20260923/checks
```

The packages retain original logs, inputs, captures, fixtures and snapshot
receipts. The source verifier freshly compares all captured Git blobs and the
complete filtered inventory at both named commits. These offline checks do not
execute archived code or rerun the GUI; consult their READMEs for precise limits.

## Acceptance limits and delivery

- Both native runs exercise OA Activities in an ordinary Overview, not a native SA
  Function workflow. Native selection used contextual Add because the chosen
  tool cannot inject held-Shift plus click; mounted tests provide separate
  Shift-before-focus evidence. The App-level multiselect tests separately use
  SA Functions, a nested Function and a FunctionalExchange in a Functional
  Dataflow view; that automated coverage is not a native SA interaction claim.
- The checker infers a bounded common delta from saved A. It verifies group
  invariants, not the exact intended pointer destination or drag magnitude.
  Native action observations, model equality, byte equality and mounted tests
  are distinct evidence and are not interchangeable.
- State, Allocation, derived Process/Scenario group adapters and aggregate
  model deletion remain incomplete. This report does not close the full issue,
  accept those families, claim Linux verification, or represent an integrated
  release. The native runs do not cover every mixed-target, cancellation or
  suspension scenario exercised by automated tests.
- Native layout review covers 1442×932, not every minimum-window, DPI or keyboard
  accessibility condition. No broad usability acceptance is inferred from this
  bounded fixture.
- Portable evidence is supplied under
  [checks](experiments/multiselect-20260923/checks/README.md) and
  [native](experiments/multiselect-20260923/native/README.md), with separate
  [source identity](experiments/multiselect-20260923/source/README.md) and incident
  records. The checks package retains 19 closed runs, including five nonzero
  historical gates. Raw absolute paths in the receipts are historical labels;
  the versioned packages make the evidence consumable on other machines.