ARCADIA-Studio/harness/state-multiselect-native-design-20260923.md

# State multiple-selection native fixture and invariant evaluator

Implementation candidate: `crates/oa-core/examples/state_multiselect_native.rs`, based on the existing ordinary fixture CLI. Written on branch `codex/multiselect-state-9e8r6t-20260923` after `7e348d9`. Compilation, unit tests and native inspection have **not** been run for this candidate. Parent owns these gates and a fresh oracle review.

## Entry and targets

The generator refuses an existing output directory and writes `baseline.json`, `manifest.json`, and canonical source under `source/`. All object IDs derive from the fixed UUID-v5 namespace `c1192026-0923-5000-8000-000000002929` and the aliases in the manifest, except `state_view`, fixed to `00000000-0000-0000-0000-000000290101`. It is the smallest diagram ID, and is a dedicated State-machine view rather than Architecture. The fixture does not persist a transient selection; select A, then Shift-click B in the native application.

| Alias / target | Authored world geometry / purpose |
| --- | --- |
| `node_a` / `state_a` | A – Processing: (0,0), 340×450; click header near (40,35) |
| `node_b` / `state_b` | B – Ready: (410,30), 210×150; click header near (450,65) |
| `node_c` / `state_c` | C – Complete: (410,330), 210×140; must remain fixed |
| `node_inner` / `inner` | A nested Region: (25,220), 290×200 |
| `node_leaf` / `state_leaf` | A.1 – Classify: (60,290), 180×90 |
| `node_entry` / `entry` | Authored (-210,280); State projection attaches symbol X to A's left boundary |
| `node_exit` / `exit` | Authored (870,350); State projection attaches symbol X to A's right boundary |

The outer machine/Region are unplaced in the main view to keep these targets readable after Fit at a 1442×932 native window. Readability is a proposed layout until visually verified. World header coordinates are not screen coordinates; account for the actual camera and canvas origin.

A and C contain StateAction rows referencing the same `shared_work` Activity. A has the `refresh` InternalTransition row. The Activity has a refinement trace, including recorded baseline properties, to an unrelated SA Function. A second State view and SA view provide preservation sentinels. Main-view routes have authored hard pins, explicit attachment sides/fractions and relative label offset/fraction; `between` also has a guard and multiline label.

## Expected mutations and limits

`moved` infers a common displacement from the saved A placement. The generated baseline puts A at authored (0,0), so its saved f32 position is the original f32 delta without lossy subtraction of a nonzero anchor. All main-view placements and route pins were translated equally by (-30,-100); sizes, relative geometry, route label offsets, other State/SA views and IDs are unchanged. Use that externally pinned origin baseline for moved checks, not an already-moved baseline. Positive command candidates include (0.01f32,10) and (0.1f32,-0.2f32) to expose nonbinary-delta rounding regressions. It independently enumerates exactly six moved placements: A, B, nested Region, nested State, entry and exit. It translates only `between` (A→B), `entry_route` (entry→leaf), and `exit_route` (leaf→exit) pins. `external` (B→C) pins remain exact. No production movement, descendant or routing helper contributes to the expected Project.

The delta must be finite, have length at least 0.01 and each axis at most 300 world units in magnitude. Fractional values are accepted without a 10-unit grid requirement. This is a bounded native-evidence acceptance threshold, not a new movement/product limit. All comparison is complete Project equality after explicit edits to a baseline clone; JSON/source roundtrips are also required.

`hide` removes exactly `node_a` and `node_b`, leaving their descendants' placements, all authored routes, engineering objects, shared activities, StateAction/InternalTransition records, other views, opposite-layer objects and refinement baseline intact. `unchanged` requires complete model equality. Authored external route equality does not require its recomputed path or labels to stay at identical screen positions.

The checker accepts JSON or `.arcadia` inputs, rejects source errors, and allows ordinary engineering-completeness warnings. Pin the generated baseline, manifest, generator source version and generation command in an external evidence receipt **before** native interaction. Project identity alone does not authenticate the baseline. A moved output passing this checker cannot prove pointer intent, focus, stationary-click behavior, selection paint, exact original source bytes or single-step history; observe those independently in the native workflow.

## Parent verification commands

```text
cargo test -p oa-core --example state_multiselect_native
cargo run -p oa-core --example state_multiselect_native -- generate FRESH_DIR
cargo run -p oa-core --example state_multiselect_native -- check unchanged FRESH_DIR/baseline.json FRESH_DIR/source/project.arcadia
cargo run -p oa-core --example state_multiselect_native -- check moved FRESH_DIR/baseline.json SAVED_MOVED_JSON_OR_ARCADIA
cargo run -p oa-core --example state_multiselect_native -- check hide FRESH_DIR/baseline.json SAVED_HIDE_JSON_OR_ARCADIA
```

For Hide performed after movement, use the externally pinned moved snapshot as that operation's baseline. Unit positives use the validated production command only to generate candidates; the oracle remains explicit. Negative tests require valid-model corruption where applicable and cover missing/double movement of each descendant, internal/boundary pins left behind, external pin drift, attachment/label metadata, StateAction phase, internal guard, shared work, fixed C, other views, trace metadata/baseline, destructive Hide and malformed source. Source-file positives and valid unexpected source edits exercise the same complete-model check.