Add named behavior creation and verified textual authoring examples

.gitattributes

@@ -18,6 +18,8 @@
 harness/fixtures/release1-native/** -text
 harness/fixtures/interface-operation-probe/** -text
 harness/history/2026-09-06-ledgers-before-consolidation/** -text
+harness/history/2026-09-10-ledgers-before-second-consolidation/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/experiments/textual-authoring-20260911-local/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
 crates/oa-desktop/src/recovery/fixtures/*.json -text
 harness/fixtures/source7-native/** -text
 harness/fixtures/basic-editing/** -text

PROJECT_GOAL.md

@@ -655,6 +655,15 @@ Requirements:
 - Strong, standardized specification.
 - Strong, standardized API.
 
+#### Textual notation
+
+Requirements:
+
+- Should not have visual noise and clutter.
+- Should have means to reduce cognitive load when developing system models.
+- Should be easily editable by humans. And AI agents.
+- System engineers should be able to easily develop system models (both big and small) using textual notation only.
+
 ### UI
 
 The focus should be on reducing system engineer's cognitive load when creating / working with a system model. Regardless of the model size (big or small).

README.md

@@ -63,7 +63,7 @@ The architecture diagram has a compact side palette; expand it to see tool names
 2. Switch to **System Analysis**. Define one System of Interest and external Actors, then functions, missions, capabilities and functional chains. The system boundary has no internal LA/PA components in this version.
 3. Select a System or System Actor and choose **Add port** in the browser or Properties. Choose Standard or Flow, then **Create port**. Use **Boundary exchange** in the diagram palette, or **Draw boundary exchange** on a selected visible source port, to connect compatible component ports directly. Create the other participant's matching port first if none exists. Functions expose separate input/output port actions; the **Functional exchange** palette tool connects them. **Actions** exposes other engineering relationships and off-diagram configuration; **Data & interfaces** holds reusable payloads and contracts.
 4. Create focused views. **Containment** nests semantic children; **Architecture · allocated work** nests work within performers; **Functional dataflow** shows work decomposition and exchanges; **Missions & capabilities** shows objectives and participation. Dashed, italic parent work denotes an allocation summary inferred from its leaves. Ports appear on their owner's boundary. **View properties** stages saved line-kind, category, behavior-coverage, context, label and individual-hide choices. Right-click empty diagram space for **Duplicate view**, retaining the same semantic records in an independent presentation. Placement **Hide** removes a placement; line hiding retains its relationship; **Delete from model** removes semantics and dependent references.
-5. In **Behavior & scenarios**, author processes/chains, scenario lifelines and ordered occurrences, including repeated uses of the same exchange and explicit fragments/branches. Select a State machine and choose **Create diagram** to place its existing regions and states/modes in a saved view. State machines also support availability and state-action links. Conditions are descriptive, not executable simulation code. Behavior and Data authoring preserve your other diagram layouts.
+5. In **Behavior & scenarios**, choose **New**, select Operational process (OA), Functional chain (SA), Scenario or State machine, then enter its name. For a scenario, choose what its lifelines represent; **Add optional context…** links a context without changing its layer-root ownership. For a state machine, search for its existing participant owner; optionally select **Create the first state view**. Choose **Create and open** to start authoring work contributions, lifelines, ordered occurrences or states. **Cancel · Esc** discards the creation draft; if another dialog is open, Escape dismisses that dialog first. Creation and its optional first view form one Undo operation. A new state machine starts without regions or states; **Create diagram** can later place its existing contents in a saved view. Behavior supports repeated exchanges, fragments/branches, availability and state-action links. Conditions are descriptive, not executable simulation code. Behavior and Data authoring preserve your other diagram layouts.
 6. Select an OA or SA element and choose **Create / update counterpart**. Review dependency scope and counterpart choices, then apply one undoable transaction. For an existing trace, **Review semantics…** compares typed content and prior observations, with explicit keep, take or final-value decisions for supported structural, scalar, constructor, individual-row and ordered-collection changes. Open additional trace rows and choose **Include this row** to combine reviewed source contributions into one validated Apply/Undo transaction; conflicting decisions require resolution. Review does not automatically synchronize the perspectives. **Attachments** reviews an existing child’s parent or a relationship endpoint. **Artifact links** reviews metadata, owner moves, explicit source-absence deletion and creation of a reserved counterpart after all introduced metadata is reviewed. These controls have automated coverage; their native acceptance remains pending. Manual traces link other engineering correspondences. **Traceability** also edits artifact URI, revision and fragment metadata.
 7. Review **Model checks**, then save `.arcadia` source or `.json`. Warnings allow incomplete authoring; structural errors preserve the committed model and rejected draft.
 
@@ -87,6 +87,8 @@ In the state view, **Select / move** drags vertices and containers without repar
 
 ## Edit the same model as text
 
+For a short text-only start, open [the distress-response model](examples/text-first/project.arcadia) and follow [its three-step walkthrough](examples/text-first/README.md). Four declarations and three explicit relationships describe participants, work, responsibility and an exchange; no diagram or handwritten UUID is needed.
+
 **Textual model** has a source-file folder tree, per-file drafts, syntax highlighting, live linting and explicit **Apply all**. Collapse/Locate navigate the hierarchy; collapsed folders retain draft and diagnostic indicators. Right-click a file for contextual actions. Projects can use relative includes to organize source into files. For example:
 
 ```text

crates/oa-desktop/src/app.rs

@@ -13,6 +13,7 @@ mod transition_context_tests;
 mod view_copy_tests;
 use crate::forms::Draft;
 use crate::{
+    behavior,
     document::Document,
     source_workspace::{self, LIMITS, Workspace},
 };
@@ -849,6 +850,7 @@ impl App {
     }
     fn execute(&mut self, command: Command) -> bool {
         let command = crate::port_edit::repair_owner_change(self.project(), command);
+        let created = self.behavior.creation.created_by(self.project(), &command);
         let scenario_selection = self
             .behavior
             .scenario
@@ -856,7 +858,16 @@ impl App {
             .or_else(|| self.behavior.topology.created_selection(&command));
         match self.document.execute(command) {
             Ok(selected) => {
-                if let Some(id) = scenario_selection.or(selected) {
+                if let Some(created) = created {
+                    self.layer = created.layer;
+                    self.selected = created.behavior;
+                    self.selected_node = None;
+                    self.behavior.active_owner = Some(created.behavior);
+                    self.behavior.diagram = behavior::state_view::State::default();
+                    self.behavior.diagram.diagram = created.diagram;
+                    self.page = Page::Behavior;
+                    self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                } else if let Some(id) = scenario_selection.or(selected) {
                     self.selected = id;
                 }
                 self.sync();
@@ -1020,6 +1031,8 @@ impl App {
             window::close_requests().map(|id| Message::Request(Pending::Close(id))),
             window::resize_events().map(|(_, size)| Message::WindowResized(size)),
             architecture_authoring::subscription(self),
+            behavior::creation::subscription(self.behavior.creation.has_pending())
+                .map(|()| Message::Escape),
             iced::event::listen_with(|event, status, _| {
                 let iced::Event::Keyboard(keyboard::Event::KeyPressed {
                     key,
@@ -1741,6 +1754,10 @@ impl App {
                 return self.update(Message::Add(child));
             }
             Message::Escape => {
+                if self.behavior.creation.has_pending() {
+                    self.behavior.creation.acknowledge_commit();
+                    self.status = "Behavior creation cancelled".into();
+                }
                 if self.connection.take().is_some() {
                     self.status = "Drawing cancelled · Select / move is active".into();
                 }
@@ -2284,7 +2301,28 @@ impl App {
             }
             Message::InspectorTab(tab) => self.inspector_tab = tab,
             Message::Behavior(event) => {
-                if event.starts_form() && !self.behavior.has_pending() && !self.apply() {
+                if matches!(&event, behavior::Event::Creation(behavior::creation::Event::Open(layer)) if *layer != self.layer)
+                {
+                    self.status =
+                        "The active layer changed. Choose New in the current layer.".into();
+                    return Task::none();
+                }
+                let creating = matches!(
+                    &event,
+                    behavior::Event::Creation(behavior::creation::Event::Open(..))
+                );
+                let focus_name = matches!(
+                    &event,
+                    behavior::Event::Creation(behavior::creation::Event::Choose(..))
+                );
+                if creating
+                    && (self.behavior.has_pending() || self.source_dirty() || self.draft_dirty())
+                {
+                    self.status = "Apply or cancel the current draft before starting a new behavior. Your inputs are retained.".into();
+                    return Task::none();
+                }
+                if !creating && event.starts_form() && !self.behavior.has_pending() && !self.apply()
+                {
                     return Task::none();
                 }
                 if event.is_submit() && (self.source_dirty() || self.draft_dirty()) {
@@ -2303,7 +2341,11 @@ impl App {
                             }
                         }
                     }
-                    Ok(None) => {}
+                    Ok(None) => {
+                        if focus_name {
+                            return iced::widget::operation::focus(behavior::creation::NAME_INPUT);
+                        }
+                    }
                     Err(error) => self.status = error,
                 }
             }

crates/oa-desktop/src/app/checkpoints.rs

@@ -173,7 +173,12 @@ impl App {
         self.behavior = restored.behavior;
         self.workflow = restored.workflow;
         let focus = self.behavior.pending_owner().unwrap_or(self.selected);
-        if let Some(layer) = self.project().layer_of(focus) {
+        if let Some(layer) = self
+            .behavior
+            .creation
+            .pending_layer()
+            .or_else(|| self.project().layer_of(focus))
+        {
             self.layer = layer;
             self.explorer_index = crate::explorer::Index::new(self.project(), layer);
             self.active_diagram = self.diagram_for(layer, focus);
@@ -209,6 +214,11 @@ impl App {
             .is_some_and(architecture_authoring::State::inline)
         {
             Task::batch([lint, iced::widget::operation::focus("architecture-name")])
+        } else if self.page == Page::Behavior && self.behavior.creation.created().is_some() {
+            Task::batch([
+                lint,
+                iced::widget::operation::focus(behavior::creation::NAME_INPUT),
+            ])
         } else {
             lint
         }

crates/oa-desktop/src/behavior.rs

@@ -14,6 +14,7 @@ use iced::{
 };
 use oa_core::*;
 use std::collections::BTreeMap;
+pub(crate) mod creation;
 pub(crate) mod scenario;
 pub(crate) mod state_canvas;
 pub(crate) mod state_edit;
@@ -731,6 +732,7 @@ mod scenario_scroll {
 }
 #[derive(Debug, Clone)]
 pub enum Event {
+    Creation(creation::Event),
     Topology(topology::Event),
     Scenario(scenario::Event),
     States(states::Event),
@@ -740,7 +742,8 @@ impl Event {
     pub fn starts_form(&self) -> bool {
         matches!(
             self,
-            Self::Topology(topology::Event::Start(..))
+            Self::Creation(creation::Event::Open(..))
+                | Self::Topology(topology::Event::Start(..))
                 | Self::Scenario(scenario::Event::Start(..))
                 | Self::States(states::Event::Start(..) | states::Event::Edit(..))
         )
@@ -749,6 +752,7 @@ impl Event {
         matches!(
             self,
             Self::Submit
+                | Self::Creation(creation::Event::Submit)
                 | Self::Topology(topology::Event::Submit)
                 | Self::Scenario(scenario::Event::Submit)
                 | Self::States(states::Event::Submit)
@@ -757,6 +761,7 @@ impl Event {
 }
 #[derive(Default)]
 pub struct State {
+    pub(crate) creation: creation::State,
     pub active_owner: Option<Id>,
     pub diagram: state_view::State,
     pub(crate) topology: topology::State,
@@ -773,6 +778,7 @@ struct RecoveryDraft {
 }
 #[derive(serde::Serialize, serde::Deserialize)]
 enum RecoveryKind {
+    Creation,
     State,
     Scenario,
     Process,
@@ -782,6 +788,7 @@ impl State {
     /// viewport geometry and document/revision tokens never cross a restart.
     pub fn recovery_snapshot(&self) -> Result<Option<serde_json::Value>, String> {
         let drafts = [
+            (RecoveryKind::Creation, self.creation.recovery_snapshot()?),
             (RecoveryKind::State, self.states.recovery_snapshot()?),
             (RecoveryKind::Scenario, self.scenario.recovery_snapshot()?),
             (RecoveryKind::Process, self.topology.recovery_snapshot()?),
@@ -817,6 +824,9 @@ impl State {
         }
         let mut restored = Self::default();
         match saved.kind {
+            RecoveryKind::Creation => {
+                restored.creation = creation::State::from_recovery(saved.draft)?
+            }
             RecoveryKind::State => restored.states = states::State::from_recovery(saved.draft)?,
             RecoveryKind::Scenario => {
                 restored.scenario = scenario::State::from_recovery(saved.draft)?
@@ -831,7 +841,7 @@ impl State {
     }
 
     pub fn has_pending(&self) -> bool {
-        self.pending_owner().is_some()
+        self.creation.has_pending() || self.pending_owner().is_some()
     }
 
     pub fn pending_owner(&self) -> Option<Id> {
@@ -844,7 +854,9 @@ impl State {
     /// Prepare the active form without discarding inputs. The caller must execute
     /// this exact command and acknowledge only a successful document transaction.
     pub fn prepare_pending(&self, p: &Project) -> Result<Option<Command>, String> {
-        if self.topology.pending_owner().is_some() {
+        if self.creation.has_pending() {
+            self.creation.prepare_pending(p).map(Some)
+        } else if self.topology.pending_owner().is_some() {
             self.topology.prepare_pending(p).map(Some)
         } else if self.scenario.pending_owner().is_some() {
             self.scenario.prepare_pending(p).map(Some)
@@ -858,6 +870,7 @@ impl State {
     /// Clear the active form after its prepared command commits successfully.
     /// Rejected commands must leave the form available for repair and retry.
     pub fn acknowledge_commit(&mut self) {
+        self.creation.acknowledge_commit();
         self.topology.acknowledge_commit();
         self.scenario.acknowledge_commit();
         self.states.acknowledge_commit();
@@ -867,7 +880,8 @@ impl State {
         if self.has_pending()
             && matches!(
                 &event,
-                Event::Topology(topology::Event::Start(..))
+                Event::Creation(creation::Event::Open(..))
+                    | Event::Topology(topology::Event::Start(..))
                     | Event::Scenario(scenario::Event::Start(..))
                     | Event::States(states::Event::Start(..) | states::Event::Edit(..))
             )
@@ -885,6 +899,7 @@ impl State {
             return Ok(None);
         }
         match event {
+            Event::Creation(event) => self.creation.update(p, event),
             Event::Topology(event) => self.topology.update(p, event),
             Event::Scenario(event) => self.scenario.update(p, event),
             Event::States(event) => self.states.update(p, event),
@@ -898,6 +913,9 @@ impl State {
 
 pub fn view(app: &App) -> Element<'_, Message> {
     let p = app.project();
+    if let Some(card) = app.behavior.creation.view(p) {
+        return card.map(|event| Message::Behavior(Event::Creation(event)));
+    }
     let choices = p
         .elements
         .values()
@@ -916,7 +934,16 @@ pub fn view(app: &App) -> Element<'_, Message> {
         .cloned();
     let mut out = column![heading("Behavior & scenarios", "Follow exchanges and operating conditions. Select a message, state or transition to edit it.")].spacing(14);
     let Some(selected) = selected else {
-        return out.push(label("Start with a Process, Scenario or State machine using Create element. Add occurrences or regions inside it to describe behavior.")).padding(24).into();
+        return out
+            .push(label(
+                "Start a named process, scenario or state machine, then model its behavior here.",
+            ))
+            .push(action(
+                "New",
+                Message::Behavior(Event::Creation(creation::Event::Open(app.layer))),
+            ))
+            .padding(24)
+            .into();
     };
     let e = &p.elements[&selected.id];
     let compact_canvas = matches!(
@@ -930,10 +957,17 @@ pub fn view(app: &App) -> Element<'_, Message> {
         out = column![].spacing(6);
     }
     out = out.push(
-        pick_list(choices, Some(selected), Message::BehaviorOwner)
-            .width(Fill)
-            .text_size(13)
-            .padding(if compact_canvas { 6 } else { 10 }),
+        row![
+            pick_list(choices, Some(selected), Message::BehaviorOwner)
+                .width(Fill)
+                .text_size(13)
+                .padding(if compact_canvas { 6 } else { 10 }),
+            action(
+                "New",
+                Message::Behavior(Event::Creation(creation::Event::Open(app.layer)))
+            )
+        ]
+        .spacing(8),
     );
     if matches!(e.kind(), Kind::Process | Kind::FunctionalChain) {
         return topology::view(app, e.id, out);

crates/oa-desktop/src/behavior/creation.rs

@@ -0,0 +1,665 @@
+//! Local behavior creation. A draft is not a model object: only its validated
+//! batch may cross Document::execute, and acknowledgement follows success.
+use iced::{
+    Element as UiElement, Fill,
+    widget::{button, checkbox, column, container, row, scrollable, text, text_input},
+};
+use oa_core::*;
+use serde::{Deserialize, Serialize};
+
+const PAGE_SIZE: usize = 6;
+pub const NAME_INPUT: &str = "behavior-creation-name";
+
+// A focused text input consumes Escape. Preserve the application's modal
+// priority by emitting its ordinary Escape message from this narrow bridge.
+pub fn subscription(active: bool) -> iced::Subscription<()> {
+    if active {
+        iced::event::listen_with(captured_escape)
+    } else {
+        iced::Subscription::none()
+    }
+}
+
+fn captured_escape(
+    event: iced::Event,
+    status: iced::event::Status,
+    _: iced::window::Id,
+) -> Option<()> {
+    (status == iced::event::Status::Captured
+        && matches!(
+            event,
+            iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
+                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
+                ..
+            })
+        ))
+    .then_some(())
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Family {
+    Sequence,
+    Scenario,
+    Machine,
+}
+impl Family {
+    fn kind(self, layer: Layer) -> Kind {
+        match (self, layer) {
+            (Self::Sequence, Layer::Oa) => Kind::Process,
+            (Self::Sequence, Layer::Sa) => Kind::FunctionalChain,
+            (Self::Scenario, _) => Kind::Scenario,
+            (Self::Machine, _) => Kind::StateMachine,
+        }
+    }
+    fn title(self, layer: Layer) -> &'static str {
+        match (self, layer) {
+            (Self::Sequence, Layer::Oa) => "Operational process",
+            (Self::Sequence, Layer::Sa) => "Functional chain",
+            (Self::Scenario, _) => "Scenario",
+            (Self::Machine, _) => "State machine",
+        }
+    }
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Picker {
+    Owner,
+    Context,
+}
+impl Picker {
+    fn index(self) -> usize {
+        match self {
+            Self::Owner => 0,
+            Self::Context => 1,
+        }
+    }
+}
+#[derive(Debug, Clone)]
+pub enum Event {
+    Open(Layer),
+    Choose(Family),
+    Name(String),
+    Owner(Id),
+    Viewpoint(ScenarioViewpoint),
+    Context(Option<Id>),
+    ContextOptions(bool),
+    FirstView(bool),
+    Search(Picker, String),
+    Page(Picker, usize),
+    Cancel,
+    Submit,
+}
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Browser {
+    query: String,
+    page: usize,
+}
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Draft {
+    version: u32,
+    document: Id,
+    layer: Layer,
+    family: Option<Family>,
+    name: String,
+    owner: Option<Id>,
+    viewpoint: Option<ScenarioViewpoint>,
+    context: Option<Id>,
+    #[serde(default)]
+    context_open: bool,
+    first_view: bool,
+    element: Id,
+    diagram: Id,
+    placement: Id,
+    browsers: [Browser; 2],
+}
+#[derive(Default)]
+pub struct State {
+    draft: Option<Draft>,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Created {
+    pub behavior: Id,
+    pub layer: Layer,
+    pub diagram: Option<Id>,
+}
+
+impl State {
+    pub fn has_pending(&self) -> bool {
+        self.draft.is_some()
+    }
+    pub fn pending_layer(&self) -> Option<Layer> {
+        self.draft.as_ref().map(|d| d.layer)
+    }
+    /// Capture this before successful acknowledgement; never select these IDs
+    /// on mere planning or a rejected source/model transaction.
+    pub fn created(&self) -> Option<Created> {
+        let d = self.draft.as_ref()?;
+        d.family.map(|family| Created {
+            behavior: d.element,
+            layer: d.layer,
+            diagram: (family == Family::Machine && d.first_view).then_some(d.diagram),
+        })
+    }
+    /// Match before execution, then apply this target only after success.
+    /// Identity alone is insufficient: changed bodies or trailing operations
+    /// must not inherit the prepared creation's selection/opening contract.
+    pub fn created_by(&self, p: &Project, command: &Command) -> Option<Created> {
+        let target = self.created()?;
+        (self.prepare_pending(p).ok().as_ref() == Some(command)).then_some(target)
+    }
+    pub fn recovery_snapshot(&self) -> Result<Option<serde_json::Value>, String> {
+        self.draft
+            .as_ref()
+            .map(serde_json::to_value)
+            .transpose()
+            .map_err(|e| e.to_string())
+    }
+    pub fn from_recovery(value: serde_json::Value) -> Result<Self, String> {
+        let draft: Draft = serde_json::from_value(value).map_err(|e| e.to_string())?;
+        if draft.version != 1 {
+            return Err("Unsupported behavior creation draft version.".into());
+        }
+        // Raw values and stale references remain editable; planning validates
+        // against the current document rather than silently fixing the draft.
+        Ok(Self { draft: Some(draft) })
+    }
+    pub fn acknowledge_commit(&mut self) {
+        self.draft = None;
+    }
+    pub fn prepare_pending(&self, p: &Project) -> Result<Command, String> {
+        self.draft
+            .as_ref()
+            .ok_or("Choose New to start a behavior.")?
+            .command(p)
+    }
+    pub fn update(&mut self, p: &Project, event: Event) -> Result<Option<Command>, String> {
+        match event {
+            Event::Cancel => {
+                self.draft = None;
+                return Ok(None);
+            }
+            Event::Open(layer) => {
+                if self.has_pending() {
+                    return Err("Create or cancel the pending behavior first.".into());
+                }
+                self.draft = Some(Draft {
+                    version: 1,
+                    document: p.id,
+                    layer,
+                    family: None,
+                    name: String::new(),
+                    owner: None,
+                    viewpoint: None,
+                    context: None,
+                    context_open: false,
+                    first_view: false,
+                    element: Id::new_v4(),
+                    diagram: Id::new_v4(),
+                    placement: Id::new_v4(),
+                    browsers: Default::default(),
+                });
+                return Ok(None);
+            }
+            Event::Submit => return self.prepare_pending(p).map(Some),
+            _ => {}
+        }
+        let d = self
+            .draft
+            .as_mut()
+            .ok_or("Choose New to start a behavior.")?;
+        if d.document != p.id {
+            return Err("This draft belongs to another document. Cancel it to start here.".into());
+        }
+        match event {
+            Event::Choose(family) => {
+                if d.family.is_some_and(|old| old != family) {
+                    return Err(
+                        "Cancel this draft before choosing a different behavior family.".into(),
+                    );
+                }
+                d.family = Some(family);
+            }
+            Event::Name(name) => d.name = name,
+            Event::Owner(id) if d.family == Some(Family::Machine) => {
+                if !eligible(p, d.layer, Picker::Owner, id) {
+                    return Err("Choose an existing participant in this layer.".into());
+                }
+                d.owner = Some(id);
+            }
+            Event::Viewpoint(viewpoint) if d.family == Some(Family::Scenario) => {
+                if !viewpoints(d.layer).contains(&viewpoint) {
+                    return Err("Choose a scenario viewpoint from this layer.".into());
+                }
+                d.viewpoint = Some(viewpoint);
+            }
+            Event::Context(id) if d.family == Some(Family::Scenario) => {
+                if id.is_some_and(|id| !eligible(p, d.layer, Picker::Context, id)) {
+                    return Err("Choose an existing same-layer scenario context.".into());
+                }
+                d.context = id;
+            }
+            Event::ContextOptions(open) if d.family == Some(Family::Scenario) => {
+                d.context_open = open;
+            }
+            Event::FirstView(value) if d.family == Some(Family::Machine) => d.first_view = value,
+            Event::Search(picker, query) => d.browsers[picker.index()] = Browser { query, page: 0 },
+            Event::Page(picker, page) => d.browsers[picker.index()].page = page,
+            Event::Cancel | Event::Open(_) | Event::Submit => unreachable!(),
+            _ => return Err("That field does not apply to this behavior family.".into()),
+        }
+        Ok(None)
+    }
+}
+
+fn viewpoints(layer: Layer) -> [ScenarioViewpoint; 2] {
+    match layer {
+        Layer::Oa => [
+            ScenarioViewpoint::OperationalActivity,
+            ScenarioViewpoint::ParticipantInteraction,
+        ],
+        Layer::Sa => [
+            ScenarioViewpoint::Functional,
+            ScenarioViewpoint::BoundaryInterface,
+        ],
+    }
+}
+fn viewpoint_title(viewpoint: ScenarioViewpoint) -> &'static str {
+    match viewpoint {
+        ScenarioViewpoint::OperationalActivity => "Activities · operational exchanges",
+        ScenarioViewpoint::ParticipantInteraction => "Participants · interactions",
+        ScenarioViewpoint::Functional => "Functions · functional exchanges",
+        ScenarioViewpoint::BoundaryInterface => "System boundary · interface exchanges",
+        ScenarioViewpoint::MixedLegacy => "Legacy mixed viewpoint",
+    }
+}
+fn eligible(p: &Project, layer: Layer, picker: Picker, id: Id) -> bool {
+    p.elements.get(&id).is_some_and(|e| {
+        e.layer() == layer
+            && match picker {
+                Picker::Owner => validation::parent_permits(e.kind(), Kind::StateMachine),
+                Picker::Context => {
+                    e.kind().is_sequence()
+                        || e.kind().is_work()
+                        || e.kind().is_performer()
+                        || matches!(
+                            e.kind(),
+                            Kind::Capability
+                                | Kind::SystemCapability
+                                | Kind::OperationalMission
+                                | Kind::Mission
+                        )
+                }
+            }
+    })
+}
+fn choices<'a>(p: &'a Project, layer: Layer, picker: Picker, query: &str) -> Vec<&'a Element> {
+    let query = query.trim().to_lowercase();
+    let mut matches: Vec<_> = p
+        .elements
+        .values()
+        .filter(|e| eligible(p, layer, picker, e.id))
+        .filter(|e| query.is_empty() || reference_label(p, e.id).to_lowercase().contains(&query))
+        .collect();
+    matches.sort_by(|a, b| {
+        a.name
+            .to_lowercase()
+            .cmp(&b.name.to_lowercase())
+            .then(a.id.cmp(&b.id))
+    });
+    matches
+}
+
+fn reference_context(p: &Project, e: &Element) -> String {
+    let mut names = Vec::new();
+    let mut parent = e.parent;
+    let mut seen = std::collections::BTreeSet::new();
+    while let Some(id) = parent {
+        if !seen.insert(id) {
+            break;
+        }
+        let Some(ancestor) = p.elements.get(&id) else {
+            break;
+        };
+        names.push(ancestor.name.as_str());
+        parent = ancestor.parent;
+    }
+    names.reverse();
+    let location = if names.is_empty() {
+        format!("{} root", e.layer())
+    } else {
+        format!("{} / {}", e.layer(), names.join(" / "))
+    };
+    format!("{} · {} · {location}", e.kind(), e.alias)
+}
+fn reference_label(p: &Project, id: Id) -> String {
+    p.elements
+        .get(&id)
+        .map(|e| format!("{} · {}", e.name, reference_context(p, e)))
+        .unwrap_or_else(|| "Missing element — choose a replacement".into())
+}
+impl Draft {
+    fn command(&self, p: &Project) -> Result<Command, String> {
+        if self.document != p.id {
+            return Err("This draft belongs to another document.".into());
+        }
+        let family = self
+            .family
+            .ok_or("Choose the behavior you want to create.")?;
+        if self.name.trim().is_empty() {
+            return Err("Enter the behavior's name before creating it.".into());
+        }
+        if [self.element, self.diagram, self.placement]
+            .into_iter()
+            .any(|id| p.contains(id))
+            || self.element == self.diagram
+            || self.element == self.placement
+            || self.diagram == self.placement
+        {
+            return Err(
+                "A reserved creation identity is already in use. Cancel and start a fresh draft."
+                    .into(),
+            );
+        }
+        let kind = family.kind(self.layer);
+        let parent = if family == Family::Machine {
+            Some(
+                self.owner
+                    .filter(|id| eligible(p, self.layer, Picker::Owner, *id))
+                    .ok_or("Choose the participant that owns this state machine.")?,
+            )
+        } else {
+            if self.owner.is_some() {
+                return Err("Processes and scenarios belong at the layer root; context is a separate reference.".into());
+            }
+            None
+        };
+        if family != Family::Machine && self.first_view {
+            return Err("A state view can only accompany a state machine.".into());
+        }
+        let mut body = ElementBody::new(kind, self.layer)
+            .ok_or("This behavior is unavailable in this layer.")?;
+        if family == Family::Scenario {
+            let viewpoint = self
+                .viewpoint
+                .filter(|v| viewpoints(self.layer).contains(v))
+                .ok_or("Choose the scenario's viewpoint explicitly.")?;
+            if self
+                .context
+                .is_some_and(|id| !eligible(p, self.layer, Picker::Context, id))
+            {
+                return Err(
+                    "The selected scenario context is missing or no longer compatible.".into(),
+                );
+            }
+            body = ElementBody::shared_in(
+                self.layer,
+                SharedBody::Scenario {
+                    viewpoint,
+                    context: self.context,
+                    precondition: String::new(),
+                    postcondition: String::new(),
+                    steps: Vec::new(),
+                },
+            );
+        } else if self.viewpoint.is_some() || self.context.is_some() {
+            return Err(
+                "Scenario viewpoint and context cannot be applied to another behavior family."
+                    .into(),
+            );
+        }
+        let element = Element {
+            id: self.element,
+            alias: p.fresh_alias(&self.name, "behavior", self.element),
+            name: self.name.clone(),
+            description: String::new(),
+            parent,
+            body,
+        };
+        let mut commands = vec![Command::CreateElement(element)];
+        if self.first_view {
+            let working = execute_batch(p, &commands).map_err(|e| e.to_string())?;
+            // Reuse the state editor's geometry contract. A new machine has one
+            // root placement; reserve both presentation IDs across retries.
+            let plan = super::state_edit::create_view(&working, self.element)
+                .map_err(|e| e.to_string())?;
+            let Command::Batch(mut view_commands) = plan.command else {
+                return Err("Unexpected state-view plan.".into());
+            };
+            if view_commands.len() != 2 {
+                return Err("Unexpected additional operation in the first state-view plan.".into());
+            }
+            let Some(Command::Layout(layout)) = view_commands.pop() else {
+                return Err("State-view plan must finish with its layout operation.".into());
+            };
+            let Some(Command::CreateDiagram(mut diagram)) = view_commands.pop() else {
+                return Err("State-view plan is missing its diagram.".into());
+            };
+            if diagram.id != layout || diagram.nodes.len() != 1 {
+                return Err("A first state view must contain only its new machine.".into());
+            }
+            let mut node = diagram
+                .nodes
+                .into_values()
+                .next()
+                .ok_or("State-view root is missing.")?;
+            if node.element != self.element {
+                return Err("State-view root differs from the new machine.".into());
+            }
+            diagram.id = self.diagram;
+            diagram.alias = working.fresh_alias(&diagram.name, "state_view", self.diagram);
+            node.id = self.placement;
+            node.alias = working.fresh_alias(
+                &format!("{} placement", self.name),
+                "placement",
+                self.placement,
+            );
+            diagram.nodes = [(node.id, node)].into_iter().collect();
+            commands.push(Command::CreateDiagram(diagram));
+            commands.push(Command::Layout(self.diagram));
+        }
+        let command = Command::Batch(commands);
+        execute_batch(p, std::slice::from_ref(&command)).map_err(|e| e.to_string())?;
+        Ok(command)
+    }
+}
+
+impl State {
+    /// Parent maps these local events into the existing guarded Behavior route.
+    /// The card's fields scroll; Create/Cancel stay outside that scroll region.
+    pub fn view<'a>(&'a self, p: &'a Project) -> Option<UiElement<'a, Event>> {
+        self.view_with(p)
+    }
+    fn view_with<'a, R: iced::advanced::text::Renderer + 'a>(
+        &'a self,
+        p: &'a Project,
+    ) -> Option<UiElement<'a, Event, iced::Theme, R>> {
+        let d = self.draft.as_ref()?;
+        let mut fields = column![].spacing(10);
+        let title = if let Some(family) = d.family {
+            fields = fields.push(
+                text_input("Exact behavior name", &d.name)
+                    .id(NAME_INPUT)
+                    .on_input(Event::Name)
+                    .on_submit(Event::Submit)
+                    .padding(8),
+            );
+            match family {
+                Family::Sequence => {
+                    fields = fields.push(
+                        text(format!(
+                            "Owned by the {} layer root. Involve existing work after creation.",
+                            d.layer
+                        ))
+                        .size(12),
+                    );
+                }
+                Family::Scenario => {
+                    fields = fields.push(
+                        text(format!(
+                            "Owned by the {} layer root. Choose what the lifelines represent:",
+                            d.layer
+                        ))
+                        .size(12),
+                    );
+                    for viewpoint in viewpoints(d.layer) {
+                        fields = fields.push(
+                            button(text(viewpoint_title(viewpoint)).size(13))
+                                .style(if d.viewpoint == Some(viewpoint) {
+                                    button::primary
+                                } else {
+                                    button::secondary
+                                })
+                                .on_press(Event::Viewpoint(viewpoint))
+                                .padding(7),
+                        );
+                    }
+                    let context_label = if d.context_open {
+                        "Hide optional context".into()
+                    } else if let Some(id) = d.context {
+                        format!("Context: {} · Change…", reference_label(p, id))
+                    } else {
+                        "Add optional context…".into()
+                    };
+                    fields = fields.push(
+                        button(text(context_label).size(12))
+                            .on_press(Event::ContextOptions(!d.context_open))
+                            .padding(6),
+                    );
+                    if d.context_open {
+                        fields = fields.push(picker_view(p, d, Picker::Context));
+                    }
+                }
+                Family::Machine => {
+                    fields = fields.push(picker_view(p, d, Picker::Owner));
+                    fields = fields.push(
+                        checkbox(d.first_view)
+                            .label("Create the first state view")
+                            .on_toggle(Event::FirstView),
+                    );
+                    fields = fields.push(text("The machine starts without regions or states. Add those explicitly in its workspace.").size(12));
+                }
+            }
+            format!("New {}", family.title(d.layer))
+        } else {
+            for family in [Family::Sequence, Family::Scenario, Family::Machine] {
+                let purpose = match family {
+                    Family::Sequence => "A path through existing work and exchanges",
+                    Family::Scenario => "Ordered interactions from an explicit viewpoint",
+                    Family::Machine => "States and modes of an existing participant",
+                };
+                fields = fields.push(
+                    button(
+                        column![text(family.title(d.layer)).size(15), text(purpose).size(12)]
+                            .spacing(3),
+                    )
+                    .on_press(Event::Choose(family))
+                    .padding(10)
+                    .width(Fill),
+                );
+            }
+            format!("New behavior · {}", d.layer)
+        };
+        let mut actions =
+            row![button("Cancel · Esc").on_press(Event::Cancel).padding(8)].spacing(8);
+        if d.family.is_some() {
+            actions = actions.push(button("Create and open").on_press(Event::Submit).padding(8));
+        }
+        Some(
+            container(
+                column![
+                    text(title).size(20),
+                    scrollable(fields)
+                        .id("behavior-creation-fields")
+                        .height(Fill),
+                    container(actions).id("behavior-creation-actions")
+                ]
+                .spacing(12),
+            )
+            .padding(18)
+            .max_width(680)
+            .height(Fill)
+            .style(crate::style::card)
+            .into(),
+        )
+    }
+}
+fn picker_view<'a, R: iced::advanced::text::Renderer + 'a>(
+    p: &'a Project,
+    d: &'a Draft,
+    picker: Picker,
+) -> UiElement<'a, Event, iced::Theme, R> {
+    let browser = &d.browsers[picker.index()];
+    let options = choices(p, d.layer, picker, &browser.query);
+    let page = browser
+        .page
+        .min(options.len().saturating_sub(1) / PAGE_SIZE);
+    let selected = match picker {
+        Picker::Owner => d.owner,
+        Picker::Context => d.context,
+    };
+    let title = match picker {
+        Picker::Owner => "Owned by participant",
+        Picker::Context => "Scenario context · optional",
+    };
+    let mut out = column![
+        text(title).size(13),
+        text_input("Search names, aliases or parent context", &browser.query)
+            .on_input(move |query| Event::Search(picker, query))
+            .padding(6)
+    ]
+    .spacing(5);
+    if let Some(id) = selected {
+        out = out.push(text(format!("Selected: {}", reference_label(p, id))).size(12));
+    } else if picker == Picker::Context {
+        out = out.push(text("No context selected").size(12));
+    }
+    if options.is_empty() {
+        out = out.push(text(match picker {
+            Picker::Owner => "No matching participant. Refine the search, or cancel and create a participant in Architecture first.",
+            Picker::Context => "No matching context. Refine the search, or leave this optional reference empty.",
+        }).size(12));
+    }
+    for e in options.iter().skip(page * PAGE_SIZE).take(PAGE_SIZE) {
+        let message = match picker {
+            Picker::Owner => Event::Owner(e.id),
+            Picker::Context => Event::Context(Some(e.id)),
+        };
+        out = out.push(
+            container(
+                button(
+                    column![
+                        text(&e.name).size(13),
+                        text(reference_context(p, e)).size(11)
+                    ]
+                    .spacing(2),
+                )
+                .style(if selected == Some(e.id) {
+                    button::primary
+                } else {
+                    button::secondary
+                })
+                .on_press(message)
+                .padding(6)
+                .width(Fill),
+            )
+            .id(format!("behavior-creation-candidate-{}", e.id)),
+        );
+    }
+    let mut navigation = row![text(format!("{} matches", options.len())).size(11)].spacing(8);
+    if page > 0 {
+        navigation = navigation.push(button("Previous").on_press(Event::Page(picker, page - 1)));
+    }
+    if (page + 1) * PAGE_SIZE < options.len() {
+        navigation = navigation.push(button("Next").on_press(Event::Page(picker, page + 1)));
+    }
+    if picker == Picker::Context && selected.is_some() {
+        navigation = navigation.push(button("Clear context").on_press(Event::Context(None)));
+    }
+    out.push(navigation).into()
+}
+
+#[cfg(test)]
+mod app_tests;
+#[cfg(test)]
+mod tests;

crates/oa-desktop/src/behavior/creation/app_tests.rs

@@ -0,0 +1,340 @@
+//! App-boundary regressions for the coordinated parent wiring. No I/O task is
+//! polled: file dialogs, checkpoint writes and lesson loading remain inactive.
+use super::*;
+use crate::app::{App, Message, Page, Pending};
+use std::sync::Arc;
+
+fn send(app: &mut App, event: Event) {
+    let _ = app.update(Message::Behavior(crate::behavior::Event::Creation(event)));
+}
+fn raw_property(app: &App) -> serde_json::Value {
+    serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap()
+}
+fn begin(app: &mut App, layer: Layer, family: Family, name: &str) {
+    let _ = app.update(Message::Layer(layer));
+    let _ = app.update(Message::Page(Page::Behavior));
+    send(app, Event::Open(layer));
+    send(app, Event::Choose(family));
+    send(app, Event::Name(name.into()));
+}
+
+fn focused_escape() -> Message {
+    use iced::advanced::{Layout, Shell, layout, widget};
+    use iced::keyboard::{self, key::Named};
+    let mut input: iced::Element<'_, (), iced::Theme, ()> = text_input("Name", "Unfinished name")
+        .id(NAME_INPUT)
+        .on_input(|_| ())
+        .into();
+    let mut tree = widget::Tree::new(input.as_widget());
+    let size = iced::Size::new(300., 40.);
+    let node =
+        input
+            .as_widget_mut()
+            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
+    tree.state
+        .downcast_mut::<iced::widget::text_input::State<()>>()
+        .focus();
+    let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
+        key: keyboard::Key::Named(Named::Escape),
+        modified_key: keyboard::Key::Named(Named::Escape),
+        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
+        location: keyboard::Location::Standard,
+        modifiers: keyboard::Modifiers::empty(),
+        text: None,
+        repeat: false,
+    });
+    let mut messages = Vec::new();
+    let mut shell = Shell::new(&mut messages);
+    input.as_widget_mut().update(
+        &mut tree,
+        &event,
+        Layout::new(&node),
+        iced::mouse::Cursor::Unavailable,
+        &(),
+        &mut iced::advanced::clipboard::Null,
+        &mut shell,
+        &iced::Rectangle::new(iced::Point::ORIGIN, size),
+    );
+    assert!(shell.is_event_captured());
+    assert_eq!(
+        captured_escape(
+            event.clone(),
+            iced::event::Status::Ignored,
+            iced::window::Id::unique()
+        ),
+        None
+    );
+    captured_escape(
+        event,
+        iced::event::Status::Captured,
+        iced::window::Id::unique(),
+    )
+    .unwrap();
+    Message::Escape
+}
+
+#[test]
+fn app_first_captured_escape_dismisses_file_or_pending_overlay_before_creation() {
+    for file in [false, true] {
+        let mut app = App::with_project(Project::empty());
+        begin(
+            &mut app,
+            Layer::Oa,
+            Family::Sequence,
+            "Keep while overlay closes",
+        );
+        let raw = app.behavior.recovery_snapshot().unwrap();
+        let accepted = app.document.snapshot();
+        if file {
+            app.file_prompt = Some(crate::app::FilePrompt {
+                operation: crate::app::FileOperation::Save,
+                path: "unsubmitted-name.arcadia".into(),
+                overwrite: false,
+            });
+        } else {
+            app.pending = Some(Pending::Walkthrough);
+        }
+        let _ = app.update(focused_escape());
+        assert!(app.file_prompt.is_none());
+        assert!(app.pending.is_none());
+        assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        let _ = app.update(focused_escape());
+        assert!(!app.behavior.has_pending());
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn app_creation_opens_the_actual_new_owner_instead_of_first_or_previously_active_behavior() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut p = Project::empty();
+        let old = p
+            .add_element(Family::Sequence.kind(layer), layer, "Old behavior", None)
+            .unwrap();
+        let mut app = App::with_project(p.clone());
+        let _ = app.update(Message::Select(old));
+        begin(&mut app, layer, Family::Sequence, "  New exact path 雨  ");
+        let target = app.behavior.creation.created().unwrap();
+        assert_ne!(target.behavior, old);
+        let before = app.document.bundle().clone();
+        send(&mut app, Event::Submit);
+        assert_eq!(app.page, Page::Behavior);
+        assert_eq!(app.layer, layer);
+        assert_eq!(app.selected, target.behavior);
+        assert_eq!(app.behavior.active_owner, Some(target.behavior));
+        assert_eq!(crate::behavior::selected_owner(&app), Some(target.behavior));
+        assert_eq!(
+            app.project().elements[&target.behavior].name,
+            "  New exact path 雨  "
+        );
+        assert!(!app.behavior.has_pending());
+        let after = app.document.bundle().clone();
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &before);
+        assert!(!app.document.can_undo());
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &after);
+        assert_eq!(app.project().elements[&old], p.elements[&old]);
+    }
+}
+
+#[test]
+fn app_machine_behavior_submit_opens_its_opted_in_view_as_one_undoable_transaction() {
+    for first_view in [false, true] {
+        let mut p = Project::empty();
+        let owner = p
+            .add_element(Kind::System, Layer::Sa, "Flight system", None)
+            .unwrap();
+        let mut app = App::with_project(p.clone());
+        begin(&mut app, Layer::Sa, Family::Machine, "  Flight modes 雨  ");
+        send(&mut app, Event::Owner(owner));
+        send(&mut app, Event::FirstView(first_view));
+        let target = app.behavior.creation.created().unwrap();
+        let before = app.document.bundle().clone();
+        let _ = app.update(Message::Behavior(crate::behavior::Event::Submit));
+        assert!(!app.behavior.has_pending(), "{}", app.status);
+        assert_eq!(app.selected, target.behavior);
+        assert_eq!(app.behavior.active_owner, Some(target.behavior));
+        assert_eq!(app.behavior.diagram.diagram, target.diagram);
+        assert_eq!(
+            crate::behavior::state_view::diagram(&app, target.behavior),
+            target.diagram
+        );
+        assert_eq!(app.project().elements[&target.behavior].parent, Some(owner));
+        assert_eq!(app.page, Page::Behavior);
+        let after = app.document.bundle().clone();
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &before);
+        assert_eq!(app.project(), &p);
+        assert!(!app.document.can_undo());
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &after);
+    }
+}
+
+#[test]
+fn app_stale_layer_open_never_starts_or_replaces_a_draft() {
+    let mut app = App::with_project(Project::empty());
+    let _ = app.update(Message::Layer(Layer::Sa));
+    app.page = Page::Behavior;
+    let accepted = app.document.snapshot();
+    send(&mut app, Event::Open(Layer::Oa));
+    assert!(!app.behavior.has_pending());
+    assert_eq!(app.layer, Layer::Sa);
+    send(&mut app, Event::Open(Layer::Sa));
+    send(&mut app, Event::Choose(Family::Sequence));
+    send(&mut app, Event::Name("Retained system chain".into()));
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    send(&mut app, Event::Open(Layer::Oa));
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+}
+
+#[test]
+fn app_new_never_auto_applies_valid_or_invalid_property_and_source_drafts() {
+    for dirty in [
+        "property-valid",
+        "property-invalid",
+        "source-valid",
+        "source-invalid",
+    ] {
+        let mut app = App::with_project(Project::empty());
+        app.page = Page::Behavior;
+        match dirty {
+            "property-valid" => app
+                .draft
+                .as_mut()
+                .unwrap()
+                .input("/name", "Raw property name".into()),
+            "property-invalid" => app.draft.as_mut().unwrap().input("/id", "-".into()),
+            "source-valid" => app.source_workspace.edit(
+                format!("{}\n// Retained comment\n", app.source_workspace.text()),
+                app.source_editor.cursor(),
+            ),
+            _ => app
+                .source_workspace
+                .edit("unfinished source 雨".into(), app.source_editor.cursor()),
+        }
+        let accepted = app.document.snapshot();
+        let property = raw_property(&app);
+        let workspace = app.source_workspace.recovery_snapshot();
+        send(&mut app, Event::Open(Layer::Oa));
+        assert!(
+            !app.behavior.creation.has_pending(),
+            "{dirty}: New must refuse without applying another editor"
+        );
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        assert_eq!(raw_property(&app), property);
+        assert_eq!(
+            serde_json::to_value(app.source_workspace.recovery_snapshot()).unwrap(),
+            serde_json::to_value(workspace).unwrap()
+        );
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn app_choosing_another_behavior_or_layer_cannot_commit_a_creation_draft() {
+    let mut p = Project::empty();
+    let old = p
+        .add_element(Kind::Process, Layer::Oa, "Old process", None)
+        .unwrap();
+    let mut app = App::with_project(p);
+    begin(&mut app, Layer::Oa, Family::Sequence, "Retain this process");
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let accepted = app.document.snapshot();
+    let _ = app.update(Message::Layer(Layer::Sa));
+    let _ = app.update(Message::BehaviorOwner(crate::app::Choice {
+        id: old,
+        label: "Old process".into(),
+    }));
+    assert_eq!(app.layer, Layer::Oa);
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    let _ = app.update(Message::Escape);
+    assert!(!app.behavior.has_pending());
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn app_lesson_request_cancel_retains_creation_then_escape_discards_only_the_draft() {
+    let mut app = App::with_project(Project::empty());
+    begin(
+        &mut app,
+        Layer::Oa,
+        Family::Sequence,
+        "Unfinished engineering path",
+    );
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let accepted = app.document.snapshot();
+    let task = app.update(Message::Home(crate::home::Event::Walkthrough));
+    assert!(matches!(app.pending, Some(Pending::Walkthrough)));
+    assert!(iced_runtime::task::into_stream(task).is_none());
+    let _ = app.update(Message::Escape);
+    assert!(app.pending.is_none());
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    let _ = app.update(Message::Escape);
+    assert!(!app.behavior.has_pending());
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+}
+
+#[test]
+fn app_recovered_rootless_sa_creation_retains_layer_ids_and_other_raw_drafts() {
+    let mut app = App::with_project(Project::empty());
+    begin(
+        &mut app,
+        Layer::Sa,
+        Family::Scenario,
+        "  Recovered system scenario 雨  ",
+    );
+    send(
+        &mut app,
+        Event::Viewpoint(ScenarioViewpoint::BoundaryInterface),
+    );
+    // Recovery can contain simultaneous drafts even though new input is guarded.
+    app.draft
+        .as_mut()
+        .unwrap()
+        .input("/name", "Retained property".into());
+    app.source_workspace.edit(
+        "unfinished source preserved".into(),
+        app.source_editor.cursor(),
+    );
+    let snapshot = crate::recovery::Snapshot::capture(
+        app.canvas_document,
+        &app.document,
+        &app.source_workspace,
+        app.draft.as_ref(),
+        &app.behavior,
+        None,
+        app.selected,
+    )
+    .unwrap();
+    let expected = snapshot.clone().restore().unwrap();
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let mut restored = App::with_project(Project::empty());
+    let _ = restored.update(Message::CheckpointLoaded(Ok(Arc::new(snapshot))));
+    assert_eq!(restored.page, Page::Behavior);
+    assert_eq!(restored.layer, Layer::Sa);
+    assert_eq!(restored.behavior.recovery_snapshot().unwrap(), raw);
+    assert_eq!(
+        restored.behavior.creation.created(),
+        app.behavior.creation.created()
+    );
+    assert_eq!(restored.project(), expected.document.project());
+    assert_eq!(restored.document.bundle(), expected.document.bundle());
+    assert_eq!(
+        restored.source_workspace.bundle(),
+        expected.workspace.bundle()
+    );
+    assert_eq!(raw_property(&restored), raw_property(&app));
+    let before = restored.document.snapshot();
+    send(&mut restored, Event::Submit);
+    assert!(Arc::ptr_eq(&before, &restored.document.snapshot()));
+    assert_eq!(restored.behavior.recovery_snapshot().unwrap(), raw);
+    assert_eq!(raw_property(&restored), raw_property(&app));
+}

crates/oa-desktop/src/behavior/creation/tests.rs

@@ -0,0 +1,599 @@
+use super::*;
+use crate::document::Document;
+use oa_core::source_project::ProjectLimits;
+
+fn start(p: &Project, layer: Layer, family: Family, name: &str) -> State {
+    let mut state = State::default();
+    assert!(state.update(p, Event::Open(layer)).unwrap().is_none());
+    state.update(p, Event::Choose(family)).unwrap();
+    state.update(p, Event::Name(name.into())).unwrap();
+    state
+}
+
+#[test]
+fn mounted_creation_keeps_actions_visible_and_renders_only_six_owner_candidates() {
+    use iced::advanced::{Layout, layout, widget};
+    use iced::{Rectangle, Size, Vector};
+    struct Geometry {
+        candidates: Vec<widget::Id>,
+        rendered: Vec<widget::Id>,
+        actions: Option<Rectangle>,
+        fields: Option<Rectangle>,
+    }
+    impl widget::Operation for Geometry {
+        fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+            visit(self);
+        }
+        fn container(&mut self, id: Option<&widget::Id>, bounds: Rectangle) {
+            if id == Some(&widget::Id::new("behavior-creation-actions")) {
+                self.actions = Some(bounds);
+            }
+            if let Some(id) = id.filter(|id| self.candidates.contains(id)) {
+                self.rendered.push(id.clone());
+            }
+        }
+        fn scrollable(
+            &mut self,
+            id: Option<&widget::Id>,
+            bounds: Rectangle,
+            _: Rectangle,
+            _: Vector,
+            _: &mut dyn widget::operation::Scrollable,
+        ) {
+            if id == Some(&widget::Id::new("behavior-creation-fields")) {
+                self.fields = Some(bounds);
+            }
+        }
+    }
+    let mut p = Project::empty();
+    for index in 0..105 {
+        p.add_element(
+            Kind::Entity,
+            Layer::Oa,
+            &format!(
+                "{index:03} Long engineering participant name {}",
+                "雨 extended ".repeat(20)
+            ),
+            None,
+        )
+        .unwrap();
+    }
+    let candidates: Vec<_> = p
+        .elements
+        .keys()
+        .map(|id| widget::Id::from(format!("behavior-creation-candidate-{id}")))
+        .collect();
+    for family in [Family::Sequence, Family::Scenario, Family::Machine] {
+        let state = start(&p, Layer::Oa, family, "Very long exact behavior name 雨");
+        for size in [
+            Size::new(500., 570.),
+            Size::new(1050., 570.),
+            Size::new(500., 320.),
+        ] {
+            let mut view: UiElement<'_, Event, iced::Theme, ()> = state.view_with(&p).unwrap();
+            let mut tree = widget::Tree::new(view.as_widget());
+            let node =
+                view.as_widget_mut()
+                    .layout(&mut tree, &(), &layout::Limits::new(Size::ZERO, size));
+            let mut geometry = Geometry {
+                candidates: candidates.clone(),
+                rendered: Vec::new(),
+                actions: None,
+                fields: None,
+            };
+            view.as_widget_mut()
+                .operate(&mut tree, Layout::new(&node), &(), &mut geometry);
+            let actions = geometry.actions.unwrap();
+            let fields = geometry.fields.unwrap();
+            assert!(actions.x >= 0. && actions.y >= 0.);
+            assert!(
+                actions.x + actions.width <= size.width
+                    && actions.y + actions.height <= size.height
+            );
+            assert!(fields.height >= 100. && fields.y + fields.height <= actions.y);
+            assert_eq!(
+                geometry.rendered.len(),
+                if family == Family::Machine { 6 } else { 0 }
+            );
+        }
+    }
+}
+
+fn roundtrip(p: Project, state: &mut State) -> Project {
+    let command = state.update(&p, Event::Submit).unwrap().unwrap();
+    assert_eq!(
+        command,
+        state.prepare_pending(&p).unwrap(),
+        "preparation must retain reserved IDs"
+    );
+    let api: Command = serde_json::from_value(serde_json::to_value(&command).unwrap()).unwrap();
+    assert_eq!(api, command);
+    let expected = execute_batch(&p, &[api]).unwrap();
+    let target = state.created().unwrap();
+    let mut document = Document::from_project(p.clone(), ProjectLimits::default()).unwrap();
+    let before_source = document.bundle().clone();
+    document.execute(command).unwrap();
+    assert_eq!(document.project(), &expected);
+    assert!(
+        state.has_pending(),
+        "only successful acknowledgement clears raw fields"
+    );
+    state.acknowledge_commit();
+    assert!(!state.has_pending());
+    assert!(document.project().elements.contains_key(&target.behavior));
+    let after_source = document.bundle().clone();
+    assert!(document.undo());
+    assert_eq!(document.project(), &p);
+    assert_eq!(document.bundle(), &before_source);
+    assert!(!document.can_undo(), "one creation must be one Undo entry");
+    assert!(document.redo());
+    assert_eq!(document.project(), &expected);
+    assert_eq!(document.bundle(), &after_source);
+    let reopened = Document::from_bundle(after_source, ProjectLimits::default()).unwrap();
+    assert_eq!(reopened.project(), &expected);
+    expected
+}
+
+#[test]
+fn oa_process_and_sa_chain_keep_exact_names_root_ownership_and_one_history_entry() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let p = Project::empty();
+        let name = "  Supply \"water\" — режим  ";
+        let mut state = start(&p, layer, Family::Sequence, name);
+        let target = state.created().unwrap();
+        let result = roundtrip(p, &mut state);
+        let element = &result.elements[&target.behavior];
+        assert_eq!(element.name, name);
+        assert_eq!(element.layer(), layer);
+        assert_eq!(
+            element.kind(),
+            if layer == Layer::Oa {
+                Kind::Process
+            } else {
+                Kind::FunctionalChain
+            }
+        );
+        assert_eq!(element.parent, None);
+        assert!(element.steps().unwrap().is_empty());
+        assert!(result.diagrams.is_empty());
+        assert!(result.relations.is_empty());
+    }
+}
+
+#[test]
+fn all_four_viewpoints_are_explicit_and_survive_source_history_reopen() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for viewpoint in viewpoints(layer) {
+            let mut p = Project::empty();
+            let context = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Capability
+                    } else {
+                        Kind::SystemCapability
+                    },
+                    layer,
+                    "Water supply",
+                    None,
+                )
+                .unwrap();
+            let mut state = start(&p, layer, Family::Scenario, "Nominal supply");
+            assert!(
+                state
+                    .prepare_pending(&p)
+                    .unwrap_err()
+                    .contains("explicitly")
+            );
+            assert!(
+                state
+                    .update(&p, Event::Viewpoint(ScenarioViewpoint::MixedLegacy))
+                    .is_err()
+            );
+            let wrong = viewpoints(if layer == Layer::Oa {
+                Layer::Sa
+            } else {
+                Layer::Oa
+            })[0];
+            assert!(state.update(&p, Event::Viewpoint(wrong)).is_err());
+            state.update(&p, Event::Viewpoint(viewpoint)).unwrap();
+            state.update(&p, Event::Context(Some(context))).unwrap();
+            let id = state.created().unwrap().behavior;
+            let result = roundtrip(p, &mut state);
+            assert_eq!(
+                result.elements[&id].parent, None,
+                "context is not containment"
+            );
+            assert!(
+                matches!(result.elements[&id].shared(), Some(SharedBody::Scenario { viewpoint: actual, context: Some(actual_context), steps, .. }) if *actual == viewpoint && *actual_context == context && steps.is_empty())
+            );
+        }
+    }
+}
+
+#[test]
+fn machine_requires_valid_owner_and_first_view_adds_no_region_or_state() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for first_view in [false, true] {
+            let mut p = Project::empty();
+            let owner = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Entity
+                    } else {
+                        Kind::System
+                    },
+                    layer,
+                    "Pump",
+                    None,
+                )
+                .unwrap();
+            let wrong_kind = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Activity
+                    } else {
+                        Kind::Function
+                    },
+                    layer,
+                    "Pump water",
+                    None,
+                )
+                .unwrap();
+            let opposite = if layer == Layer::Oa {
+                Layer::Sa
+            } else {
+                Layer::Oa
+            };
+            let wrong_layer = p
+                .add_element(
+                    if opposite == Layer::Oa {
+                        Kind::Entity
+                    } else {
+                        Kind::System
+                    },
+                    opposite,
+                    "Other layer pump",
+                    None,
+                )
+                .unwrap();
+            let mut state = start(&p, layer, Family::Machine, "Pump modes");
+            assert!(
+                state
+                    .prepare_pending(&p)
+                    .unwrap_err()
+                    .contains("participant")
+            );
+            assert!(state.update(&p, Event::Owner(wrong_kind)).is_err());
+            assert!(state.update(&p, Event::Owner(wrong_layer)).is_err());
+            state.update(&p, Event::Owner(owner)).unwrap();
+            state.update(&p, Event::FirstView(first_view)).unwrap();
+            let target = state.created().unwrap();
+            let expected_count = p.elements.len() + 1;
+            let result = roundtrip(p, &mut state);
+            assert_eq!(result.elements.len(), expected_count);
+            assert_eq!(result.elements[&target.behavior].parent, Some(owner));
+            assert_eq!(result.elements[&target.behavior].kind(), Kind::StateMachine);
+            assert_eq!(result.diagrams.len(), usize::from(first_view));
+            if let Some(view) = target.diagram {
+                let diagram = &result.diagrams[&view];
+                assert_eq!(
+                    diagram.projection,
+                    ProjectionKind::StateMachine {
+                        machine: target.behavior
+                    }
+                );
+                assert_eq!(diagram.nodes.len(), 1);
+                assert_eq!(
+                    diagram.nodes.values().next().unwrap().element,
+                    target.behavior
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn cancel_and_illegal_family_layer_switches_never_create_model_objects() {
+    let p = Project::empty();
+    let mut state = start(&p, Layer::Oa, Family::Scenario, "Raw name");
+    state
+        .update(
+            &p,
+            Event::Viewpoint(ScenarioViewpoint::ParticipantInteraction),
+        )
+        .unwrap();
+    let snapshot = state.recovery_snapshot().unwrap();
+    assert!(state.update(&p, Event::Open(Layer::Sa)).is_err());
+    assert!(state.update(&p, Event::Choose(Family::Sequence)).is_err());
+    assert_eq!(state.recovery_snapshot().unwrap(), snapshot);
+    assert!(state.update(&p, Event::Cancel).unwrap().is_none());
+    assert!(!state.has_pending());
+    assert!(state.created().is_none());
+    assert!(state.prepare_pending(&p).is_err());
+    assert!(p.elements.is_empty());
+    assert!(p.diagrams.is_empty());
+}
+
+#[test]
+fn recovery_preserves_exact_raw_inputs_reserved_ids_and_revalidates_stale_owner() {
+    let mut p = Project::empty();
+    let owner = p
+        .add_element(Kind::Entity, Layer::Oa, "Plant", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Machine, " \nRaw rejected name\0 ");
+    state.update(&p, Event::Owner(owner)).unwrap();
+    state.update(&p, Event::FirstView(true)).unwrap();
+    state
+        .update(&p, Event::Search(Picker::Owner, " Plant ".into()))
+        .unwrap();
+    let raw = state.recovery_snapshot().unwrap().unwrap();
+    let mut restored = State::from_recovery(raw.clone()).unwrap();
+    assert_eq!(restored.recovery_snapshot().unwrap(), Some(raw.clone()));
+    assert_eq!(restored.created(), state.created());
+    assert_eq!(restored.pending_layer(), Some(Layer::Oa));
+    assert!(restored.prepare_pending(&p).is_err());
+    restored
+        .update(&p, Event::Name("Plant modes".into()))
+        .unwrap();
+    let command = restored.prepare_pending(&p).unwrap();
+    let again = State::from_recovery(restored.recovery_snapshot().unwrap().unwrap()).unwrap();
+    assert_eq!(again.prepare_pending(&p).unwrap(), command);
+    p.elements.remove(&owner);
+    let before = restored.recovery_snapshot().unwrap();
+    assert!(
+        restored
+            .prepare_pending(&p)
+            .unwrap_err()
+            .contains("participant")
+    );
+    assert_eq!(restored.recovery_snapshot().unwrap(), before);
+    let different = Project::empty();
+    assert!(
+        restored
+            .prepare_pending(&different)
+            .unwrap_err()
+            .contains("another document")
+    );
+}
+
+#[test]
+fn rejected_source_transaction_keeps_draft_and_every_accepted_source_byte() {
+    let p = Project::empty();
+    let initial = Document::from_project(p.clone(), ProjectLimits::default()).unwrap();
+    let bytes: usize = initial.bundle().files.values().map(String::len).sum();
+    let limits = ProjectLimits {
+        model: language::ParseLimits {
+            max_source_bytes: bytes + 32,
+            ..language::ParseLimits::UNLIMITED
+        },
+        ..ProjectLimits::default()
+    };
+    let mut doc = Document::from_bundle(initial.bundle().clone(), limits).unwrap();
+    let mut state = start(
+        &p,
+        Layer::Oa,
+        Family::Sequence,
+        "A long exact name retained after the source budget refuses this new process",
+    );
+    let raw = state.recovery_snapshot().unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    assert!(doc.execute(command).is_err());
+    assert_eq!(doc.project(), &p);
+    assert_eq!(doc.bundle(), initial.bundle());
+    assert!(!doc.can_undo());
+    assert_eq!(state.recovery_snapshot().unwrap(), raw);
+    state.update(&p, Event::Cancel).unwrap();
+}
+
+#[test]
+fn owner_search_is_name_ordered_filtered_and_page_sized_not_a_catalog() {
+    let mut p = Project::empty();
+    for index in (0..105).rev() {
+        p.add_element(Kind::Entity, Layer::Oa, &format!("Pump {index:03}"), None)
+            .unwrap();
+    }
+    p.add_element(Kind::System, Layer::Sa, "Pump 999", None)
+        .unwrap();
+    p.add_element(Kind::Activity, Layer::Oa, "Pump work", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Machine, "Pump modes");
+    let all = choices(&p, Layer::Oa, Picker::Owner, "");
+    assert_eq!(all.len(), 105);
+    assert_eq!(all[0].name, "Pump 000");
+    state
+        .update(&p, Event::Page(Picker::Owner, usize::MAX))
+        .unwrap();
+    assert!(
+        state.view(&p).is_some(),
+        "stale pages are clamped before slicing"
+    );
+    state
+        .update(&p, Event::Search(Picker::Owner, "Pump 104".into()))
+        .unwrap();
+    assert_eq!(state.draft.as_ref().unwrap().browsers[0].page, 0);
+    let found = choices(&p, Layer::Oa, Picker::Owner, "Pump 104");
+    assert_eq!(found.len(), 1);
+    state.update(&p, Event::Owner(found[0].id)).unwrap();
+    assert_eq!(state.draft.as_ref().unwrap().owner, Some(found[0].id));
+}
+
+#[test]
+fn repeated_owner_names_remain_distinguishable_by_searchable_parent_context_and_alias() {
+    let mut p = Project::empty();
+    let north = p
+        .add_element(Kind::Entity, Layer::Oa, "North station", None)
+        .unwrap();
+    let south = p
+        .add_element(Kind::Entity, Layer::Oa, "South station", None)
+        .unwrap();
+    let first = p
+        .add_element(Kind::Entity, Layer::Oa, "Pump", Some(north))
+        .unwrap();
+    let second = p
+        .add_element(Kind::Entity, Layer::Oa, "Pump", Some(south))
+        .unwrap();
+    let label = reference_label(&p, second);
+    assert_ne!(reference_label(&p, first), label);
+    assert!(label.contains("South station") && label.contains("Pump"));
+    assert!(label.contains(&p.elements[&second].alias));
+    let found = choices(&p, Layer::Oa, Picker::Owner, "south station");
+    assert!(found.iter().any(|e| e.id == second));
+    assert!(!found.iter().any(|e| e.id == first));
+    let mut state = start(&p, Layer::Oa, Family::Machine, "Pump states");
+    state.update(&p, Event::Owner(second)).unwrap();
+    let result = execute_batch(&p, &[state.prepare_pending(&p).unwrap()]).unwrap();
+    assert_eq!(
+        result.elements[&state.created().unwrap().behavior].parent,
+        Some(second)
+    );
+}
+
+#[test]
+fn corrupted_recovery_and_reserved_identity_collision_refuse_without_repairing_raw_values() {
+    let p = Project::empty();
+    let state = start(&p, Layer::Sa, Family::Sequence, "Supply");
+    let raw = state.recovery_snapshot().unwrap().unwrap();
+    for (field, value) in [
+        ("version", serde_json::json!(99)),
+        ("unexpected", serde_json::json!(true)),
+    ] {
+        let mut bad = raw.clone();
+        bad[field] = value;
+        assert!(State::from_recovery(bad).is_err());
+    }
+    let mut bad = raw;
+    bad["element"] = serde_json::json!(p.id);
+    let restored = State::from_recovery(bad.clone()).unwrap();
+    assert!(
+        restored
+            .prepare_pending(&p)
+            .unwrap_err()
+            .contains("identity")
+    );
+    assert_eq!(restored.recovery_snapshot().unwrap(), Some(bad));
+}
+
+#[test]
+fn post_commit_selection_is_correlated_with_exact_created_behavior_and_view() {
+    let mut p = Project::empty();
+    let owner = p
+        .add_element(Kind::Entity, Layer::Oa, "Pump", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Machine, "Pump modes");
+    state.update(&p, Event::Owner(owner)).unwrap();
+    state.update(&p, Event::FirstView(true)).unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    assert_eq!(state.created_by(&p, &command), state.created());
+    assert_eq!(
+        state.created_by(&p, &Command::Rename(owner, "Unrelated change".into())),
+        None
+    );
+    for edit in 0..4 {
+        let mut changed = command.clone();
+        let Command::Batch(ref mut commands) = changed else {
+            panic!("creation batch");
+        };
+        if edit < 3 {
+            let Command::CreateElement(element) = &mut commands[0] else {
+                panic!("new behavior");
+            };
+            match edit {
+                0 => element.id = Id::new_v4(),
+                1 => element.name = "A different authored draft".into(),
+                _ => element.parent = None,
+            }
+        } else {
+            let Command::CreateDiagram(diagram) = &mut commands[1] else {
+                panic!("new view");
+            };
+            diagram.projection = ProjectionKind::StateMachine { machine: owner };
+        }
+        assert_eq!(state.created_by(&p, &changed), None);
+    }
+    let Command::Batch(commands) = command else {
+        panic!("creation batch");
+    };
+    assert_eq!(
+        state.created_by(&p, &commands[0]),
+        None,
+        "an opt-in view must be part of the actual committed batch"
+    );
+}
+
+#[test]
+fn optional_context_collapses_without_losing_authored_reference_or_raw_search() {
+    let mut p = Project::empty();
+    let context = p
+        .add_element(Kind::Capability, Layer::Oa, "Water supply", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Scenario, "Supply nominal");
+    assert!(!state.draft.as_ref().unwrap().context_open);
+    state
+        .update(&p, Event::Viewpoint(ScenarioViewpoint::OperationalActivity))
+        .unwrap();
+    state.update(&p, Event::ContextOptions(true)).unwrap();
+    state
+        .update(&p, Event::Search(Picker::Context, " Water ".into()))
+        .unwrap();
+    state.update(&p, Event::Context(Some(context))).unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    state.update(&p, Event::ContextOptions(false)).unwrap();
+    let restored = State::from_recovery(state.recovery_snapshot().unwrap().unwrap()).unwrap();
+    assert!(!restored.draft.as_ref().unwrap().context_open);
+    assert_eq!(
+        restored.draft.as_ref().unwrap().browsers[1].query,
+        " Water "
+    );
+    assert_eq!(restored.prepare_pending(&p).unwrap(), command);
+    assert_eq!(restored.created_by(&p, &command), restored.created());
+}
+
+#[test]
+fn creation_selection_rejects_changed_scenario_body_and_post_creation_operations() {
+    let mut p = Project::empty();
+    let capability = p
+        .add_element(Kind::SystemCapability, Layer::Sa, "Supply", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Sa, Family::Scenario, "Nominal functions");
+    state
+        .update(&p, Event::Viewpoint(ScenarioViewpoint::Functional))
+        .unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    assert_eq!(state.created_by(&p, &command), state.created());
+    for edit in 0..4 {
+        let mut altered = command.clone();
+        let Command::Batch(commands) = &mut altered else {
+            panic!("creation batch");
+        };
+        match edit {
+            0 => {
+                let Command::CreateElement(element) = &mut commands[0] else {
+                    panic!("scenario");
+                };
+                let Some(SharedBody::Scenario { viewpoint, .. }) = element.shared_mut() else {
+                    panic!("scenario body");
+                };
+                *viewpoint = ScenarioViewpoint::BoundaryInterface;
+            }
+            1 => {
+                let Command::CreateElement(element) = &mut commands[0] else {
+                    panic!("scenario");
+                };
+                let Some(SharedBody::Scenario { context, .. }) = element.shared_mut() else {
+                    panic!("scenario body");
+                };
+                *context = Some(capability);
+            }
+            2 => commands.push(Command::Rename(
+                state.created().unwrap().behavior,
+                "Changed afterward".into(),
+            )),
+            _ => commands.push(Command::Delete(state.created().unwrap().behavior)),
+        }
+        assert!(
+            execute_batch(&p, std::slice::from_ref(&altered)).is_ok(),
+            "the alternate command is valid, but is not this authored creation"
+        );
+        assert_eq!(state.created_by(&p, &altered), None);
+    }
+}

crates/oa-desktop/src/forms/history_fields.rs

@@ -579,11 +579,11 @@ fn render<'a>(
             for (index, item) in items.iter().enumerate().skip(page * PAGE_SIZE).take(PAGE_SIZE) {
                 let item_path = format!("{path}/{index}");
                 let mut card = column![render(draft, project, item_schema, Some(item), &item_path, &format!("{} {}", title, index + 1), depth + 1)].spacing(8);
-                if path == FACETS {
-                    if let Some(current) = current_observation(draft, project, &item_path) {
-                        card = card.push(button("Use current counterpart observations")
-                            .on_press(Message::FieldShape(item_path.clone(), json!(current))).style(style::nav));
-                    }
+                if path == FACETS
+                    && let Some(current) = current_observation(draft, project, &item_path)
+                {
+                    card = card.push(button("Use current counterpart observations")
+                        .on_press(Message::FieldShape(item_path.clone(), json!(current))).style(style::nav));
                 }
                 card = card.push(row![
                     button("↑").on_press_maybe((index > 0).then(|| Message::FieldArray(path.into(), Some(index), -1))),

crates/oa-desktop/src/guide.rs

@@ -446,8 +446,8 @@ fn article(topic: Topic) -> Article {
                             "Describe a path through exchanges",
                             &[
                                 "First create the activities/functions and their exchanges. Check the source and target work for every exchange.",
-                                "Open Behavior & scenarios. Create Process in OA or Functional chain in SA using Create element and + At root.",
-                                "Select that behavior in the page's selector. Open Tools and choose Work or Exchange, then a highlighted path or contribution position to involve an existing source. Each contribution keeps its own identity while referring to the shared engineering definition.",
+                                "Open Behavior & scenarios → New. Choose Operational process in OA or Functional chain in SA, enter its exact name, then Create and open. The new behavior belongs at the layer root and opens immediately; Undo removes the creation as one edit.",
+                                "Open Tools and choose Work or Exchange, then a highlighted path or contribution position to involve an existing source. Each contribution keeps its own identity while referring to the shared engineering definition.",
                                 "In Tools, choose Sequence link and click or drag from the preceding contribution to the following contribution. Choose Tools → Select / reorder to drag a selected path endpoint and reconnect it; a contribution's ↕ handle changes its position within a column. These are local contributions and sequence links, not new architecture exchanges.",
                                 "Select a contribution, then add another after it. Tools → Two paths… creates a split, two paths and their merge in one undoable edit. Enter explicit alternative conditions. Fit overview uses the visible canvas area; 100% keeps working scale with scrollbars. If the minimum zoom is reached, scroll to inspect the remainder.",
                                 "Use Chain involvement from the Process/Functional chain to the capability it supports. Read Model checks for unfinished or disconnected paths.",
@@ -489,7 +489,7 @@ fn article(topic: Topic) -> Article {
                         walkthrough(
                             "Create a scenario",
                             &[
-                                "Open Behavior & scenarios, choose Scenario under Create element and add it at a legal root/owner. Select the scenario in the behavior selector.",
+                                "Open Behavior & scenarios → New → Scenario and enter its name. Explicitly choose Activities or Participants in OA, or Functions or System boundary in SA. Add optional context only when needed: this is a reference, while the scenario itself belongs at the layer root. Create and open starts the empty scenario.",
                                 "Use + Lifeline and choose the participant or work it represents. Choices follow the scenario's viewpoint: operational activities, operational participants, system functions or system boundary participants.",
                                 "Choose + Message and its style. Call + correlated reply creates both occurrences in one edit. Select the exchange and compatible sending/receiving lifelines. Reply to existing call offers valid unanswered calls.",
                                 "Use Action, Observe state or Fragment for other behavior. A local timer has an expression and a lifeline, with no global exchange. Create and delete messages describe participant lifetime; Model checks also flag risks inside repeated loops.",
@@ -543,7 +543,8 @@ fn article(topic: Topic) -> Article {
                         walkthrough(
                             "Build a state machine",
                             &[
-                                "In Behavior & scenarios, create or select a State machine, then choose Create diagram. This places its existing regions and vertices in a saved view. + View creates another independent layout.",
+                                "In Behavior & scenarios → New → State machine, enter its name and search for the existing same-layer participant that owns it. Candidate labels show parent context and alias to distinguish repeated names. If the participant does not exist yet, cancel and create it in Architecture first.",
+                                "Optionally select Create the first state view, then Create and open. The new machine starts without regions or states. For an existing machine, Create diagram places its existing regions and vertices in a saved view; + View creates another independent layout.",
                                 "Choose + Region and click the highlighted machine, or a State/Mode for a nested region. Choose Initial, State, Mode or another kind from + State / symbol, then click its highlighted owning region. Rename the new element in Properties.",
                                 "Choose Transition and drag from a source vertex to a compatible target, or click the source and then the target. In Select / move, drag states or containers to arrange them; a container moves its descendant placements without changing ownership.",
                                 "Select a drawn transition and drag its endpoint handle to reconnect it. Its right-click menu also offers Reconnect source and Reconnect target; choose one, then click a compatible vertex.",
@@ -894,6 +895,10 @@ fn article(topic: Topic) -> Article {
                             "A property draft is not yet the model",
                             "Apply changes validates the candidate. When it is rejected, correct the retained draft or use Revert. The canvas continues to show accepted values. Navigation that needs to apply an invalid draft may remain on the current record so your work is not lost. You can read this guide without applying or discarding that draft.",
                         ),
+                        explain(
+                            "A new behavior is still a draft",
+                            "Behavior → New keeps the exact name, owner and viewpoint choices outside the model until Create and open succeeds. Cancel or Escape discards only this draft; if a dialog is open, the first Escape dismisses that dialog. New refuses other unfinished property, source or behavior drafts without applying them. Recovery restores the creation form in its original layer, including rejected raw text, for correction or cancellation.",
+                        ),
                         explain(
                             "Aliases and references",
                             "Stable source aliases must follow the language's identifier rules and avoid reserved words. Use a simple descriptive identifier such as assess_incident. Spaces belong in the displayed Name, not the alias. Reference pickers offer compatible model records; creating the required target first is often the missing step.",

docs/language.html

@@ -1274,9 +1274,21 @@ reference checks.</p>
 <p>Omitted schema-2 viewpoints hydrate as MixedLegacy in both source and JSON.
 This preserves pre-extension mixed work/participant scenes without discarding
 their lifelines or silently assigning a stricter meaning. MixedLegacy emits a
-review warning. New graphical factories explicitly select OperationalActivity
-or Functional by layer. Authors can select a strict viewpoint after reviewing
-the legacy scene; canonical source then records that choice.</p>
+review warning. Source parsing also uses MixedLegacy when <span class="docutils literal">viewpoint</span> is
+omitted from a newly authored source-7 scenario; it does not infer a strict
+viewpoint from the layer or lifelines. Write the intended viewpoint explicitly
+when starting a scenario. For example, this new OA source project starts an
+activity-based scenario whose lifelines and occurrences can be added later:</p>
+<pre class="literal-block">arcadia 7;
+project response &quot;Distress response&quot; {
+    oa_scenario assessment &quot;Assess the distress report&quot; {
+        viewpoint OperationalActivity;
+    }
+}</pre>
+<p>An empty scenario can produce completeness warnings while remaining editable.
+The desktop's Behavior <strong>New</strong> flow asks authors to choose one of the layer's
+two strict viewpoints explicitly. Authors can also select a strict viewpoint
+after reviewing a legacy scene; canonical source then records that choice.</p>
 <p>MessageKind is Asynchronous, Call, Reply, Create, Delete, or
 <span class="docutils literal">{ Timer { expression &quot;after 5 s&quot;; }; }</span>. A process/chain exchange
 contribution MUST remain Asynchronous with no reply correlation. Call/reply,
@@ -2217,6 +2229,23 @@ strings use JSON string escaping, including <span class="docutils literal">\n</s
 and Unicode escapes. Literal unescaped newlines inside strings are invalid.
 Numbers use JSON decimal/exponent syntax; NaN, infinity, hexadecimal numbers,
 leading plus signs, and leading zeroes are invalid.</p>
+<p>A small model may begin with engineering declarations alone. This complete
+source describes two participants, their work, responsibility and an exchange:</p>
+<pre class="literal-block">arcadia 7;
+project distress &quot;Distress response&quot; {
+    oa_actor vessel &quot;Vessel in distress&quot; {}
+    oa_entity rescue &quot;Rescue coordination&quot; {}
+    oa_activity report &quot;Report distress&quot; {}
+    oa_activity assess &quot;Assess incident&quot; {}
+    allocation vessel_reports &quot;Crew reports&quot; { source &#64;vessel; target &#64;report; }
+    allocation rescue_assesses &quot;Team assesses&quot; { source &#64;rescue; target &#64;assess; }
+    interaction distress_report &quot;Distress report&quot; { source &#64;report; target &#64;assess; }
+}</pre>
+<p>No diagram, placement, empty description or explicit root parent is required.
+The accepted source adds identities; keep those clauses during later edits.
+Changing <span class="docutils literal">&quot;Assess incident&quot;</span> changes the display name while <span class="docutils literal">&#64;assess</span> still
+resolves to the same activity. Behavior-coverage warnings permit this intermediate
+model to be saved. Allocation remains explicit and distinct from decomposition.</p>
 <p>Aliases match <span class="docutils literal"><span class="pre">[A-Za-z_][A-Za-z0-9_]*</span></span>. The following aliases are reserved:
 arcadia, project, id, oa, sa, element, relation, diagram, node, artifact,
 trace, body, alias, name, description, parent, from, to, entity, actor,
@@ -2227,7 +2256,7 @@ spellings can be used in alias positions because references begin with <span cla
 <span class="docutils literal"><span class="pre">element-kind</span></span> and <span class="docutils literal"><span class="pre">relation-kind</span></span> are exactly the corresponding declaration
 keywords listed above. Typed field
 sets and enum constructors are closed by sections 3–5.</p>
-<pre class="code text literal-block"><code>document    = &quot;arcadia&quot; &quot;5&quot; &quot;;&quot; project
+<pre class="code text literal-block"><code>document    = &quot;arcadia&quot; &quot;7&quot; &quot;;&quot; project
 project     = &quot;project&quot; alias string identity? &quot;{&quot; project-entry* &quot;}&quot;
 project-entry = &quot;description&quot; string &quot;;&quot; | declaration
 declaration = element

docs/language.rst

@@ -631,9 +631,23 @@ reference checks.
 Omitted schema-2 viewpoints hydrate as MixedLegacy in both source and JSON.
 This preserves pre-extension mixed work/participant scenes without discarding
 their lifelines or silently assigning a stricter meaning. MixedLegacy emits a
-review warning. New graphical factories explicitly select OperationalActivity
-or Functional by layer. Authors can select a strict viewpoint after reviewing
-the legacy scene; canonical source then records that choice.
+review warning. Source parsing also uses MixedLegacy when ``viewpoint`` is
+omitted from a newly authored source-7 scenario; it does not infer a strict
+viewpoint from the layer or lifelines. Write the intended viewpoint explicitly
+when starting a scenario. For example, this new OA source project starts an
+activity-based scenario whose lifelines and occurrences can be added later::
+
+    arcadia 7;
+    project response "Distress response" {
+        oa_scenario assessment "Assess the distress report" {
+            viewpoint OperationalActivity;
+        }
+    }
+
+An empty scenario can produce completeness warnings while remaining editable.
+The desktop's Behavior **New** flow asks authors to choose one of the layer's
+two strict viewpoints explicitly. Authors can also select a strict viewpoint
+after reviewing a legacy scene; canonical source then records that choice.
 
 MessageKind is Asynchronous, Call, Reply, Create, Delete, or
 ``{ Timer { expression "after 5 s"; }; }``. A process/chain exchange
@@ -1582,6 +1596,26 @@ and Unicode escapes. Literal unescaped newlines inside strings are invalid.
 Numbers use JSON decimal/exponent syntax; NaN, infinity, hexadecimal numbers,
 leading plus signs, and leading zeroes are invalid.
 
+A small model may begin with engineering declarations alone. This complete
+source describes two participants, their work, responsibility and an exchange::
+
+    arcadia 7;
+    project distress "Distress response" {
+        oa_actor vessel "Vessel in distress" {}
+        oa_entity rescue "Rescue coordination" {}
+        oa_activity report "Report distress" {}
+        oa_activity assess "Assess incident" {}
+        allocation vessel_reports "Crew reports" { source @vessel; target @report; }
+        allocation rescue_assesses "Team assesses" { source @rescue; target @assess; }
+        interaction distress_report "Distress report" { source @report; target @assess; }
+    }
+
+No diagram, placement, empty description or explicit root parent is required.
+The accepted source adds identities; keep those clauses during later edits.
+Changing ``"Assess incident"`` changes the display name while ``@assess`` still
+resolves to the same activity. Behavior-coverage warnings permit this intermediate
+model to be saved. Allocation remains explicit and distinct from decomposition.
+
 Aliases match ``[A-Za-z_][A-Za-z0-9_]*``. The following aliases are reserved:
 arcadia, project, id, oa, sa, element, relation, diagram, node, artifact,
 trace, body, alias, name, description, parent, from, to, entity, actor,
@@ -1596,7 +1630,7 @@ sets and enum constructors are closed by sections 3–5.
 
 .. code-block:: text
 
-    document    = "arcadia" "5" ";" project
+    document    = "arcadia" "7" ";" project
     project     = "project" alias string identity? "{" project-entry* "}"
     project-entry = "description" string ";" | declaration
     declaration = element

examples/release1/README.md

@@ -65,12 +65,12 @@ The integration oracle executes this exact semantic review and source update. It
 | `oa/`, `sa/` | Participants, work, data, capabilities and reusable behavior |
 | `views/` | Five saved views; filters and placements are presentation state |
 | `traceability.arcadia` | OA↔SA correspondence and review history |
-| `model.json` | Current schema-6 interchange of the final accepted model |
+| `model.json` | Current schema-7 interchange of the final accepted model |
 | `transition-before.json`, `transition-request.json` | Explicit first-transition replay inputs |
 | `evidence/repair-check.md` | Local teaching evidence linked from the SA conversation |
 | `model.rs` | Deterministic lesson builder shared by generator and tests |
 
-The REST routes are documented in [the API reference](../../docs/api.rst). Import `model.json` with `POST /api/v1/projects/import`; query the returned resource's `/model` and `/validation`. Expect schema 6 and the one warning above. JSON import provides canonical source; to retain the exact modular source layout, use `/api/v1/projects/import-source-project` with a SourceBundle containing entry `project.arcadia` and only the 30 reachable `.arcadia` file strings, keyed by slash-separated relative paths. Neither route reads the artifact target from your local filesystem.
+The REST routes are documented in [the API reference](../../docs/api.rst). Import `model.json` with `POST /api/v1/projects/import`; query the returned resource's `/model` and `/validation`. Expect schema 7 and the one warning above. JSON import provides canonical source; to retain the exact modular source layout, use `/api/v1/projects/import-source-project` with a SourceBundle containing entry `project.arcadia` and only the 30 reachable `.arcadia` file strings, keyed by slash-separated relative paths. Neither route reads the artifact target from your local filesystem.
 
 For transition replay, import `transition-before.json` instead. Submit `transition-request.json` to that baseline resource's `/transitions/preview` with its current ETag in `If-Match`. Review the returned plan, then follow the documented `/transitions/apply` protocol. Use the baseline resource for this exercise: the final model already contains the mapped records and subsequent refinements. This tutorial's automated evidence is core/source validation; it does not claim a separate native or HTTP acceptance run of this particular example.
 

examples/text-first/README.md

@@ -0,0 +1,24 @@
+# Start a model in text
+
+Open `project.arcadia`, then choose **Textual model**. The model describes who
+reports distress, who assesses it, and the information passing between those
+activities. It needs no diagram or handwritten UUIDs.
+
+1. Read each declaration as **kind, alias, display name**. References such as
+   `@assess` use the alias. The two allocations state responsibility; the
+   interaction states the direction of the exchange.
+2. Change `"Assess incident"` to a name suited to your project. Use **Apply all**,
+   then **Save all**. Keep the identity clauses added to the accepted source:
+   they preserve the same model objects in later edits.
+3. Add work and exchanges as your understanding grows. Behavior coverage checks
+   identify activities and exchanges that still need process or scenario context;
+   these advisory checks allow you to save the intermediate model.
+
+Changing a display name keeps references intact. Changing an alias requires
+updating every `@alias` use. Nesting expresses decomposition; an allocation
+expresses who performs work. Neither implies the other.
+
+For a larger example with behavior, ports, views and OA/SA correspondence, use
+[the water-pressure walkthrough](../release1/README.md). The
+[language reference](../../docs/language.rst) defines all declarations and the
+rules for splitting a project into included files.

examples/text-first/project.arcadia

@@ -0,0 +1,10 @@
+arcadia 7;
+project distress "Distress response" {
+    oa_actor vessel "Vessel in distress" {}
+    oa_entity rescue "Rescue coordination" {}
+    oa_activity report "Report distress" {}
+    oa_activity assess "Assess incident" {}
+    allocation vessel_reports "Crew reports" { source @vessel; target @report; }
+    allocation rescue_assesses "Team assesses" { source @rescue; target @assess; }
+    interaction distress_report "Distress report" { source @report; target @assess; }
+}

harness/PLAN.md

@@ -1,119 +1,78 @@
 # First release execution plan
 
-**Current next steps, 2026-09-10:** integrate verified bundle `01bb52a` with our
-published palette; accept the separate typed-history constructor correction;
-then compile and test process/scenario/history together. Implement the measured
-remaining-height scenario workspace after preserving the new navigation and
-clicked-slot contracts. Close packaging review, current shared core/server and
-specification gates, then optimized package/runtime and full engineering-story
-acceptance. The user has reauthorized native control; Linux runtime still needs
-a viable environment. The original release objective remains unchanged.
+Updated 2026-09-11, Codex-9e8r6t `/root`.
+[PROJECT_GOAL.md](../PROJECT_GOAL.md) defines the outcome;
+[TASK_LEDGER.md](TASK_LEDGER.md) separates evidence from assumptions;
+[STATE.md](STATE.md) owns active leases and results.
 
-**Active execution, 2026-09-10:** finish the already-started architecture palette
-and inline naming with focused correctness checks, then perform actual native
-basic-editing acceptance. In parallel, independently audit current behavior/
-scenario workflows and remaining release requirements. Use concrete findings to
-choose the next implementation; preserve the original first-release scope.
-Root alone operates native UI and integrates shared files. Serialize Cargo jobs.
-The renewed request authorizes Computer Use; older stop statements below are
-historical. Current platform gates and final release acceptance remain required.
+## Immediate implementation and acceptance
 
+1. Commit/publish the now-verified creation integration and matching GUI stage. Final immutable
+   desktop653/653 passed after creation ancestry/guide changes, alongside focused
+   creation21/guide3. StrictClippy/fmt pass after a behavior-equivalent history
+   rewrite; affected history63 and GUI build also pass. Preserve exact artifact
+   scopes and serialize future Cargo/source leases.
+2. Natively test the independently reviewed local creation workflow: explicit
+   names/viewpoints/owners, source/property draft retention, SA recovery, first
+   Escape and exact source/selection/Undo. Address actual task friction.
+3. Operate the rebuilt app at minimum/normal sizes. Complete the saved basic
+   supplementary move/camera/invalid-draft and minimum-size story; the main basic
+   model and explicit transition passed full Project+SourceBundle, Undo/Redo and
+   reopen on candidate3 at wide size. Exercise new
+   scenario workspace, creation and caller return with real inputs and saved
+   model evidence, then correct and reverify concrete defects.
+4. Integrate standalone B4 scenario lifetimes and the external independent
+   scenario contract without overwriting local layout work. Resolve source-derived
+   lifetime versus insertion bounds, activation-after-Delete and lane-map issues.
+   Close remaining
+   contextual operand, missing-source and state-naming workflow gaps identified
+   by the current behavior audit and native study.
 
-**Latest refinement:** consult actual installed Capella 7.1, replace the user-rejected horizontal creation/connection rows with a compact contextual palette and inline authoring, independently critique interaction risks, then build and verify the real workflow at wide/minimum sizes. [Benchmark and concrete acceptance](release-capella-basic-editing-20260907.md). Do not ship the rejected toolbar as the usability correction.
+## Foundational semantic additions
 
-**Current priority (7 September):** the user's usability correction takes precedence over the advanced feature sequence below. Establish contextual named diagram creation, existing-element placement, basic editing and clear layer transitions, then verify them natively. Desktop checks were explicitly reauthorized. See [priority reset and acceptance](release-basic-editing-reset-20260907.md).
+The updated objective explicitly requires functional constraints/calculations,
+quantities/units and maintained model libraries. Current metadata/includes are
+insufficient. This work runs independently of useful behavior improvements.
 
-## Outcome and baseline
+The newest objective also requires complete uncluttered text-only workflows.
+Combine the local three-task usability audit with the other host's language/
+identity/API design. Two concise current-grammar recipes now pass their bounded
+REST identity/source/persistence experiment. Next evaluate
+cross-file definitions/references, safe alias rename and identity-preserving
+patch preview on repeated-name modular models. Do not equate shorter examples
+or parser throughput with task usability, and do not silently change omissions.
 
-Deliver the first release of Arcadia Studio for system engineers: complete Operational Analysis and System Analysis/System Architecture workflows, equivalent graphical and textual models, clear artifact traceability and a deployable/programmatically accessible Rust service. Logical/Physical Architecture and later Arcadia layers are future releases, as the new objective explicitly states.
+- Compare real candidate semantics before large changes. Use primary Capella,
+  SysML and quantity/unit evidence, with explicit compatibility limits.
+- Falsify candidates through mass/power/latency budgets, mixed/affine units,
+  unknown/error/false results, dependency cycles, reference identity and bounded
+  evaluation. Separate descriptive existing text from executable declarations.
+- Probe libraries through two projects/two instances, pinned offline content,
+  exports/dependency closure, bindings, distinct origin/local identities, updates
+  with local divergence, detachment and exact transactional rollback.
+- Run a small pure-core experiment for the selected candidate. Independent
+  criticism must precede broad schema/source/API migration. Retain current typed
+  Project, Command and source-writer boundaries unless evidence requires change.
+- Implement the ratified contracts across validation, visitors, deletion,
+  identity, OA/SA transitions, source/reST, schema/REST, ergonomic graphical
+  authoring and help. Add real examples and independent parity acceptance.
 
-The authoritative objective is attachment `10b0f701-1743-4de7-9ee1-225920e19649/goal-objective.md`. It retains first-release scope and strengthens domain coherence, alternative evaluation and target-user task evidence. TASK_LEDGER.md separates given/verified facts, assumptions and open candidates; STATE.md records progress. The accepted 0.2.0 prototype is a historical baseline, not proof of release completeness. Its old D:/CodexBuilds archives are unavailable on this machine; existing dist archives must not be replaced until new acceptance passes.
+## Integration and release
 
-The user's cross-branch reminder led to an ancestry/patch/tree audit. Continue from integrated `c091f80` on `codex/release1-continuation`; direct state/scenario/process, data, hosted and semantic review work already exists here. `release-branch-integration-20260906.md` records the audit. `release-current-coverage-20260906.md` is the current measurable acceptance map and supersedes stale absence claims in older narratives below.
+- Publish coherent commits and verified bundle transfers through Gitea; keep
+  concise host-scoped handoffs and Wiki. Do not overwrite another host's branch.
+- Refresh relevant source/schema/example/doc gates and run current core,
+  desktop/server and real REST transport/restart/ETag/draft-conflict workflows.
+- Build matching optimized desktop/server packages. Regenerate complete notices
+  for actual inputs and verify archive contents, hashes and clean-runtime launch.
+  Historical ELF fixtures and build preparation do not replace execution.
+- Obtain a viable Linux environment and run current GUI/server workflows there.
+  Supported WSL2 failed; no repeated rejected workaround. Continue independent
+  work while the environment question is pending.
+- Conduct fresh independent requirements, semantic, usability, architecture,
+  correctness, runtime and documentation reviews. Resolve all material findings,
+  reverify affected behavior and only then declare release completion.
 
-## Existing architecture and retained decisions
-
-Retain three Rust crates and one typed Project/validated atomic Command boundary. oa-core owns semantics, references, history, transitions, source and persistence; oa-desktop owns Iced interaction/drafts/projections; oa-server owns REST/ETag/current-model storage. Keep identity, semantic containment, allocation and per-diagram placement separate. No runtime plugin framework or later-layer skeleton.
-
-The current forms are a closed typed-record adapter, not a second metamodel. Expand their real creation/reference/variant controls with every semantic addition. Core choices must drive graphical choices. New persistent fields participate in text round trips, identity/removal visitors, transitions, API schemas and graphical authoring tests.
-
-## Milestones and measurable acceptance
-
-Nested source ownership and persistent REST bundles are implemented and verified: Windows minimum-size source-to-graphics, nested reparent/source/Undo/Redo/Save/reopen, recovery, rebuilt Linux source/history/Save/reopen, independent review and both platform suites passed. Preserve the existing grammar/updater and separate allocation/order semantics.
-
-Explorer/port discovery, custom routing, direct palette connections, four-side port
-anchors, contextual menus and source folders have scoped Windows/Linux acceptance.
-See release-explorer-usability.md, release-routing-verification.md,
-release-routing-linux.md and release-port-drawing.md for exact evidence and limits.
-
-Direct state-machine editing is accepted through316dc55: typed persisted views,
-explicit-owner creation, movement, direct transitions/reconnection, typed detail
-forms, folding, placement and correct camera/tool lifetime. Windows default/minimum
-and Linux native acceptance plus independent reviews are recorded in
-release-state-editing.md. Direct scenario/process gestures remain required.
-
-R6 data contracts and direct scenario/process gestures are integrated; native
-acceptance continues on both platforms. Typed R3 core/source5/REST and scalar review
-milestones1–2 are integrated and pass full platform checks. Close independent scalar
-fixes and native review, then finish constructor/keyed/order/reset/artifact and
-multi-source graphical authoring using the existing shared core planner. Source5
-migration retains lexical ownership/comments; no flat source rewrite is allowed.
-See release-data-contract.md, release-semantic-integration.md and release-semantic-gui.md.
-
-Continue source authoring improvements only through the production parser/updater.
-The23-test experiment is evidence, not architecture: independent probes exposed
-comment misattachment and unsupported edits. Additional shorthand must preserve
-complete edit/delete behavior and exact source history, and justify itself in real
-human authoring tasks. Shared state placements are now validated; scenario/chain
-interaction must preserve its own occurrence and ordering semantics.
-
-1. **Release coverage audit and interfaces.** Compare actual core/UI/API with official Capella OA/SA semantics and the new objective. Freeze a coverage table and concrete variant/reference/transition contracts before editing shared interfaces. Distinguish unsupported later layers from missing OA/SA workflows; V2 exclusions are reconsidered. Native audit exercises onboarding/help/authoring at supported sizes. Independent audits have separate file ownership.
-2. **Complete engineering semantics.** Fill verified gaps in capability relationships and mission involvement; operational process/functional-chain function/control topology; scenario/state/data constructs needed by OA/SA engineers. Add typed semantic-content drift and reviewed existing-counterpart reconciliation, including reference mapping and explicit dependency/ownership decisions. Every addition has a usable graphical authoring workflow, equivalent source/API representation, meaningful reject/undo/delete/reidentify/transition tests and a worked example. Exact additions and invariants are recorded in the coverage/interface artifact from milestone1, avoiding speculative LA/PA concepts.
-3. **Approachable authoring and help.** Replace static help with searchable topic navigation, concise concepts, numbered OA→SA tutorials, related topics and direct workspace actions. Add a focused starting workspace, recent models and practical creation guidance. Improve source authoring with asynchronous versioned lint, semantic warnings, diagnostic navigation and find/go-to tools. Make selection/navigation and hidden/placed model distinctions clear. Add recoverable local checkpoints for unsaved accepted models and drafts; preserve explicit file-save/conflict behavior.
-4. **Connected automation workflow.** Keep headless deployment and shared core REST contract. Add direct optional desktop open/publish/save of hosted models using explicit connection details and conditional ETags, preserving drafts on failure/conflict and keeping credentials in memory. Verify actual desktop→API→desktop edits and artifact integration locally. Update OpenAPI, deployment and source contracts for the expanded release semantics.
-5. **Release integration and polish.** Guided examples cover OA goals/roles/process alternatives, system missions/capabilities/boundary contracts, chains/scenarios/states and evidence. Review default/minimum/wide layouts, practical keyboard paths, empty/loading/error/recovery states and performance on representative models. Build/run the actual native app after each meaningful UI milestone, fix from evidence, then reverify.
-6. **Independent final acceptance and packaging.** Fresh requirements, correctness, native UX and simplicity reviews in parallel; fix all material findings and rerun affected checks. Full Windows/Linux locked tests, formatting, strict Clippy and optimized builds. Operate primary GUI workflows and actual service transport. Verify current docs/reST rendering, examples/migration, reproducible source workflow, package binary equality/archive contents and checksums. Only then replace 0.2.0 bundles and mark this goal complete.
-
-Dependencies: milestone1 freezes shared interfaces for2; guide/lifecycle work in3 can proceed independently once UI ownership is partitioned. Structural counterpart work depends on2. Hosted client4 depends on final core/API types but transport/lifecycle can be developed independently. Milestones5–6 integrate all preceding work.
-
-## UI and state flow
-
-Keep task navigation, engineering perspective and context-sensitive properties. A Home/start workspace offers projects, recovery and tutorials without obscuring active modeling. Help uses local Rust-owned content and search/category navigation; workspace links pass explicit events and respect draft/modal guards.
-
-Text edits update a snapshot/version; parsing/semantic lint runs on a blocking worker and only the latest result is adopted. Syntax errors and semantic warnings have distinct severity/location and navigate to source. Applying text remains one atomic model transaction. Invalid text and property input are recoverable drafts.
-
-Recovery writes separate per-session checkpoints in user-local application data, never silently overwrites a model file, and offers explicit restore. Recent paths are convenience metadata. Hosted models use a separate connection/resource/revision/ETag handle; ordinary core editing and Undo stay local until explicit conditional Save. Network/file failures retain the same draft. Tokens are not persisted or included in diagnostics.
-
-## Failure and verification strategy
-
-Cover wrong-layer/reference/kind input, ownership/reference cycles, duplicate or ambiguous counterpart matches, stale plans/ETags, typed semantic drift, sequence control topology and repeated occurrences, invalid source/property drafts, external file edits, failed storage/network operations, oversized models and unavailable graphics. Keep incomplete engineering work editable through warnings while rejecting structural corruption.
-
-Tests must cover user-visible meaning and cross-representation invariants, not just serialize the same value twice. Use actual HTTP and native CUA for end-to-end behaviors. Independent review targets current artifacts and the original release objective, not only implementation summaries. Record unsupported/unavailable environments without turning missing required functionality into a limitation.
-
-## Definition of done
-
-Every concrete requirement in the new objective and release coverage table has authoritative current evidence. Primary OA/SA engineering workflows work graphically, textually and through the API; help is navigable and useful; native Windows/Linux UI is intentionally designed and exercised; no blocking/high-impact defect remains; strict checks pass; independent findings are closed; durable docs accurately reflect the release; another engineer can build/run/test and use the supplied packages. V2 completion alone does not satisfy this goal.
-
-## Historical milestone progress — hosted integration
-
-Milestone4 desktop adapter is implemented on the existing Document/REST boundary.
-Windows native publish, graphical/text save, rejected invalid source, API artifact
-reload and stale-revision recovery are demonstrated. Offline/retry and exact local-copy/catalog Open native acceptance passed on Windows.
-Destination and catalog defects found afterward were fixed/reviewed/integrated; remaining platform/native cases retain their report scope. Constructor/keyed/order/Child/Incident/artifact and multi-source review, Home/recents and checkpoint recovery are now implemented. Their scoped native and automated results are in STATE.md; this older milestone is not a current absence list.
-
-## Current execution refinement — 2026-09-07
-
-First-release scope above is unchanged. The user-requested Windows development preview is packaged with565files, including all37 teaching-folder files, and is linked from `DEVELOPMENT_SUMMARY.md`. Latest Fit6 and two existing scroll/branch regressions pass; full desktop570/570, workspace bins, formatting and strict workspace/all-target Clippy pass. Corrected full server56/56 retains its unchanged-server scope. Exact build status and provenance are recorded in STATE.md. This is not an optimized final release.
-
-Native6BAB operation/recovery/history passes and BCC1 corrected OA/SA nested routing passes retain their separate binary scopes. The latest DC50 preview launched with a clean PATH, and its four-card OA Fit overview was visible at1444×932 and1102×932. Minimum-height, pending-form and remaining process-purpose acceptance are still open. Computer Use was stopped by the user's Escape; leave both live GUI processes untouched and continue independent work.
-
-Native Linux core436passed/2ignored is complete on its frozen455-file snapshot. The original server compile passed, unit2/2 and HTTP50/51 passed, and the single504-versus412 timing fixture failed twice. Its private preparation-gate replacement passes on Windows but still requires Linux execution. Preserve the original failures and exact final-state assertions; do not alter the production30-second deadline to make the fixture pass.
-
-The fresh Linux GUI cross-build passed on immutable458-file snapshot `source7-20260907T102528493108Z`, including the Fit constructor fix. Run `20260907T1025486926611Z` completed in2m20s Cargo time with pre/post checks, ELF requirements and all37 lesson files verified; the compiler lease is released. The subsequent headless guest failed its early IO-APIC timer check on three bounded boots, before SSH/tests. Exact matching boot assets were extracted, but automatic approval review rejected the proposed transient boot workaround before launch. All task VMs are stopped; no application failure or current Linux server pass is inferred. Latest guide-label changes and the validated Exchange/CommonWork native oracles follow the frozen binary snapshot.
-
-Next actions:
-
-1. Retain all three guest boot records and exact-kernel proof; the proposed direct-boot action was denied by automatic approval review and must not be retried or split to bypass it. Resolve the runtime gate through an approved route or changed environment. Verify actual readiness and remaining monotonic budget before running the corrected Linux server gate. Do not restart on observation timeout alone.
-2. Preserve the reviewed guide corrections and validated expected-model/source Exchange/CommonWork oracles; the updated guide now builds on Windows and belongs in the next packaged/native snapshot. Complete native purpose authoring/history once control is available.
-3. Once native control is authorized again, complete current-layout minimum-height/Focus/pending-form checks, remaining engineering/hosted walkthroughs and actual Linux GUI acceptance using exact model/source/history evidence.
-4. Execute the corrected Linux server suite; complete final Windows/Linux optimized builds, package provenance, documentation/contracts, and fresh independent cross-disciplinary end-state review. Successful slices do not complete the goal.
+Historical milestones and evidence remain intact in
+[the dated plan archive](history/2026-09-10-ledgers-before-second-consolidation/PLAN.md).
+They do not supersede current user scope or imply current-tree acceptance.

harness/STATE.md

@@ -1,163 +1,149 @@
 # Progress Ledger — first release
 
-## Active continuation — 2026-09-10
+Updated 2026-09-11, Codex-9e8r6t `/root`, Windows host.
+**Release remains unaccepted; meaningful product and integration work is active.**
 
-Latest checkpoint: read updated objective attachment `578cf63e-08b7-411f-a01e-20416441d5e2`
-fully and updated `PROJECT_GOAL.md`. Its emphasis on Capella-level useful modeling
-and usability keeps behavior authoring central. Packaging is committed `b98f135`;
-current product/release acceptance remains incomplete. First merged desktop
-artifact finished **615/618 passed**, with three concrete failures assigned;
-the previous running status below is historical. Full evidence and diagnosis:
-`release-integrated-gates-20260910.md`.
+## Objective and current source
 
-Current leases: behavior_audit owns scenario workspace/B3 corrections and sole
-Cargo compilation; release_audit now owns only new behavior/creation.rs/tests
-pending coordinated shared wiring, with packaging frozen; palette_finish owns
-exclusive native input for a bounded Capella behavior-creation study. Root does
-not operate native UI until that lease returns. Candidate 2 closed cleanly after
-F2 equality and saved Actor checkpoint; no process 648 remains. Root owns merges,
-specification checks and ledgers. Other host owns remaining typed-history seed
-fix, standalone scenario lifetimes and its own native scenario contract.
+Deliver the complete OA/SA first release in [PROJECT_GOAL.md](../PROJECT_GOAL.md).
+The latest authoritative attachment is
+`815ff7b9-73c4-41a2-a809-635ecf8389d6/goal-objective.md`, read in full and preserved
+in that file. It requires constraints/calculations, quantities/units and reusable
+libraries, plus uncluttered human/AI text-only modeling at small and large scale.
+Long homogeneous lists and poor behavior editing remain explicit concerns.
 
-Integration update (2026-09-10): local branch is `codex/release1-9e8r6t`.
-Palette `7d1df4f` is published separately. Received Codex-956atf's exact Git
-bundle (57,658 bytes, SHA256 `85A38B00207036DCB8DB24ED4A7E80B2BE670275EEB7B00413D36153322ADA5D`),
-verified its parent `1797516`, and published its original `01bb52a` commit on
-`codex/behavior-authoring-20260910`. It is being merged here with our palette
-fixes and all additional tests. Only common ledgers conflicted; the other host's
-dated sections are preserved in `release-otherhost-checkpoint-20260910.md` so
-its cold toolchain/process claims cannot be mistaken for this host's state.
-Its optional history-value constructor cache defect has a follow-up pending.
-No integrated compile/native pass is claimed. Scenario layout follows the merge;
-the checkpoint worker independently restores inline name focus after recovery.
-The user subsequently reauthorized Computer Use explicitly. Candidate 2 native
-F2/Save/Undo/Redo now passes the independent exact name-only three-source delta
-and the full Entity Undo oracle. Recovery autofocus is committed in `31b7dc3`;
-its 13 focused tests passed after integrated compilation. The immutable 618-test
-artifact from `057eddd` plus that checkpoint patch is running separately from
-current source edits. The verified follow-up bundle `b6b76ef` now supplies the
-F1 nullable-constructor correction; its additional tests await the next build.
+Local branch: `codex/release1-9e8r6t`, base `1797516`, committed head `d114a27` at
+this checkpoint. Scenario integration3978bbe and subsequent Sensor identity fix
+are committed. Named behavior creation is wired and has passing focused tests;
+its final ancestry/guide correction passed full653; post-lint history63, strict
+Clippy/fmt and matching GUI build passed. Preserve all
+workers' edits. No open Gitea PRs at the latest read, comments through118.
 
-Latest checkpoint (18:10 UTC, Codex-9e8r6t): palette compile repairs, bounded
-inline naming, stale-submit retention and focused first-Escape cancellation are
-implemented. Candidate 1 passed desktop 588/588; candidate 2 passed 22 focused
-tests, GUI build, format and strict desktop Clippy. Candidate 2 native recovery,
-focused Escape, first-submit Save As and complete Entity model/three exact
-sources passed. Full basic editing/transition/reopen acceptance remains pending.
-The user stopped Computer Use with physical Escape; native control is paused.
-Source integration and packaging continue. See `release-palette-native-20260910.md`.
+## Completed work and scoped evidence
 
-Two independent hosts cooperate in Gitea issue #1: this host is Codex-9e8r6t;
-Codex-956atf owns process insertion, scenario clicked slots/reuse navigation and
-typed stored-history forms. Exchange separate branches from `1797516`; do not
-overwrite the shared continuation ref. Our later scenario layout work awaits
-that source snapshot. Our release worker owns packaging/Docker/notice scripts;
-our behavior worker independently reviews those changes. Cargo writers remain
-serialized. Linux runtime is blocked by a verified supported WSL2 import failure
-(`HCS_E_HYPERV_NOT_INSTALLED`); no repeated workaround is authorized by that fact.
-The user has been asked for a viable Linux environment. This does not block the
-remaining Windows/product work. The release is not accepted.
+- Palette inline naming and focused Escape: `7d1df4f`, independently published as
+  `codex/palette-authoring-20260910`. Candidate 2 focused tests, GUI build and
+  strict desktop Clippy passed. Its native F2 rename/Save/Undo/Redo matched exact
+  three-file expectations; Entity creation matched the complete independent
+  model/source oracle. Candidate3 completed ordinary Activity, existing placement,
+  allocation, direct Interaction and F2: complete basic model/four sources PASS.
+  Explicit SA actor/destination transition passed complete model/six sources;
+  Undo four-source baseline, Redo six-source result and reopen all passed. Six
+  physical files are byte-identical across reopen/reuse-preview Cancel/Save.
+  Immutable checkpoints/logs: `.local/native-qa/palette-20260910-v3/`.
+- Recovery naming autofocus: `31b7dc3`, 13 focused checkpoint tests passed after
+  integrated compilation. Its new autofocus behavior still needs native check.
+- Other-host behavior/topology/scenario/history: original `01bb52a` integrated
+  as `057eddd`; constructor cache fix `b6b76ef` integrated as `a70de55`; explicit
+  history seed fix `4ecad78` cherry-picked as `81668f9`.
+- Corrected immutable desktop artifact completed **631/631 passed**,408.18s,
+  exit0; all three prior618-artifact failures are fixed. Exact artifact/logs in
+  `.local/scenario-workspace-20260910/tests-81668f9/`. It covers3978bbe workspace,
+  Back/OpenUse guards and both history fixes, but not later Sensor/creation work.
+- A real same-size owner/document Sensor regression led to `d114a27`; affected
+  scenario53/53 passed. Current native candidate3 predates that correction.
+  Mounted workspace tests cover500×570 and wide geometry; native current-build
+  scenario acceptance remains pending.
+- Named local creation passed final21/21 and guide3/3 after ancestry-label
+  correction. The matching immutable desktop suite passed **653/653**,362.83s,
+  zero failures/ignored; exact artifact864B0F…E86/log/result under
+  `.local/behavior-creation-20260911/tests-final`. Independent integration review
+  found no additional correctness blocker. StrictClippy/all-targets/-Dwarnings
+  and workspacefmt pass after one behavior-equivalent history_fields let-chain
+  correction; affected history63/63 and matching GUI rebuild pass. Current native
+  GUI is `gui-verified` SHA D4D9C2BD…B20C31; native acceptance is active.
+- Source schema checks passed: 72 fixtures, 204 schemas, 14 families, 90 scalar
+  leaves. API/language reST rendered with strict docutils without warnings.
+- Packaging committed `b98f135`: portable Linux adapter, shared package checks,
+  Docker input validation and exact upstream notices. Independent review found
+  and fixed five concrete defects. Python 11/11 and PowerShell contracts pass.
+  Historical Windows-input ZIP has 557 files; real Linux notices close over
+  339 packages/681 files. Linux archive adapter used inert ELF fixtures, not
+  actual current application binaries. Exact Fira/Cantarell notice Git bytes
+  were independently verified. Current-source notices need regeneration.
+- Independent native Capella creation study completed, saved and closed cleanly;
+  report `release-capella-creation-study-20260910.md` is complete. Viewpoint-first
+  naming and distinct local create/existing selection inform the implementation.
+- Textual usability audit completed three static tasks and example counts. The
+  existing grammar already permits omitted initial IDs/defaults; key gaps are
+  cross-file reference context, safe alias refactoring and reviewed patches.
+  Source7 EBNF/schema documentation and viewpoint omission guidance are corrected;
+  generated language HTML passed strict docutils. Both concise snippets passed
+  26 real REST requests: identity-only stabilization, exact no-op/name edit,
+  stale/invalid nonmutation and restart persistence. All120 current core/server
+  files match the preserved source7 binary's documented snapshot. This closes
+  the bounded recipe gap, not large-model or native text-editor acceptance. The
+  verified recipe is now `examples/text-first` and in the language reference.
 
-The renewed user objective is recorded in `PROJECT_GOAL.md` and attachment
-`d3ddacce-6cca-47c5-9dd4-3d7cc2cfdba1/pasted-text.txt`. Continue to a complete,
-usable OA/SA first release; the release is **not accepted**. Initial HEAD is
-`1797516`, branch `codex/release1-continuation`, initially clean working tree.
-Gitea issue #1, its comments and Wiki Home were read before resuming work.
+Detailed evidence: [integrated gates](release-integrated-gates-20260910.md),
+[palette native](release-palette-native-20260910.md),
+[scenario workspace](release-scenario-workspace-20260910.md),
+[creation design](release-local-behavior-creation-20260910.md),
+[packaging implementation](release-packaging-implementation-20260910.md),
+[independent packaging review](release-packaging-independent-review-20260910.md).
 
-The current user request authorizes native Computer Use verification. Older
-Escape-hold statements below are historical. No Arcadia, Capella, Cargo, rustc
-or QEMU process was running at this continuation's initial inventory. Root owns
-native Windows operation, integration and the common ledgers. Current workers:
+## Active ownership and execution
 
-- `palette_finish`: architecture palette/inline naming repairs and the sole
-  initial Cargo writer lease; focused tests and a GUI build for native QA.
-- `behavior_audit`: independent actual behavior/scenario workflow and semantic
-  gap review, with no GUI control or implementation changes.
-- `release_audit`: fresh requirements, platform and release gate review;
-  read-only Linux readiness inspection, no VM launches or system changes.
+- Root: integration, common ledgers, source/API checks. Full653 is terminal PASS.
+  Computer Use remains authorized; old Escape holds are historical. Native input
+  is temporarily leased exclusively to palette_finish for the bounded QA below.
+- `release_audit`: creation/guide/historylint implementation and report frozen,
+  all assigned gates passed; Cargo writer released. No duplicate full suite.
+- `behavior_audit`: independent native creation saved-model oracle compiled
+  warnings-denied; self-falsifiers and six-source baseline pass. Exe73FA81…A9BFF;
+  final report follows. Direct-rustc released; no native.
+- `palette_finish`: exclusive native lease for fresh v4 GUI wide/minimum creation
+  drafts, focus, long names, first Escape and exact cancellation. No accepted new
+  model objects until the independent oracle; no source/Cargo. Text experiment
+  finished and its loopback server is stopped.
+- Separate host Codex-956atf: standalone scenario lifetime projection, independent
+  native scenario oracle, quantity/calculation design and library design. It has
+  its own cold toolchain/results. Its source-only reviews are not local passes.
 
-Highest-value next actions: repair and verify the unfinished palette, exercise
-real basic diagram editing against the existing independent fixture, act on
-concrete behavior-workflow findings, then close current platform and release
-acceptance gates. Historical Linux boot-workaround rejection remains recorded;
-do not retry the denied action. Historical test counts do not establish current
-acceptance. Meaningful progress is underway through repairs, independent review
-and preparation of native model/source/history checks.
+Verified bundles for eb5161b and 4ecad78 are retained in
+`.local/integration-20260910`. Local refs `codex/behavior-snapshot-eb5161b` and
+`codex/history-seed-20260910` preserve exact commits. B4 lifetime projection and
+its guide delta are not integrated yet; coordinate shared scene wiring. Review
+found insertion versus lifetime bounds, activation after branch-local Delete and
+unassigned-lane map differences that must be addressed before acceptance.
 
-The sections below retain their original evidence scope and date.
+## Unresolved requirements and gates
 
-**Checkpoint publication — 2026-09-10:** the user requested committing all current changes and pushing `codex/release1-continuation` to both `origin` and `gitea`. This is a work-in-progress snapshot. The interrupted palette-focused compilation failed with E0659 (ambiguous `column!` in `app/architecture_authoring/palette.rs:168`) and E0507 (moving the view out of an Arc in `diagram.rs:624`); an unnecessary-pattern-parentheses warning also remains in `architecture_authoring.rs:346`. The prior 584-test pass does not cover this newer palette revision. No Cargo/rustc process or local subagent was active at the publication preflight. Fix these errors and complete automated/native acceptance before packaging the redesign. Gitea coordination starts at issue #1 and the project Wiki; older evidence below retains its original scope.
+1. Finish native basic supplementary move/camera/focus/minimum matrix and current
+   scenario/process/state tasks. Main basic/transition/history/reopen passed at
+   wide size. Check raw drafts, recovery, exact source and real task completion.
+2. Natively verify named local Process/Scenario/State machine creation; address
+   contextual missing-source and operand-editing detours from the behavior audit.
+3. Constraints/calculations and quantity compatibility are currently descriptive
+   metadata; same-project includes are not maintained cross-project libraries.
+   Independent semantic designs and falsification are active before broad schema
+   changes. See [library review brief](release-library-candidate-review-20260910.md).
+   Other-host proposals expose cosmetic package revision/type compatibility,
+   subjectless analysis closure and text-only instance normalization decisions;
+   full reports are requested but not yet available locally.
+4. Implement and evaluate text-only authoring improvements after synthesizing
+   local usability and other-host language designs. Concise examples alone do
+   not satisfy modular engineering navigation and safe changes.
+5. Run coherent current desktop/core/server, specification, examples, REST and
+   optimized packaging gates after integration. Prior passes remain scoped.
+6. Current Linux runtime requires a viable environment: supported WSL2 import
+   failed once with HCS_E_HYPERV_NOT_INSTALLED; no distro registered. The user
+   has a pending environment question. No repeated denied QEMU workaround.
+7. Fresh independent cross-disciplinary release review remains required after
+   actual workflow and semantic acceptance, with all material findings resolved.
 
-**Latest priority checkpoint — Capella consultation and redesign:** the user rejected the large creation buttons and explicitly requested consulting the installed Capella. Native control resumed for that consultation in a disposable Capella 7.1 workspace. Actual palette, F2 rename and activity allocation were exercised; saved XML confirms allocation distinct from ownership. The horizontal creation/connection rows are being replaced with a compact expandable palette and inline naming. This supersedes the Escape hold and toolbar-fix proposal below. New implementation, native acceptance and a fresh user build remain pending. [Observed benchmark, alternatives and acceptance criteria](release-capella-basic-editing-20260907.md). The first-release goal remains active.
+## Handoff and publication
 
-**Latest checkpoint:** basic-editing v1 passed full desktop584/584, Windows binaries, format and strict all-target Clippy. Native v1 D8CFAA confirmed direct contextual named Entity creation at100%, and found a22px placement shift caused by the pending toolbar changing canvas height. The user pressed Escape at the attempted Undo; that action did not execute. **Desktop control is paused again.** Process9600 remains the isolated unsaved QA application; do not overwrite its binary or presume a clean close. Code-only placement fix is continuing. [Exact v1 evidence and remaining acceptance](release-basic-editing-reset-20260907.md). This supersedes the resumed-control state below; the first-release goal remains incomplete.
+Use Gitea issue #1 and current Wiki to coordinate as **Codex-9e8r6t**. Read before
+resuming; preserve the other host's work. Direct Git push now fails authentication;
+anonymous fetch and Gitea MCP still work. Integration3978bbe was published and
+independently fetched/hash-verified as a Git bundle on
+`codex/integration-transfer-20260910`; Wiki `Integration3978bbe` and issue#97 own
+exact transfer instructions. Other host has integrated it and an equivalent
+Sensor fix. Publish the next coherent creation/docs checkpoint similarly;
+preserve its later B4/reference chooser/design work and avoid duplicate patches.
 
-**Superseding priority checkpoint:** the user explicitly said “Resume desktop checks” and rejected the focus on advanced review before basic diagram editing. Isolated native checks resumed and reproduced the global creation catalog, placeholder creation/camera jump and noisy review. Contextual named creation and compatible layer-transition destinations are now being implemented and tested. Their new executable has not yet been accepted. [Current priority and scoped evidence](release-basic-editing-reset-20260907.md). The older Escape hold and next-step priorities below are superseded; historical binary/test results retain their original scope.
-
-Current checkpoint: 2026-09-07. The requested Windows development preview is built and packaged with its runtime, documentation, notices and complete examples. Latest Fit6, two existing scroll/branch regressions, full desktop570/570, workspace bins, formatting and strict workspace/all-target Clippy pass. Corrected server56/56 retains its earlier unchanged-server scope. Packaged DC50 GUI launched and the OA graph Fit overview was observed at1444×932 and1102×932; minimum-height and pending-form native acceptance remain open. The user stopped Computer Use with Escape; do not resume native control without renewed authorization. Native Linux core436passed/2ignored remains verified; corrected Linux server and full Linux GUI build/runtime remain open. The fresh Linux desktop cross-build passed on Rust1.90 in2m20s using the preserved cache; ELF and all37 teaching files are verified. Three later guest boots failed the early IO-APIC timer check before SSH/tests; the exact-kernel workaround was then rejected by automatic approval review before launch. All task VM processes are stopped. **Goal active; release incomplete.** The authoritative objective is `C:\Users\User\.codex\attachments\10b0f701-1743-4de7-9ee1-225920e19649\goal-objective.md`: a usable, feature-complete OA/SA engineering tool for Windows and Linux with graphical/source/REST parity, artifact traceability, offline guidance and independent end-state acceptance.
-
-## Workspace and ownership
-
-- Current branch `codex/release1-continuation`, checkpoint **4b6b5fc1977523e8cf52fdd5503a0a71c87a3f63** commits290files of source6 work and evidence. [Bounded checkpoint audit](release-checkpoint-integration-review-20260906.md) verified65pinned manifest entries and145exact staged/working fixture/archive files; `.gitattributes` protects their measured line endings. Integrated ancestry starts at `c091f80`; [branch audit](release-branch-integration-20260906.md) prevents reimplementing already integrated work. New source7 implementation is authorized but not yet accepted.
-- Historical6BAB native scope (superseded in rendering by BCC1 and Fit by DC50): acceptance binary `.local/native-qa/bin-source7-acceptance/arcadia-studio.exe` SHA256 `6BAB6CDE7D31326F3C3CF7342D9B25FB6ADA032864BBE8104625E5EC9736283B` follows the Windows433/55/561 and strict/build gates below. Reset and ReadStatus each passed exact complete model/source Save/Undo/Redo and reopening with the correct derived Reply allocation30/31. OA caller→First.B passed exact persistence/history/reopen; routing remains open. Process11060 closed cleanly; isolated old6 recovery process11240 also closed after its complete source/JSON/raw-draft pass. Old5 process5244 subsequently passed exact30-source/full-JSON recovery and raw-workspace comparison. Current7 process8224→10420 passed invalid nested-link draft crash recovery; completing the recovered SA X→[R3,Inner]/B link passed exact model/two-source Save/Undo/Redo and saved reopening. Those historical native processes closed; the later BCC1 routing and DC50 Fit evidence is recorded separately below. [Native evidence](release-source7-native-acceptance-20260907.md).
-- Completed bounded90minute Linux gate: one-job Rust1.90,455-file immutable snapshot SHA256 `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279`, launched07:02:43UTC, deadline08:32:43UTC. Server compilation passed17m10s; unit2/2 and HTTP50/51 passed, with one504-vs-412 test assertion reproduced in an isolated rerun. Its two-second read/PATCH checks passed, but later persisted-state assertions were not reached. This establishes a timing-dependent fixture/deadline mismatch, not a production locking defect. Native core completed436passed/0failed/2ignored across40targets, Rust1.90, compile23m03 and1992seconds total; all455 source pre/post checks passed. The two ignored cases are optional inheritance scaling and explicit strace fault injection (earlier separately scoped injection passes remain historical). All artifacts were copied before sync/poweroff; QEMU6280, launcher5000 and seed816 were absent08:13:56UTC. [Current Linux report](release-source7-linux-gate-20260907.md). Earlier Linux evidence retains its older snapshot scope. WSL remains pending restart; no host restart is authorized.
-- Windows session5735 completed all six gates with exit0: focused prepared-HTTP and cancellation, full server56/56 in68.78s, format10.44s, strict workspace/all-target Clippy99.60s, bins102.22s. Status/logs: `.local/source7-post-routing-gates-status.json`. Distinct GUI BCC1FC6DB68123C9D3A43CE53AA8EF59E33C54080632C104C99ED13270D5333F process8568 passed the scoped corrected routing checks and closed cleanly. [HTTP evaluator correction](release-http-preparation-phase-regression-20260907.md), [routing correction](release-contextual-route-native-fix-20260907.md), [native details](release-source7-native-acceptance-20260907.md). These passes precede the now-tested [Fit/layout correction](release-process-fit-layout-audit-20260907.md).
-- The requested Windows preview is `dist/ArcadiaStudio-preview-source7-20260907-x86_64-pc-windows-gnullvm/arcadia-studio.exe`; its565-file ZIP includes all37 teaching-folder files and has SHA256 `1fac10b30daf2f8e1dac29e9469485e4bea142e77ff5a13e4c9d1e41ff03abb2`. The adjacent provenance records actual source/binary hashes. This is a development profile, not an optimized final release. Latest gates are in `.local/source7-latest-preview-status.json`; full desktop570/570 completed in198.82s test time,200.63s command time, exit0 in `.local/source7-latest-full-desktop-status.json`. Initial Fit4/2 failures exposed real zero-size-slot remounting; corrected constructors pass unchanged expectations. [Fit review](release-process-fit-independent-review-20260907.md), [development summary](../DEVELOPMENT_SUMMARY.md).
-- Computer Use is stopped. Read-only inspection initially found preview9148 and second GUI8044 live; later9148 exited without agent intervention, while8044 remained untouched. No GUI control/closure is authorized for background verification. The cross-compiler lease ended after the successful142.766s monotonic run; no cross processes remain. The Linux worker completed a bounded headless guest experiment and released the lease. Three boots (same configuration twice, then Normal boot priority) reached terminal IO-APIC timer panic before SSH/Cargo; all task VM trees stopped and exact evidence was preserved. Exact matching kernel/microcode extraction passed without changing base/overlay hashes; automatic approval review rejected preparation/launch of the transient no_timer_check experiment as “blocked by policy.” No fourth boot or corrected tests ran. No task VM is live; see [the preserved boot evidence](release-source7-linux-server-corrected-gate-20260907.md). [Cross-build report](release-source7-linux-gui-cross-build-20260907.md).
-
-## Current source build and stopped runtime gate
-
-The guide-only followup compiled successfully with locked Windows workspace bins in12.70s Cargo/12.82s command, exit0. Status `.local/source7-guide-current-build-status.json` records guide SHA256 `80A6797051FB28E767F2AB5DD2F335ABCD9F3E5F3A75C731CDE46D8B90D5C92E`; resulting GUI SHA256 `327FBDF734716A7F1AF2874183D46A531A8F429BA1A478E83A3E7F2EB1D6248B`. Formatting and independent actual-label review pass. This later debug artifact does not replace the user-facing packaged DC50 preview, its archive or earlier native evidence. No full570 rerun is claimed for the text-only followup.
-
-Previous goal turn made progress by confirming full570 tests and handing off the package/summary. This continuation produced the successful Linux GUI build/ELF evidence, validated purpose oracles, corrected/built guide text, and concrete guest-boot evidence. Goal remains active/incomplete. The denied direct-boot action must not be split or retried to bypass automatic review; no new Linux job is running or scheduled.
-
-## Latest Linux build and purpose-oracle evidence
-
-Linux GUI snapshot458files `source7-20260907T102528493108Z` has archive SHA256 `9b10aa8457a5371367f7e24a0b2260b63c19fed69873d98a3972062a744503d7`. Run `20260907T1025486926611Z` passed locked/offline Rust1.90 zigbuild, both source checks and independent ELF/package readback. GUI72,953,296bytes SHA256 `330A3872D48EBF24AD21E6D4FA13CB6098BEBB3CB7FF82A2E082925CCF3DD346`; ELF64PIE, glibc requirements≤2.28, all37 lesson files exact. Actual Linux GUI runtime is still unverified. Subsequent guide-label text is excluded from both published Windows and this frozen Linux preview.
-
-Extended native checker `source7-native-contract-incidence.exe` SHA256 `16994DC437F5CCC5E5F6FBB4212C03449F2389AE4615FA98B2930B3637468EE3` compiled with warnings denied in4.05s during a coordinated short lease. OA Exchange and SA CommonWork self-checks pass: exact contextual assembly, unchanged precedence, wrong direction/work rejection, caller-only exchange coverage and stable source update. Separate43-element/10-relation incidence fixture baseline passes; all original golden hashes and preserved OA-link/Reset accepted cases remain exact. Independent review found no material issue. [Cases and reproducible native steps](fixtures/source7-native/README.md). Native purpose authoring/history remains pending.
-
-## Completed and verified at this checkpoint
-
-| Scope | Evidence and limit |
-|---|---|
-| Historical source6 diagnostics and guide | Semantic filter **108 desktop + 2 core** passed; full desktop **527/527** passed; strict all-target Clippy and GUI/server build passed (`.local/semantic-diagnostics-final-tests.log`, `desktop-diagnostics-final-tests.log`, `diagnostics-final-clippy.log`, `diagnostics-final-build.log`). Subsequent guide **3/3** focused tests, strict Clippy and build passed (`.local/guide-navigation-{tests,clippy,build}.log`). The guide test increases compiled desktop inventory to528; no full528 run or final full-workspace total is claimed. |
-| Current artifact implementation checkpoint | Full desktop **518/518**, corrected fresh artifact picker **6/6**, strict all-target Clippy passed. Logs `.local/source6-artifact-inspector-desktop-tests2.log`, `.local/source6-artifacts-final-tests2.log`, `.local/source6-artifacts-final-clippy3.log`. Four subsequent artifact recovery falsifiers and two core absence oracles passed separately. This predates latest display corrections. |
-| Native artifact MOVE / CREATE / DELETE | All three complete source Apply/Save, one Undo/Save and one Redo/Save oracles passed; **nine saves succeeded first attempt**. MOVE invalid Owner and disabled optional text, and CREATE excluded row/all eight decisions/reserved UUID survived controlled-stop recovery exactly. DELETE removed destination from identified moved-source absence while retaining the source link. [Exact native report](release-artifacts-native-20260906.md), [fixture/generator instructions](fixtures/release1-native/artifacts/README.md). |
-| Source-6 atomic batch review | Included valid and excluded invalid raw rows survived forced-stop recovery; repaired two-source Apply and complete Save/Undo/Redo source comparisons passed. [Native report](release-current-native-verification.md). |
-| Scenario ordered-member variant | At1100×700, Take rejected ambiguous insertion; explicit final order retained the local self-test. Complete Apply/Save, Undo/Save and Redo/Save matched the independent source oracles with only the schema5→6 header token upgrade. All three saves succeeded first attempt. Branch steps/fragment branches and this variant's crash recovery remain separate cases. [Exact native report](release-current-native-verification.md). |
-| Native guide navigation | On current guide binary at1100×700: related Scenarios-bottom→Exchanges opens the new heading; filtering `exchange` retains the current topic's bottom position; `Git` auto-selects Build first and opens its heading. No dirty model. Root's actual native observations close these bounded scroll cases; [implementation/tests](release-semantic-conflict-diagnostics-20260906.md) remain separately scoped. |
-| Communication means | Drawing/create/reuse and legacy reverse full-model/source/history passes are retained. Corrected reverse Apply now opens the explicitly requested OA scenario in Behavior, preserving the original four-object Architecture. Distinct oracle predicts10UUIDs/zero placements; accepted model/all3sources, Undo baseline, Redo and reopen pass. Every Save succeeded first submission. Navigation5focused tests, strict Clippy and bins build pass; compiled desktop535 is not a full535 run. [Exact report](release-communication-native-20260906.md), [implementation](release-behavior-transition-context-20260906.md). |
-| Teaching project and Home hook | Corrected94element/62relation/5view/68trace/30source example passes4expanded direct-rustc tests. Minimum-size Home/guide, raw-source guard, reviewed NameTake and exact source/history/reopen pass. Navigation fix is reverified. Additional data/interface/type drill-down, saved-view comparisons, invalid-view guard and typed Entry action selection pass. Fold/unfold and function rename/Undo/Redo each match complete model/all30source oracles, five first-submission saves; saved reopen retains the Entry target identity. Complete process/scenario/reuse/evidence lesson remains open. [Native report](release-teaching-native-20260906.md). |
-| Child/Incident and source-5 recovery | Two-row attachment recovery and complete Apply/Save/Undo/Redo passed, every save first attempt. Exact old source-5 raw/base/include/path retention, manual repair and two-file Save passed. [Attachments](release-attachments-native-20260906.md), [source-5 native](release-source5-native-recovery-20260906.md), [independent review](release-source5-checkpoint-independent-review-20260906.md). |
-| Dense saved views | Forty-label baseline and selected real relation identities inspected; filter, duplicate/hide, original10/copy9 persistence across restart and exact model oracle passed. Additional coverage/context intersections, empty selections and Names-and-items preview/Apply/Undo observed. Minimum-size overview requires working zoom/pan. Limits remain in [native evidence](release-current-native-verification.md). |
-| Core/source/REST integration | Fresh `--all-targets` core run: **433 passed/1 ignored**,44 target summaries, exit0 in138.72s; fresh server run: **55/55**,4 summaries, exit0 in64.74s. Logs `.local/source7-core-all-targets.log`, `.local/source7-server-all-targets.log`; exits/timings in `.local/source7-current-gates-status.json`. These supersede the earlier combined core count and pre-budget-fix HTTP51 checkpoint. OpenAPI **72fixtures/204schemas/90leaves** and both strict reST renders pass. [Core checkpoint](release-source7-core-checkpoint-20260906.md), [API integration](release-source7-api-integration-20260906.md). |
-| Source7 desktop authoring and recovery | Latest routing3/3 and full desktop **564/564 pass**; [routing checkpoint](release-contextual-route-native-fix-20260907.md) records exact logs. Earlier full desktop **561/561 passed**, zero failed/ignored,263.39s in `.local/source7-desktop-full-tests2.log`. The initial560/1 run exposed canvas scroll-state loss when a new conditional navigation control shifted its widget; a fixed navigation container corrected it, and the unchanged regression passed. Coverage includes qualified5, operation3 (selected Async request fields), semantic source7 facets/omission3, recovery8, legacy source5 13, artifact search2 and focus guard1. Exact old-version enum/cache-path intent rejection and raw text retention are covered. The complete-scope endpoint picker preserves access beyond512; canvas preview remains bounded. Guide now accurately describes attachment/artifact reconciliation and artifact filtering. [Desktop checkpoint](release-source7-desktop-authoring-20260906.md), [recovery](release-source7-recovery-20260906.md). |
-| Windows strict/build checkpoint and native7 | Strict workspace/all-target Clippy passed2m50s; root observed final format exit0/empty log. Three affected semantic tests passed3.46s after equivalent lint edits; native build exit0 recorded in `.local/source7-current-gates-status.json`. These earlier results scope the6BAB binary, not the later routing test binary or pending new strict/build sequence. Reset/ReadStatus full model/all-source Save/Undo/Redo/reopen pass. OA First.B persistence passes but routing acceptance remains open. Old6 Recover preserved the complete30-file bundle/workspace/Ports DTO, exact spaces/Unicode/fingerprint/reserved identity; Cancel/Save as and JSON export passed full independent source/model equality. Original seed unchanged. Old5 complete accepted/raw recovery, exact repair/30-source Save and full-model export pass. Current7 invalid nested draft crash recovery plus completed link Save/Undo/Redo/reopen pass; rendering still uses the older binary. [Native report](release-source7-native-acceptance-20260907.md). |
-| Current Linux source7 and cross-built probe | Frozen native server compilation passed17m10s; unit2/2 and HTTP50/51, with one timing-dependent504-vs-412 assertion reproduced twice. No complete server pass; later targets not claimed. Native core436passed/0failed/2ignored; VM cleanly off08:13:56UTC. Separately, the complete Windows macro/build-script cross-build probe's hash-verified ELF executed successfully on Linux; this is neither a full desktop build nor GUI acceptance. [Native Linux gate](release-source7-linux-gate-20260907.md), [cross-build probe](release-linux-cross-build-probe-20260906.md). |
-| Historical Linux/MSRV core and server | Ubuntu24.04.4/x86_64/glibc2.39/ext4/Rust1.90: core38/38, patched journal4focused/42full and3explicit syscall fault cases pass on recorded snapshots. Actual server build passes34m42s including3m24s pause. Real HTTP modular import, invalid PUT unchanged source/ETag, clean SIGTERM and exact model/source/ETag restart pass on the older28-source lesson snapshot. Full server test command timed out while compiling; zero tests executed. That gate shut down cleanly21:53:56; the separate current gate has the scoped results above. Current desktop/Linux package unverified. [Linux report](release-linux-validation-options.md), [journal contract](release-linux-journal-publication.md). |
-| Packaging foundation | Portable Windows QA staging, dependency/runtime/font/Rust notices, archive readback and clean-PATH smoke passed at earlier binaries. [Package report](release-windows-package-review.md). QA archives are not current final release artifacts. |
-
-Historical full platform/native milestones retain their original revision scope; [complete prior ledger](history/2026-09-06-ledgers-before-consolidation/STATE.md) preserves all evidence links and previous environments. A test or native pass never transfers automatically to a changed executable.
-
-## Active findings and checks
-
-Native artifact review exposed same-row conflict wording and reserved identities shown as deleted. Corrections retain typed actual-slot equality, row-addressed reservations and accepted-identity precedence; independent re-review found no further material defect. The completed108-semantic/527-desktop checks supersede the earlier interrupted run and include reserved-label/partial-creation regressions. Revised artifact wording still needs its own native observation on the current binary. Guide-scroll implementation/tests/build and the bounded native cases above passed. [Diagnostic/guide report](release-semantic-conflict-diagnostics-20260906.md).
-
-**F1** teaching onboarding/review/history has current-binary native evidence; remaining tutorial work is scoped in its report. **F2**, faithful behavior-canvas SVG export, is deferred by root's scope decision: export remains architecture-only and must be described that way; no faithful scenario/process/state SVG acceptance is claimed.
-
-Reverse scenario's first-dependency focus/overlapping architecture placements and teaching NameTake's separate layer/view mismatch are fixed and natively reverified. Latest NameTake4focused tests, strict alltargetClippy28.26s and binsbuild50.50s pass; no full539desktop pass is claimed. [Navigation evidence](release-semantic-review-navigation-20260906.md). Minimum-size process working space is cramped; native lesson evidence records23% overview versus100% scrolling rather than claiming readability at Fit.
-
-Independent scope reconciliation verified **S1** missing contextual assembly into repeated/nested process references and **S2** missing maintained interface-operation identity in parameterless messages. Isolated existing-core probes falsify the proposed workarounds. Root ratified the jointly critiqued [source7 integration decision](release-source7-integration-decision-20260906.md), including deterministic cache-independent admission, whole-link deletion, purpose-specific analysis, exact Call-derived operation/Reply identity and one frozen old5/6 checkpoint migration. These contracts now have implemented core/source/REST/desktop/recovery paths and the current automated gates above; remaining native7 and current Linux acceptance remain incomplete. [Scope reconciliation](release-scope-reconciliation-20260906.md).
-
-Linux ordinary rename's empty-target replacement was independently reproduced and corrected using `renameat2(RENAME_NOREPLACE)` without fallback. Exact errno/no-write assertions now pass under actual syscall injection. This establishes the ext4 publication invariant, not power-loss durability, hostile ancestor protection or model-file compare-and-swap. Windows retains its no-replace API and bounded scanner retries.
-
-## Remaining gates and next actions
-
-1. Fit implementation/review and automated gates are complete, including full570 desktop tests. Finish its native minimum-height/Focus/pending-form checks when native control resumes. Preserve completed BCC1 routing and old5/old6/current7 recovery/source/history oracles. Complete remaining current-binary S1/S2 purpose workflows and teaching cases; operation allocation deletion remains subject to independent channel validation. Native-check revised reserved labels and same-row conflicts. The later guide-only control-label correction passed formatting, independent review and the fresh workspace-binary build; it awaits the next packaged/native release snapshot.
-2. Close uncovered selective-view lifecycle cases; advanced ordered/process/scenario/fragment variants beyond the accepted Scenario case; typed state actions and pending Linux data/hosted/compact workflows. Implemented semantics must not be called missing merely because acceptance is outstanding; [coverage audit](release-current-coverage-20260906.md) is the baseline map, newer scoped reports supersede its old gap claims.
-3. Verify complete current Linux integration suites and desktop/server build/runtime, then supported-size native workflows. The successful core/MSRV pilot is a reusable starting point, not application acceptance.
-4. Preserve current strict Clippy/format/reST/example/source/OpenAPI results and rerun affected checks after changes. Complete optimized/MSRV/final platform gates, actual hosted transport variants and final migration/package checks. Rebuild portable distributions from the accepted exact tree, validate notices/runtime/content/checksums and clean-environment launch before replacing old bundles.
-5. Conduct fresh independent requirements/domain/parity/architecture/runtime/UX/end-state reviews; resolve material findings. Commit/integrate authorized source with reviewable scope; remote publication is not requested. Only complete the goal when its applicable criteria are met.
-
-Meaningful progress continues: native lifecycle and Linux no-replace uncertainty have been resolved with exact oracles. The highest-value work is current-binary validation and closing uncovered engineering workflows, not accumulating repeated historical headings or treating aggregate test counts as release completion.
+The old ledgers, including all historical platform and native evidence, were
+archived byte-for-byte before this consolidation in
+[history/2026-09-10-ledgers-before-second-consolidation](history/2026-09-10-ledgers-before-second-consolidation/STATE.md),
+with hashes.json. Their historical-current wording does not supersede this file.

harness/TASK_LEDGER.md

@@ -1,112 +1,118 @@
 # Task Ledger — first release
 
-## Updated objective and current strategy — 2026-09-10
-
-Given: the latest authoritative request is
-`578cf63e-08b7-411f-a01e-20416441d5e2/goal-objective.md`, copied into
-`PROJECT_GOAL.md`. It preserves complete OA/SA, parity, API, traceability,
-cross-platform and review requirements, and explicitly emphasizes that current
-usability/functionality remains below Capella. The next changes must address
-actual engineer workflows; passing narrow technical checks is insufficient.
-
-Verified: palette F2/Save/Undo/Redo and the exact Entity source oracle passed
-on candidate 2. Named Actor placement is saved; full basic workflow is pending.
-Merged desktop ran 618 tests: 615 passed and 3 failed, with concrete navigation
-and history-seed causes now assigned. Schema fixtures and strict reST rendering
-passed. Packaging is committed with independent review and exact notice bytes.
-See `release-integrated-gates-20260910.md` for scope and failures.
-
-Strategy: finish the actual remaining-height scenario workspace, repair its
-navigation and typed-history failures, and make starting a named behavior local
-with explicit viewpoint/owner choices. An independent native Capella study
-informs that workflow while the creation worker implements its isolated module.
-Root integrates and then evaluates realistic current-build tasks. Assumption:
-these changes will reduce navigation/draft detours; native acceptance must prove
-that. Linux runtime and broader parity/release gates remain unresolved.
-
-**18:10 UTC checkpoint, 2026-09-10:** palette repair candidate 2 passes focused
-tests/build/format/strict Clippy and native recovered-draft Escape/save plus the
-complete Entity source oracle. The user stopped Computer Use; native verification
-is paused with the rest of basic editing still unaccepted. Root publishes the
-palette delta on a separate Gitea branch. Other-host process/scenario/forms source
-is awaited; packaging implementation and independent adversarial review continue.
-See the latest `STATE.md` section and dated reports for exact evidence and leases.
-
-**Active objective, 2026-09-10:** the user renewed the complete first-release
-request in `PROJECT_GOAL.md` and the latest pasted request. Native verification
-and GPT-6 Astra worker delegation are explicitly requested. Initial repository
-and Gitea evidence confirms an unfinished compact-palette redesign, including
-two compile errors; prior native and automated passes remain historical.
-The current hypothesis is that direct contextual authoring can make existing
-OA/SA semantics approachable. Test that hypothesis against real engineering
-tasks before claiming usability. Root owns integration/native operation and
-ledgers; bounded palette, behavior-gap and release-readiness workers are active.
-See the dated active section of `STATE.md` for exact ownership and next actions.
-
-
-**Superseding user direction:** large horizontal creation buttons were rejected as intrusive and unprofessional. The user explicitly authorized consulting the installed Capella; that consultation has resumed and established actual compact palette, inline rename and explicit activity-allocation behavior. See [Capella 7.1 evidence and selected redesign](release-capella-basic-editing-20260907.md). The current candidate replaces creation/connection rows with one compact expandable palette and an in-place name editor. Native acceptance of the redesigned executable is pending; compactness is not assumed to prove usability. The earlier Escape hold and proposed toolbar-only correction below are superseded.
-
-**Latest evidence:** basic editing full desktop584/584, bins, formatting and strictClippy passed. Native named Entity creation works at100%, but changing pending-toolbar height moves the screen placement22px. User Escape stopped the attempted Undo; native checks are paused again. Code-only toolbar correction proceeds. [Current findings](release-basic-editing-reset-20260907.md). The previous goal turn made concrete progress through implementation, integration gates and a native-discovered defect; this is not a no-progress blocker turn.
-
-**Current steering:** basic diagram authoring and understandable OA/SA transitions come first. The user explicitly reauthorized desktop checks; root resumed the isolated test build and reproduced the reported usability problems. Creation, transition and independent fixture work is underway. No new basic-editing native pass is claimed. See [priority reset](release-basic-editing-reset-20260907.md); older execution priorities and Escape hold are superseded.
-
-Updated 2026-09-07 after source7 Reset/ReadStatus and old6 recovery native passes, OA contextual persistence with rendering open, and reproducible Linux server test deadline evidence. Native Linux core now passed436/0failed/2ignored and its guest shut down cleanly. Old5 full recovery and source7 pending nested-link crash recovery/history/reopen also passed; routing3/3 and full desktop564/564 now pass. Root's private-server/full-server/format/strict-Clippy/bins sequence is running with results pending. [STATE.md](STATE.md) owns current execution/evidence and leases. [PLAN.md](PLAN.md) owns the release plan; [DECISIONS.md](DECISIONS.md) preserves architectural rationale. Full pre-consolidation contents, including superseded requirements interpretations and evidence, remain [archived byte-for-byte](history/2026-09-06-ledgers-before-consolidation/TASK_LEDGER.md).
+Updated 2026-09-11 by Codex-9e8r6t `/root`. Release not accepted.
 
 ## Goal and success criteria
 
-The authoritative user objective is `C:\Users\User\.codex\attachments\10b0f701-1743-4de7-9ee1-225920e19649\goal-objective.md`. Deliver a usable, substantially complete OA/SA engineering tool in Rust/Iced on Windows and Linux; equivalent graphical, strict textual/reST and REST workflows; practical artifact traceability; navigable offline guidance; recoverable drafts; reproducible deployment. Completion requires native engineering task evidence and fresh independent end-state review, not implementation or passing tests alone. Later Arcadia layers remain future scope.
+[PROJECT_GOAL.md](../PROJECT_GOAL.md), copied from attachment
+`815ff7b9-73c4-41a2-a809-635ecf8389d6/goal-objective.md`, is authoritative.
+Deliver a usable, substantially complete OA/SA systems modeling product in
+Rust/Iced on Windows and Linux, with equivalent graphical/textual/REST editing,
+strict reST semantics/API, arbitrary development-artifact traceability and
+navigable offline help. Constraints/calculations, quantities/units and reusable
+model libraries and complete uncluttered text-only small/large modeling are
+explicit requirements. Later Arcadia layers remain future
+releases. Completion requires real engineering tasks, sound semantics, relevant
+passing checks and fresh independent cross-disciplinary review.
 
-## Given facts and constraints
+## Given facts
 
-- User prioritizes Capella domain fidelity, useful containment/nesting and explicit typed ports, while avoiding clutter, persistent action overload and awkward navigation. Study real domain workflows rather than mechanically copying Capella classes.
-- Both-layer transitions and reviewed counterpart reconciliation must be intuitive and precise. Behavior/scenario diagrams must be directly editable and preserve selection/camera/task context.
-- Human/AI/Git-friendly modular source, comments/includes, complete graphical/source/API parity and clear rejection are required. One validated model/history boundary must govern every representation.
-- User permits autonomous reversible engineering, experiments, independent agents and authorized native work. Root is the sole native operator in this collaboration. Do not run concurrent shared Cargo writers. No remote push, usage reset, broad target deletion or host restart is implied by current task authorization.
-- User permits isolated Linux work. WSL remains unavailable pending restart; earlier task-local QEMU core and server gates completed and shut down cleanly; the separate source7 core gate also completed and shut down cleanly, as recorded below. The server built and passed real HTTP/restart checks; its full test command timed out during compilation before any test executed. Historical external worktrees/toolchains are not present on this machine.
+- User prioritizes Capella's domain capability and useful visual nesting while
+  rejecting clutter, intrusive creation rows, static behavior diagrams and long
+  homogeneous option lists. Reduce cognitive load in small and large models.
+- Source must be understandable to engineers and AI, work with Git and preserve
+  full parity. OA/SA transitions in both directions must be clear and reviewed.
+- User authorizes autonomous reversible work, research, native Computer Use and
+  parallel agents. Use GPT-6 Astra exclusively with task-appropriate effort.
+- Gitea coordination and shared Wiki updates are required. Identify host and
+  worker consistently and preserve overlapping work. Explicit project messages
+  are authorized; unrelated external messages are not.
 
 ## Verified facts
 
-- Latest superseding checkpoint: Fit6 and both existing scroll/branch regressions, full desktop570/570, workspace bins, format and strict workspace/all-target Clippy pass. Windows preview565-file ZIP and complete examples are verified; current server56/56 also passed. Native BCC1 OA/SA nested routing and unchanged-source oracles passed, followed by bounded DC50 packaged Fit overview. Earlier pending-build/routing claims below retain their historical scope and are superseded by these exact current results in STATE.md.
+[STATE.md](STATE.md) records exact commits, live leases and scoped verification.
+The current model has one typed core, validated atomic commands and coordinated
+Project/SourceBundle history shared by desktop and REST. Included files share
+one global namespace. Current Constraint expressions are strings; numeric unit
+strings do not convert values or establish dimensional compatibility. There is
+no package/version/instance/update contract for cross-project libraries.
 
-- Branch/patch/tree audit established that direct state/scenario/process, data contracts, hosted editing and earlier semantic review are already integrated; no required production transplant was found. [Branch evidence](release-branch-integration-20260906.md).
-- Capella's function input/output exchange endpoints and component Standard/Flow ports are distinct; explicit allocation connects them. Preserve that domain distinction. [Native benchmark](release-capella-workflow-benchmark.md).
-- Source6 introduced participant CommunicationMean, typed explicit transition endpoint decisions, saved exchange categories/view selectors, completeness warnings and presentation duplication; current source7 retains them. Older audit absence claims are superseded; native acceptance remains scoped by reports.
-- Semantic review includes independent scalar/constructor/keyed/order/Child/Incident/artifact facets and multiple source rows. One frozen accepted base, explicit mappings, unique merged candidate slots and one atomic command preserve raw excluded/rejected drafts. Recovery replans; it never restores an unchecked serialized command. [Batch design](release-semantic-batch-foundation-design.md), [artifact contract](release-semantic-artifacts.md).
-- Native Windows artifact MOVE/CREATE/DELETE passed exact complete Save/Undo/Redo oracles, nine first-attempt saves. MOVE invalid raw optional state and CREATE exclusion/reserved identity survived controlled-stop recovery exactly. Destination-only retention is automated evidence, not separately native-applied in that run. [Native report](release-artifacts-native-20260906.md).
-- Native batch, Child/Incident and source-5 checkpoint workflows have scoped exact source/recovery/history evidence. Dense views have persistence/duplicate/hide and bounded readability evidence. Current counts, binaries and remaining cases are in STATE.md; these are not universal usability claims.
-- Native communication means drawing, explicit create/reuse ports and reverse Call/Reply pass independent complete model/source and exact Undo/Redo checks. The reverse navigation/overlapping-placement defect is fixed and reverified against a distinct oracle:10newUUIDs,zero implicit placements, correct Behavior owner and preserved Architecture. [Exact evidence](release-communication-native-20260906.md).
-- Windows semantic108desktop+2core/full527desktop passes remain scoped. Subsequent guide/home and behavior navigation slices passed focused tests/strict Clippy/build; semantic navigation is also natively reverified. Fresh source7 core all-targets433passed/1ignored across44 summaries and server55/55 across4 summaries have recorded exit0. Full desktop561/561 passed263.39s after a real scroll-state regression was fixed with a stable navigation Column; the unchanged test passed. Strict workspace/all-target Clippy and root-observed final format exit0 pass;3 affected semantic tests passed after equivalent lint edits. Subsequent routing3/3 and full desktop564/564 pass; new standalone build and strict/server results remain pending. Logs and exact scope are in STATE.md; do not add affected reruns to full-suite totals.
-- Native Scenario ordered review passed ambiguity rejection, explicit retained-local final order and complete Save/Undo/Redo source oracles at1100×700. Current guide binary passes related-topic heading reset, same-topic search scroll retention and Git auto-selected-topic reset without dirtying the model. Branch/fragment order variants and revised artifact diagnostic rendering remain separate gates. [Native ordered evidence](release-current-native-verification.md), [guide/diagnostic implementation](release-semantic-conflict-diagnostics-20260906.md).
-- Windows user-local GNU/LLVM builds and isolated clean-PATH native launch work. Actual Ubuntu24.04.4/Rust1.90 core/journal tests pass on hashed snapshots. Actual Linux server build and real HTTP modular import/invalidPUT/cleanrestart exact source/model/ETag pass on the older28-source lesson snapshot. Its full server test command timed out during compilation with zero tests executed, then that gate shut down cleanly. The current frozen source7 gate compiled the server in17m10s and passed unit2/2 plus HTTP50/51; the sole504-vs-412 timing assertion failed again alone. Its final persisted-state checks were not reached. Native core436passed/0failed/2ignored and the VM shut down cleanly08:13:56UTC; full desktop/Linux package remain unverified. [Linux evidence](release-linux-validation-options.md).
-- Corrected30-source/37-file teaching project passes minimum-size Home/guide/dirty-source guard, located initial warning, reviewed NameTake and complete exact source/Undo/Redo/reopen checks. The layer/canvas mismatch is corrected and natively reverified. Data/interface/type navigation, saved-view distinctions, invalid-view draft guard and typed state Entry fold/rename/history/reopen pass. The process workspace is cramped at minimum size and artifact navigation required excessive scrolling; targeted source7 UI improvements await native observation. [Native evidence](release-teaching-native-20260906.md).
-- Scope reconciliation established caller-context links into repeated/nested reusable chains (**S1**) and maintained interface-operation selection for parameterless messages (**S2**) as real missing semantics. Their ratified source7 implementation now has fresh full core/server/desktop gates, OpenAPI72 fixtures and strict reST evidence. Old5/6 compatibility and current7 raw recovery tests pass. Root's native Reset and ReadStatus cases passed complete Save/Undo/Redo oracles and reopened with explicit derived allocation30/31. OA First.B persistence/history/reopen passed but rendering is open; old6 recovery passed full30-source/model JSON and exact raw workspace/Ports DTO comparison. Old5 complete raw/accepted recovery, exact repaired30-source save/full-model export pass. Current7 invalid nested draft crash recovery and completed link Save/Undo/Redo/reopen also pass; corrected rendering and remaining native7/Linux workflows remain open. [Native report](release-source7-native-acceptance-20260907.md). [Scope reconciliation](release-scope-reconciliation-20260906.md), [integration decision](release-source7-integration-decision-20260906.md).
+Candidate3 completed the main basic/transition/history/reopen story with exact
+four/six-source independent model oracles; supplementary native cases remain.
+Corrected immutable desktop631/631 passed; later Sensor correction passed53/53.
+Final creation21/guide3 and matching full desktop653/653 passed after ancestry
+label correction. StrictClippy/fmt pass after one behavior-equivalent history
+let-chain rewrite; affected history63 and matching GUI build pass. Native acceptance
+is active. Mounted
+layout tests establish pane geometry, not native task acceptance. Packaging checks
+and independent review are scoped to supplied binaries/fixtures, not release
+acceptance. Supported WSL2 import failed; a current Linux runtime is unavailable.
 
-## Decisions and candidate designs
+Current grammar supports omitted initial IDs/defaults, lexical ownership, forward
+references and preserved source. Static audit found no exposed project-wide
+reference navigation/alias refactor; current Find searches the active buffer.
+The process example has128lines/14UUIDs/31empty-default lines, while meaningful
+shorter source is possible. Two concise snippets passed26 real REST requests,
+including identity-only normalization, exact name-only edits, rejected writes and
+restart persistence. Counts and this small trial prove neither improved native
+usability nor large-project performance.
 
-Retain three Rust crates, one typed Project and validated atomic Command. Keep semantic ownership, reference/allocation/order relationships and diagram placement separate. Forms remain a closed typed adapter, not a second metamodel. Persistent additions require model validation, references/deletion, transition, parser/updater, API/schema and reachable graphical editing parity.
+## Assumptions
 
-Semantic reconciliation uses finite typed facets and separate member/presence/order decisions. Compare actual destination slots before constructing the core's complete candidate; two rows never become sequential Apply. Missing identities are not inferred by names. Raw constructor/numeric/keyed/optional drafts survive rejection, exclusion and checkpoint recovery. Artifact Presence means attachment to the reviewed owner; an identified source moved away can delete the destination, whereas a source key of None preserves destination-only membership. No invented tombstone or silent seed acknowledgment.
+- Contextual named creation, remaining-height canvas and local source insertion
+  can reduce actual authoring detours. Native engineer tasks must establish this.
+- A bounded pure calculation/quantity model and pinned library content may fit
+  the existing typed core better than a general-purpose metamodel rewrite.
+  Independent designs and experiments must test this before ratification.
+- Existing OA/SA semantics provide a useful foundation; neither their presence
+  nor old acceptance proves full conformance to the updated release objective.
 
-Source updates preserve lexical ownership/comments/includes and exact history. Checkpoint source5/6→7 upgrade admits only the established token/typed migration contract, validates old base fingerprints and resets transient approvals; it does not silently rebase authored drafts. Hosted saves remain explicit and conditional on the resource/ETag; credentials stay in memory.
+## Open questions
 
-For Linux journal publication, ordinary rename lost the empty-target ownership invariant in a real ext4 probe. Selected `renameat2(RENAME_NOREPLACE)` through existing locked libc with no fallback; syscall errors fail before model writes. Alternative overwrite fallback was rejected by that falsifier. Windows native no-replace/retry behavior is retained; other OS behavior is explicit. [Contract, alternatives and measured limits](release-linux-journal-publication.md).
+- Which precise calculation, quantity-kind/unit and library contracts satisfy
+  practical budgets, reuse and update workflows without ambiguous defaults or
+  implicit execution? How should they migrate and participate in transitions?
+- Which behavior workflows still force cancellation/navigation to create missing
+  context, and which local actions best remove those detours?
+- Which text-only assistance best preserves engineering context and identity:
+  native language services, external-editor services, source recipes or explicit
+  reviewed patch operations? Which grammar changes are actually necessary?
+- Does the new scenario pane remain readable and editable through actual native
+  window sizes, camera changes, nested fragments and reopened caller contexts?
+- Which viable Linux environment can run current GUI/server acceptance? Current
+  VM limitation does not block remaining Windows, semantics or source work.
 
-Root selected **F1**, a complete source-6 teaching-project example. Corrected model/replay tests and bounded native onboarding/review/history pass; the full process/scenario/state/data/evidence lesson remains open. **F2**, faithful behavior-canvas SVG export, is deferred: current export scope is architecture-only, not a claim of faithful scenario/process/state export. Record this as an explicit scope decision rather than an accepted behavior-export result.
+## Candidate designs and decisions
 
-Behavior-root transition Apply should focus the explicitly requested counterpart and its nearest behavior owner. Without an explicit destination diagram it must preserve unrelated architecture presentation. Ordinary architecture transitions retain their existing path; explicit destination remains honored. This decision follows the independently reproduced reverse scenario placement/navigation failure, not a semantic change to the core transition.
+- Behavior creation: compact New → three task choices → focused name/owner/
+  viewpoint card, explicit missing inputs, atomic creation and reserved recovery
+  IDs. Implemented and independently reviewed; final gates/native proof pending.
+- Scenario workspace: compact header, optional Tools/Selection shelves, actual
+  remaining-height canvas/form, pinned actions, independent scrolling and
+  explicit Fit/Focus. Mounted tests support this choice; native proof pending.
+- Quantities/calculations: compare additive pure analysis records, extension of
+  existing fields and external evaluation. No broad schema decision yet.
+- Libraries: compare copied source, live references, generic definition/usages
+  and pinned typed packages with explicit mappings and reviewed updates.
+  [Falsification brief](release-library-candidate-review-20260910.md) records
+  identity, dependency, offline and conflict requirements. No ratified winner.
+- Text authoring: use existing omission/default/identity contracts for concise
+  experiments; compare source navigation/refactoring/patch assistance before
+  grammar redesign. No namespace, hidden identity or omission change ratified.
 
-## Assumptions and open questions
-
-- Nested source and contextual editors should reduce authoring effort; additional shorthand/grouping must justify grammar or interaction complexity through real tasks. Dense-view path overlap is not itself a failure when every actual identity remains accessible; arbitrary crossing-free layout is not promised.
-- Remaining native variants must establish useful engineering workflows: CM transitions, advanced OA process/SA chain/scenario reuse/fragment/order, typed state actions, compact/Linux/hosted cases, and uncovered saved-view lifecycle combinations. Do not expand or shrink required OA/SA scope merely to fit implementation convenience.
-- Latest diagnostic/reserved-label corrections have independent review and completed semantic/full-desktop/Clippy/build checks; their revised artifact rendering still needs native verification. The historical source6 process3012 closed cleanly. The6BAB source7 native build passed the scoped cases above;11060 and old6 recovery11240 closed cleanly. Old5 recovery/repair/save/model and current7 nested draft recovery/history/reopen pass on that binary. Later routing/hit-priority changes passed3focused/full564 desktop tests; root is running the server/format/strict/build sequence with results pending, and no corrected-render native acceptance is transferred. Exact binary scope is in STATE.md.
-- Historical Linux evidence includes x86_64/glibc2.39/ext4 core/MSRV and server/HTTP runtime. Current455-file snapshot SHA256 `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279` is frozen; core completed436passes/2ignored before clean VM shutdown08:13:56UTC; its original08:32:43UTC deadline was not reached. The hash-verified cross-built probe executed successfully on Linux, including its Windows macro/build-script build path, but no complete Linux GUI has been built. Syscall failure tests do not establish power-loss durability, network-filesystem behavior or cross-process model CAS. [Current Linux gate](release-source7-linux-gate-20260907.md).
-- Earlier Windows QA packages include runtime/notices and verified archive contents; final accepted-tree optimized distributions and exact provenance/checksums remain a release gate. [Packaging evidence](release-windows-package-review.md).
+Long-lived decisions remain in [DECISIONS.md](DECISIONS.md). New user scope and
+normative contracts supersede older prototype exclusions.
 
 ## Current strategy
 
-The requested Windows preview and whole-run development summary are delivered; the summary is being refreshed with the confirmed package, full570/570 desktop result and final Fit/strict/build gates. Preview DC50 has bounded native launch/overview evidence, not complete minimum-height/pending-form acceptance. Computer Use stopped on user Escape, so leave live GUI processes untouched and advance independent verification.
+Finish coherent creation gates and test the rebuilt product against independent
+saved-source oracles. Close remaining scenario lifecycle integration boundaries.
+Use the native Capella study and independent criticism to address real authoring
+friction. In parallel, resolve foundational semantic additions and text-only
+authoring through bounded competing designs and executable experiments. Then implement all representations,
+verify real REST and Windows/Linux workflows, build actual optimized packages
+and conduct fresh end-state review. Do not weaken acceptance to match current
+implementation or stop because a narrow technical milestone passed.
 
-Preserve the successful immutable458-file Linux GUI cross-build with the Fit fix, exact ELF/package evidence and released compiler lease. Three subsequent guest boots reached terminal IO-APIC timer panic before any tests; exact-kernel extraction succeeded but automatic approval review denied the proposed transient workaround. All task VMs are stopped. Preserve the denied action and evidence without bypassing review. Its snapshot/run/hashes and actual process status belong in STATE.md and the cross-build report. Preserve the original interrupted runs, cache, native core436/2ignored and failed Linux timed-server fixture. The replacement private HTTP preparation test and full server56 pass on Windows; Linux execution remains required.
-
-Guide steps now name Tools/Selection details/Restore panels and the exact Reply label; formatting, independent label review and a fresh Windows workspace-binary build pass. The user-facing preview retains its original tested bytes. Independent full-model/source purpose oracles compiled and passed both self-checks and preserved baseline cases; complete their native authoring/history steps when control resumes. Complete current native OA/SA teaching, artifact, saved-view, process/scenario and hosted cases once control is available. Retain caller-specific budgets, actual port proof, independent channel validation and exact old5/6 recovery bytes. Final optimized packages, current platform gates and fresh independent end-state review remain open; architecture-only SVG and passing slices do not redefine completion.
+Pre-consolidation content is preserved byte-for-byte in
+[the dated archive](history/2026-09-10-ledgers-before-second-consolidation/TASK_LEDGER.md).

harness/behavior-creation-contract.rs

@@ -0,0 +1,568 @@
+//! Independent native creation oracle; no desktop producer is imported.
+//! self-check BASE | check STAGE BASE ACTUAL ROLES | same EXPECTED ACTUAL
+use oa_core::{source_project::*, *};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs,
+    path::Path,
+};
+
+const PROCESS: &str = "Coordinate rescue";
+const SCENARIO: &str = "Rescue coordination conversation";
+const MACHINE: &str = "Rescue team operating modes";
+const VIEW: &str = "Rescue team operating modes · states";
+const CAPABILITY: u128 = 0xb451c00000004000800000000000001f;
+const OWNER: u128 = 0xc062944912094b50afacf558a9a0fc7f;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+enum Stage {
+    Baseline,
+    Process,
+    Scenario,
+    Machine,
+}
+impl Stage {
+    fn parse(value: &str) -> Self {
+        match value {
+            "baseline" => Self::Baseline,
+            "process" => Self::Process,
+            "scenario" => Self::Scenario,
+            "machine" => Self::Machine,
+            _ => panic!("Stage must be baseline, process, scenario or machine"),
+        }
+    }
+    fn additions(self) -> usize {
+        match self {
+            Self::Baseline => 0,
+            Self::Process => 1,
+            Self::Scenario => 2,
+            Self::Machine => 3,
+        }
+    }
+}
+
+fn source_paths(root: &Path, here: &Path, paths: &mut BTreeSet<String>) {
+    for entry in fs::read_dir(here).unwrap() {
+        let entry = entry.unwrap();
+        let kind = entry.file_type().unwrap();
+        assert!(
+            !kind.is_symlink(),
+            "Native checkpoint must contain ordinary files"
+        );
+        if kind.is_dir() {
+            source_paths(root, &entry.path(), paths);
+        } else if entry.path().extension().is_some_and(|ext| ext == "arcadia") {
+            assert!(kind.is_file());
+            paths.insert(
+                entry
+                    .path()
+                    .strip_prefix(root)
+                    .unwrap()
+                    .to_str()
+                    .unwrap()
+                    .replace('\\', "/"),
+            );
+        }
+    }
+}
+fn load(entry: &Path) -> CompiledSourceProject {
+    let files = source_files::load_project(entry, ProjectLimits::default()).unwrap();
+    let raw = files.reachable_bundle();
+    let compiled = compile_bundle(&raw, ProjectLimits::default()).unwrap();
+    assert_eq!(
+        compiled.bundle, raw,
+        "No migration, normalization or implicit identity insertion"
+    );
+    execute_batch(&compiled.decoded.project, &[]).unwrap();
+    let mut disk = BTreeSet::new();
+    let root = entry.parent().unwrap();
+    source_paths(root, root, &mut disk);
+    assert_eq!(
+        disk,
+        raw.files.keys().cloned().collect(),
+        "Reject detached extra source files too"
+    );
+    compiled
+}
+fn fnv1a(bytes: &[u8]) -> u64 {
+    bytes.iter().fold(0xcbf29ce484222325, |hash, byte| {
+        (hash ^ u64::from(*byte)).wrapping_mul(0x100000001b3)
+    })
+}
+fn pinned_baseline(base: &CompiledSourceProject) -> bool {
+    // Fixed byte fingerprints of the root-preserved transition/reopen input,
+    // recorded before any creation. SHA-256 provenance is in the fixture README.
+    let pins = [
+        ("project.arcadia", 4844, 0x450c6ffd8225af32),
+        ("rationale.arcadia", 57, 0xf87e3c2e303f9b62),
+        ("traceability.arcadia", 395, 0xb47992dbdacab344),
+        ("oa/participants.arcadia", 403, 0x1e109eef81968b5f),
+        (
+            "oa/activities/activity_assess_incident.arcadia",
+            376,
+            0x0e67e533db3cff78,
+        ),
+        ("sa/participants.arcadia", 124, 0xcadb35025aea18cc),
+    ];
+    base.bundle.entry == "project.arcadia"
+        && base.bundle.files.len() == pins.len()
+        && pins.iter().all(|(path, length, hash)| {
+            base.bundle
+                .files
+                .get(*path)
+                .is_some_and(|text| text.len() == *length && fnv1a(text.as_bytes()) == *hash)
+        })
+}
+fn baseline(entry: &Path) -> CompiledSourceProject {
+    let base = load(entry);
+    assert!(
+        pinned_baseline(&base),
+        "The six-file baseline differs from the frozen pre-creation input"
+    );
+    let p = &base.decoded.project;
+    assert_eq!(
+        (
+            p.elements.len(),
+            p.relations.len(),
+            p.diagrams.len(),
+            p.traces.len()
+        ),
+        (10, 2, 4, 1)
+    );
+    let context = &p.elements[&Id::from_u128(CAPABILITY)];
+    assert_eq!(
+        (
+            context.name.as_str(),
+            context.kind(),
+            context.layer(),
+            context.parent
+        ),
+        ("Rescue capability", Kind::Capability, Layer::Oa, None)
+    );
+    let owner = &p.elements[&Id::from_u128(OWNER)];
+    assert_eq!(
+        (
+            owner.name.as_str(),
+            owner.kind(),
+            owner.layer(),
+            owner.parent
+        ),
+        ("Rescue team", Kind::SystemActor, Layer::Sa, None)
+    );
+    for name in [PROCESS, SCENARIO, MACHINE] {
+        assert!(
+            !p.elements.values().any(|e| e.name == name),
+            "Baseline already contains requested creation"
+        );
+    }
+    base
+}
+
+struct Roles<'a> {
+    actual: &'a Project,
+    baseline: &'a Project,
+    used: BTreeSet<Id>,
+}
+impl Roles<'_> {
+    fn fresh(&mut self, choices: Vec<Id>, role: &str) -> Id {
+        assert_eq!(
+            choices.len(),
+            1,
+            "Exactly one literal identity role required: {role}"
+        );
+        let id = choices[0];
+        assert_eq!(id.get_version_num(), 4, "{role} must be a fresh UUIDv4");
+        assert!(
+            !self.baseline.contains(id),
+            "{role} reuses a baseline identity"
+        );
+        assert!(self.used.insert(id), "{role} reuses another fresh role");
+        id
+    }
+    fn element(&mut self, kind: Kind, layer: Layer, name: &str) -> Id {
+        self.fresh(
+            self.actual
+                .elements
+                .values()
+                .filter(|e| e.kind() == kind && e.layer() == layer && e.name == name)
+                .map(|e| e.id)
+                .collect(),
+            name,
+        )
+    }
+    fn view(&mut self, machine: Id) -> Id {
+        self.fresh(
+            self.actual
+                .diagrams
+                .values()
+                .filter(|d| {
+                    d.layer == Layer::Sa
+                        && d.name == VIEW
+                        && d.projection == ProjectionKind::StateMachine { machine }
+                })
+                .map(|d| d.id)
+                .collect(),
+            VIEW,
+        )
+    }
+    fn node(&mut self, diagram: Id, machine: Id) -> Id {
+        self.fresh(
+            self.actual.diagrams[&diagram]
+                .nodes
+                .values()
+                .filter(|node| node.element == machine)
+                .map(|node| node.id)
+                .collect(),
+            "new machine's exact view placement",
+        )
+    }
+}
+fn element(p: &Project, id: Id, name: &str, parent: Option<Id>, body: ElementBody) -> Element {
+    Element {
+        id,
+        alias: p.fresh_alias(name, "behavior", id),
+        name: name.into(),
+        description: String::new(),
+        parent,
+        body,
+    }
+}
+fn advance(base: &mut CompiledSourceProject, commands: Vec<Command>) {
+    let project = execute_batch(&base.decoded.project, &[Command::Batch(commands)]).unwrap();
+    *base = update_bundle(base, &project, ProjectLimits::default()).unwrap();
+}
+fn predict(base: &CompiledSourceProject, stage: Stage, carrier: &Project) -> CompiledSourceProject {
+    let mut result = base.clone();
+    let mut roles = Roles {
+        actual: carrier,
+        baseline: &base.decoded.project,
+        used: BTreeSet::new(),
+    };
+    if stage >= Stage::Process {
+        let id = roles.element(Kind::Process, Layer::Oa, PROCESS);
+        let record = element(
+            &result.decoded.project,
+            id,
+            PROCESS,
+            None,
+            ElementBody::Oa(OaBody::Process { steps: vec![] }),
+        );
+        advance(&mut result, vec![Command::CreateElement(record)]);
+    }
+    if stage >= Stage::Scenario {
+        let id = roles.element(Kind::Scenario, Layer::Oa, SCENARIO);
+        let record = element(
+            &result.decoded.project,
+            id,
+            SCENARIO,
+            None,
+            ElementBody::shared_in(
+                Layer::Oa,
+                SharedBody::Scenario {
+                    viewpoint: ScenarioViewpoint::ParticipantInteraction,
+                    context: Some(Id::from_u128(CAPABILITY)),
+                    precondition: String::new(),
+                    postcondition: String::new(),
+                    steps: vec![],
+                },
+            ),
+        );
+        advance(&mut result, vec![Command::CreateElement(record)]);
+    }
+    if stage == Stage::Machine {
+        let machine = roles.element(Kind::StateMachine, Layer::Sa, MACHINE);
+        let diagram = roles.view(machine);
+        let placement = roles.node(diagram, machine);
+        let record = element(
+            &result.decoded.project,
+            machine,
+            MACHINE,
+            Some(Id::from_u128(OWNER)),
+            ElementBody::shared_in(Layer::Sa, SharedBody::StateMachine),
+        );
+        let p = execute_batch(
+            &result.decoded.project,
+            &[Command::CreateElement(record.clone())],
+        )
+        .unwrap();
+        // Published first-view contract, independently constructed: one root,
+        // default options, no routes/regions/states. Shared core Layout owns the
+        // final geometry; no observed geometry or desktop planner is consulted.
+        let view = Diagram {
+            id: diagram,
+            alias: p.fresh_alias(VIEW, "state_view", diagram),
+            name: VIEW.into(),
+            description: String::new(),
+            layer: Layer::Sa,
+            projection: ProjectionKind::StateMachine { machine },
+            routes: vec![],
+            view_options: Default::default(),
+            nodes: BTreeMap::from([(
+                placement,
+                NodePlacement {
+                    id: placement,
+                    alias: p.fresh_alias(&format!("{MACHINE} placement"), "placement", placement),
+                    element: machine,
+                    position: Position { x: 60., y: 60. },
+                    size: Size {
+                        width: 336.,
+                        height: 104.,
+                    },
+                    collapsed: false,
+                    port_anchors: vec![],
+                },
+            )]),
+        };
+        advance(
+            &mut result,
+            vec![
+                Command::CreateElement(record),
+                Command::CreateDiagram(view),
+                Command::Layout(diagram),
+            ],
+        );
+    }
+    let p = &result.decoded.project;
+    assert_eq!(
+        p.elements.len(),
+        base.decoded.project.elements.len() + stage.additions()
+    );
+    assert_eq!(
+        p.diagrams.len(),
+        base.decoded.project.diagrams.len() + usize::from(stage == Stage::Machine)
+    );
+    assert_eq!(p.relations, base.decoded.project.relations);
+    assert_eq!(p.traces, base.decoded.project.traces);
+    result
+}
+fn equal(left: &CompiledSourceProject, right: &CompiledSourceProject) -> bool {
+    left.decoded.project == right.decoded.project && left.bundle == right.bundle
+}
+fn assert_equal(expected: &CompiledSourceProject, actual: &CompiledSourceProject) {
+    assert_eq!(
+        actual.decoded.project, expected.decoded.project,
+        "Complete Project differs from independent prediction"
+    );
+    assert_eq!(
+        actual.bundle, expected.bundle,
+        "Complete SourceBundle differs, including comments and all included bytes"
+    );
+}
+fn test_id(n: u128) -> Id {
+    Id::from_u128(0xc4ea7100000040008000000000000000 + n)
+}
+fn false_carrier(base: &Project) -> Project {
+    let mut p = base.clone();
+    for (n, kind, layer, name) in [
+        (1, Kind::Process, Layer::Oa, PROCESS),
+        (2, Kind::Scenario, Layer::Oa, SCENARIO),
+        (3, Kind::StateMachine, Layer::Sa, MACHINE),
+    ] {
+        p.elements.insert(
+            test_id(n),
+            Element {
+                id: test_id(n),
+                alias: format!("false_alias_{n}"),
+                name: name.into(),
+                description: "Must never be copied".into(),
+                parent: None,
+                body: ElementBody::new(kind, layer).unwrap(),
+            },
+        );
+    }
+    p.diagrams.insert(
+        test_id(4),
+        Diagram {
+            id: test_id(4),
+            alias: "false_view_alias".into(),
+            name: VIEW.into(),
+            description: "False view description".into(),
+            layer: Layer::Sa,
+            projection: ProjectionKind::StateMachine {
+                machine: test_id(3),
+            },
+            routes: vec![],
+            view_options: Default::default(),
+            nodes: BTreeMap::from([(
+                test_id(5),
+                NodePlacement {
+                    id: test_id(5),
+                    alias: "false_node_alias".into(),
+                    element: test_id(3),
+                    position: Position {
+                        x: 9999.,
+                        y: -9999.,
+                    },
+                    size: Size {
+                        width: 1.,
+                        height: 1.,
+                    },
+                    collapsed: true,
+                    port_anchors: vec![],
+                },
+            )]),
+        },
+    );
+    p
+}
+fn self_check(base: &CompiledSourceProject) {
+    let original = base.clone();
+    let carrier = false_carrier(&base.decoded.project);
+    assert_equal(base, &predict(base, Stage::Baseline, &carrier));
+    for stage in [Stage::Process, Stage::Scenario, Stage::Machine] {
+        let expected = predict(base, stage, &carrier);
+        assert_equal(&expected, &predict(base, stage, &expected.decoded.project));
+        let parsed = compile_bundle(&expected.bundle, ProjectLimits::default()).unwrap();
+        assert_equal(&expected, &parsed);
+        let mut altered = expected.clone();
+        altered
+            .decoded
+            .project
+            .elements
+            .get_mut(&test_id(1))
+            .unwrap()
+            .description = "Unrequested metadata".into();
+        assert!(!equal(&expected, &altered));
+        let mut altered = expected.clone();
+        altered
+            .decoded
+            .project
+            .elements
+            .get_mut(&Id::from_u128(CAPABILITY))
+            .unwrap()
+            .name = "Changed unrelated baseline".into();
+        assert!(!equal(&expected, &altered));
+        let mut changed_source = expected.bundle.clone();
+        changed_source
+            .files
+            .get_mut("rationale.arcadia")
+            .unwrap()
+            .push_str("// Extra comment\n");
+        let altered = compile_bundle(&changed_source, ProjectLimits::default()).unwrap();
+        assert_eq!(altered.decoded.project, expected.decoded.project);
+        assert!(
+            !equal(&expected, &altered),
+            "Identical semantics do not excuse changed source bytes"
+        );
+        if stage >= Stage::Scenario {
+            let mut altered = expected.clone();
+            *altered
+                .decoded
+                .project
+                .elements
+                .get_mut(&test_id(2))
+                .unwrap()
+                .shared_mut()
+                .unwrap() = SharedBody::Scenario {
+                viewpoint: ScenarioViewpoint::OperationalActivity,
+                context: None,
+                precondition: String::new(),
+                postcondition: String::new(),
+                steps: vec![],
+            };
+            assert!(!equal(&expected, &altered));
+        }
+        if stage == Stage::Machine {
+            assert_ne!(
+                expected.decoded.project, carrier,
+                "Never adopt role-carrier metadata/geometry"
+            );
+            assert_eq!(
+                expected.decoded.project.elements[&test_id(3)].parent,
+                Some(Id::from_u128(OWNER))
+            );
+            let view = &expected.decoded.project.diagrams[&test_id(4)];
+            assert_eq!(view.nodes.len(), 1);
+            let node = &view.nodes[&test_id(5)];
+            println!(
+                "PREDICT first view: {VIEW}; machine-root position {:?}, size {:?}; {} exact source files",
+                node.position,
+                node.size,
+                expected.bundle.files.len()
+            );
+            let mut altered = expected.clone();
+            altered
+                .decoded
+                .project
+                .diagrams
+                .get_mut(&test_id(4))
+                .unwrap()
+                .nodes
+                .get_mut(&test_id(5))
+                .unwrap()
+                .position
+                .x += 1.;
+            assert!(!equal(&expected, &altered));
+            let mut altered = expected.clone();
+            let extra = element(
+                &altered.decoded.project,
+                test_id(6),
+                "Unrequested region",
+                Some(test_id(3)),
+                ElementBody::shared_in(Layer::Sa, SharedBody::Region),
+            );
+            altered.decoded.project.elements.insert(extra.id, extra);
+            assert!(!equal(&expected, &altered), "Reject extra semantic objects");
+            let mut altered = expected.clone();
+            altered
+                .bundle
+                .files
+                .insert("unrequested.arcadia".into(), "// Extra file\n".into());
+            assert!(!equal(&expected, &altered));
+        }
+        println!(
+            "PASS self-check {stage:?}: full source fixed point; false metadata, unrelated edits and source-only drift rejected"
+        );
+    }
+    let mut altered_base = base.clone();
+    altered_base
+        .bundle
+        .files
+        .get_mut("rationale.arcadia")
+        .unwrap()
+        .push(' ');
+    assert!(
+        !pinned_baseline(&altered_base),
+        "Reject an altered baseline before use"
+    );
+    assert_equal(&original, base);
+    println!("PASS baseline retained unchanged; no native acceptance claimed");
+}
+fn main() {
+    assert_eq!(SCHEMA_VERSION, 7);
+    let args: Vec<_> = std::env::args().collect();
+    match args.get(1).map(String::as_str) {
+        Some("self-check") => {
+            assert_eq!(args.len(), 3, "self-check BASELINE_ENTRY");
+            self_check(&baseline(Path::new(&args[2])));
+        }
+        Some("check") => {
+            assert_eq!(
+                args.len(),
+                6,
+                "check baseline|process|scenario|machine BASELINE_ENTRY ACTUAL_ENTRY ROLE_ENTRY"
+            );
+            let stage = Stage::parse(&args[2]);
+            let base = baseline(Path::new(&args[3]));
+            let actual = load(Path::new(&args[4]));
+            let carrier = load(Path::new(&args[5]));
+            let expected = predict(&base, stage, &carrier.decoded.project);
+            assert_equal(&expected, &actual);
+            println!(
+                "PASS {stage:?}: complete Project + {} exact source files; only fresh literal-role UUIDs borrowed",
+                actual.bundle.files.len()
+            );
+        }
+        Some("same") => {
+            assert_eq!(args.len(), 4, "same EXPECTED_CHECKPOINT ACTUAL_CHECKPOINT");
+            let expected = load(Path::new(&args[2]));
+            let actual = load(Path::new(&args[3]));
+            assert_equal(&expected, &actual);
+            println!(
+                "PASS exact checkpoint identity/model/{}-file SourceBundle equality",
+                actual.bundle.files.len()
+            );
+        }
+        _ => panic!("self-check BASE | check STAGE BASE ACTUAL ROLES | same EXPECTED ACTUAL"),
+    }
+}

harness/experiments/textual-authoring-20260911-local/.gitignore

@@ -0,0 +1,2 @@
+store-*/
+__pycache__/

harness/experiments/textual-authoring-20260911-local/README.md

@@ -0,0 +1,16 @@
+# Existing source-7 text-authoring experiment
+
+Executed 2026-09-11 by Codex-9e8r6t /root/palette_finish. See the measured appendix in `harness/release-textual-usability-audit-20260911.md`.
+
+From the repository root on this configured Windows host:
+
+```powershell
+. .local/toolchain/env.ps1
+& 'C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe' harness/experiments/textual-authoring-20260911-local/run_experiment.py
+```
+
+The script uses the existing server executable, a fresh ignored experiment store, and an OS-assigned loopback port. It never compiles or opens a GUI. It requires the explicitly referenced preserved source snapshot for provenance comparison. Each invocation overwrites the result files, so preserve them before rerunning. It terminates only its own server after completed synchronous requests and verifies saved source/model by reopening the store.
+
+`summary.json` and `http-results.json` record the passing 26-request run. Their JSON string values preserve exact submitted/accepted source newlines; the separate input/stabilized/renamed text snapshots use Windows newlines through Python's text writer. Byte-preservation assertions compare the original submitted and returned strings before that snapshot conversion. `provenance.json` records the binary and all 120 core/server snapshot/current file hashes. `review-results.json` records separate inventory/hash equality, exact advisory warning counts, and artifact hashes.
+
+The first attempt reached successful OA checks and imported the scenario, then failed because this experiment's expected JSON wrapper was incorrectly written as `Shared/layer/body/Scenario`. Production schema uses `Oa/Shared/Scenario`, as independently checked against `model.rs` and the existing release1 JSON. The expectation was corrected without changing either input, model semantics or server. `initial-harness-failure.json` and `initial-http-results.json` retain that harness failure. It was not a product failure; only the later complete run is counted as passing.

harness/experiments/textual-authoring-20260911-local/http-results.json

@@ -0,0 +1,990 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/v1/projects/import-source-project",
+    "status": 201,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r1\"",
+    "location": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268",
+    "seconds": 0.04514070000004722,
+    "body": {
+      "elements": 4,
+      "migration": null,
+      "model_id": "59d44355-d4a1-4e59-905c-ae415209e93a",
+      "name": "Distress response",
+      "relations": 3,
+      "resource_id": "988a0812-0719-4084-89aa-3a8473d5e268",
+      "revision": 1,
+      "schema_version": 7
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/source-project",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r1\"",
+    "location": null,
+    "seconds": 0.0015170999995461898,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"59d44355-d4a1-4e59-905c-ae415209e93a\" {\n    oa_actor vessel \"Vessel in distress\" id \"dde90260-064b-4360-90df-2082bc4b25a2\" {}\n    oa_entity rescue \"Rescue coordination\" id \"2d1f63d3-a6b5-4912-9109-50a1bfb736da\" {}\n    oa_activity report \"Report distress\" id \"82839234-23ed-4d8c-abdc-84f0e4db89e3\" {}\n    oa_activity assess \"Assess incident\" id \"ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2\" {}\n    allocation vessel_reports \"Crew reports\" id \"988baf52-2159-4769-a4a2-6bb76134fbb5\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"450a369f-785c-422d-ad17-48a95a174410\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"60f3d1b7-cced-49f6-9a1c-189ecbec1f3b\" { source @report; target @assess; }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/model",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r1\"",
+    "location": null,
+    "seconds": 0.0013882000002922723,
+    "body": {
+      "schema_version": 7,
+      "id": "59d44355-d4a1-4e59-905c-ae415209e93a",
+      "alias": "distress",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "2d1f63d3-a6b5-4912-9109-50a1bfb736da": {
+          "id": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+          "alias": "rescue",
+          "name": "Rescue coordination",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Entity"
+          }
+        },
+        "82839234-23ed-4d8c-abdc-84f0e4db89e3": {
+          "id": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+          "alias": "report",
+          "name": "Report distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "dde90260-064b-4360-90df-2082bc4b25a2": {
+          "id": "dde90260-064b-4360-90df-2082bc4b25a2",
+          "alias": "vessel",
+          "name": "Vessel in distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Actor"
+          }
+        },
+        "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2": {
+          "id": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+          "alias": "assess",
+          "name": "Assess incident",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        }
+      },
+      "relations": {
+        "450a369f-785c-422d-ad17-48a95a174410": {
+          "id": "450a369f-785c-422d-ad17-48a95a174410",
+          "alias": "rescue_assesses",
+          "name": "Team assesses",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+              "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2"
+            }
+          }
+        },
+        "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b": {
+          "id": "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b",
+          "alias": "distress_report",
+          "name": "Distress report",
+          "description": "",
+          "body": {
+            "Interaction": {
+              "source": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+              "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+              "items": []
+            }
+          }
+        },
+        "988baf52-2159-4769-a4a2-6bb76134fbb5": {
+          "id": "988baf52-2159-4769-a4a2-6bb76134fbb5",
+          "alias": "vessel_reports",
+          "name": "Crew reports",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "dde90260-064b-4360-90df-2082bc4b25a2",
+              "target": "82839234-23ed-4d8c-abdc-84f0e4db89e3"
+            }
+          }
+        }
+      },
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/source-project",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r1\"",
+    "location": null,
+    "seconds": 0.002903800001149648,
+    "body": {
+      "changed": false,
+      "issues": [
+        {
+          "code": "work_without_behavior_context",
+          "column": 5,
+          "line": 5,
+          "message": "Include this leaf activity/function in a process/chain or scenario through a work action or exchange occurrence.",
+          "object_id": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 351,
+            "start": 270
+          }
+        },
+        {
+          "code": "work_without_behavior_context",
+          "column": 5,
+          "line": 6,
+          "message": "Include this leaf activity/function in a process/chain or scenario through a work action or exchange occurrence.",
+          "object_id": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 437,
+            "start": 356
+          }
+        },
+        {
+          "code": "exchange_without_behavior_context",
+          "column": 5,
+          "line": 9,
+          "message": "Use this exchange in a process/chain or scenario.",
+          "object_id": "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 813,
+            "start": 690
+          }
+        }
+      ],
+      "migration": null,
+      "revision": 1,
+      "source_project": {
+        "entry": "project.arcadia",
+        "files": {
+          "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"59d44355-d4a1-4e59-905c-ae415209e93a\" {\n    oa_actor vessel \"Vessel in distress\" id \"dde90260-064b-4360-90df-2082bc4b25a2\" {}\n    oa_entity rescue \"Rescue coordination\" id \"2d1f63d3-a6b5-4912-9109-50a1bfb736da\" {}\n    oa_activity report \"Report distress\" id \"82839234-23ed-4d8c-abdc-84f0e4db89e3\" {}\n    oa_activity assess \"Assess incident\" id \"ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2\" {}\n    allocation vessel_reports \"Crew reports\" id \"988baf52-2159-4769-a4a2-6bb76134fbb5\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"450a369f-785c-422d-ad17-48a95a174410\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"60f3d1b7-cced-49f6-9a1c-189ecbec1f3b\" { source @report; target @assess; }\n}\n"
+        }
+      }
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/source-project",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r2\"",
+    "location": null,
+    "seconds": 0.013732199999139993,
+    "body": {
+      "changed": true,
+      "issues": [
+        {
+          "code": "work_without_behavior_context",
+          "column": 5,
+          "line": 5,
+          "message": "Include this leaf activity/function in a process/chain or scenario through a work action or exchange occurrence.",
+          "object_id": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 351,
+            "start": 270
+          }
+        },
+        {
+          "code": "work_without_behavior_context",
+          "column": 5,
+          "line": 6,
+          "message": "Include this leaf activity/function in a process/chain or scenario through a work action or exchange occurrence.",
+          "object_id": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 447,
+            "start": 356
+          }
+        },
+        {
+          "code": "exchange_without_behavior_context",
+          "column": 5,
+          "line": 9,
+          "message": "Use this exchange in a process/chain or scenario.",
+          "object_id": "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 823,
+            "start": 700
+          }
+        }
+      ],
+      "migration": null,
+      "revision": 2,
+      "source_project": {
+        "entry": "project.arcadia",
+        "files": {
+          "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"59d44355-d4a1-4e59-905c-ae415209e93a\" {\n    oa_actor vessel \"Vessel in distress\" id \"dde90260-064b-4360-90df-2082bc4b25a2\" {}\n    oa_entity rescue \"Rescue coordination\" id \"2d1f63d3-a6b5-4912-9109-50a1bfb736da\" {}\n    oa_activity report \"Report distress\" id \"82839234-23ed-4d8c-abdc-84f0e4db89e3\" {}\n    oa_activity assess \"Assess incident carefully\" id \"ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2\" {}\n    allocation vessel_reports \"Crew reports\" id \"988baf52-2159-4769-a4a2-6bb76134fbb5\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"450a369f-785c-422d-ad17-48a95a174410\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"60f3d1b7-cced-49f6-9a1c-189ecbec1f3b\" { source @report; target @assess; }\n}\n"
+        }
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/model",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r2\"",
+    "location": null,
+    "seconds": 0.002524200001062127,
+    "body": {
+      "schema_version": 7,
+      "id": "59d44355-d4a1-4e59-905c-ae415209e93a",
+      "alias": "distress",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "2d1f63d3-a6b5-4912-9109-50a1bfb736da": {
+          "id": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+          "alias": "rescue",
+          "name": "Rescue coordination",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Entity"
+          }
+        },
+        "82839234-23ed-4d8c-abdc-84f0e4db89e3": {
+          "id": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+          "alias": "report",
+          "name": "Report distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "dde90260-064b-4360-90df-2082bc4b25a2": {
+          "id": "dde90260-064b-4360-90df-2082bc4b25a2",
+          "alias": "vessel",
+          "name": "Vessel in distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Actor"
+          }
+        },
+        "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2": {
+          "id": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+          "alias": "assess",
+          "name": "Assess incident carefully",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        }
+      },
+      "relations": {
+        "450a369f-785c-422d-ad17-48a95a174410": {
+          "id": "450a369f-785c-422d-ad17-48a95a174410",
+          "alias": "rescue_assesses",
+          "name": "Team assesses",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+              "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2"
+            }
+          }
+        },
+        "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b": {
+          "id": "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b",
+          "alias": "distress_report",
+          "name": "Distress report",
+          "description": "",
+          "body": {
+            "Interaction": {
+              "source": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+              "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+              "items": []
+            }
+          }
+        },
+        "988baf52-2159-4769-a4a2-6bb76134fbb5": {
+          "id": "988baf52-2159-4769-a4a2-6bb76134fbb5",
+          "alias": "vessel_reports",
+          "name": "Crew reports",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "dde90260-064b-4360-90df-2082bc4b25a2",
+              "target": "82839234-23ed-4d8c-abdc-84f0e4db89e3"
+            }
+          }
+        }
+      },
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/source-project",
+    "status": 412,
+    "etag": null,
+    "location": null,
+    "seconds": 0.011585599999307306,
+    "body": {
+      "type": "urn:arcadia:problem:revision_conflict",
+      "title": "Precondition Failed",
+      "status": 412,
+      "code": "revision_conflict",
+      "detail": "Project changed. Reload and review the current model before retrying.",
+      "current_revision": 2
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/source-project",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r2\"",
+    "location": null,
+    "seconds": 0.012601500000528176,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"59d44355-d4a1-4e59-905c-ae415209e93a\" {\n    oa_actor vessel \"Vessel in distress\" id \"dde90260-064b-4360-90df-2082bc4b25a2\" {}\n    oa_entity rescue \"Rescue coordination\" id \"2d1f63d3-a6b5-4912-9109-50a1bfb736da\" {}\n    oa_activity report \"Report distress\" id \"82839234-23ed-4d8c-abdc-84f0e4db89e3\" {}\n    oa_activity assess \"Assess incident carefully\" id \"ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2\" {}\n    allocation vessel_reports \"Crew reports\" id \"988baf52-2159-4769-a4a2-6bb76134fbb5\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"450a369f-785c-422d-ad17-48a95a174410\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"60f3d1b7-cced-49f6-9a1c-189ecbec1f3b\" { source @report; target @assess; }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/source-project",
+    "status": 422,
+    "etag": null,
+    "location": null,
+    "seconds": 0.0024663000003783964,
+    "body": {
+      "type": "urn:arcadia:problem:invalid_source_project",
+      "title": "Unprocessable Entity",
+      "status": 422,
+      "code": "invalid_source_project",
+      "detail": "Source project could not be applied.",
+      "issues": [
+        {
+          "severity": "error",
+          "code": "invalid_source",
+          "message": "Unexpected content after the project closing brace.",
+          "line": 12,
+          "column": 1,
+          "path": "project.arcadia",
+          "span": {
+            "start": 827,
+            "end": 828
+          }
+        }
+      ]
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/source-project",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r2\"",
+    "location": null,
+    "seconds": 0.002105400000800728,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"59d44355-d4a1-4e59-905c-ae415209e93a\" {\n    oa_actor vessel \"Vessel in distress\" id \"dde90260-064b-4360-90df-2082bc4b25a2\" {}\n    oa_entity rescue \"Rescue coordination\" id \"2d1f63d3-a6b5-4912-9109-50a1bfb736da\" {}\n    oa_activity report \"Report distress\" id \"82839234-23ed-4d8c-abdc-84f0e4db89e3\" {}\n    oa_activity assess \"Assess incident carefully\" id \"ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2\" {}\n    allocation vessel_reports \"Crew reports\" id \"988baf52-2159-4769-a4a2-6bb76134fbb5\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"450a369f-785c-422d-ad17-48a95a174410\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"60f3d1b7-cced-49f6-9a1c-189ecbec1f3b\" { source @report; target @assess; }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/model",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r2\"",
+    "location": null,
+    "seconds": 0.02230009999948379,
+    "body": {
+      "schema_version": 7,
+      "id": "59d44355-d4a1-4e59-905c-ae415209e93a",
+      "alias": "distress",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "2d1f63d3-a6b5-4912-9109-50a1bfb736da": {
+          "id": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+          "alias": "rescue",
+          "name": "Rescue coordination",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Entity"
+          }
+        },
+        "82839234-23ed-4d8c-abdc-84f0e4db89e3": {
+          "id": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+          "alias": "report",
+          "name": "Report distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "dde90260-064b-4360-90df-2082bc4b25a2": {
+          "id": "dde90260-064b-4360-90df-2082bc4b25a2",
+          "alias": "vessel",
+          "name": "Vessel in distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Actor"
+          }
+        },
+        "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2": {
+          "id": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+          "alias": "assess",
+          "name": "Assess incident carefully",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        }
+      },
+      "relations": {
+        "450a369f-785c-422d-ad17-48a95a174410": {
+          "id": "450a369f-785c-422d-ad17-48a95a174410",
+          "alias": "rescue_assesses",
+          "name": "Team assesses",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+              "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2"
+            }
+          }
+        },
+        "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b": {
+          "id": "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b",
+          "alias": "distress_report",
+          "name": "Distress report",
+          "description": "",
+          "body": {
+            "Interaction": {
+              "source": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+              "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+              "items": []
+            }
+          }
+        },
+        "988baf52-2159-4769-a4a2-6bb76134fbb5": {
+          "id": "988baf52-2159-4769-a4a2-6bb76134fbb5",
+          "alias": "vessel_reports",
+          "name": "Crew reports",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "dde90260-064b-4360-90df-2082bc4b25a2",
+              "target": "82839234-23ed-4d8c-abdc-84f0e4db89e3"
+            }
+          }
+        }
+      },
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/v1/projects/import-source-project",
+    "status": 201,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r1\"",
+    "location": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f",
+    "seconds": 0.0049866000008478295,
+    "body": {
+      "elements": 1,
+      "migration": null,
+      "model_id": "aba296aa-46c9-4e90-b520-15c692da7b96",
+      "name": "Distress response",
+      "relations": 0,
+      "resource_id": "7e68232b-6c51-4744-ab55-9069e91f1c3f",
+      "revision": 1,
+      "schema_version": 7
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/source-project",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r1\"",
+    "location": null,
+    "seconds": 0.0014524000016535865,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject response \"Distress response\" id \"aba296aa-46c9-4e90-b520-15c692da7b96\" {\n    oa_scenario assessment \"Assess the distress report\" id \"96a98e8f-6434-42be-8de2-5c715bbcf2ca\" {\n        viewpoint OperationalActivity;\n    }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/model",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r1\"",
+    "location": null,
+    "seconds": 0.02343220000147994,
+    "body": {
+      "schema_version": 7,
+      "id": "aba296aa-46c9-4e90-b520-15c692da7b96",
+      "alias": "response",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "96a98e8f-6434-42be-8de2-5c715bbcf2ca": {
+          "id": "96a98e8f-6434-42be-8de2-5c715bbcf2ca",
+          "alias": "assessment",
+          "name": "Assess the distress report",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": {
+              "Shared": {
+                "Scenario": {
+                  "viewpoint": "OperationalActivity",
+                  "context": null,
+                  "precondition": "",
+                  "postcondition": "",
+                  "steps": []
+                }
+              }
+            }
+          }
+        }
+      },
+      "relations": {},
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/source-project",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r1\"",
+    "location": null,
+    "seconds": 0.014025200000105542,
+    "body": {
+      "changed": false,
+      "issues": [
+        {
+          "code": "empty_sequence",
+          "column": 5,
+          "field": "steps",
+          "line": 3,
+          "message": "Add ordered occurrences.",
+          "object_id": "96a98e8f-6434-42be-8de2-5c715bbcf2ca",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 236,
+            "start": 96
+          }
+        }
+      ],
+      "migration": null,
+      "revision": 1,
+      "source_project": {
+        "entry": "project.arcadia",
+        "files": {
+          "project.arcadia": "arcadia 7;\nproject response \"Distress response\" id \"aba296aa-46c9-4e90-b520-15c692da7b96\" {\n    oa_scenario assessment \"Assess the distress report\" id \"96a98e8f-6434-42be-8de2-5c715bbcf2ca\" {\n        viewpoint OperationalActivity;\n    }\n}\n"
+        }
+      }
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/source-project",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r2\"",
+    "location": null,
+    "seconds": 0.0041495000004942995,
+    "body": {
+      "changed": true,
+      "issues": [
+        {
+          "code": "empty_sequence",
+          "column": 5,
+          "field": "steps",
+          "line": 3,
+          "message": "Add ordered occurrences.",
+          "object_id": "96a98e8f-6434-42be-8de2-5c715bbcf2ca",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 238,
+            "start": 96
+          }
+        }
+      ],
+      "migration": null,
+      "revision": 2,
+      "source_project": {
+        "entry": "project.arcadia",
+        "files": {
+          "project.arcadia": "arcadia 7;\nproject response \"Distress response\" id \"aba296aa-46c9-4e90-b520-15c692da7b96\" {\n    oa_scenario assessment \"Assess the reported distress\" id \"96a98e8f-6434-42be-8de2-5c715bbcf2ca\" {\n        viewpoint OperationalActivity;\n    }\n}\n"
+        }
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/model",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r2\"",
+    "location": null,
+    "seconds": 0.0017606000001251232,
+    "body": {
+      "schema_version": 7,
+      "id": "aba296aa-46c9-4e90-b520-15c692da7b96",
+      "alias": "response",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "96a98e8f-6434-42be-8de2-5c715bbcf2ca": {
+          "id": "96a98e8f-6434-42be-8de2-5c715bbcf2ca",
+          "alias": "assessment",
+          "name": "Assess the reported distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": {
+              "Shared": {
+                "Scenario": {
+                  "viewpoint": "OperationalActivity",
+                  "context": null,
+                  "precondition": "",
+                  "postcondition": "",
+                  "steps": []
+                }
+              }
+            }
+          }
+        }
+      },
+      "relations": {},
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/source-project",
+    "status": 412,
+    "etag": null,
+    "location": null,
+    "seconds": 0.002149799998733215,
+    "body": {
+      "type": "urn:arcadia:problem:revision_conflict",
+      "title": "Precondition Failed",
+      "status": 412,
+      "code": "revision_conflict",
+      "detail": "Project changed. Reload and review the current model before retrying.",
+      "current_revision": 2
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/source-project",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r2\"",
+    "location": null,
+    "seconds": 0.015539500000159023,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject response \"Distress response\" id \"aba296aa-46c9-4e90-b520-15c692da7b96\" {\n    oa_scenario assessment \"Assess the reported distress\" id \"96a98e8f-6434-42be-8de2-5c715bbcf2ca\" {\n        viewpoint OperationalActivity;\n    }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/source-project",
+    "status": 422,
+    "etag": null,
+    "location": null,
+    "seconds": 0.0019488000016281148,
+    "body": {
+      "type": "urn:arcadia:problem:invalid_source_project",
+      "title": "Unprocessable Entity",
+      "status": 422,
+      "code": "invalid_source_project",
+      "detail": "Source project could not be applied.",
+      "issues": [
+        {
+          "severity": "error",
+          "code": "invalid_source",
+          "message": "Unexpected content after the project closing brace.",
+          "line": 8,
+          "column": 1,
+          "path": "project.arcadia",
+          "span": {
+            "start": 242,
+            "end": 243
+          }
+        }
+      ]
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/source-project",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r2\"",
+    "location": null,
+    "seconds": 0.007741199999145465,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject response \"Distress response\" id \"aba296aa-46c9-4e90-b520-15c692da7b96\" {\n    oa_scenario assessment \"Assess the reported distress\" id \"96a98e8f-6434-42be-8de2-5c715bbcf2ca\" {\n        viewpoint OperationalActivity;\n    }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/model",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r2\"",
+    "location": null,
+    "seconds": 0.0016271999993477948,
+    "body": {
+      "schema_version": 7,
+      "id": "aba296aa-46c9-4e90-b520-15c692da7b96",
+      "alias": "response",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "96a98e8f-6434-42be-8de2-5c715bbcf2ca": {
+          "id": "96a98e8f-6434-42be-8de2-5c715bbcf2ca",
+          "alias": "assessment",
+          "name": "Assess the reported distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": {
+              "Shared": {
+                "Scenario": {
+                  "viewpoint": "OperationalActivity",
+                  "context": null,
+                  "precondition": "",
+                  "postcondition": "",
+                  "steps": []
+                }
+              }
+            }
+          }
+        }
+      },
+      "relations": {},
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/source-project",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r2\"",
+    "location": null,
+    "seconds": 0.015101699998922413,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"59d44355-d4a1-4e59-905c-ae415209e93a\" {\n    oa_actor vessel \"Vessel in distress\" id \"dde90260-064b-4360-90df-2082bc4b25a2\" {}\n    oa_entity rescue \"Rescue coordination\" id \"2d1f63d3-a6b5-4912-9109-50a1bfb736da\" {}\n    oa_activity report \"Report distress\" id \"82839234-23ed-4d8c-abdc-84f0e4db89e3\" {}\n    oa_activity assess \"Assess incident carefully\" id \"ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2\" {}\n    allocation vessel_reports \"Crew reports\" id \"988baf52-2159-4769-a4a2-6bb76134fbb5\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"450a369f-785c-422d-ad17-48a95a174410\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"60f3d1b7-cced-49f6-9a1c-189ecbec1f3b\" { source @report; target @assess; }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268/model",
+    "status": 200,
+    "etag": "\"p-988a0812-0719-4084-89aa-3a8473d5e268-r2\"",
+    "location": null,
+    "seconds": 0.0017494000003352994,
+    "body": {
+      "schema_version": 7,
+      "id": "59d44355-d4a1-4e59-905c-ae415209e93a",
+      "alias": "distress",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "2d1f63d3-a6b5-4912-9109-50a1bfb736da": {
+          "id": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+          "alias": "rescue",
+          "name": "Rescue coordination",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Entity"
+          }
+        },
+        "82839234-23ed-4d8c-abdc-84f0e4db89e3": {
+          "id": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+          "alias": "report",
+          "name": "Report distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "dde90260-064b-4360-90df-2082bc4b25a2": {
+          "id": "dde90260-064b-4360-90df-2082bc4b25a2",
+          "alias": "vessel",
+          "name": "Vessel in distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Actor"
+          }
+        },
+        "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2": {
+          "id": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+          "alias": "assess",
+          "name": "Assess incident carefully",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        }
+      },
+      "relations": {
+        "450a369f-785c-422d-ad17-48a95a174410": {
+          "id": "450a369f-785c-422d-ad17-48a95a174410",
+          "alias": "rescue_assesses",
+          "name": "Team assesses",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+              "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2"
+            }
+          }
+        },
+        "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b": {
+          "id": "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b",
+          "alias": "distress_report",
+          "name": "Distress report",
+          "description": "",
+          "body": {
+            "Interaction": {
+              "source": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+              "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+              "items": []
+            }
+          }
+        },
+        "988baf52-2159-4769-a4a2-6bb76134fbb5": {
+          "id": "988baf52-2159-4769-a4a2-6bb76134fbb5",
+          "alias": "vessel_reports",
+          "name": "Crew reports",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "dde90260-064b-4360-90df-2082bc4b25a2",
+              "target": "82839234-23ed-4d8c-abdc-84f0e4db89e3"
+            }
+          }
+        }
+      },
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/source-project",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r2\"",
+    "location": null,
+    "seconds": 0.02587170000151673,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject response \"Distress response\" id \"aba296aa-46c9-4e90-b520-15c692da7b96\" {\n    oa_scenario assessment \"Assess the reported distress\" id \"96a98e8f-6434-42be-8de2-5c715bbcf2ca\" {\n        viewpoint OperationalActivity;\n    }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f/model",
+    "status": 200,
+    "etag": "\"p-7e68232b-6c51-4744-ab55-9069e91f1c3f-r2\"",
+    "location": null,
+    "seconds": 0.012360599999738042,
+    "body": {
+      "schema_version": 7,
+      "id": "aba296aa-46c9-4e90-b520-15c692da7b96",
+      "alias": "response",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "96a98e8f-6434-42be-8de2-5c715bbcf2ca": {
+          "id": "96a98e8f-6434-42be-8de2-5c715bbcf2ca",
+          "alias": "assessment",
+          "name": "Assess the reported distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": {
+              "Shared": {
+                "Scenario": {
+                  "viewpoint": "OperationalActivity",
+                  "context": null,
+                  "precondition": "",
+                  "postcondition": "",
+                  "steps": []
+                }
+              }
+            }
+          }
+        }
+      },
+      "relations": {},
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  }
+]

harness/experiments/textual-authoring-20260911-local/initial-harness-failure.json

@@ -0,0 +1,4 @@
+{
+  "type": "AssertionError",
+  "message": ""
+}

harness/experiments/textual-authoring-20260911-local/initial-http-results.json

@@ -0,0 +1,597 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/v1/projects/import-source-project",
+    "status": 201,
+    "etag": "\"p-70aac325-7baf-4c74-a317-cddd3057eba0-r1\"",
+    "location": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0",
+    "seconds": 2.0888063999991573,
+    "body": {
+      "elements": 4,
+      "migration": null,
+      "model_id": "d64f066e-ccf3-4c6d-a95e-c76d7b47c9e0",
+      "name": "Distress response",
+      "relations": 3,
+      "resource_id": "70aac325-7baf-4c74-a317-cddd3057eba0",
+      "revision": 1,
+      "schema_version": 7
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/source-project",
+    "status": 200,
+    "etag": "\"p-70aac325-7baf-4c74-a317-cddd3057eba0-r1\"",
+    "location": null,
+    "seconds": 0.002310800000486779,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"d64f066e-ccf3-4c6d-a95e-c76d7b47c9e0\" {\n    oa_actor vessel \"Vessel in distress\" id \"cb442f05-8ee5-46a5-aa6a-4a4c024a6911\" {}\n    oa_entity rescue \"Rescue coordination\" id \"07d99082-023d-49fb-ba08-23031fed5256\" {}\n    oa_activity report \"Report distress\" id \"54c4dded-0e11-4162-8b26-180ca533466b\" {}\n    oa_activity assess \"Assess incident\" id \"287779b1-50a2-454b-b8c0-8e7a815f6f66\" {}\n    allocation vessel_reports \"Crew reports\" id \"5ca61660-cde4-41fb-9078-378d07c1a116\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"65c4d3c4-0c85-4470-ba73-401f04e3f6b4\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"c343da78-0685-43b8-815c-e5326f2ac594\" { source @report; target @assess; }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/model",
+    "status": 200,
+    "etag": "\"p-70aac325-7baf-4c74-a317-cddd3057eba0-r1\"",
+    "location": null,
+    "seconds": 0.005676400000083959,
+    "body": {
+      "schema_version": 7,
+      "id": "d64f066e-ccf3-4c6d-a95e-c76d7b47c9e0",
+      "alias": "distress",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "07d99082-023d-49fb-ba08-23031fed5256": {
+          "id": "07d99082-023d-49fb-ba08-23031fed5256",
+          "alias": "rescue",
+          "name": "Rescue coordination",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Entity"
+          }
+        },
+        "287779b1-50a2-454b-b8c0-8e7a815f6f66": {
+          "id": "287779b1-50a2-454b-b8c0-8e7a815f6f66",
+          "alias": "assess",
+          "name": "Assess incident",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "54c4dded-0e11-4162-8b26-180ca533466b": {
+          "id": "54c4dded-0e11-4162-8b26-180ca533466b",
+          "alias": "report",
+          "name": "Report distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "cb442f05-8ee5-46a5-aa6a-4a4c024a6911": {
+          "id": "cb442f05-8ee5-46a5-aa6a-4a4c024a6911",
+          "alias": "vessel",
+          "name": "Vessel in distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Actor"
+          }
+        }
+      },
+      "relations": {
+        "5ca61660-cde4-41fb-9078-378d07c1a116": {
+          "id": "5ca61660-cde4-41fb-9078-378d07c1a116",
+          "alias": "vessel_reports",
+          "name": "Crew reports",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "cb442f05-8ee5-46a5-aa6a-4a4c024a6911",
+              "target": "54c4dded-0e11-4162-8b26-180ca533466b"
+            }
+          }
+        },
+        "65c4d3c4-0c85-4470-ba73-401f04e3f6b4": {
+          "id": "65c4d3c4-0c85-4470-ba73-401f04e3f6b4",
+          "alias": "rescue_assesses",
+          "name": "Team assesses",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "07d99082-023d-49fb-ba08-23031fed5256",
+              "target": "287779b1-50a2-454b-b8c0-8e7a815f6f66"
+            }
+          }
+        },
+        "c343da78-0685-43b8-815c-e5326f2ac594": {
+          "id": "c343da78-0685-43b8-815c-e5326f2ac594",
+          "alias": "distress_report",
+          "name": "Distress report",
+          "description": "",
+          "body": {
+            "Interaction": {
+              "source": "54c4dded-0e11-4162-8b26-180ca533466b",
+              "target": "287779b1-50a2-454b-b8c0-8e7a815f6f66",
+              "items": []
+            }
+          }
+        }
+      },
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/source-project",
+    "status": 200,
+    "etag": "\"p-70aac325-7baf-4c74-a317-cddd3057eba0-r1\"",
+    "location": null,
+    "seconds": 0.016113300000142772,
+    "body": {
+      "changed": false,
+      "issues": [
+        {
+          "code": "work_without_behavior_context",
+          "column": 5,
+          "line": 6,
+          "message": "Include this leaf activity/function in a process/chain or scenario through a work action or exchange occurrence.",
+          "object_id": "287779b1-50a2-454b-b8c0-8e7a815f6f66",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 437,
+            "start": 356
+          }
+        },
+        {
+          "code": "work_without_behavior_context",
+          "column": 5,
+          "line": 5,
+          "message": "Include this leaf activity/function in a process/chain or scenario through a work action or exchange occurrence.",
+          "object_id": "54c4dded-0e11-4162-8b26-180ca533466b",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 351,
+            "start": 270
+          }
+        },
+        {
+          "code": "exchange_without_behavior_context",
+          "column": 5,
+          "line": 9,
+          "message": "Use this exchange in a process/chain or scenario.",
+          "object_id": "c343da78-0685-43b8-815c-e5326f2ac594",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 813,
+            "start": 690
+          }
+        }
+      ],
+      "migration": null,
+      "revision": 1,
+      "source_project": {
+        "entry": "project.arcadia",
+        "files": {
+          "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"d64f066e-ccf3-4c6d-a95e-c76d7b47c9e0\" {\n    oa_actor vessel \"Vessel in distress\" id \"cb442f05-8ee5-46a5-aa6a-4a4c024a6911\" {}\n    oa_entity rescue \"Rescue coordination\" id \"07d99082-023d-49fb-ba08-23031fed5256\" {}\n    oa_activity report \"Report distress\" id \"54c4dded-0e11-4162-8b26-180ca533466b\" {}\n    oa_activity assess \"Assess incident\" id \"287779b1-50a2-454b-b8c0-8e7a815f6f66\" {}\n    allocation vessel_reports \"Crew reports\" id \"5ca61660-cde4-41fb-9078-378d07c1a116\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"65c4d3c4-0c85-4470-ba73-401f04e3f6b4\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"c343da78-0685-43b8-815c-e5326f2ac594\" { source @report; target @assess; }\n}\n"
+        }
+      }
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/source-project",
+    "status": 200,
+    "etag": "\"p-70aac325-7baf-4c74-a317-cddd3057eba0-r2\"",
+    "location": null,
+    "seconds": 0.023813899999368005,
+    "body": {
+      "changed": true,
+      "issues": [
+        {
+          "code": "work_without_behavior_context",
+          "column": 5,
+          "line": 6,
+          "message": "Include this leaf activity/function in a process/chain or scenario through a work action or exchange occurrence.",
+          "object_id": "287779b1-50a2-454b-b8c0-8e7a815f6f66",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 447,
+            "start": 356
+          }
+        },
+        {
+          "code": "work_without_behavior_context",
+          "column": 5,
+          "line": 5,
+          "message": "Include this leaf activity/function in a process/chain or scenario through a work action or exchange occurrence.",
+          "object_id": "54c4dded-0e11-4162-8b26-180ca533466b",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 351,
+            "start": 270
+          }
+        },
+        {
+          "code": "exchange_without_behavior_context",
+          "column": 5,
+          "line": 9,
+          "message": "Use this exchange in a process/chain or scenario.",
+          "object_id": "c343da78-0685-43b8-815c-e5326f2ac594",
+          "path": "project.arcadia",
+          "severity": "warning",
+          "span": {
+            "end": 823,
+            "start": 700
+          }
+        }
+      ],
+      "migration": null,
+      "revision": 2,
+      "source_project": {
+        "entry": "project.arcadia",
+        "files": {
+          "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"d64f066e-ccf3-4c6d-a95e-c76d7b47c9e0\" {\n    oa_actor vessel \"Vessel in distress\" id \"cb442f05-8ee5-46a5-aa6a-4a4c024a6911\" {}\n    oa_entity rescue \"Rescue coordination\" id \"07d99082-023d-49fb-ba08-23031fed5256\" {}\n    oa_activity report \"Report distress\" id \"54c4dded-0e11-4162-8b26-180ca533466b\" {}\n    oa_activity assess \"Assess incident carefully\" id \"287779b1-50a2-454b-b8c0-8e7a815f6f66\" {}\n    allocation vessel_reports \"Crew reports\" id \"5ca61660-cde4-41fb-9078-378d07c1a116\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"65c4d3c4-0c85-4470-ba73-401f04e3f6b4\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"c343da78-0685-43b8-815c-e5326f2ac594\" { source @report; target @assess; }\n}\n"
+        }
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/model",
+    "status": 200,
+    "etag": "\"p-70aac325-7baf-4c74-a317-cddd3057eba0-r2\"",
+    "location": null,
+    "seconds": 0.005347199999960139,
+    "body": {
+      "schema_version": 7,
+      "id": "d64f066e-ccf3-4c6d-a95e-c76d7b47c9e0",
+      "alias": "distress",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "07d99082-023d-49fb-ba08-23031fed5256": {
+          "id": "07d99082-023d-49fb-ba08-23031fed5256",
+          "alias": "rescue",
+          "name": "Rescue coordination",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Entity"
+          }
+        },
+        "287779b1-50a2-454b-b8c0-8e7a815f6f66": {
+          "id": "287779b1-50a2-454b-b8c0-8e7a815f6f66",
+          "alias": "assess",
+          "name": "Assess incident carefully",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "54c4dded-0e11-4162-8b26-180ca533466b": {
+          "id": "54c4dded-0e11-4162-8b26-180ca533466b",
+          "alias": "report",
+          "name": "Report distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "cb442f05-8ee5-46a5-aa6a-4a4c024a6911": {
+          "id": "cb442f05-8ee5-46a5-aa6a-4a4c024a6911",
+          "alias": "vessel",
+          "name": "Vessel in distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Actor"
+          }
+        }
+      },
+      "relations": {
+        "5ca61660-cde4-41fb-9078-378d07c1a116": {
+          "id": "5ca61660-cde4-41fb-9078-378d07c1a116",
+          "alias": "vessel_reports",
+          "name": "Crew reports",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "cb442f05-8ee5-46a5-aa6a-4a4c024a6911",
+              "target": "54c4dded-0e11-4162-8b26-180ca533466b"
+            }
+          }
+        },
+        "65c4d3c4-0c85-4470-ba73-401f04e3f6b4": {
+          "id": "65c4d3c4-0c85-4470-ba73-401f04e3f6b4",
+          "alias": "rescue_assesses",
+          "name": "Team assesses",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "07d99082-023d-49fb-ba08-23031fed5256",
+              "target": "287779b1-50a2-454b-b8c0-8e7a815f6f66"
+            }
+          }
+        },
+        "c343da78-0685-43b8-815c-e5326f2ac594": {
+          "id": "c343da78-0685-43b8-815c-e5326f2ac594",
+          "alias": "distress_report",
+          "name": "Distress report",
+          "description": "",
+          "body": {
+            "Interaction": {
+              "source": "54c4dded-0e11-4162-8b26-180ca533466b",
+              "target": "287779b1-50a2-454b-b8c0-8e7a815f6f66",
+              "items": []
+            }
+          }
+        }
+      },
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/source-project",
+    "status": 412,
+    "etag": null,
+    "location": null,
+    "seconds": 0.013102300001264666,
+    "body": {
+      "type": "urn:arcadia:problem:revision_conflict",
+      "title": "Precondition Failed",
+      "status": 412,
+      "code": "revision_conflict",
+      "detail": "Project changed. Reload and review the current model before retrying.",
+      "current_revision": 2
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/source-project",
+    "status": 200,
+    "etag": "\"p-70aac325-7baf-4c74-a317-cddd3057eba0-r2\"",
+    "location": null,
+    "seconds": 0.002053700000033132,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"d64f066e-ccf3-4c6d-a95e-c76d7b47c9e0\" {\n    oa_actor vessel \"Vessel in distress\" id \"cb442f05-8ee5-46a5-aa6a-4a4c024a6911\" {}\n    oa_entity rescue \"Rescue coordination\" id \"07d99082-023d-49fb-ba08-23031fed5256\" {}\n    oa_activity report \"Report distress\" id \"54c4dded-0e11-4162-8b26-180ca533466b\" {}\n    oa_activity assess \"Assess incident carefully\" id \"287779b1-50a2-454b-b8c0-8e7a815f6f66\" {}\n    allocation vessel_reports \"Crew reports\" id \"5ca61660-cde4-41fb-9078-378d07c1a116\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"65c4d3c4-0c85-4470-ba73-401f04e3f6b4\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"c343da78-0685-43b8-815c-e5326f2ac594\" { source @report; target @assess; }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/source-project",
+    "status": 422,
+    "etag": null,
+    "location": null,
+    "seconds": 0.012539299999843934,
+    "body": {
+      "type": "urn:arcadia:problem:invalid_source_project",
+      "title": "Unprocessable Entity",
+      "status": 422,
+      "code": "invalid_source_project",
+      "detail": "Source project could not be applied.",
+      "issues": [
+        {
+          "severity": "error",
+          "code": "invalid_source",
+          "message": "Unexpected content after the project closing brace.",
+          "line": 12,
+          "column": 1,
+          "path": "project.arcadia",
+          "span": {
+            "start": 827,
+            "end": 828
+          }
+        }
+      ]
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/source-project",
+    "status": 200,
+    "etag": "\"p-70aac325-7baf-4c74-a317-cddd3057eba0-r2\"",
+    "location": null,
+    "seconds": 0.0015880999999353662,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"d64f066e-ccf3-4c6d-a95e-c76d7b47c9e0\" {\n    oa_actor vessel \"Vessel in distress\" id \"cb442f05-8ee5-46a5-aa6a-4a4c024a6911\" {}\n    oa_entity rescue \"Rescue coordination\" id \"07d99082-023d-49fb-ba08-23031fed5256\" {}\n    oa_activity report \"Report distress\" id \"54c4dded-0e11-4162-8b26-180ca533466b\" {}\n    oa_activity assess \"Assess incident carefully\" id \"287779b1-50a2-454b-b8c0-8e7a815f6f66\" {}\n    allocation vessel_reports \"Crew reports\" id \"5ca61660-cde4-41fb-9078-378d07c1a116\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"65c4d3c4-0c85-4470-ba73-401f04e3f6b4\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"c343da78-0685-43b8-815c-e5326f2ac594\" { source @report; target @assess; }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/70aac325-7baf-4c74-a317-cddd3057eba0/model",
+    "status": 200,
+    "etag": "\"p-70aac325-7baf-4c74-a317-cddd3057eba0-r2\"",
+    "location": null,
+    "seconds": 0.0021672000002581626,
+    "body": {
+      "schema_version": 7,
+      "id": "d64f066e-ccf3-4c6d-a95e-c76d7b47c9e0",
+      "alias": "distress",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "07d99082-023d-49fb-ba08-23031fed5256": {
+          "id": "07d99082-023d-49fb-ba08-23031fed5256",
+          "alias": "rescue",
+          "name": "Rescue coordination",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Entity"
+          }
+        },
+        "287779b1-50a2-454b-b8c0-8e7a815f6f66": {
+          "id": "287779b1-50a2-454b-b8c0-8e7a815f6f66",
+          "alias": "assess",
+          "name": "Assess incident carefully",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "54c4dded-0e11-4162-8b26-180ca533466b": {
+          "id": "54c4dded-0e11-4162-8b26-180ca533466b",
+          "alias": "report",
+          "name": "Report distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Activity"
+          }
+        },
+        "cb442f05-8ee5-46a5-aa6a-4a4c024a6911": {
+          "id": "cb442f05-8ee5-46a5-aa6a-4a4c024a6911",
+          "alias": "vessel",
+          "name": "Vessel in distress",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": "Actor"
+          }
+        }
+      },
+      "relations": {
+        "5ca61660-cde4-41fb-9078-378d07c1a116": {
+          "id": "5ca61660-cde4-41fb-9078-378d07c1a116",
+          "alias": "vessel_reports",
+          "name": "Crew reports",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "cb442f05-8ee5-46a5-aa6a-4a4c024a6911",
+              "target": "54c4dded-0e11-4162-8b26-180ca533466b"
+            }
+          }
+        },
+        "65c4d3c4-0c85-4470-ba73-401f04e3f6b4": {
+          "id": "65c4d3c4-0c85-4470-ba73-401f04e3f6b4",
+          "alias": "rescue_assesses",
+          "name": "Team assesses",
+          "description": "",
+          "body": {
+            "Allocation": {
+              "source": "07d99082-023d-49fb-ba08-23031fed5256",
+              "target": "287779b1-50a2-454b-b8c0-8e7a815f6f66"
+            }
+          }
+        },
+        "c343da78-0685-43b8-815c-e5326f2ac594": {
+          "id": "c343da78-0685-43b8-815c-e5326f2ac594",
+          "alias": "distress_report",
+          "name": "Distress report",
+          "description": "",
+          "body": {
+            "Interaction": {
+              "source": "54c4dded-0e11-4162-8b26-180ca533466b",
+              "target": "287779b1-50a2-454b-b8c0-8e7a815f6f66",
+              "items": []
+            }
+          }
+        }
+      },
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/v1/projects/import-source-project",
+    "status": 201,
+    "etag": "\"p-6733e0e7-0a94-48ef-84ff-b3970a4b84b4-r1\"",
+    "location": "/api/v1/projects/6733e0e7-0a94-48ef-84ff-b3970a4b84b4",
+    "seconds": 0.004914300001473748,
+    "body": {
+      "elements": 1,
+      "migration": null,
+      "model_id": "585d2e53-49a0-41ab-9aa1-f60d8194276b",
+      "name": "Distress response",
+      "relations": 0,
+      "resource_id": "6733e0e7-0a94-48ef-84ff-b3970a4b84b4",
+      "revision": 1,
+      "schema_version": 7
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/6733e0e7-0a94-48ef-84ff-b3970a4b84b4/source-project",
+    "status": 200,
+    "etag": "\"p-6733e0e7-0a94-48ef-84ff-b3970a4b84b4-r1\"",
+    "location": null,
+    "seconds": 0.0016458999998576473,
+    "body": {
+      "entry": "project.arcadia",
+      "files": {
+        "project.arcadia": "arcadia 7;\nproject response \"Distress response\" id \"585d2e53-49a0-41ab-9aa1-f60d8194276b\" {\n    oa_scenario assessment \"Assess the distress report\" id \"6adbebae-5d8e-41da-a6d5-90f75926bcf8\" {\n        viewpoint OperationalActivity;\n    }\n}\n"
+      }
+    }
+  },
+  {
+    "method": "GET",
+    "path": "/api/v1/projects/6733e0e7-0a94-48ef-84ff-b3970a4b84b4/model",
+    "status": 200,
+    "etag": "\"p-6733e0e7-0a94-48ef-84ff-b3970a4b84b4-r1\"",
+    "location": null,
+    "seconds": 0.004791299999851617,
+    "body": {
+      "schema_version": 7,
+      "id": "585d2e53-49a0-41ab-9aa1-f60d8194276b",
+      "alias": "response",
+      "name": "Distress response",
+      "description": "",
+      "elements": {
+        "6adbebae-5d8e-41da-a6d5-90f75926bcf8": {
+          "id": "6adbebae-5d8e-41da-a6d5-90f75926bcf8",
+          "alias": "assessment",
+          "name": "Assess the distress report",
+          "description": "",
+          "parent": null,
+          "body": {
+            "Oa": {
+              "Shared": {
+                "Scenario": {
+                  "viewpoint": "OperationalActivity",
+                  "context": null,
+                  "precondition": "",
+                  "postcondition": "",
+                  "steps": []
+                }
+              }
+            }
+          }
+        }
+      },
+      "relations": {},
+      "diagrams": {},
+      "artifact_links": {},
+      "traces": {}
+    }
+  }
+]

harness/experiments/textual-authoring-20260911-local/oa-initial-model.json

@@ -0,0 +1,91 @@
+{
+  "schema_version": 7,
+  "id": "59d44355-d4a1-4e59-905c-ae415209e93a",
+  "alias": "distress",
+  "name": "Distress response",
+  "description": "",
+  "elements": {
+    "2d1f63d3-a6b5-4912-9109-50a1bfb736da": {
+      "id": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+      "alias": "rescue",
+      "name": "Rescue coordination",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Entity"
+      }
+    },
+    "82839234-23ed-4d8c-abdc-84f0e4db89e3": {
+      "id": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+      "alias": "report",
+      "name": "Report distress",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Activity"
+      }
+    },
+    "dde90260-064b-4360-90df-2082bc4b25a2": {
+      "id": "dde90260-064b-4360-90df-2082bc4b25a2",
+      "alias": "vessel",
+      "name": "Vessel in distress",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Actor"
+      }
+    },
+    "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2": {
+      "id": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+      "alias": "assess",
+      "name": "Assess incident",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Activity"
+      }
+    }
+  },
+  "relations": {
+    "450a369f-785c-422d-ad17-48a95a174410": {
+      "id": "450a369f-785c-422d-ad17-48a95a174410",
+      "alias": "rescue_assesses",
+      "name": "Team assesses",
+      "description": "",
+      "body": {
+        "Allocation": {
+          "source": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+          "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2"
+        }
+      }
+    },
+    "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b": {
+      "id": "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b",
+      "alias": "distress_report",
+      "name": "Distress report",
+      "description": "",
+      "body": {
+        "Interaction": {
+          "source": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+          "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+          "items": []
+        }
+      }
+    },
+    "988baf52-2159-4769-a4a2-6bb76134fbb5": {
+      "id": "988baf52-2159-4769-a4a2-6bb76134fbb5",
+      "alias": "vessel_reports",
+      "name": "Crew reports",
+      "description": "",
+      "body": {
+        "Allocation": {
+          "source": "dde90260-064b-4360-90df-2082bc4b25a2",
+          "target": "82839234-23ed-4d8c-abdc-84f0e4db89e3"
+        }
+      }
+    }
+  },
+  "diagrams": {},
+  "artifact_links": {},
+  "traces": {}
+}

harness/experiments/textual-authoring-20260911-local/oa-input.arcadia

@@ -0,0 +1,10 @@
+arcadia 7;
+project distress "Distress response" {
+    oa_actor vessel "Vessel in distress" {}
+    oa_entity rescue "Rescue coordination" {}
+    oa_activity report "Report distress" {}
+    oa_activity assess "Assess incident" {}
+    allocation vessel_reports "Crew reports" { source @vessel; target @report; }
+    allocation rescue_assesses "Team assesses" { source @rescue; target @assess; }
+    interaction distress_report "Distress report" { source @report; target @assess; }
+}

harness/experiments/textual-authoring-20260911-local/oa-renamed-model.json

@@ -0,0 +1,91 @@
+{
+  "schema_version": 7,
+  "id": "59d44355-d4a1-4e59-905c-ae415209e93a",
+  "alias": "distress",
+  "name": "Distress response",
+  "description": "",
+  "elements": {
+    "2d1f63d3-a6b5-4912-9109-50a1bfb736da": {
+      "id": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+      "alias": "rescue",
+      "name": "Rescue coordination",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Entity"
+      }
+    },
+    "82839234-23ed-4d8c-abdc-84f0e4db89e3": {
+      "id": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+      "alias": "report",
+      "name": "Report distress",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Activity"
+      }
+    },
+    "dde90260-064b-4360-90df-2082bc4b25a2": {
+      "id": "dde90260-064b-4360-90df-2082bc4b25a2",
+      "alias": "vessel",
+      "name": "Vessel in distress",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Actor"
+      }
+    },
+    "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2": {
+      "id": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+      "alias": "assess",
+      "name": "Assess incident carefully",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Activity"
+      }
+    }
+  },
+  "relations": {
+    "450a369f-785c-422d-ad17-48a95a174410": {
+      "id": "450a369f-785c-422d-ad17-48a95a174410",
+      "alias": "rescue_assesses",
+      "name": "Team assesses",
+      "description": "",
+      "body": {
+        "Allocation": {
+          "source": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+          "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2"
+        }
+      }
+    },
+    "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b": {
+      "id": "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b",
+      "alias": "distress_report",
+      "name": "Distress report",
+      "description": "",
+      "body": {
+        "Interaction": {
+          "source": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+          "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+          "items": []
+        }
+      }
+    },
+    "988baf52-2159-4769-a4a2-6bb76134fbb5": {
+      "id": "988baf52-2159-4769-a4a2-6bb76134fbb5",
+      "alias": "vessel_reports",
+      "name": "Crew reports",
+      "description": "",
+      "body": {
+        "Allocation": {
+          "source": "dde90260-064b-4360-90df-2082bc4b25a2",
+          "target": "82839234-23ed-4d8c-abdc-84f0e4db89e3"
+        }
+      }
+    }
+  },
+  "diagrams": {},
+  "artifact_links": {},
+  "traces": {}
+}

harness/experiments/textual-authoring-20260911-local/oa-renamed.arcadia

@@ -0,0 +1,10 @@
+arcadia 7;
+project distress "Distress response" id "59d44355-d4a1-4e59-905c-ae415209e93a" {
+    oa_actor vessel "Vessel in distress" id "dde90260-064b-4360-90df-2082bc4b25a2" {}
+    oa_entity rescue "Rescue coordination" id "2d1f63d3-a6b5-4912-9109-50a1bfb736da" {}
+    oa_activity report "Report distress" id "82839234-23ed-4d8c-abdc-84f0e4db89e3" {}
+    oa_activity assess "Assess incident carefully" id "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2" {}
+    allocation vessel_reports "Crew reports" id "988baf52-2159-4769-a4a2-6bb76134fbb5" { source @vessel; target @report; }
+    allocation rescue_assesses "Team assesses" id "450a369f-785c-422d-ad17-48a95a174410" { source @rescue; target @assess; }
+    interaction distress_report "Distress report" id "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b" { source @report; target @assess; }
+}

harness/experiments/textual-authoring-20260911-local/oa-stabilized.arcadia

@@ -0,0 +1,10 @@
+arcadia 7;
+project distress "Distress response" id "59d44355-d4a1-4e59-905c-ae415209e93a" {
+    oa_actor vessel "Vessel in distress" id "dde90260-064b-4360-90df-2082bc4b25a2" {}
+    oa_entity rescue "Rescue coordination" id "2d1f63d3-a6b5-4912-9109-50a1bfb736da" {}
+    oa_activity report "Report distress" id "82839234-23ed-4d8c-abdc-84f0e4db89e3" {}
+    oa_activity assess "Assess incident" id "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2" {}
+    allocation vessel_reports "Crew reports" id "988baf52-2159-4769-a4a2-6bb76134fbb5" { source @vessel; target @report; }
+    allocation rescue_assesses "Team assesses" id "450a369f-785c-422d-ad17-48a95a174410" { source @rescue; target @assess; }
+    interaction distress_report "Distress report" id "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b" { source @report; target @assess; }
+}

harness/experiments/textual-authoring-20260911-local/provenance.json

@@ -0,0 +1,611 @@
+{
+  "executable": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\target-gnullvm\\debug\\arcadia-server.exe",
+  "exe_sha256": "efeeb89c0d2e0f93df4472cb3e9f48b2b722a37ae1043c90a5a56f2e845fe665",
+  "exe_bytes": 39743488,
+  "snapshot": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\linux-qa\\runtime\\source7-20260907T082753190288Z.tar.gz",
+  "snapshot_sha256": "cbb371a93a562e1e641d7629fe351e016d63e66fc9112499b3fed6d5cd171f78",
+  "source_comparisons": [
+    {
+      "path": "crates/oa-core/Cargo.toml",
+      "snapshot_sha256": "64824ec447be777841a972bf06c894ef2624a37e4725583bcfe0389deb9f00a3",
+      "current_sha256": "64824ec447be777841a972bf06c894ef2624a37e4725583bcfe0389deb9f00a3"
+    },
+    {
+      "path": "crates/oa-core/build.rs",
+      "snapshot_sha256": "ab1be6ae1fd8bf3ebaeef6348347a9d5e666bde693126f199e041659e0b094a9",
+      "current_sha256": "ab1be6ae1fd8bf3ebaeef6348347a9d5e666bde693126f199e041659e0b094a9"
+    },
+    {
+      "path": "crates/oa-core/examples/generate_demo.rs",
+      "snapshot_sha256": "e26f432c95331aeca50985dbb3ad2c558affd43023b585811f0f7bfaa59f6661",
+      "current_sha256": "e26f432c95331aeca50985dbb3ad2c558affd43023b585811f0f7bfaa59f6661"
+    },
+    {
+      "path": "crates/oa-core/examples/generate_release1.rs",
+      "snapshot_sha256": "1d5f11165d74893e4bc18dbf3a2f2111f4026bd89fd06ee7f0bae69e45c4d4b5",
+      "current_sha256": "1d5f11165d74893e4bc18dbf3a2f2111f4026bd89fd06ee7f0bae69e45c4d4b5"
+    },
+    {
+      "path": "crates/oa-core/examples/release_dense_views.rs",
+      "snapshot_sha256": "a83158488ef9b7394f136c52b1496719be935c4e5bdfe457cab5c9894f5f9412",
+      "current_sha256": "a83158488ef9b7394f136c52b1496719be935c4e5bdfe457cab5c9894f5f9412"
+    },
+    {
+      "path": "crates/oa-core/examples/routing_workshop.rs",
+      "snapshot_sha256": "571307b18b6d4fa04700c5a4d4b0c2154c419e93a21292b2028e7b6f46a2faa7",
+      "current_sha256": "571307b18b6d4fa04700c5a4d4b0c2154c419e93a21292b2028e7b6f46a2faa7"
+    },
+    {
+      "path": "crates/oa-core/src/data.rs",
+      "snapshot_sha256": "7f9c7c7dd8353cb5a38597b92cde6d3e890203d392473187eb387d41ff37414a",
+      "current_sha256": "7f9c7c7dd8353cb5a38597b92cde6d3e890203d392473187eb387d41ff37414a"
+    },
+    {
+      "path": "crates/oa-core/src/demo.rs",
+      "snapshot_sha256": "ad62123f96c20ff023cafc1a9849b0fa06bc62edd1fb9701799e4599b458600c",
+      "current_sha256": "ad62123f96c20ff023cafc1a9849b0fa06bc62edd1fb9701799e4599b458600c"
+    },
+    {
+      "path": "crates/oa-core/src/language.rs",
+      "snapshot_sha256": "638f08a42e9cf4996b5d07f69b4d6f517a518369f3604d25be1006e40e080765",
+      "current_sha256": "638f08a42e9cf4996b5d07f69b4d6f517a518369f3604d25be1006e40e080765"
+    },
+    {
+      "path": "crates/oa-core/src/language/semantic_source.rs",
+      "snapshot_sha256": "584b5bb59d87a7b8d44d5dd2d124c3a1323b21492b138a17bc9526c0087c9e29",
+      "current_sha256": "584b5bb59d87a7b8d44d5dd2d124c3a1323b21492b138a17bc9526c0087c9e29"
+    },
+    {
+      "path": "crates/oa-core/src/language_nesting_tests.rs",
+      "snapshot_sha256": "bd061611e8cb6f28ab203c73e544ac98bf275eb464cd314ad5fbd25f773df33b",
+      "current_sha256": "bd061611e8cb6f28ab203c73e544ac98bf275eb464cd314ad5fbd25f773df33b"
+    },
+    {
+      "path": "crates/oa-core/src/lib.rs",
+      "snapshot_sha256": "52cb6ee7a4ffc00711ecf121c1a1b14ca154863f7ca27b0d2a8e239edce8aca7",
+      "current_sha256": "52cb6ee7a4ffc00711ecf121c1a1b14ca154863f7ca27b0d2a8e239edce8aca7"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v2/README.md",
+      "snapshot_sha256": "fb61d3faa33d7bdfba73415415a0882c0fbd3e0b45df42f972a19aec6da927b9",
+      "current_sha256": "fb61d3faa33d7bdfba73415415a0882c0fbd3e0b45df42f972a19aec6da927b9"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v2/adapter.rs",
+      "snapshot_sha256": "66741b4c8354a23b8a932ecc5bf1bc3bb6e74279558757b8c35bc2157a7e51b5",
+      "current_sha256": "66741b4c8354a23b8a932ecc5bf1bc3bb6e74279558757b8c35bc2157a7e51b5"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v2/mod.rs",
+      "snapshot_sha256": "857d8bb13b6814daba6780ca770c16352943c01cb130245d055f11b3b957b3e9",
+      "current_sha256": "857d8bb13b6814daba6780ca770c16352943c01cb130245d055f11b3b957b3e9"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v2/model.rs",
+      "snapshot_sha256": "8ac63eb59b2e57bdecff2477ee0634096090924d3dd1851e1c454880a889dacb",
+      "current_sha256": "8ac63eb59b2e57bdecff2477ee0634096090924d3dd1851e1c454880a889dacb"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v2/references.rs",
+      "snapshot_sha256": "33a6819abc83139fdaebeebd1b553238a328637106cce7dd5a535f1791d43e20",
+      "current_sha256": "33a6819abc83139fdaebeebd1b553238a328637106cce7dd5a535f1791d43e20"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v2/source.rs",
+      "snapshot_sha256": "74fee9b24e7c912182c998ab9d9aeec125e2009c3214959229e844c67afe2bf6",
+      "current_sha256": "74fee9b24e7c912182c998ab9d9aeec125e2009c3214959229e844c67afe2bf6"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v2/state_validation.rs",
+      "snapshot_sha256": "e29ef071bab0a68460ddf55c46131c6f66c022d52c3c602c37c013c3649da1b0",
+      "current_sha256": "e29ef071bab0a68460ddf55c46131c6f66c022d52c3c602c37c013c3649da1b0"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v2/transitions.rs",
+      "snapshot_sha256": "f74174c532ba56b57c80b719a11fb4adea0a78ccc2828fff72fe2b9eda5a10b1",
+      "current_sha256": "f74174c532ba56b57c80b719a11fb4adea0a78ccc2828fff72fe2b9eda5a10b1"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v2/validation.rs",
+      "snapshot_sha256": "6d5e4a4e2805ae5045bf789a0485e14a61c63346587bace2b4a91173a688f780",
+      "current_sha256": "6d5e4a4e2805ae5045bf789a0485e14a61c63346587bace2b4a91173a688f780"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v3/README.md",
+      "snapshot_sha256": "3755a63f840d7f0eadf68afa7a9d587877a9468ff982d3610539e8a0bb067a82",
+      "current_sha256": "3755a63f840d7f0eadf68afa7a9d587877a9468ff982d3610539e8a0bb067a82"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v3/mod.rs",
+      "snapshot_sha256": "f4edb6a0b50ecfe8670973776d703047b064420cb1f05913129c00fc656b3722",
+      "current_sha256": "f4edb6a0b50ecfe8670973776d703047b064420cb1f05913129c00fc656b3722"
+    },
+    {
+      "path": "crates/oa-core/src/migration_v4.rs",
+      "snapshot_sha256": "50c652964f0f309e7f3f54b6ef12c40d42fcecc0490f005995c713df1179af70",
+      "current_sha256": "50c652964f0f309e7f3f54b6ef12c40d42fcecc0490f005995c713df1179af70"
+    },
+    {
+      "path": "crates/oa-core/src/model.rs",
+      "snapshot_sha256": "4585c895c64c4a183941c92cf047a9e52ff0cbe41971e16e78d229ea9dc101fb",
+      "current_sha256": "4585c895c64c4a183941c92cf047a9e52ff0cbe41971e16e78d229ea9dc101fb"
+    },
+    {
+      "path": "crates/oa-core/src/operations.rs",
+      "snapshot_sha256": "a5ffbbf54cd440316a106d1188bfb699b57dae59f466edcb33618c333cd19f41",
+      "current_sha256": "a5ffbbf54cd440316a106d1188bfb699b57dae59f466edcb33618c333cd19f41"
+    },
+    {
+      "path": "crates/oa-core/src/persistence.rs",
+      "snapshot_sha256": "1c01474f906a63e552c0d590b272c95821c00a100b3e79e58e67dbbeac341a14",
+      "current_sha256": "1c01474f906a63e552c0d590b272c95821c00a100b3e79e58e67dbbeac341a14"
+    },
+    {
+      "path": "crates/oa-core/src/ports.rs",
+      "snapshot_sha256": "5cac12eea70a54ebebbd6be77b63ce92e3195325c4bc7d27705c518686cbac80",
+      "current_sha256": "5cac12eea70a54ebebbd6be77b63ce92e3195325c4bc7d27705c518686cbac80"
+    },
+    {
+      "path": "crates/oa-core/src/projection.rs",
+      "snapshot_sha256": "69ed12bace2cc5024e151752a174ab14034ac2d05eb741fcf13e9a27521c059b",
+      "current_sha256": "69ed12bace2cc5024e151752a174ab14034ac2d05eb741fcf13e9a27521c059b"
+    },
+    {
+      "path": "crates/oa-core/src/projection/port_layout.rs",
+      "snapshot_sha256": "a08d17d10a58bb8b206dd001b19b91d5aa3a9f743b298a4da57d503223c20079",
+      "current_sha256": "a08d17d10a58bb8b206dd001b19b91d5aa3a9f743b298a4da57d503223c20079"
+    },
+    {
+      "path": "crates/oa-core/src/projection/state.rs",
+      "snapshot_sha256": "73a607bac713ec7ff49a509fefb1a53c7686dca93ee241ffc835564d743afb28",
+      "current_sha256": "73a607bac713ec7ff49a509fefb1a53c7686dca93ee241ffc835564d743afb28"
+    },
+    {
+      "path": "crates/oa-core/src/references.rs",
+      "snapshot_sha256": "93553c234f32da35f1f41a7b83ad81c471c9803efa78ca222cf7de3c2f86c0bb",
+      "current_sha256": "93553c234f32da35f1f41a7b83ad81c471c9803efa78ca222cf7de3c2f86c0bb"
+    },
+    {
+      "path": "crates/oa-core/src/routing.rs",
+      "snapshot_sha256": "c5ebb350ba76f731f5c48d968bfbba4b6ef68ec046eb5893d116c4637ef15080",
+      "current_sha256": "c5ebb350ba76f731f5c48d968bfbba4b6ef68ec046eb5893d116c4637ef15080"
+    },
+    {
+      "path": "crates/oa-core/src/semantic.rs",
+      "snapshot_sha256": "f9895dd5b8fb27d10d4cfbb41c3542ef2018365a589b8d5778e5674ae5a1f239",
+      "current_sha256": "f9895dd5b8fb27d10d4cfbb41c3542ef2018365a589b8d5778e5674ae5a1f239"
+    },
+    {
+      "path": "crates/oa-core/src/semantic/catalog.rs",
+      "snapshot_sha256": "1ff74fcca18084d178681d7ff38ee1ccac632c27c4de0595ba1ceab8067ab3a4",
+      "current_sha256": "1ff74fcca18084d178681d7ff38ee1ccac632c27c4de0595ba1ceab8067ab3a4"
+    },
+    {
+      "path": "crates/oa-core/src/semantic/historical.rs",
+      "snapshot_sha256": "eaf3284bf234312698514cdb636bc8348e1b5d746cb16b18df777e77d312abfb",
+      "current_sha256": "eaf3284bf234312698514cdb636bc8348e1b5d746cb16b18df777e77d312abfb"
+    },
+    {
+      "path": "crates/oa-core/src/semantic/linked.rs",
+      "snapshot_sha256": "6f335b14e809aecfc35defcaf77cb821b080d1506dbc46297912b25af98c07a2",
+      "current_sha256": "6f335b14e809aecfc35defcaf77cb821b080d1506dbc46297912b25af98c07a2"
+    },
+    {
+      "path": "crates/oa-core/src/semantic/mutate.rs",
+      "snapshot_sha256": "dc2b4c4a6eb156fe468eaa8c85fd37a505c0cd8ea1f226cb69cd01689afd3d9d",
+      "current_sha256": "dc2b4c4a6eb156fe468eaa8c85fd37a505c0cd8ea1f226cb69cd01689afd3d9d"
+    },
+    {
+      "path": "crates/oa-core/src/semantic/review.rs",
+      "snapshot_sha256": "0c157d2c327e72e89cca3b423e71ee73798105c5bb7271439c1a101642c91e3e",
+      "current_sha256": "0c157d2c327e72e89cca3b423e71ee73798105c5bb7271439c1a101642c91e3e"
+    },
+    {
+      "path": "crates/oa-core/src/semantic/types.rs",
+      "snapshot_sha256": "6922fe35089f12fad43ab0ce1c6886d01a3855f90b8e2543e99802ac5e6f1bbb",
+      "current_sha256": "6922fe35089f12fad43ab0ce1c6886d01a3855f90b8e2543e99802ac5e6f1bbb"
+    },
+    {
+      "path": "crates/oa-core/src/session.rs",
+      "snapshot_sha256": "1eb77b329b2986fc6f5dc0171e77fd860375cdfd8c769a1367b445d6c49ebe00",
+      "current_sha256": "1eb77b329b2986fc6f5dc0171e77fd860375cdfd8c769a1367b445d6c49ebe00"
+    },
+    {
+      "path": "crates/oa-core/src/source_files.rs",
+      "snapshot_sha256": "669491dbddb8e8e6556161426dffa1a49ac1c826d31020bff0956d81a4d84683",
+      "current_sha256": "669491dbddb8e8e6556161426dffa1a49ac1c826d31020bff0956d81a4d84683"
+    },
+    {
+      "path": "crates/oa-core/src/source_project.rs",
+      "snapshot_sha256": "1394370bcc5908873b830c2c11312e6e1611af41f46c4f43ca0a6bcb713bb466",
+      "current_sha256": "1394370bcc5908873b830c2c11312e6e1611af41f46c4f43ca0a6bcb713bb466"
+    },
+    {
+      "path": "crates/oa-core/src/source_project/source_migration.rs",
+      "snapshot_sha256": "add463ae85c420f853d324b00a221f0f874164cc3f3ed6bbb07557a9ed7a8c95",
+      "current_sha256": "add463ae85c420f853d324b00a221f0f874164cc3f3ed6bbb07557a9ed7a8c95"
+    },
+    {
+      "path": "crates/oa-core/src/source_project/source_structure.rs",
+      "snapshot_sha256": "9f1f83315856a7025fe662c0fbb13452f31613224a03663150d6225d1ddc162f",
+      "current_sha256": "9f1f83315856a7025fe662c0fbb13452f31613224a03663150d6225d1ddc162f"
+    },
+    {
+      "path": "crates/oa-core/src/state_validation.rs",
+      "snapshot_sha256": "e28d7f74385e2a78763716b34491bd73a00bfeccc085970ceb130627e3faee18",
+      "current_sha256": "e28d7f74385e2a78763716b34491bd73a00bfeccc085970ceb130627e3faee18"
+    },
+    {
+      "path": "crates/oa-core/src/topology_context.rs",
+      "snapshot_sha256": "16de69b297de95d93c73808621607833b713af811dd082f0169186ae1e5c3e2d",
+      "current_sha256": "16de69b297de95d93c73808621607833b713af811dd082f0169186ae1e5c3e2d"
+    },
+    {
+      "path": "crates/oa-core/src/topology_context/analysis.rs",
+      "snapshot_sha256": "dead6194f0aa60cc46045c0e5ee10dbdbb689158c38634dfbbbc45d2ba88ac65",
+      "current_sha256": "dead6194f0aa60cc46045c0e5ee10dbdbb689158c38634dfbbbc45d2ba88ac65"
+    },
+    {
+      "path": "crates/oa-core/src/topology_context/analysis_tests.rs",
+      "snapshot_sha256": "17839263410815e96fe027d4eba3aae0a9ab3b82b16947e2b29ebe0d09782b56",
+      "current_sha256": "17839263410815e96fe027d4eba3aae0a9ab3b82b16947e2b29ebe0d09782b56"
+    },
+    {
+      "path": "crates/oa-core/src/transitions.rs",
+      "snapshot_sha256": "fadd1b07b89cae4117b91abb4f1ac9ea81ff818ef20f2175e76ee8cf21fb708d",
+      "current_sha256": "fadd1b07b89cae4117b91abb4f1ac9ea81ff818ef20f2175e76ee8cf21fb708d"
+    },
+    {
+      "path": "crates/oa-core/src/transitions/communication.rs",
+      "snapshot_sha256": "2b476630a88edd9021b9156ca12a5402e01604095f0d4002afb452671903a028",
+      "current_sha256": "2b476630a88edd9021b9156ca12a5402e01604095f0d4002afb452671903a028"
+    },
+    {
+      "path": "crates/oa-core/src/validation.rs",
+      "snapshot_sha256": "7c1b4ae5e4ebba13e99af9158ccde138dfc5e9a7afb580e76fba72d0b64ba74e",
+      "current_sha256": "7c1b4ae5e4ebba13e99af9158ccde138dfc5e9a7afb580e76fba72d0b64ba74e"
+    },
+    {
+      "path": "crates/oa-core/src/validation/coverage.rs",
+      "snapshot_sha256": "b08e4b344ecad055714168c83beff7fe29ba4edc53edbffa2eae04e5580a4d5f",
+      "current_sha256": "b08e4b344ecad055714168c83beff7fe29ba4edc53edbffa2eae04e5580a4d5f"
+    },
+    {
+      "path": "crates/oa-core/src/view_options.rs",
+      "snapshot_sha256": "421ede0a04c593ca1df0e6e0d06fabcfcc8113cdbcfb0adc7f5c8ef4d1724208",
+      "current_sha256": "421ede0a04c593ca1df0e6e0d06fabcfcc8113cdbcfb0adc7f5c8ef4d1724208"
+    },
+    {
+      "path": "crates/oa-core/src/view_options_tests.rs",
+      "snapshot_sha256": "64aac44de2df42a1012239a3dd75c473daf0c8990b3170b7bf7e78a556080208",
+      "current_sha256": "64aac44de2df42a1012239a3dd75c473daf0c8990b3170b7bf7e78a556080208"
+    },
+    {
+      "path": "crates/oa-core/tests/communication_boundary_scenarios.rs",
+      "snapshot_sha256": "e1100b8f363910a487d90c73acc7df543dc6d532158c3c63ad11cd3d40d8e12b",
+      "current_sha256": "e1100b8f363910a487d90c73acc7df543dc6d532158c3c63ad11cd3d40d8e12b"
+    },
+    {
+      "path": "crates/oa-core/tests/communication_means.rs",
+      "snapshot_sha256": "a25f2749180bc6f4beb1445bfad3351eedf0669131a7439b633ab804439e95a4",
+      "current_sha256": "a25f2749180bc6f4beb1445bfad3351eedf0669131a7439b633ab804439e95a4"
+    },
+    {
+      "path": "crates/oa-core/tests/coverage_diagnostics.rs",
+      "snapshot_sha256": "e2e9c3996daab47f2bd23f5d8c48b4e372af33331152f5fc85b76f06d04fcdf4",
+      "current_sha256": "e2e9c3996daab47f2bd23f5d8c48b4e372af33331152f5fc85b76f06d04fcdf4"
+    },
+    {
+      "path": "crates/oa-core/tests/fixtures/v2-coastal-rescue.arcadia",
+      "snapshot_sha256": "f0df129c1914bfc01d0b047b0cd4b520d8cf0c249ea9ced085de400c0be87ff3",
+      "current_sha256": "f0df129c1914bfc01d0b047b0cd4b520d8cf0c249ea9ced085de400c0be87ff3"
+    },
+    {
+      "path": "crates/oa-core/tests/fixtures/v2-coastal-rescue.json",
+      "snapshot_sha256": "3ed53508eb544bbd788832f7bebea2ec31b3d66191f24f45098cc9750ec4c005",
+      "current_sha256": "3ed53508eb544bbd788832f7bebea2ec31b3d66191f24f45098cc9750ec4c005"
+    },
+    {
+      "path": "crates/oa-core/tests/fixtures/v3-data-contract.arcadia",
+      "snapshot_sha256": "305f19d1b79f99f8d4cf627ba2e9ca6836bb7959cc0070227815937a699eafea",
+      "current_sha256": "305f19d1b79f99f8d4cf627ba2e9ca6836bb7959cc0070227815937a699eafea"
+    },
+    {
+      "path": "crates/oa-core/tests/fixtures/v3-data-contract.json",
+      "snapshot_sha256": "1b41299c53204e6232397d25a58d5bccdbbc16e770c75e8edb55ce36ccfe58a2",
+      "current_sha256": "1b41299c53204e6232397d25a58d5bccdbbc16e770c75e8edb55ce36ccfe58a2"
+    },
+    {
+      "path": "crates/oa-core/tests/fixtures/v4-reviewed-prose.arcadia",
+      "snapshot_sha256": "5fa53a26a5ad010c8e59eb56d9b2b52003569e66c0377ffb58840590168ad0c1",
+      "current_sha256": "5fa53a26a5ad010c8e59eb56d9b2b52003569e66c0377ffb58840590168ad0c1"
+    },
+    {
+      "path": "crates/oa-core/tests/fixtures/v4-reviewed-prose.json",
+      "snapshot_sha256": "2808088afcc165f4bd6da5129151143411c997041c3de61d600ab76e05d24a47",
+      "current_sha256": "2808088afcc165f4bd6da5129151143411c997041c3de61d600ab76e05d24a47"
+    },
+    {
+      "path": "crates/oa-core/tests/language.rs",
+      "snapshot_sha256": "77f6cb2a69976bfb5f60b243b71c07fb0edc7505002c1e9e73fcd6ddf6d9496e",
+      "current_sha256": "77f6cb2a69976bfb5f60b243b71c07fb0edc7505002c1e9e73fcd6ddf6d9496e"
+    },
+    {
+      "path": "crates/oa-core/tests/port_anchors.rs",
+      "snapshot_sha256": "efbc0fa18733b1aaac501f9785a4c392fc49c05c45a5778d26e9b5dd951ca6fa",
+      "current_sha256": "efbc0fa18733b1aaac501f9785a4c392fc49c05c45a5778d26e9b5dd951ca6fa"
+    },
+    {
+      "path": "crates/oa-core/tests/port_migration.rs",
+      "snapshot_sha256": "1801c376a5435ac7efb2a8342348b2c7ffef930bba65deca4acb66b06e0483d7",
+      "current_sha256": "1801c376a5435ac7efb2a8342348b2c7ffef930bba65deca4acb66b06e0483d7"
+    },
+    {
+      "path": "crates/oa-core/tests/port_source.rs",
+      "snapshot_sha256": "8d2ddaca4045d330f6eda2591561497b858aad53769a823249d0bea4f5916e12",
+      "current_sha256": "8d2ddaca4045d330f6eda2591561497b858aad53769a823249d0bea4f5916e12"
+    },
+    {
+      "path": "crates/oa-core/tests/prepared_commands.rs",
+      "snapshot_sha256": "52cab1c668064777412df0a6a3c20d74d579b33794b4b00525b9f151c06eac9b",
+      "current_sha256": "52cab1c668064777412df0a6a3c20d74d579b33794b4b00525b9f151c06eac9b"
+    },
+    {
+      "path": "crates/oa-core/tests/process_diagnostics.rs",
+      "snapshot_sha256": "1dbbc590239ef7542be4a2bdc9543aaa64d108417b03dd312a0894e364745906",
+      "current_sha256": "1dbbc590239ef7542be4a2bdc9543aaa64d108417b03dd312a0894e364745906"
+    },
+    {
+      "path": "crates/oa-core/tests/r3_constructor_ack.rs",
+      "snapshot_sha256": "e5c44676ea0aab97f2e091ddac2f4bc4a4a90f5877f7bbf08b61229600944dd0",
+      "current_sha256": "e5c44676ea0aab97f2e091ddac2f4bc4a4a90f5877f7bbf08b61229600944dd0"
+    },
+    {
+      "path": "crates/oa-core/tests/r3_migration.rs",
+      "snapshot_sha256": "ebd04120f5215b3956fdc79ee78f6e38734c7d13392f1fc28aaba957912265bd",
+      "current_sha256": "ebd04120f5215b3956fdc79ee78f6e38734c7d13392f1fc28aaba957912265bd"
+    },
+    {
+      "path": "crates/oa-core/tests/r3_semantic.rs",
+      "snapshot_sha256": "49c3763eaf2131070a7c46cc23a84f917d292d41610b6404510e5607f8890c32",
+      "current_sha256": "49c3763eaf2131070a7c46cc23a84f917d292d41610b6404510e5607f8890c32"
+    },
+    {
+      "path": "crates/oa-core/tests/r3_source.rs",
+      "snapshot_sha256": "f31f60659df3c7ef601650d1cff140589d8729f01a3f65a4a6a6c2272f15c408",
+      "current_sha256": "f31f60659df3c7ef601650d1cff140589d8729f01a3f65a4a6a6c2272f15c408"
+    },
+    {
+      "path": "crates/oa-core/tests/r6_data.rs",
+      "snapshot_sha256": "5f7ffb3bc73c3c85423623fe56f8680646dc97040327bdbead9d47a37e80f155",
+      "current_sha256": "5f7ffb3bc73c3c85423623fe56f8680646dc97040327bdbead9d47a37e80f155"
+    },
+    {
+      "path": "crates/oa-core/tests/r6_migration.rs",
+      "snapshot_sha256": "81519bc1512f5e069432e9a1cdad04c10216d492df01b4b75b02102480ebd6a1",
+      "current_sha256": "81519bc1512f5e069432e9a1cdad04c10216d492df01b4b75b02102480ebd6a1"
+    },
+    {
+      "path": "crates/oa-core/tests/r6_source.rs",
+      "snapshot_sha256": "88a0aa087a7678e2898ff6057538072ca92072190712f05fff08372cc56ebed6",
+      "current_sha256": "88a0aa087a7678e2898ff6057538072ca92072190712f05fff08372cc56ebed6"
+    },
+    {
+      "path": "crates/oa-core/tests/release1_teaching.rs",
+      "snapshot_sha256": "be179290d871125dc97cfd2a3067c7ac89c8a538fdb0afafc5b825bcdfb2bef2",
+      "current_sha256": "be179290d871125dc97cfd2a3067c7ac89c8a538fdb0afafc5b825bcdfb2bef2"
+    },
+    {
+      "path": "crates/oa-core/tests/release_capabilities.rs",
+      "snapshot_sha256": "b92cba2a562e78287ddd7dc3e94557848d17faa0c8a102601b50286b9af48a30",
+      "current_sha256": "b92cba2a562e78287ddd7dc3e94557848d17faa0c8a102601b50286b9af48a30"
+    },
+    {
+      "path": "crates/oa-core/tests/release_diagrams.rs",
+      "snapshot_sha256": "cefcc0582d91266d5de6ee5daefcfe41b606ab971ab235b59034a8e1dbc24b7d",
+      "current_sha256": "cefcc0582d91266d5de6ee5daefcfe41b606ab971ab235b59034a8e1dbc24b7d"
+    },
+    {
+      "path": "crates/oa-core/tests/release_language_limits.rs",
+      "snapshot_sha256": "8578da4f76bbd2d0e1bfe295ab1259e2162a3fe3d0d2ba8901915d7a40942806",
+      "current_sha256": "8578da4f76bbd2d0e1bfe295ab1259e2162a3fe3d0d2ba8901915d7a40942806"
+    },
+    {
+      "path": "crates/oa-core/tests/release_ports.rs",
+      "snapshot_sha256": "506e62beab0c7ec0cece83e9e0c1a810fa1f99285c9e1cab0c77f06de55a40e1",
+      "current_sha256": "506e62beab0c7ec0cece83e9e0c1a810fa1f99285c9e1cab0c77f06de55a40e1"
+    },
+    {
+      "path": "crates/oa-core/tests/release_routing.rs",
+      "snapshot_sha256": "ae168faaba23769b7ca1fd65f217b9db671726e67276eb5a04e5e72b1447a462",
+      "current_sha256": "ae168faaba23769b7ca1fd65f217b9db671726e67276eb5a04e5e72b1447a462"
+    },
+    {
+      "path": "crates/oa-core/tests/release_scenarios.rs",
+      "snapshot_sha256": "0f5d876badeec653fc7b12610a77d867e9a53582e605253deff8d379da21572f",
+      "current_sha256": "0f5d876badeec653fc7b12610a77d867e9a53582e605253deff8d379da21572f"
+    },
+    {
+      "path": "crates/oa-core/tests/release_states.rs",
+      "snapshot_sha256": "b1a26acee95eaba7f9920f9da738a1e33606552eb078e6d298895daff7e3d811",
+      "current_sha256": "b1a26acee95eaba7f9920f9da738a1e33606552eb078e6d298895daff7e3d811"
+    },
+    {
+      "path": "crates/oa-core/tests/release_topology.rs",
+      "snapshot_sha256": "c51dbe5aa5a038f9ed830daa02aa67714472179eb7fd6da5ce36dc6931c8b3a9",
+      "current_sha256": "c51dbe5aa5a038f9ed830daa02aa67714472179eb7fd6da5ce36dc6931c8b3a9"
+    },
+    {
+      "path": "crates/oa-core/tests/review_regressions.rs",
+      "snapshot_sha256": "f154e5c88d35e31512e2b07733a1327ea3e2fcfd1ef8eb23066a4e9573f387c1",
+      "current_sha256": "f154e5c88d35e31512e2b07733a1327ea3e2fcfd1ef8eb23066a4e9573f387c1"
+    },
+    {
+      "path": "crates/oa-core/tests/route_source.rs",
+      "snapshot_sha256": "1a73fdbac0d0ae0e84d8d67b6ad398e11223958f5dca007f73757c91827decfb",
+      "current_sha256": "1a73fdbac0d0ae0e84d8d67b6ad398e11223958f5dca007f73757c91827decfb"
+    },
+    {
+      "path": "crates/oa-core/tests/routing_geometry.rs",
+      "snapshot_sha256": "2d8eea4a2bba535ed0ea6daabccdaf87b375828c404baa10518c7bd7fd6253d3",
+      "current_sha256": "2d8eea4a2bba535ed0ea6daabccdaf87b375828c404baa10518c7bd7fd6253d3"
+    },
+    {
+      "path": "crates/oa-core/tests/routing_labels.rs",
+      "snapshot_sha256": "dff884d799c3c5c9257210248c55767e294e3cb317c605cbd0ddc9600c216eb6",
+      "current_sha256": "dff884d799c3c5c9257210248c55767e294e3cb317c605cbd0ddc9600c216eb6"
+    },
+    {
+      "path": "crates/oa-core/tests/semantic_artifact_absence_oracle.rs",
+      "snapshot_sha256": "d93eaf9667f4221232168bef0fe9f069e5be1b1f23410bda5dd67010b96e5c8a",
+      "current_sha256": "d93eaf9667f4221232168bef0fe9f069e5be1b1f23410bda5dd67010b96e5c8a"
+    },
+    {
+      "path": "crates/oa-core/tests/semantic_attachments_gui_oracle.rs",
+      "snapshot_sha256": "7f526d363ba05e7ac89faf0fead0796e419c34ee204edf44a1b46c78308b0970",
+      "current_sha256": "7f526d363ba05e7ac89faf0fead0796e419c34ee204edf44a1b46c78308b0970"
+    },
+    {
+      "path": "crates/oa-core/tests/source6_view_contract.rs",
+      "snapshot_sha256": "fa566de53946d40bbbd9033edfeed177180c4dc44afa2f2f4667ffdc622eb3bb",
+      "current_sha256": "fa566de53946d40bbbd9033edfeed177180c4dc44afa2f2f4667ffdc622eb3bb"
+    },
+    {
+      "path": "crates/oa-core/tests/source7_contract.rs",
+      "snapshot_sha256": "cad4f1a135ddbd947bdf3c71d1b44f1e438725095ea8c4d893464bc721c2363f",
+      "current_sha256": "cad4f1a135ddbd947bdf3c71d1b44f1e438725095ea8c4d893464bc721c2363f"
+    },
+    {
+      "path": "crates/oa-core/tests/source_files.rs",
+      "snapshot_sha256": "f0429a0b89a443458ea9af7083c1e4e7411417a7e6b47e618bfbb9266dc164f9",
+      "current_sha256": "f0429a0b89a443458ea9af7083c1e4e7411417a7e6b47e618bfbb9266dc164f9"
+    },
+    {
+      "path": "crates/oa-core/tests/source_identity_updates.rs",
+      "snapshot_sha256": "f52aa38b4d317e532c641ad7463472e4b40e802e60052cf0017556ffc63da06c",
+      "current_sha256": "f52aa38b4d317e532c641ad7463472e4b40e802e60052cf0017556ffc63da06c"
+    },
+    {
+      "path": "crates/oa-core/tests/source_nested_updates.rs",
+      "snapshot_sha256": "9ac3390936c0d250651ea94a1b8faf0adfb680f061ececc56f2a52909b5ba855",
+      "current_sha256": "9ac3390936c0d250651ea94a1b8faf0adfb680f061ececc56f2a52909b5ba855"
+    },
+    {
+      "path": "crates/oa-core/tests/source_project.rs",
+      "snapshot_sha256": "cef58adb16aa4d2527ddc0628aec3e26f0b42b4be70014a7e360fafdac13a942",
+      "current_sha256": "cef58adb16aa4d2527ddc0628aec3e26f0b42b4be70014a7e360fafdac13a942"
+    },
+    {
+      "path": "crates/oa-core/tests/state_diagrams.rs",
+      "snapshot_sha256": "6b02b387a3ae559cb3ad72de24292a5abcb76aaac0adbab5d2aa5211b22cd2e5",
+      "current_sha256": "6b02b387a3ae559cb3ad72de24292a5abcb76aaac0adbab5d2aa5211b22cd2e5"
+    },
+    {
+      "path": "crates/oa-core/tests/workflows.rs",
+      "snapshot_sha256": "bd843dfddbd5724ec08f657571f887496203056fe2fa5864ef50a168a613b89b",
+      "current_sha256": "bd843dfddbd5724ec08f657571f887496203056fe2fa5864ef50a168a613b89b"
+    },
+    {
+      "path": "crates/oa-server/Cargo.toml",
+      "snapshot_sha256": "527ff5e15010a8b560a6659aa1ae4bf0c8df0d9e019f03c47529ec6a750c0982",
+      "current_sha256": "527ff5e15010a8b560a6659aa1ae4bf0c8df0d9e019f03c47529ec6a750c0982"
+    },
+    {
+      "path": "crates/oa-server/build.rs",
+      "snapshot_sha256": "ab1be6ae1fd8bf3ebaeef6348347a9d5e666bde693126f199e041659e0b094a9",
+      "current_sha256": "ab1be6ae1fd8bf3ebaeef6348347a9d5e666bde693126f199e041659e0b094a9"
+    },
+    {
+      "path": "crates/oa-server/src/error.rs",
+      "snapshot_sha256": "93817f1502386e4662c96ee1c7d1c4afc4e33bda6fd64e46c86c8e1afd5a9368",
+      "current_sha256": "93817f1502386e4662c96ee1c7d1c4afc4e33bda6fd64e46c86c8e1afd5a9368"
+    },
+    {
+      "path": "crates/oa-server/src/lib.rs",
+      "snapshot_sha256": "20bef350350ed6339588b23af684abf745f97916c7edf3853ee042abe687e664",
+      "current_sha256": "20bef350350ed6339588b23af684abf745f97916c7edf3853ee042abe687e664"
+    },
+    {
+      "path": "crates/oa-server/src/main.rs",
+      "snapshot_sha256": "d59a6a2b5c7034bd2e00a516d2d49abb16391bf0316c1c357ddafb9c82d2d1e3",
+      "current_sha256": "d59a6a2b5c7034bd2e00a516d2d49abb16391bf0316c1c357ddafb9c82d2d1e3"
+    },
+    {
+      "path": "crates/oa-server/src/preparation_http_tests.rs",
+      "snapshot_sha256": "454b90d0055d35644c8d990cd7576ddf675a9b271ca07fe9b0efce25d8ddbc07",
+      "current_sha256": "454b90d0055d35644c8d990cd7576ddf675a9b271ca07fe9b0efce25d8ddbc07"
+    },
+    {
+      "path": "crates/oa-server/src/routes.rs",
+      "snapshot_sha256": "3f9a0c22043dbf28f7a8e587d2fc3abf869f76f4d23a46fe0aeb9c4392454a4b",
+      "current_sha256": "3f9a0c22043dbf28f7a8e587d2fc3abf869f76f4d23a46fe0aeb9c4392454a4b"
+    },
+    {
+      "path": "crates/oa-server/src/store.rs",
+      "snapshot_sha256": "37dcfb845b7993d5bced2bcf25fedfcd2a9c20a748f9315afe6cca1f41f89ae5",
+      "current_sha256": "37dcfb845b7993d5bced2bcf25fedfcd2a9c20a748f9315afe6cca1f41f89ae5"
+    },
+    {
+      "path": "crates/oa-server/src/store_preparation_gate.rs",
+      "snapshot_sha256": "427c390da3c0281ba1fe115a93ea90800e3b45fce6bcb9185e71982ddd885fec",
+      "current_sha256": "427c390da3c0281ba1fe115a93ea90800e3b45fce6bcb9185e71982ddd885fec"
+    },
+    {
+      "path": "crates/oa-server/tests/http.rs",
+      "snapshot_sha256": "50daa6a90e96ad6fe3c6a27df2eaebe486270599c203892d09769c547a194975",
+      "current_sha256": "50daa6a90e96ad6fe3c6a27df2eaebe486270599c203892d09769c547a194975"
+    },
+    {
+      "path": "crates/oa-server/tests/http/communication_limits.rs",
+      "snapshot_sha256": "ba5474dd8e494a0176fffb4548c8e3deb2081b15de33bfce82394c764e0a2c16",
+      "current_sha256": "ba5474dd8e494a0176fffb4548c8e3deb2081b15de33bfce82394c764e0a2c16"
+    },
+    {
+      "path": "crates/oa-server/tests/http/data_contracts.rs",
+      "snapshot_sha256": "8cd456db83f301baca380acf025a5a99db4edf7d8839537dfbd02c4307e10e6b",
+      "current_sha256": "8cd456db83f301baca380acf025a5a99db4edf7d8839537dfbd02c4307e10e6b"
+    },
+    {
+      "path": "crates/oa-server/tests/http/port_anchors.rs",
+      "snapshot_sha256": "7199d0a208ddad9e1518b6e3fb390d64da111716d7505ba5c995deae19ad1258",
+      "current_sha256": "7199d0a208ddad9e1518b6e3fb390d64da111716d7505ba5c995deae19ad1258"
+    },
+    {
+      "path": "crates/oa-server/tests/http/semantic_transitions.rs",
+      "snapshot_sha256": "856d1c9b633ffb581e3e631f4e5a607789a02181dbf060667f208a569bfa4920",
+      "current_sha256": "856d1c9b633ffb581e3e631f4e5a607789a02181dbf060667f208a569bfa4920"
+    },
+    {
+      "path": "crates/oa-server/tests/http/source6_views.rs",
+      "snapshot_sha256": "867bccda0e030eeeb9976b4ceeb47b21ab5044d700278022d5fb495bbb64ca07",
+      "current_sha256": "867bccda0e030eeeb9976b4ceeb47b21ab5044d700278022d5fb495bbb64ca07"
+    },
+    {
+      "path": "crates/oa-server/tests/http/source7_contracts.rs",
+      "snapshot_sha256": "0e0a467186da7263c0754890aff69ebd0d92d36b5224e4865bb6854b18dab7e8",
+      "current_sha256": "0e0a467186da7263c0754890aff69ebd0d92d36b5224e4865bb6854b18dab7e8"
+    },
+    {
+      "path": "crates/oa-server/tests/http/source_projects.rs",
+      "snapshot_sha256": "8ff580f317ec267d1cd72ae14d8638f74a77cdf99ca4c78f66f4290c2d77460a",
+      "current_sha256": "8ff580f317ec267d1cd72ae14d8638f74a77cdf99ca4c78f66f4290c2d77460a"
+    },
+    {
+      "path": "crates/oa-server/tests/semantic_http_contract.py",
+      "snapshot_sha256": "4737ff94f10761f94151a694414c5c62737e0391ec820bca132830652bc4cca2",
+      "current_sha256": "4737ff94f10761f94151a694414c5c62737e0391ec820bca132830652bc4cca2"
+    },
+    {
+      "path": "crates/oa-server/tests/semantic_schema.py",
+      "snapshot_sha256": "70c9d267268bd390680f290a585bd4ae0c6d8ef999ee2f32ece6e172293574f7",
+      "current_sha256": "70c9d267268bd390680f290a585bd4ae0c6d8ef999ee2f32ece6e172293574f7"
+    },
+    {
+      "path": "crates/oa-server/tests/state_representation.rs",
+      "snapshot_sha256": "6686c826f28248ae4b63ec3f2112e193d4a347724b87974483217fcfee49cd61",
+      "current_sha256": "6686c826f28248ae4b63ec3f2112e193d4a347724b87974483217fcfee49cd61"
+    }
+  ],
+  "help": "Arcadia model REST service\n\nUsage: arcadia-server [--bind IP:PORT] [--data-dir PATH] [--token-file PATH]\n\nDefaults: 127.0.0.1:8787; platform-local ArcadiaStudio/server directory.\nToken required for non-loopback binds. ARCADIA_SERVER_TOKEN is an alternative.\nKeep the data directory on local storage. See docs/server.md for deployment and API limits.\n",
+  "version": "arcadia-server 0.2.0"
+}

harness/experiments/textual-authoring-20260911-local/review-results.json

@@ -0,0 +1,27 @@
+{
+  "matching_core_server_inventory_and_hash_count": 120,
+  "warnings_in_successful_puts": [
+    [
+      "work_without_behavior_context",
+      "work_without_behavior_context",
+      "exchange_without_behavior_context"
+    ],
+    [
+      "work_without_behavior_context",
+      "work_without_behavior_context",
+      "exchange_without_behavior_context"
+    ],
+    [
+      "empty_sequence"
+    ],
+    [
+      "empty_sequence"
+    ]
+  ],
+  "hashes": {
+    "run_experiment.py": "34b1d1fab80e156f02e2c8232b3218bf4385f9eb869275c31512f140a2c53fa7",
+    "summary.json": "49d6d1fcdae1460fac05df441b87df996135a7d3b2c61f4ae99bb48f4f153e5a",
+    "http-results.json": "5c83be6a6571b459e8a80c767acfc2cf12129ea6254dbe761ba5c58449169441",
+    "provenance.json": "d04b3b77cc1901a858b40a735a8dbd1946c491dd5e44b054fcb431b885c12de3"
+  }
+}

harness/experiments/textual-authoring-20260911-local/run_experiment.py

@@ -0,0 +1,207 @@
+"""Bounded real-HTTP checks of existing source7 authoring; no compiler or GUI."""
+import copy
+import hashlib
+import json
+import os
+from pathlib import Path
+import queue
+import re
+import subprocess
+import tarfile
+import threading
+import time
+import urllib.error
+import urllib.request
+
+ROOT = Path(__file__).resolve().parents[3]
+OUT = Path(__file__).resolve().parent
+EXE = ROOT / '.local/target-gnullvm/debug/arcadia-server.exe'
+IDENTITY = re.compile(r' id "[0-9a-f-]{36}"')
+OA = '''arcadia 7;
+project distress "Distress response" {
+    oa_actor vessel "Vessel in distress" {}
+    oa_entity rescue "Rescue coordination" {}
+    oa_activity report "Report distress" {}
+    oa_activity assess "Assess incident" {}
+    allocation vessel_reports "Crew reports" { source @vessel; target @report; }
+    allocation rescue_assesses "Team assesses" { source @rescue; target @assess; }
+    interaction distress_report "Distress report" { source @report; target @assess; }
+}
+'''
+SCENARIO = '''arcadia 7;
+project response "Distress response" {
+    oa_scenario assessment "Assess the distress report" {
+        viewpoint OperationalActivity;
+    }
+}
+'''
+
+def save(name, value):
+    path = OUT / name
+    path.write_text(value if isinstance(value, str) else json.dumps(value, ensure_ascii=False, indent=2) + '\n', encoding='utf-8')
+
+def digest(data):
+    return hashlib.sha256(data).hexdigest()
+
+def provenance():
+    archive = ROOT / '.local/linux-qa/runtime/source7-20260907T082753190288Z.tar.gz'
+    comparisons = []
+    with tarfile.open(archive) as source:
+        for member in source.getmembers():
+            path = member.name.removeprefix('./')
+            if member.isfile() and (path.startswith('crates/oa-core/') or path.startswith('crates/oa-server/')):
+                current = ROOT / path
+                old = source.extractfile(member).read()
+                comparisons.append({'path': path, 'snapshot_sha256': digest(old), 'current_sha256': digest(current.read_bytes()) if current.is_file() else None})
+    assert comparisons, 'Snapshot paths were not recognized; do not infer equality'
+    return {'executable': str(EXE), 'exe_sha256': digest(EXE.read_bytes()), 'exe_bytes': EXE.stat().st_size,
+            'snapshot': str(archive), 'snapshot_sha256': digest(archive.read_bytes()), 'source_comparisons': comparisons,
+            'help': subprocess.check_output([str(EXE), '--help'], text=True),
+            'version': subprocess.check_output([str(EXE), '--version'], text=True).strip()}
+
+def start_server(store):
+    env = os.environ.copy()
+    env.pop('ARCADIA_SERVER_TOKEN', None)
+    proc = subprocess.Popen([str(EXE), '--bind', '127.0.0.1:0', '--data-dir', str(store)],
+                            stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True,
+                            env=env, creationflags=subprocess.CREATE_NO_WINDOW)
+    lines = queue.Queue()
+    threading.Thread(target=lambda: [lines.put(line) for line in proc.stderr], daemon=True).start()
+    line = lines.get(timeout=15)
+    match = re.search(r'listening on (127\.0\.0\.1:\d+)', line)
+    if not match:
+        proc.terminate()
+        proc.wait(timeout=10)
+        raise AssertionError(line)
+    return proc, 'http://' + match[1], line.strip()
+
+requests = []
+base = ''
+def request(method, path, payload=None, etag=None, expected=200):
+    headers = {'Content-Type': 'application/json'}
+    if etag:
+        headers['If-Match'] = etag
+    raw = None if payload is None else json.dumps(payload, ensure_ascii=False).encode('utf-8')
+    started = time.perf_counter()
+    try:
+        response = urllib.request.urlopen(urllib.request.Request(base + path, data=raw, headers=headers, method=method), timeout=15)
+    except urllib.error.HTTPError as error:
+        response = error
+    with response:
+        data = response.read().decode('utf-8')
+        body = json.loads(data) if data else None
+        result = {'method': method, 'path': path, 'status': response.status,
+                  'etag': response.headers.get('ETag'), 'location': response.headers.get('Location'),
+                  'seconds': time.perf_counter() - started, 'body': body}
+    requests.append(result)
+    save('http-results.json', requests)
+    assert result['status'] == expected, result
+    return result
+
+def assert_semantics(model, kind):
+    assert model['schema_version'] == 7
+    for key in ['diagrams', 'artifact_links', 'traces']:
+        assert model[key] == {}, (key, model[key])
+    elements = {v['alias']: v for v in model['elements'].values()}
+    relations = {v['alias']: v for v in model['relations'].values()}
+    assert all(v['parent'] is None and v['description'] == '' for v in elements.values())
+    if kind == 'oa':
+        expected = {'vessel': ('Actor', 'Vessel in distress'), 'rescue': ('Entity', 'Rescue coordination'),
+                    'report': ('Activity', 'Report distress'), 'assess': ('Activity', 'Assess incident')}
+        assert set(elements) == set(expected)
+        for alias, (body, name) in expected.items():
+            assert elements[alias]['body'] == {'Oa': body}
+            assert elements[alias]['name'] == name
+        links = {'vessel_reports': ('Allocation', 'vessel', 'report'),
+                 'rescue_assesses': ('Allocation', 'rescue', 'assess'),
+                 'distress_report': ('Interaction', 'report', 'assess')}
+        assert set(relations) == set(links)
+        for alias, (body, source, target) in links.items():
+            fields = {'source': elements[source]['id'], 'target': elements[target]['id']}
+            if body == 'Interaction':
+                fields['items'] = []
+            assert relations[alias]['body'] == {body: fields}
+    else:
+        assert set(elements) == {'assessment'} and not relations
+        assert elements['assessment']['body'] == {'Oa': {'Shared': {'Scenario': {
+            'viewpoint': 'OperationalActivity', 'context': None, 'precondition': '', 'postcondition': '', 'steps': []}}}}
+    return elements
+
+def exercise(kind, source, name, replacement, alias):
+    save(kind + '-input.arcadia', source)
+    bundle = {'entry': 'project.arcadia', 'files': {'project.arcadia': source}}
+    created = request('POST', '/api/v1/projects/import-source-project', bundle, expected=201)
+    path = created['location']
+    assert path and path.startswith('/api/v1/projects/')
+    accepted = request('GET', path + '/source-project')
+    stable = accepted['body']
+    text = stable['files']['project.arcadia']
+    assert stable['entry'] == 'project.arcadia' and set(stable['files']) == {'project.arcadia'}
+    assert IDENTITY.sub('', text) == source, 'Normalization changed more than UUID insertion'
+    ids = IDENTITY.findall(text)
+    assert len(ids) == (8 if kind == 'oa' else 2) and len(set(ids)) == len(ids)
+    save(kind + '-stabilized.arcadia', text)
+    initial_model = request('GET', path + '/model')['body']
+    elements = assert_semantics(initial_model, kind)
+    save(kind + '-initial-model.json', initial_model)
+    unchanged = request('PUT', path + '/source-project', stable, accepted['etag'])
+    assert unchanged['body']['changed'] is False and unchanged['etag'] == accepted['etag']
+    assert unchanged['body']['source_project'] == stable
+    changed = copy.deepcopy(stable)
+    assert text.count('"' + name + '"') == 1
+    changed['files']['project.arcadia'] = text.replace('"' + name + '"', '"' + replacement + '"')
+    updated = request('PUT', path + '/source-project', changed, accepted['etag'])
+    assert updated['body']['changed'] is True and updated['etag'] != accepted['etag']
+    assert updated['body']['source_project'] == changed
+    after = request('GET', path + '/model')['body']
+    expected_model = copy.deepcopy(initial_model)
+    expected_model['elements'][elements[alias]['id']]['name'] = replacement
+    assert after == expected_model, 'Name-only edit changed other semantic facts'
+    assert IDENTITY.findall(changed['files']['project.arcadia']) == ids
+    save(kind + '-renamed.arcadia', changed['files']['project.arcadia'])
+    save(kind + '-renamed-model.json', after)
+    stale = request('PUT', path + '/source-project', stable, accepted['etag'], expected=412)
+    assert request('GET', path + '/source-project')['body'] == changed
+    invalid = copy.deepcopy(changed)
+    invalid['files']['project.arcadia'] += '\nunknown_declaration broken "Broken" {}\n'
+    rejected = request('PUT', path + '/source-project', invalid, updated['etag'], expected=422)
+    assert request('GET', path + '/source-project')['body'] == changed
+    assert request('GET', path + '/model')['body'] == after
+    return {'path': path, 'source': changed, 'model': after, 'ids': len(ids),
+            'initial_issues': created['body'], 'stale_status': stale['status'], 'invalid_status': rejected['status']}
+
+def main():
+    global base
+    began = time.perf_counter()
+    store = OUT / ('store-' + time.strftime('%Y%m%dT%H%M%SZ', time.gmtime()))
+    assert not store.exists(), 'Never reuse an earlier experiment store'
+    save('provenance.json', provenance())
+    proc = None
+    try:
+        proc, base, startup = start_server(store)
+        save('server-start.txt', startup + '\n')
+        results = [exercise('oa', OA, 'Assess incident', 'Assess incident carefully', 'assess'),
+                   exercise('scenario', SCENARIO, 'Assess the distress report', 'Assess the reported distress', 'assessment')]
+        proc.terminate()
+        proc.wait(timeout=10)
+        proc, base, startup = start_server(store)
+        save('server-restart.txt', startup + '\n')
+        for item in results:
+            assert request('GET', item['path'] + '/source-project')['body'] == item['source']
+            assert request('GET', item['path'] + '/model')['body'] == item['model']
+        save('summary.json', {'status': 'PASS', 'elapsed_seconds': time.perf_counter() - began,
+                              'request_count': len(requests), 'cases': results, 'store': str(store),
+                              'limitations': ['Existing preserved binary; no current rebuild',
+                                              'No GUI/Undo/performance acceptance',
+                                              'Process termination after synchronous requests; restart verifies persisted data']})
+        print(json.dumps({'status': 'PASS', 'requests': len(requests), 'seconds': time.perf_counter() - began}))
+    except Exception as error:
+        save('failure.json', {'type': type(error).__name__, 'message': str(error)})
+        raise
+    finally:
+        if proc is not None and proc.poll() is None:
+            proc.terminate()
+            proc.wait(timeout=10)
+
+if __name__ == '__main__':
+    main()

harness/experiments/textual-authoring-20260911-local/scenario-initial-model.json

@@ -0,0 +1,33 @@
+{
+  "schema_version": 7,
+  "id": "aba296aa-46c9-4e90-b520-15c692da7b96",
+  "alias": "response",
+  "name": "Distress response",
+  "description": "",
+  "elements": {
+    "96a98e8f-6434-42be-8de2-5c715bbcf2ca": {
+      "id": "96a98e8f-6434-42be-8de2-5c715bbcf2ca",
+      "alias": "assessment",
+      "name": "Assess the distress report",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Scenario": {
+              "viewpoint": "OperationalActivity",
+              "context": null,
+              "precondition": "",
+              "postcondition": "",
+              "steps": []
+            }
+          }
+        }
+      }
+    }
+  },
+  "relations": {},
+  "diagrams": {},
+  "artifact_links": {},
+  "traces": {}
+}

harness/experiments/textual-authoring-20260911-local/scenario-input.arcadia

@@ -0,0 +1,6 @@
+arcadia 7;
+project response "Distress response" {
+    oa_scenario assessment "Assess the distress report" {
+        viewpoint OperationalActivity;
+    }
+}

harness/experiments/textual-authoring-20260911-local/scenario-renamed-model.json

@@ -0,0 +1,33 @@
+{
+  "schema_version": 7,
+  "id": "aba296aa-46c9-4e90-b520-15c692da7b96",
+  "alias": "response",
+  "name": "Distress response",
+  "description": "",
+  "elements": {
+    "96a98e8f-6434-42be-8de2-5c715bbcf2ca": {
+      "id": "96a98e8f-6434-42be-8de2-5c715bbcf2ca",
+      "alias": "assessment",
+      "name": "Assess the reported distress",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Scenario": {
+              "viewpoint": "OperationalActivity",
+              "context": null,
+              "precondition": "",
+              "postcondition": "",
+              "steps": []
+            }
+          }
+        }
+      }
+    }
+  },
+  "relations": {},
+  "diagrams": {},
+  "artifact_links": {},
+  "traces": {}
+}

harness/experiments/textual-authoring-20260911-local/scenario-renamed.arcadia

@@ -0,0 +1,6 @@
+arcadia 7;
+project response "Distress response" id "aba296aa-46c9-4e90-b520-15c692da7b96" {
+    oa_scenario assessment "Assess the reported distress" id "96a98e8f-6434-42be-8de2-5c715bbcf2ca" {
+        viewpoint OperationalActivity;
+    }
+}

harness/experiments/textual-authoring-20260911-local/scenario-stabilized.arcadia

@@ -0,0 +1,6 @@
+arcadia 7;
+project response "Distress response" id "aba296aa-46c9-4e90-b520-15c692da7b96" {
+    oa_scenario assessment "Assess the distress report" id "96a98e8f-6434-42be-8de2-5c715bbcf2ca" {
+        viewpoint OperationalActivity;
+    }
+}

harness/experiments/textual-authoring-20260911-local/server-restart.txt

@@ -0,0 +1 @@
+arcadia-server 0.2.0 listening on 127.0.0.1:56922; data C:\Users\User\Documents\Git\ARCADIA-Studio\harness\experiments\textual-authoring-20260911-local\store-20260911T084050Z

harness/experiments/textual-authoring-20260911-local/server-start.txt

@@ -0,0 +1 @@
+arcadia-server 0.2.0 listening on 127.0.0.1:56899; data C:\Users\User\Documents\Git\ARCADIA-Studio\harness\experiments\textual-authoring-20260911-local\store-20260911T084050Z

harness/experiments/textual-authoring-20260911-local/summary.json

@@ -0,0 +1,181 @@
+{
+  "status": "PASS",
+  "elapsed_seconds": 0.901579600000332,
+  "request_count": 26,
+  "cases": [
+    {
+      "path": "/api/v1/projects/988a0812-0719-4084-89aa-3a8473d5e268",
+      "source": {
+        "entry": "project.arcadia",
+        "files": {
+          "project.arcadia": "arcadia 7;\nproject distress \"Distress response\" id \"59d44355-d4a1-4e59-905c-ae415209e93a\" {\n    oa_actor vessel \"Vessel in distress\" id \"dde90260-064b-4360-90df-2082bc4b25a2\" {}\n    oa_entity rescue \"Rescue coordination\" id \"2d1f63d3-a6b5-4912-9109-50a1bfb736da\" {}\n    oa_activity report \"Report distress\" id \"82839234-23ed-4d8c-abdc-84f0e4db89e3\" {}\n    oa_activity assess \"Assess incident carefully\" id \"ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2\" {}\n    allocation vessel_reports \"Crew reports\" id \"988baf52-2159-4769-a4a2-6bb76134fbb5\" { source @vessel; target @report; }\n    allocation rescue_assesses \"Team assesses\" id \"450a369f-785c-422d-ad17-48a95a174410\" { source @rescue; target @assess; }\n    interaction distress_report \"Distress report\" id \"60f3d1b7-cced-49f6-9a1c-189ecbec1f3b\" { source @report; target @assess; }\n}\n"
+        }
+      },
+      "model": {
+        "schema_version": 7,
+        "id": "59d44355-d4a1-4e59-905c-ae415209e93a",
+        "alias": "distress",
+        "name": "Distress response",
+        "description": "",
+        "elements": {
+          "2d1f63d3-a6b5-4912-9109-50a1bfb736da": {
+            "id": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+            "alias": "rescue",
+            "name": "Rescue coordination",
+            "description": "",
+            "parent": null,
+            "body": {
+              "Oa": "Entity"
+            }
+          },
+          "82839234-23ed-4d8c-abdc-84f0e4db89e3": {
+            "id": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+            "alias": "report",
+            "name": "Report distress",
+            "description": "",
+            "parent": null,
+            "body": {
+              "Oa": "Activity"
+            }
+          },
+          "dde90260-064b-4360-90df-2082bc4b25a2": {
+            "id": "dde90260-064b-4360-90df-2082bc4b25a2",
+            "alias": "vessel",
+            "name": "Vessel in distress",
+            "description": "",
+            "parent": null,
+            "body": {
+              "Oa": "Actor"
+            }
+          },
+          "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2": {
+            "id": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+            "alias": "assess",
+            "name": "Assess incident carefully",
+            "description": "",
+            "parent": null,
+            "body": {
+              "Oa": "Activity"
+            }
+          }
+        },
+        "relations": {
+          "450a369f-785c-422d-ad17-48a95a174410": {
+            "id": "450a369f-785c-422d-ad17-48a95a174410",
+            "alias": "rescue_assesses",
+            "name": "Team assesses",
+            "description": "",
+            "body": {
+              "Allocation": {
+                "source": "2d1f63d3-a6b5-4912-9109-50a1bfb736da",
+                "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2"
+              }
+            }
+          },
+          "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b": {
+            "id": "60f3d1b7-cced-49f6-9a1c-189ecbec1f3b",
+            "alias": "distress_report",
+            "name": "Distress report",
+            "description": "",
+            "body": {
+              "Interaction": {
+                "source": "82839234-23ed-4d8c-abdc-84f0e4db89e3",
+                "target": "ef1f684c-7cfa-40dc-9db3-d1c4dcd11ec2",
+                "items": []
+              }
+            }
+          },
+          "988baf52-2159-4769-a4a2-6bb76134fbb5": {
+            "id": "988baf52-2159-4769-a4a2-6bb76134fbb5",
+            "alias": "vessel_reports",
+            "name": "Crew reports",
+            "description": "",
+            "body": {
+              "Allocation": {
+                "source": "dde90260-064b-4360-90df-2082bc4b25a2",
+                "target": "82839234-23ed-4d8c-abdc-84f0e4db89e3"
+              }
+            }
+          }
+        },
+        "diagrams": {},
+        "artifact_links": {},
+        "traces": {}
+      },
+      "ids": 8,
+      "initial_issues": {
+        "elements": 4,
+        "migration": null,
+        "model_id": "59d44355-d4a1-4e59-905c-ae415209e93a",
+        "name": "Distress response",
+        "relations": 3,
+        "resource_id": "988a0812-0719-4084-89aa-3a8473d5e268",
+        "revision": 1,
+        "schema_version": 7
+      },
+      "stale_status": 412,
+      "invalid_status": 422
+    },
+    {
+      "path": "/api/v1/projects/7e68232b-6c51-4744-ab55-9069e91f1c3f",
+      "source": {
+        "entry": "project.arcadia",
+        "files": {
+          "project.arcadia": "arcadia 7;\nproject response \"Distress response\" id \"aba296aa-46c9-4e90-b520-15c692da7b96\" {\n    oa_scenario assessment \"Assess the reported distress\" id \"96a98e8f-6434-42be-8de2-5c715bbcf2ca\" {\n        viewpoint OperationalActivity;\n    }\n}\n"
+        }
+      },
+      "model": {
+        "schema_version": 7,
+        "id": "aba296aa-46c9-4e90-b520-15c692da7b96",
+        "alias": "response",
+        "name": "Distress response",
+        "description": "",
+        "elements": {
+          "96a98e8f-6434-42be-8de2-5c715bbcf2ca": {
+            "id": "96a98e8f-6434-42be-8de2-5c715bbcf2ca",
+            "alias": "assessment",
+            "name": "Assess the reported distress",
+            "description": "",
+            "parent": null,
+            "body": {
+              "Oa": {
+                "Shared": {
+                  "Scenario": {
+                    "viewpoint": "OperationalActivity",
+                    "context": null,
+                    "precondition": "",
+                    "postcondition": "",
+                    "steps": []
+                  }
+                }
+              }
+            }
+          }
+        },
+        "relations": {},
+        "diagrams": {},
+        "artifact_links": {},
+        "traces": {}
+      },
+      "ids": 2,
+      "initial_issues": {
+        "elements": 1,
+        "migration": null,
+        "model_id": "aba296aa-46c9-4e90-b520-15c692da7b96",
+        "name": "Distress response",
+        "relations": 0,
+        "resource_id": "7e68232b-6c51-4744-ab55-9069e91f1c3f",
+        "revision": 1,
+        "schema_version": 7
+      },
+      "stale_status": 412,
+      "invalid_status": 422
+    }
+  ],
+  "store": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\harness\\experiments\\textual-authoring-20260911-local\\store-20260911T084050Z",
+  "limitations": [
+    "Existing preserved binary; no current rebuild",
+    "No GUI/Undo/performance acceptance",
+    "Process termination after synchronous requests; restart verifies persisted data"
+  ]
+}

harness/fixtures/basic-editing/README.md

@@ -43,7 +43,7 @@ Run these on fresh copies or restore the preserved main-sequence state afterward
 
 ## What equality proves
 
-The checker reads new UUIDv4 identities only through exact literal kind/layer/name, relationship endpoint, placement diagram+element and OA/SA trace roles. Each role must be unique, fresh relative to the fixture and distinct from every other role. It constructs every other field through typed core commands, independently fixed names/coordinates/default sizes and an explicit core transition request. The complete Project **and** complete two-file SourceBundle must match, including unused seed records, all placements, aliases, trace baseline, source ordering and included comment bytes. Final equality also rejects any unclaimed extra object or UUID.
+The checker reads new UUIDv4 identities only through exact literal kind/layer/name, relationship endpoint, placement diagram+element and OA/SA trace roles. Each role must be unique, fresh relative to the fixture and distinct from every other role. It constructs every other field through typed core commands, independently fixed names/coordinates/default sizes and an explicit core transition request. The complete Project **and** complete SourceBundle must match, including unused seed records, all placements, aliases, trace baseline, source ordering, included comment bytes and any new modules introduced by creation. The baseline has two source files; named participant creation adds a third. Final equality also rejects any unclaimed extra object, UUID or source file.
 
 No geometry is normalized. Explicit final placement properties make the full persisted comparison reproducible without pretending that coordinates copied from the actual model prove a correct click transform. Separate visual evidence must establish the original clicked spot and stable camera. Save/Undo/Redo checks must preserve distinct copies; checking only the final state does not prove history.
 

harness/fixtures/behavior-creation/README.md

@@ -0,0 +1,73 @@
+# Native behavior creation contract
+
+Independent checker: `harness/behavior-creation-contract.rs`. The contract was
+prepared before reading any created output on 2026-09-11. Its direct-rustc build,
+self-check and unchanged-baseline comparison pass; native creation acceptance
+is not implied.
+
+Use a whole-directory copy of the preserved input:
+`.local/native-qa/palette-20260910-v3/checkpoint-transition-reopen/project.arcadia`.
+It contains 10 elements, two relations, four diagrams, one trace and six source
+files. Do not edit or overwrite that baseline or an earlier checkpoint.
+
+Perform these cumulative operations through Behavior → New, saving a separate
+whole-directory checkpoint after each Create and open:
+
+| Stage | Intended fields and exact result |
+| --- | --- |
+| `process` | OA **Operational process**, name **Coordinate rescue**. Root ownership, empty steps and description; no diagram or implicit work. |
+| `scenario` | OA **Scenario**, name **Rescue coordination conversation**. Explicit **Participants · interactions** (`ParticipantInteraction`) viewpoint; optional context **Rescue capability**, UUID `b451c000-0000-4000-8000-00000000001f`. Root ownership is separate from context. Empty precondition, postcondition, steps and description; no lifelines/messages or diagram. |
+| `machine` | SA **State machine**, name **Rescue team operating modes**. Existing **Rescue team** SystemActor owner, UUID `c0629449-1209-4b50-afac-f558a9a0fc7f`. Opt into **Create the first state view**. No regions or states. |
+
+Before observing output, the first-view contract is fixed as **Rescue team
+operating modes · states**, SA `StateMachine { machine: NEW_MACHINE }` projection,
+empty description/routes, default view options, exactly one placement of the
+new machine. Its initial position is 60,60 and size 336×104; the independent
+shared-core Layout prediction retains those values. The machine's semantic
+parent remains the SystemActor, not its diagram. Every previous object and
+source byte is retained except the explicitly predicted additions/includes.
+
+Build only within a coordinated direct-rustc writer window. This imports
+`oa_core` and no desktop creation producer:
+
+```powershell
+. .local/toolchain/env.ps1
+rustc --edition 2024 -D warnings --crate-name behavior_creation_contract harness/behavior-creation-contract.rs --extern oa_core=.local/target-gnullvm/debug/deps/liboa_core-3e81c616fea1d901.rlib -L dependency=.local/target-gnullvm/debug/deps -C linker=clang.exe -o .local/behavior-creation-oracle-20260911/behavior-creation-contract.exe
+$oracle = '.local/behavior-creation-oracle-20260911/behavior-creation-contract.exe'
+$base = '.local/native-qa/palette-20260910-v3/checkpoint-transition-reopen/project.arcadia'
+& $oracle self-check $base
+& $oracle check baseline $base $base $base
+& $oracle check process $base PATH_TO_PROCESS_ENTRY PATH_TO_PROCESS_ENTRY
+& $oracle check scenario $base PATH_TO_SCENARIO_ENTRY PATH_TO_SCENARIO_ENTRY
+& $oracle check machine $base PATH_TO_MACHINE_ENTRY PATH_TO_MACHINE_ENTRY
+```
+
+After each creation, Undo once and Save into a fresh checkpoint; `same` must
+compare that checkpoint with the preceding accepted stage (the initial baseline
+for Process). Redo once and Save into another fresh checkpoint. For Redo and
+reopen, pass the **first committed checkpoint** as the final role argument:
+
+```powershell
+& $oracle same PREVIOUS_ACCEPTED_ENTRY UNDO_ENTRY
+& $oracle check machine $base REDO_ENTRY FIRST_MACHINE_ENTRY
+& $oracle same FIRST_MACHINE_ENTRY REOPEN_ENTRY
+```
+
+Use the corresponding stage for Process/Scenario history. This pins original
+UUIDs across history; using a redo file as its own role carrier would not prove
+identity retention. A cancellation has no predicted addition: compare its
+checkpoint with the accepted pre-cancellation checkpoint using `same`.
+
+The checker borrows only unique fresh UUIDv4 values with exact literal
+kind/layer/name, view projection/name, or diagram/element placement roles.
+Descriptions, aliases, parents, viewpoint/context, body defaults and geometry
+are independently constructed. It compares complete Project and SourceBundle,
+rejects detached extra `.arcadia` files, and uses pinned six-file byte lengths
+and FNV-1a fingerprints to refuse a substituted baseline. SHA-256 provenance
+is recorded in `harness/release-behavior-creation-oracle-20260911.md`.
+
+Self-checks use deliberately false metadata/geometry in the role carrier, then
+reject changed scenario semantics, unrelated edits, extra objects/files and
+source-only comment drift. Native focus, readable labels, minimum/wide layout,
+selection of the new owner/view, and one-step Undo/Redo are separate observations;
+saved equality alone cannot establish them.

harness/history/2026-09-10-ledgers-before-second-consolidation/PLAN.md

@@ -0,0 +1,119 @@
+# First release execution plan
+
+**Current next steps, 2026-09-10:** integrate verified bundle `01bb52a` with our
+published palette; accept the separate typed-history constructor correction;
+then compile and test process/scenario/history together. Implement the measured
+remaining-height scenario workspace after preserving the new navigation and
+clicked-slot contracts. Close packaging review, current shared core/server and
+specification gates, then optimized package/runtime and full engineering-story
+acceptance. The user has reauthorized native control; Linux runtime still needs
+a viable environment. The original release objective remains unchanged.
+
+**Active execution, 2026-09-10:** finish the already-started architecture palette
+and inline naming with focused correctness checks, then perform actual native
+basic-editing acceptance. In parallel, independently audit current behavior/
+scenario workflows and remaining release requirements. Use concrete findings to
+choose the next implementation; preserve the original first-release scope.
+Root alone operates native UI and integrates shared files. Serialize Cargo jobs.
+The renewed request authorizes Computer Use; older stop statements below are
+historical. Current platform gates and final release acceptance remain required.
+
+
+**Latest refinement:** consult actual installed Capella 7.1, replace the user-rejected horizontal creation/connection rows with a compact contextual palette and inline authoring, independently critique interaction risks, then build and verify the real workflow at wide/minimum sizes. [Benchmark and concrete acceptance](release-capella-basic-editing-20260907.md). Do not ship the rejected toolbar as the usability correction.
+
+**Current priority (7 September):** the user's usability correction takes precedence over the advanced feature sequence below. Establish contextual named diagram creation, existing-element placement, basic editing and clear layer transitions, then verify them natively. Desktop checks were explicitly reauthorized. See [priority reset and acceptance](release-basic-editing-reset-20260907.md).
+
+## Outcome and baseline
+
+Deliver the first release of Arcadia Studio for system engineers: complete Operational Analysis and System Analysis/System Architecture workflows, equivalent graphical and textual models, clear artifact traceability and a deployable/programmatically accessible Rust service. Logical/Physical Architecture and later Arcadia layers are future releases, as the new objective explicitly states.
+
+The authoritative objective is attachment `10b0f701-1743-4de7-9ee1-225920e19649/goal-objective.md`. It retains first-release scope and strengthens domain coherence, alternative evaluation and target-user task evidence. TASK_LEDGER.md separates given/verified facts, assumptions and open candidates; STATE.md records progress. The accepted 0.2.0 prototype is a historical baseline, not proof of release completeness. Its old D:/CodexBuilds archives are unavailable on this machine; existing dist archives must not be replaced until new acceptance passes.
+
+The user's cross-branch reminder led to an ancestry/patch/tree audit. Continue from integrated `c091f80` on `codex/release1-continuation`; direct state/scenario/process, data, hosted and semantic review work already exists here. `release-branch-integration-20260906.md` records the audit. `release-current-coverage-20260906.md` is the current measurable acceptance map and supersedes stale absence claims in older narratives below.
+
+## Existing architecture and retained decisions
+
+Retain three Rust crates and one typed Project/validated atomic Command boundary. oa-core owns semantics, references, history, transitions, source and persistence; oa-desktop owns Iced interaction/drafts/projections; oa-server owns REST/ETag/current-model storage. Keep identity, semantic containment, allocation and per-diagram placement separate. No runtime plugin framework or later-layer skeleton.
+
+The current forms are a closed typed-record adapter, not a second metamodel. Expand their real creation/reference/variant controls with every semantic addition. Core choices must drive graphical choices. New persistent fields participate in text round trips, identity/removal visitors, transitions, API schemas and graphical authoring tests.
+
+## Milestones and measurable acceptance
+
+Nested source ownership and persistent REST bundles are implemented and verified: Windows minimum-size source-to-graphics, nested reparent/source/Undo/Redo/Save/reopen, recovery, rebuilt Linux source/history/Save/reopen, independent review and both platform suites passed. Preserve the existing grammar/updater and separate allocation/order semantics.
+
+Explorer/port discovery, custom routing, direct palette connections, four-side port
+anchors, contextual menus and source folders have scoped Windows/Linux acceptance.
+See release-explorer-usability.md, release-routing-verification.md,
+release-routing-linux.md and release-port-drawing.md for exact evidence and limits.
+
+Direct state-machine editing is accepted through316dc55: typed persisted views,
+explicit-owner creation, movement, direct transitions/reconnection, typed detail
+forms, folding, placement and correct camera/tool lifetime. Windows default/minimum
+and Linux native acceptance plus independent reviews are recorded in
+release-state-editing.md. Direct scenario/process gestures remain required.
+
+R6 data contracts and direct scenario/process gestures are integrated; native
+acceptance continues on both platforms. Typed R3 core/source5/REST and scalar review
+milestones1–2 are integrated and pass full platform checks. Close independent scalar
+fixes and native review, then finish constructor/keyed/order/reset/artifact and
+multi-source graphical authoring using the existing shared core planner. Source5
+migration retains lexical ownership/comments; no flat source rewrite is allowed.
+See release-data-contract.md, release-semantic-integration.md and release-semantic-gui.md.
+
+Continue source authoring improvements only through the production parser/updater.
+The23-test experiment is evidence, not architecture: independent probes exposed
+comment misattachment and unsupported edits. Additional shorthand must preserve
+complete edit/delete behavior and exact source history, and justify itself in real
+human authoring tasks. Shared state placements are now validated; scenario/chain
+interaction must preserve its own occurrence and ordering semantics.
+
+1. **Release coverage audit and interfaces.** Compare actual core/UI/API with official Capella OA/SA semantics and the new objective. Freeze a coverage table and concrete variant/reference/transition contracts before editing shared interfaces. Distinguish unsupported later layers from missing OA/SA workflows; V2 exclusions are reconsidered. Native audit exercises onboarding/help/authoring at supported sizes. Independent audits have separate file ownership.
+2. **Complete engineering semantics.** Fill verified gaps in capability relationships and mission involvement; operational process/functional-chain function/control topology; scenario/state/data constructs needed by OA/SA engineers. Add typed semantic-content drift and reviewed existing-counterpart reconciliation, including reference mapping and explicit dependency/ownership decisions. Every addition has a usable graphical authoring workflow, equivalent source/API representation, meaningful reject/undo/delete/reidentify/transition tests and a worked example. Exact additions and invariants are recorded in the coverage/interface artifact from milestone1, avoiding speculative LA/PA concepts.
+3. **Approachable authoring and help.** Replace static help with searchable topic navigation, concise concepts, numbered OA→SA tutorials, related topics and direct workspace actions. Add a focused starting workspace, recent models and practical creation guidance. Improve source authoring with asynchronous versioned lint, semantic warnings, diagnostic navigation and find/go-to tools. Make selection/navigation and hidden/placed model distinctions clear. Add recoverable local checkpoints for unsaved accepted models and drafts; preserve explicit file-save/conflict behavior.
+4. **Connected automation workflow.** Keep headless deployment and shared core REST contract. Add direct optional desktop open/publish/save of hosted models using explicit connection details and conditional ETags, preserving drafts on failure/conflict and keeping credentials in memory. Verify actual desktop→API→desktop edits and artifact integration locally. Update OpenAPI, deployment and source contracts for the expanded release semantics.
+5. **Release integration and polish.** Guided examples cover OA goals/roles/process alternatives, system missions/capabilities/boundary contracts, chains/scenarios/states and evidence. Review default/minimum/wide layouts, practical keyboard paths, empty/loading/error/recovery states and performance on representative models. Build/run the actual native app after each meaningful UI milestone, fix from evidence, then reverify.
+6. **Independent final acceptance and packaging.** Fresh requirements, correctness, native UX and simplicity reviews in parallel; fix all material findings and rerun affected checks. Full Windows/Linux locked tests, formatting, strict Clippy and optimized builds. Operate primary GUI workflows and actual service transport. Verify current docs/reST rendering, examples/migration, reproducible source workflow, package binary equality/archive contents and checksums. Only then replace 0.2.0 bundles and mark this goal complete.
+
+Dependencies: milestone1 freezes shared interfaces for2; guide/lifecycle work in3 can proceed independently once UI ownership is partitioned. Structural counterpart work depends on2. Hosted client4 depends on final core/API types but transport/lifecycle can be developed independently. Milestones5–6 integrate all preceding work.
+
+## UI and state flow
+
+Keep task navigation, engineering perspective and context-sensitive properties. A Home/start workspace offers projects, recovery and tutorials without obscuring active modeling. Help uses local Rust-owned content and search/category navigation; workspace links pass explicit events and respect draft/modal guards.
+
+Text edits update a snapshot/version; parsing/semantic lint runs on a blocking worker and only the latest result is adopted. Syntax errors and semantic warnings have distinct severity/location and navigate to source. Applying text remains one atomic model transaction. Invalid text and property input are recoverable drafts.
+
+Recovery writes separate per-session checkpoints in user-local application data, never silently overwrites a model file, and offers explicit restore. Recent paths are convenience metadata. Hosted models use a separate connection/resource/revision/ETag handle; ordinary core editing and Undo stay local until explicit conditional Save. Network/file failures retain the same draft. Tokens are not persisted or included in diagnostics.
+
+## Failure and verification strategy
+
+Cover wrong-layer/reference/kind input, ownership/reference cycles, duplicate or ambiguous counterpart matches, stale plans/ETags, typed semantic drift, sequence control topology and repeated occurrences, invalid source/property drafts, external file edits, failed storage/network operations, oversized models and unavailable graphics. Keep incomplete engineering work editable through warnings while rejecting structural corruption.
+
+Tests must cover user-visible meaning and cross-representation invariants, not just serialize the same value twice. Use actual HTTP and native CUA for end-to-end behaviors. Independent review targets current artifacts and the original release objective, not only implementation summaries. Record unsupported/unavailable environments without turning missing required functionality into a limitation.
+
+## Definition of done
+
+Every concrete requirement in the new objective and release coverage table has authoritative current evidence. Primary OA/SA engineering workflows work graphically, textually and through the API; help is navigable and useful; native Windows/Linux UI is intentionally designed and exercised; no blocking/high-impact defect remains; strict checks pass; independent findings are closed; durable docs accurately reflect the release; another engineer can build/run/test and use the supplied packages. V2 completion alone does not satisfy this goal.
+
+## Historical milestone progress — hosted integration
+
+Milestone4 desktop adapter is implemented on the existing Document/REST boundary.
+Windows native publish, graphical/text save, rejected invalid source, API artifact
+reload and stale-revision recovery are demonstrated. Offline/retry and exact local-copy/catalog Open native acceptance passed on Windows.
+Destination and catalog defects found afterward were fixed/reviewed/integrated; remaining platform/native cases retain their report scope. Constructor/keyed/order/Child/Incident/artifact and multi-source review, Home/recents and checkpoint recovery are now implemented. Their scoped native and automated results are in STATE.md; this older milestone is not a current absence list.
+
+## Current execution refinement — 2026-09-07
+
+First-release scope above is unchanged. The user-requested Windows development preview is packaged with565files, including all37 teaching-folder files, and is linked from `DEVELOPMENT_SUMMARY.md`. Latest Fit6 and two existing scroll/branch regressions pass; full desktop570/570, workspace bins, formatting and strict workspace/all-target Clippy pass. Corrected full server56/56 retains its unchanged-server scope. Exact build status and provenance are recorded in STATE.md. This is not an optimized final release.
+
+Native6BAB operation/recovery/history passes and BCC1 corrected OA/SA nested routing passes retain their separate binary scopes. The latest DC50 preview launched with a clean PATH, and its four-card OA Fit overview was visible at1444×932 and1102×932. Minimum-height, pending-form and remaining process-purpose acceptance are still open. Computer Use was stopped by the user's Escape; leave both live GUI processes untouched and continue independent work.
+
+Native Linux core436passed/2ignored is complete on its frozen455-file snapshot. The original server compile passed, unit2/2 and HTTP50/51 passed, and the single504-versus412 timing fixture failed twice. Its private preparation-gate replacement passes on Windows but still requires Linux execution. Preserve the original failures and exact final-state assertions; do not alter the production30-second deadline to make the fixture pass.
+
+The fresh Linux GUI cross-build passed on immutable458-file snapshot `source7-20260907T102528493108Z`, including the Fit constructor fix. Run `20260907T1025486926611Z` completed in2m20s Cargo time with pre/post checks, ELF requirements and all37 lesson files verified; the compiler lease is released. The subsequent headless guest failed its early IO-APIC timer check on three bounded boots, before SSH/tests. Exact matching boot assets were extracted, but automatic approval review rejected the proposed transient boot workaround before launch. All task VMs are stopped; no application failure or current Linux server pass is inferred. Latest guide-label changes and the validated Exchange/CommonWork native oracles follow the frozen binary snapshot.
+
+Next actions:
+
+1. Retain all three guest boot records and exact-kernel proof; the proposed direct-boot action was denied by automatic approval review and must not be retried or split to bypass it. Resolve the runtime gate through an approved route or changed environment. Verify actual readiness and remaining monotonic budget before running the corrected Linux server gate. Do not restart on observation timeout alone.
+2. Preserve the reviewed guide corrections and validated expected-model/source Exchange/CommonWork oracles; the updated guide now builds on Windows and belongs in the next packaged/native snapshot. Complete native purpose authoring/history once control is available.
+3. Once native control is authorized again, complete current-layout minimum-height/Focus/pending-form checks, remaining engineering/hosted walkthroughs and actual Linux GUI acceptance using exact model/source/history evidence.
+4. Execute the corrected Linux server suite; complete final Windows/Linux optimized builds, package provenance, documentation/contracts, and fresh independent cross-disciplinary end-state review. Successful slices do not complete the goal.

harness/history/2026-09-10-ledgers-before-second-consolidation/STATE.md

@@ -0,0 +1,163 @@
+# Progress Ledger — first release
+
+## Active continuation — 2026-09-10
+
+Latest checkpoint: read updated objective attachment `578cf63e-08b7-411f-a01e-20416441d5e2`
+fully and updated `PROJECT_GOAL.md`. Its emphasis on Capella-level useful modeling
+and usability keeps behavior authoring central. Packaging is committed `b98f135`;
+current product/release acceptance remains incomplete. First merged desktop
+artifact finished **615/618 passed**, with three concrete failures assigned;
+the previous running status below is historical. Full evidence and diagnosis:
+`release-integrated-gates-20260910.md`.
+
+Current leases: behavior_audit owns scenario workspace/B3 corrections and sole
+Cargo compilation; release_audit now owns only new behavior/creation.rs/tests
+pending coordinated shared wiring, with packaging frozen; palette_finish owns
+exclusive native input for a bounded Capella behavior-creation study. Root does
+not operate native UI until that lease returns. Candidate 2 closed cleanly after
+F2 equality and saved Actor checkpoint; no process 648 remains. Root owns merges,
+specification checks and ledgers. Other host owns remaining typed-history seed
+fix, standalone scenario lifetimes and its own native scenario contract.
+
+Integration update (2026-09-10): local branch is `codex/release1-9e8r6t`.
+Palette `7d1df4f` is published separately. Received Codex-956atf's exact Git
+bundle (57,658 bytes, SHA256 `85A38B00207036DCB8DB24ED4A7E80B2BE670275EEB7B00413D36153322ADA5D`),
+verified its parent `1797516`, and published its original `01bb52a` commit on
+`codex/behavior-authoring-20260910`. It is being merged here with our palette
+fixes and all additional tests. Only common ledgers conflicted; the other host's
+dated sections are preserved in `release-otherhost-checkpoint-20260910.md` so
+its cold toolchain/process claims cannot be mistaken for this host's state.
+Its optional history-value constructor cache defect has a follow-up pending.
+No integrated compile/native pass is claimed. Scenario layout follows the merge;
+the checkpoint worker independently restores inline name focus after recovery.
+The user subsequently reauthorized Computer Use explicitly. Candidate 2 native
+F2/Save/Undo/Redo now passes the independent exact name-only three-source delta
+and the full Entity Undo oracle. Recovery autofocus is committed in `31b7dc3`;
+its 13 focused tests passed after integrated compilation. The immutable 618-test
+artifact from `057eddd` plus that checkpoint patch is running separately from
+current source edits. The verified follow-up bundle `b6b76ef` now supplies the
+F1 nullable-constructor correction; its additional tests await the next build.
+
+Latest checkpoint (18:10 UTC, Codex-9e8r6t): palette compile repairs, bounded
+inline naming, stale-submit retention and focused first-Escape cancellation are
+implemented. Candidate 1 passed desktop 588/588; candidate 2 passed 22 focused
+tests, GUI build, format and strict desktop Clippy. Candidate 2 native recovery,
+focused Escape, first-submit Save As and complete Entity model/three exact
+sources passed. Full basic editing/transition/reopen acceptance remains pending.
+The user stopped Computer Use with physical Escape; native control is paused.
+Source integration and packaging continue. See `release-palette-native-20260910.md`.
+
+Two independent hosts cooperate in Gitea issue #1: this host is Codex-9e8r6t;
+Codex-956atf owns process insertion, scenario clicked slots/reuse navigation and
+typed stored-history forms. Exchange separate branches from `1797516`; do not
+overwrite the shared continuation ref. Our later scenario layout work awaits
+that source snapshot. Our release worker owns packaging/Docker/notice scripts;
+our behavior worker independently reviews those changes. Cargo writers remain
+serialized. Linux runtime is blocked by a verified supported WSL2 import failure
+(`HCS_E_HYPERV_NOT_INSTALLED`); no repeated workaround is authorized by that fact.
+The user has been asked for a viable Linux environment. This does not block the
+remaining Windows/product work. The release is not accepted.
+
+The renewed user objective is recorded in `PROJECT_GOAL.md` and attachment
+`d3ddacce-6cca-47c5-9dd4-3d7cc2cfdba1/pasted-text.txt`. Continue to a complete,
+usable OA/SA first release; the release is **not accepted**. Initial HEAD is
+`1797516`, branch `codex/release1-continuation`, initially clean working tree.
+Gitea issue #1, its comments and Wiki Home were read before resuming work.
+
+The current user request authorizes native Computer Use verification. Older
+Escape-hold statements below are historical. No Arcadia, Capella, Cargo, rustc
+or QEMU process was running at this continuation's initial inventory. Root owns
+native Windows operation, integration and the common ledgers. Current workers:
+
+- `palette_finish`: architecture palette/inline naming repairs and the sole
+  initial Cargo writer lease; focused tests and a GUI build for native QA.
+- `behavior_audit`: independent actual behavior/scenario workflow and semantic
+  gap review, with no GUI control or implementation changes.
+- `release_audit`: fresh requirements, platform and release gate review;
+  read-only Linux readiness inspection, no VM launches or system changes.
+
+Highest-value next actions: repair and verify the unfinished palette, exercise
+real basic diagram editing against the existing independent fixture, act on
+concrete behavior-workflow findings, then close current platform and release
+acceptance gates. Historical Linux boot-workaround rejection remains recorded;
+do not retry the denied action. Historical test counts do not establish current
+acceptance. Meaningful progress is underway through repairs, independent review
+and preparation of native model/source/history checks.
+
+The sections below retain their original evidence scope and date.
+
+**Checkpoint publication — 2026-09-10:** the user requested committing all current changes and pushing `codex/release1-continuation` to both `origin` and `gitea`. This is a work-in-progress snapshot. The interrupted palette-focused compilation failed with E0659 (ambiguous `column!` in `app/architecture_authoring/palette.rs:168`) and E0507 (moving the view out of an Arc in `diagram.rs:624`); an unnecessary-pattern-parentheses warning also remains in `architecture_authoring.rs:346`. The prior 584-test pass does not cover this newer palette revision. No Cargo/rustc process or local subagent was active at the publication preflight. Fix these errors and complete automated/native acceptance before packaging the redesign. Gitea coordination starts at issue #1 and the project Wiki; older evidence below retains its original scope.
+
+**Latest priority checkpoint — Capella consultation and redesign:** the user rejected the large creation buttons and explicitly requested consulting the installed Capella. Native control resumed for that consultation in a disposable Capella 7.1 workspace. Actual palette, F2 rename and activity allocation were exercised; saved XML confirms allocation distinct from ownership. The horizontal creation/connection rows are being replaced with a compact expandable palette and inline naming. This supersedes the Escape hold and toolbar-fix proposal below. New implementation, native acceptance and a fresh user build remain pending. [Observed benchmark, alternatives and acceptance criteria](release-capella-basic-editing-20260907.md). The first-release goal remains active.
+
+**Latest checkpoint:** basic-editing v1 passed full desktop584/584, Windows binaries, format and strict all-target Clippy. Native v1 D8CFAA confirmed direct contextual named Entity creation at100%, and found a22px placement shift caused by the pending toolbar changing canvas height. The user pressed Escape at the attempted Undo; that action did not execute. **Desktop control is paused again.** Process9600 remains the isolated unsaved QA application; do not overwrite its binary or presume a clean close. Code-only placement fix is continuing. [Exact v1 evidence and remaining acceptance](release-basic-editing-reset-20260907.md). This supersedes the resumed-control state below; the first-release goal remains incomplete.
+
+**Superseding priority checkpoint:** the user explicitly said “Resume desktop checks” and rejected the focus on advanced review before basic diagram editing. Isolated native checks resumed and reproduced the global creation catalog, placeholder creation/camera jump and noisy review. Contextual named creation and compatible layer-transition destinations are now being implemented and tested. Their new executable has not yet been accepted. [Current priority and scoped evidence](release-basic-editing-reset-20260907.md). The older Escape hold and next-step priorities below are superseded; historical binary/test results retain their original scope.
+
+Current checkpoint: 2026-09-07. The requested Windows development preview is built and packaged with its runtime, documentation, notices and complete examples. Latest Fit6, two existing scroll/branch regressions, full desktop570/570, workspace bins, formatting and strict workspace/all-target Clippy pass. Corrected server56/56 retains its earlier unchanged-server scope. Packaged DC50 GUI launched and the OA graph Fit overview was observed at1444×932 and1102×932; minimum-height and pending-form native acceptance remain open. The user stopped Computer Use with Escape; do not resume native control without renewed authorization. Native Linux core436passed/2ignored remains verified; corrected Linux server and full Linux GUI build/runtime remain open. The fresh Linux desktop cross-build passed on Rust1.90 in2m20s using the preserved cache; ELF and all37 teaching files are verified. Three later guest boots failed the early IO-APIC timer check before SSH/tests; the exact-kernel workaround was then rejected by automatic approval review before launch. All task VM processes are stopped. **Goal active; release incomplete.** The authoritative objective is `C:\Users\User\.codex\attachments\10b0f701-1743-4de7-9ee1-225920e19649\goal-objective.md`: a usable, feature-complete OA/SA engineering tool for Windows and Linux with graphical/source/REST parity, artifact traceability, offline guidance and independent end-state acceptance.
+
+## Workspace and ownership
+
+- Current branch `codex/release1-continuation`, checkpoint **4b6b5fc1977523e8cf52fdd5503a0a71c87a3f63** commits290files of source6 work and evidence. [Bounded checkpoint audit](release-checkpoint-integration-review-20260906.md) verified65pinned manifest entries and145exact staged/working fixture/archive files; `.gitattributes` protects their measured line endings. Integrated ancestry starts at `c091f80`; [branch audit](release-branch-integration-20260906.md) prevents reimplementing already integrated work. New source7 implementation is authorized but not yet accepted.
+- Historical6BAB native scope (superseded in rendering by BCC1 and Fit by DC50): acceptance binary `.local/native-qa/bin-source7-acceptance/arcadia-studio.exe` SHA256 `6BAB6CDE7D31326F3C3CF7342D9B25FB6ADA032864BBE8104625E5EC9736283B` follows the Windows433/55/561 and strict/build gates below. Reset and ReadStatus each passed exact complete model/source Save/Undo/Redo and reopening with the correct derived Reply allocation30/31. OA caller→First.B passed exact persistence/history/reopen; routing remains open. Process11060 closed cleanly; isolated old6 recovery process11240 also closed after its complete source/JSON/raw-draft pass. Old5 process5244 subsequently passed exact30-source/full-JSON recovery and raw-workspace comparison. Current7 process8224→10420 passed invalid nested-link draft crash recovery; completing the recovered SA X→[R3,Inner]/B link passed exact model/two-source Save/Undo/Redo and saved reopening. Those historical native processes closed; the later BCC1 routing and DC50 Fit evidence is recorded separately below. [Native evidence](release-source7-native-acceptance-20260907.md).
+- Completed bounded90minute Linux gate: one-job Rust1.90,455-file immutable snapshot SHA256 `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279`, launched07:02:43UTC, deadline08:32:43UTC. Server compilation passed17m10s; unit2/2 and HTTP50/51 passed, with one504-vs-412 test assertion reproduced in an isolated rerun. Its two-second read/PATCH checks passed, but later persisted-state assertions were not reached. This establishes a timing-dependent fixture/deadline mismatch, not a production locking defect. Native core completed436passed/0failed/2ignored across40targets, Rust1.90, compile23m03 and1992seconds total; all455 source pre/post checks passed. The two ignored cases are optional inheritance scaling and explicit strace fault injection (earlier separately scoped injection passes remain historical). All artifacts were copied before sync/poweroff; QEMU6280, launcher5000 and seed816 were absent08:13:56UTC. [Current Linux report](release-source7-linux-gate-20260907.md). Earlier Linux evidence retains its older snapshot scope. WSL remains pending restart; no host restart is authorized.
+- Windows session5735 completed all six gates with exit0: focused prepared-HTTP and cancellation, full server56/56 in68.78s, format10.44s, strict workspace/all-target Clippy99.60s, bins102.22s. Status/logs: `.local/source7-post-routing-gates-status.json`. Distinct GUI BCC1FC6DB68123C9D3A43CE53AA8EF59E33C54080632C104C99ED13270D5333F process8568 passed the scoped corrected routing checks and closed cleanly. [HTTP evaluator correction](release-http-preparation-phase-regression-20260907.md), [routing correction](release-contextual-route-native-fix-20260907.md), [native details](release-source7-native-acceptance-20260907.md). These passes precede the now-tested [Fit/layout correction](release-process-fit-layout-audit-20260907.md).
+- The requested Windows preview is `dist/ArcadiaStudio-preview-source7-20260907-x86_64-pc-windows-gnullvm/arcadia-studio.exe`; its565-file ZIP includes all37 teaching-folder files and has SHA256 `1fac10b30daf2f8e1dac29e9469485e4bea142e77ff5a13e4c9d1e41ff03abb2`. The adjacent provenance records actual source/binary hashes. This is a development profile, not an optimized final release. Latest gates are in `.local/source7-latest-preview-status.json`; full desktop570/570 completed in198.82s test time,200.63s command time, exit0 in `.local/source7-latest-full-desktop-status.json`. Initial Fit4/2 failures exposed real zero-size-slot remounting; corrected constructors pass unchanged expectations. [Fit review](release-process-fit-independent-review-20260907.md), [development summary](../DEVELOPMENT_SUMMARY.md).
+- Computer Use is stopped. Read-only inspection initially found preview9148 and second GUI8044 live; later9148 exited without agent intervention, while8044 remained untouched. No GUI control/closure is authorized for background verification. The cross-compiler lease ended after the successful142.766s monotonic run; no cross processes remain. The Linux worker completed a bounded headless guest experiment and released the lease. Three boots (same configuration twice, then Normal boot priority) reached terminal IO-APIC timer panic before SSH/Cargo; all task VM trees stopped and exact evidence was preserved. Exact matching kernel/microcode extraction passed without changing base/overlay hashes; automatic approval review rejected preparation/launch of the transient no_timer_check experiment as “blocked by policy.” No fourth boot or corrected tests ran. No task VM is live; see [the preserved boot evidence](release-source7-linux-server-corrected-gate-20260907.md). [Cross-build report](release-source7-linux-gui-cross-build-20260907.md).
+
+## Current source build and stopped runtime gate
+
+The guide-only followup compiled successfully with locked Windows workspace bins in12.70s Cargo/12.82s command, exit0. Status `.local/source7-guide-current-build-status.json` records guide SHA256 `80A6797051FB28E767F2AB5DD2F335ABCD9F3E5F3A75C731CDE46D8B90D5C92E`; resulting GUI SHA256 `327FBDF734716A7F1AF2874183D46A531A8F429BA1A478E83A3E7F2EB1D6248B`. Formatting and independent actual-label review pass. This later debug artifact does not replace the user-facing packaged DC50 preview, its archive or earlier native evidence. No full570 rerun is claimed for the text-only followup.
+
+Previous goal turn made progress by confirming full570 tests and handing off the package/summary. This continuation produced the successful Linux GUI build/ELF evidence, validated purpose oracles, corrected/built guide text, and concrete guest-boot evidence. Goal remains active/incomplete. The denied direct-boot action must not be split or retried to bypass automatic review; no new Linux job is running or scheduled.
+
+## Latest Linux build and purpose-oracle evidence
+
+Linux GUI snapshot458files `source7-20260907T102528493108Z` has archive SHA256 `9b10aa8457a5371367f7e24a0b2260b63c19fed69873d98a3972062a744503d7`. Run `20260907T1025486926611Z` passed locked/offline Rust1.90 zigbuild, both source checks and independent ELF/package readback. GUI72,953,296bytes SHA256 `330A3872D48EBF24AD21E6D4FA13CB6098BEBB3CB7FF82A2E082925CCF3DD346`; ELF64PIE, glibc requirements≤2.28, all37 lesson files exact. Actual Linux GUI runtime is still unverified. Subsequent guide-label text is excluded from both published Windows and this frozen Linux preview.
+
+Extended native checker `source7-native-contract-incidence.exe` SHA256 `16994DC437F5CCC5E5F6FBB4212C03449F2389AE4615FA98B2930B3637468EE3` compiled with warnings denied in4.05s during a coordinated short lease. OA Exchange and SA CommonWork self-checks pass: exact contextual assembly, unchanged precedence, wrong direction/work rejection, caller-only exchange coverage and stable source update. Separate43-element/10-relation incidence fixture baseline passes; all original golden hashes and preserved OA-link/Reset accepted cases remain exact. Independent review found no material issue. [Cases and reproducible native steps](fixtures/source7-native/README.md). Native purpose authoring/history remains pending.
+
+## Completed and verified at this checkpoint
+
+| Scope | Evidence and limit |
+|---|---|
+| Historical source6 diagnostics and guide | Semantic filter **108 desktop + 2 core** passed; full desktop **527/527** passed; strict all-target Clippy and GUI/server build passed (`.local/semantic-diagnostics-final-tests.log`, `desktop-diagnostics-final-tests.log`, `diagnostics-final-clippy.log`, `diagnostics-final-build.log`). Subsequent guide **3/3** focused tests, strict Clippy and build passed (`.local/guide-navigation-{tests,clippy,build}.log`). The guide test increases compiled desktop inventory to528; no full528 run or final full-workspace total is claimed. |
+| Current artifact implementation checkpoint | Full desktop **518/518**, corrected fresh artifact picker **6/6**, strict all-target Clippy passed. Logs `.local/source6-artifact-inspector-desktop-tests2.log`, `.local/source6-artifacts-final-tests2.log`, `.local/source6-artifacts-final-clippy3.log`. Four subsequent artifact recovery falsifiers and two core absence oracles passed separately. This predates latest display corrections. |
+| Native artifact MOVE / CREATE / DELETE | All three complete source Apply/Save, one Undo/Save and one Redo/Save oracles passed; **nine saves succeeded first attempt**. MOVE invalid Owner and disabled optional text, and CREATE excluded row/all eight decisions/reserved UUID survived controlled-stop recovery exactly. DELETE removed destination from identified moved-source absence while retaining the source link. [Exact native report](release-artifacts-native-20260906.md), [fixture/generator instructions](fixtures/release1-native/artifacts/README.md). |
+| Source-6 atomic batch review | Included valid and excluded invalid raw rows survived forced-stop recovery; repaired two-source Apply and complete Save/Undo/Redo source comparisons passed. [Native report](release-current-native-verification.md). |
+| Scenario ordered-member variant | At1100×700, Take rejected ambiguous insertion; explicit final order retained the local self-test. Complete Apply/Save, Undo/Save and Redo/Save matched the independent source oracles with only the schema5→6 header token upgrade. All three saves succeeded first attempt. Branch steps/fragment branches and this variant's crash recovery remain separate cases. [Exact native report](release-current-native-verification.md). |
+| Native guide navigation | On current guide binary at1100×700: related Scenarios-bottom→Exchanges opens the new heading; filtering `exchange` retains the current topic's bottom position; `Git` auto-selects Build first and opens its heading. No dirty model. Root's actual native observations close these bounded scroll cases; [implementation/tests](release-semantic-conflict-diagnostics-20260906.md) remain separately scoped. |
+| Communication means | Drawing/create/reuse and legacy reverse full-model/source/history passes are retained. Corrected reverse Apply now opens the explicitly requested OA scenario in Behavior, preserving the original four-object Architecture. Distinct oracle predicts10UUIDs/zero placements; accepted model/all3sources, Undo baseline, Redo and reopen pass. Every Save succeeded first submission. Navigation5focused tests, strict Clippy and bins build pass; compiled desktop535 is not a full535 run. [Exact report](release-communication-native-20260906.md), [implementation](release-behavior-transition-context-20260906.md). |
+| Teaching project and Home hook | Corrected94element/62relation/5view/68trace/30source example passes4expanded direct-rustc tests. Minimum-size Home/guide, raw-source guard, reviewed NameTake and exact source/history/reopen pass. Navigation fix is reverified. Additional data/interface/type drill-down, saved-view comparisons, invalid-view guard and typed Entry action selection pass. Fold/unfold and function rename/Undo/Redo each match complete model/all30source oracles, five first-submission saves; saved reopen retains the Entry target identity. Complete process/scenario/reuse/evidence lesson remains open. [Native report](release-teaching-native-20260906.md). |
+| Child/Incident and source-5 recovery | Two-row attachment recovery and complete Apply/Save/Undo/Redo passed, every save first attempt. Exact old source-5 raw/base/include/path retention, manual repair and two-file Save passed. [Attachments](release-attachments-native-20260906.md), [source-5 native](release-source5-native-recovery-20260906.md), [independent review](release-source5-checkpoint-independent-review-20260906.md). |
+| Dense saved views | Forty-label baseline and selected real relation identities inspected; filter, duplicate/hide, original10/copy9 persistence across restart and exact model oracle passed. Additional coverage/context intersections, empty selections and Names-and-items preview/Apply/Undo observed. Minimum-size overview requires working zoom/pan. Limits remain in [native evidence](release-current-native-verification.md). |
+| Core/source/REST integration | Fresh `--all-targets` core run: **433 passed/1 ignored**,44 target summaries, exit0 in138.72s; fresh server run: **55/55**,4 summaries, exit0 in64.74s. Logs `.local/source7-core-all-targets.log`, `.local/source7-server-all-targets.log`; exits/timings in `.local/source7-current-gates-status.json`. These supersede the earlier combined core count and pre-budget-fix HTTP51 checkpoint. OpenAPI **72fixtures/204schemas/90leaves** and both strict reST renders pass. [Core checkpoint](release-source7-core-checkpoint-20260906.md), [API integration](release-source7-api-integration-20260906.md). |
+| Source7 desktop authoring and recovery | Latest routing3/3 and full desktop **564/564 pass**; [routing checkpoint](release-contextual-route-native-fix-20260907.md) records exact logs. Earlier full desktop **561/561 passed**, zero failed/ignored,263.39s in `.local/source7-desktop-full-tests2.log`. The initial560/1 run exposed canvas scroll-state loss when a new conditional navigation control shifted its widget; a fixed navigation container corrected it, and the unchanged regression passed. Coverage includes qualified5, operation3 (selected Async request fields), semantic source7 facets/omission3, recovery8, legacy source5 13, artifact search2 and focus guard1. Exact old-version enum/cache-path intent rejection and raw text retention are covered. The complete-scope endpoint picker preserves access beyond512; canvas preview remains bounded. Guide now accurately describes attachment/artifact reconciliation and artifact filtering. [Desktop checkpoint](release-source7-desktop-authoring-20260906.md), [recovery](release-source7-recovery-20260906.md). |
+| Windows strict/build checkpoint and native7 | Strict workspace/all-target Clippy passed2m50s; root observed final format exit0/empty log. Three affected semantic tests passed3.46s after equivalent lint edits; native build exit0 recorded in `.local/source7-current-gates-status.json`. These earlier results scope the6BAB binary, not the later routing test binary or pending new strict/build sequence. Reset/ReadStatus full model/all-source Save/Undo/Redo/reopen pass. OA First.B persistence passes but routing acceptance remains open. Old6 Recover preserved the complete30-file bundle/workspace/Ports DTO, exact spaces/Unicode/fingerprint/reserved identity; Cancel/Save as and JSON export passed full independent source/model equality. Original seed unchanged. Old5 complete accepted/raw recovery, exact repair/30-source Save and full-model export pass. Current7 invalid nested draft crash recovery plus completed link Save/Undo/Redo/reopen pass; rendering still uses the older binary. [Native report](release-source7-native-acceptance-20260907.md). |
+| Current Linux source7 and cross-built probe | Frozen native server compilation passed17m10s; unit2/2 and HTTP50/51, with one timing-dependent504-vs-412 assertion reproduced twice. No complete server pass; later targets not claimed. Native core436passed/0failed/2ignored; VM cleanly off08:13:56UTC. Separately, the complete Windows macro/build-script cross-build probe's hash-verified ELF executed successfully on Linux; this is neither a full desktop build nor GUI acceptance. [Native Linux gate](release-source7-linux-gate-20260907.md), [cross-build probe](release-linux-cross-build-probe-20260906.md). |
+| Historical Linux/MSRV core and server | Ubuntu24.04.4/x86_64/glibc2.39/ext4/Rust1.90: core38/38, patched journal4focused/42full and3explicit syscall fault cases pass on recorded snapshots. Actual server build passes34m42s including3m24s pause. Real HTTP modular import, invalid PUT unchanged source/ETag, clean SIGTERM and exact model/source/ETag restart pass on the older28-source lesson snapshot. Full server test command timed out while compiling; zero tests executed. That gate shut down cleanly21:53:56; the separate current gate has the scoped results above. Current desktop/Linux package unverified. [Linux report](release-linux-validation-options.md), [journal contract](release-linux-journal-publication.md). |
+| Packaging foundation | Portable Windows QA staging, dependency/runtime/font/Rust notices, archive readback and clean-PATH smoke passed at earlier binaries. [Package report](release-windows-package-review.md). QA archives are not current final release artifacts. |
+
+Historical full platform/native milestones retain their original revision scope; [complete prior ledger](history/2026-09-06-ledgers-before-consolidation/STATE.md) preserves all evidence links and previous environments. A test or native pass never transfers automatically to a changed executable.
+
+## Active findings and checks
+
+Native artifact review exposed same-row conflict wording and reserved identities shown as deleted. Corrections retain typed actual-slot equality, row-addressed reservations and accepted-identity precedence; independent re-review found no further material defect. The completed108-semantic/527-desktop checks supersede the earlier interrupted run and include reserved-label/partial-creation regressions. Revised artifact wording still needs its own native observation on the current binary. Guide-scroll implementation/tests/build and the bounded native cases above passed. [Diagnostic/guide report](release-semantic-conflict-diagnostics-20260906.md).
+
+**F1** teaching onboarding/review/history has current-binary native evidence; remaining tutorial work is scoped in its report. **F2**, faithful behavior-canvas SVG export, is deferred by root's scope decision: export remains architecture-only and must be described that way; no faithful scenario/process/state SVG acceptance is claimed.
+
+Reverse scenario's first-dependency focus/overlapping architecture placements and teaching NameTake's separate layer/view mismatch are fixed and natively reverified. Latest NameTake4focused tests, strict alltargetClippy28.26s and binsbuild50.50s pass; no full539desktop pass is claimed. [Navigation evidence](release-semantic-review-navigation-20260906.md). Minimum-size process working space is cramped; native lesson evidence records23% overview versus100% scrolling rather than claiming readability at Fit.
+
+Independent scope reconciliation verified **S1** missing contextual assembly into repeated/nested process references and **S2** missing maintained interface-operation identity in parameterless messages. Isolated existing-core probes falsify the proposed workarounds. Root ratified the jointly critiqued [source7 integration decision](release-source7-integration-decision-20260906.md), including deterministic cache-independent admission, whole-link deletion, purpose-specific analysis, exact Call-derived operation/Reply identity and one frozen old5/6 checkpoint migration. These contracts now have implemented core/source/REST/desktop/recovery paths and the current automated gates above; remaining native7 and current Linux acceptance remain incomplete. [Scope reconciliation](release-scope-reconciliation-20260906.md).
+
+Linux ordinary rename's empty-target replacement was independently reproduced and corrected using `renameat2(RENAME_NOREPLACE)` without fallback. Exact errno/no-write assertions now pass under actual syscall injection. This establishes the ext4 publication invariant, not power-loss durability, hostile ancestor protection or model-file compare-and-swap. Windows retains its no-replace API and bounded scanner retries.
+
+## Remaining gates and next actions
+
+1. Fit implementation/review and automated gates are complete, including full570 desktop tests. Finish its native minimum-height/Focus/pending-form checks when native control resumes. Preserve completed BCC1 routing and old5/old6/current7 recovery/source/history oracles. Complete remaining current-binary S1/S2 purpose workflows and teaching cases; operation allocation deletion remains subject to independent channel validation. Native-check revised reserved labels and same-row conflicts. The later guide-only control-label correction passed formatting, independent review and the fresh workspace-binary build; it awaits the next packaged/native release snapshot.
+2. Close uncovered selective-view lifecycle cases; advanced ordered/process/scenario/fragment variants beyond the accepted Scenario case; typed state actions and pending Linux data/hosted/compact workflows. Implemented semantics must not be called missing merely because acceptance is outstanding; [coverage audit](release-current-coverage-20260906.md) is the baseline map, newer scoped reports supersede its old gap claims.
+3. Verify complete current Linux integration suites and desktop/server build/runtime, then supported-size native workflows. The successful core/MSRV pilot is a reusable starting point, not application acceptance.
+4. Preserve current strict Clippy/format/reST/example/source/OpenAPI results and rerun affected checks after changes. Complete optimized/MSRV/final platform gates, actual hosted transport variants and final migration/package checks. Rebuild portable distributions from the accepted exact tree, validate notices/runtime/content/checksums and clean-environment launch before replacing old bundles.
+5. Conduct fresh independent requirements/domain/parity/architecture/runtime/UX/end-state reviews; resolve material findings. Commit/integrate authorized source with reviewable scope; remote publication is not requested. Only complete the goal when its applicable criteria are met.
+
+Meaningful progress continues: native lifecycle and Linux no-replace uncertainty have been resolved with exact oracles. The highest-value work is current-binary validation and closing uncovered engineering workflows, not accumulating repeated historical headings or treating aggregate test counts as release completion.

harness/history/2026-09-10-ledgers-before-second-consolidation/TASK_LEDGER.md

@@ -0,0 +1,116 @@
+# Task Ledger — first release
+
+## Updated objective and current strategy — 2026-09-10
+
+Given: the latest authoritative request is
+`578cf63e-08b7-411f-a01e-20416441d5e2/goal-objective.md`, copied into
+`PROJECT_GOAL.md`. It preserves complete OA/SA, parity, API, traceability,
+cross-platform and review requirements, and explicitly emphasizes that current
+usability/functionality remains below Capella. The next changes must address
+actual engineer workflows; passing narrow technical checks is insufficient.
+Its explicit semantic-model list includes constraints and calculations,
+quantities and units, and reusable model libraries. Their completeness is not
+inferred from metadata fields or included source files: the other host's fresh
+requirements_delta review is mapping real behavior and required acceptance.
+
+Verified: palette F2/Save/Undo/Redo and the exact Entity source oracle passed
+on candidate 2. Named Actor placement is saved; full basic workflow is pending.
+Merged desktop ran 618 tests: 615 passed and 3 failed, with concrete navigation
+and history-seed causes now assigned. Schema fixtures and strict reST rendering
+passed. Packaging is committed with independent review and exact notice bytes.
+See `release-integrated-gates-20260910.md` for scope and failures.
+
+Strategy: finish the actual remaining-height scenario workspace, repair its
+navigation and typed-history failures, and make starting a named behavior local
+with explicit viewpoint/owner choices. An independent native Capella study
+informs that workflow while the creation worker implements its isolated module.
+Root integrates and then evaluates realistic current-build tasks. Assumption:
+these changes will reduce navigation/draft detours; native acceptance must prove
+that. Linux runtime and broader parity/release gates remain unresolved.
+
+**18:10 UTC checkpoint, 2026-09-10:** palette repair candidate 2 passes focused
+tests/build/format/strict Clippy and native recovered-draft Escape/save plus the
+complete Entity source oracle. The user stopped Computer Use; native verification
+is paused with the rest of basic editing still unaccepted. Root publishes the
+palette delta on a separate Gitea branch. Other-host process/scenario/forms source
+is awaited; packaging implementation and independent adversarial review continue.
+See the latest `STATE.md` section and dated reports for exact evidence and leases.
+
+**Active objective, 2026-09-10:** the user renewed the complete first-release
+request in `PROJECT_GOAL.md` and the latest pasted request. Native verification
+and GPT-6 Astra worker delegation are explicitly requested. Initial repository
+and Gitea evidence confirms an unfinished compact-palette redesign, including
+two compile errors; prior native and automated passes remain historical.
+The current hypothesis is that direct contextual authoring can make existing
+OA/SA semantics approachable. Test that hypothesis against real engineering
+tasks before claiming usability. Root owns integration/native operation and
+ledgers; bounded palette, behavior-gap and release-readiness workers are active.
+See the dated active section of `STATE.md` for exact ownership and next actions.
+
+
+**Superseding user direction:** large horizontal creation buttons were rejected as intrusive and unprofessional. The user explicitly authorized consulting the installed Capella; that consultation has resumed and established actual compact palette, inline rename and explicit activity-allocation behavior. See [Capella 7.1 evidence and selected redesign](release-capella-basic-editing-20260907.md). The current candidate replaces creation/connection rows with one compact expandable palette and an in-place name editor. Native acceptance of the redesigned executable is pending; compactness is not assumed to prove usability. The earlier Escape hold and proposed toolbar-only correction below are superseded.
+
+**Latest evidence:** basic editing full desktop584/584, bins, formatting and strictClippy passed. Native named Entity creation works at100%, but changing pending-toolbar height moves the screen placement22px. User Escape stopped the attempted Undo; native checks are paused again. Code-only toolbar correction proceeds. [Current findings](release-basic-editing-reset-20260907.md). The previous goal turn made concrete progress through implementation, integration gates and a native-discovered defect; this is not a no-progress blocker turn.
+
+**Current steering:** basic diagram authoring and understandable OA/SA transitions come first. The user explicitly reauthorized desktop checks; root resumed the isolated test build and reproduced the reported usability problems. Creation, transition and independent fixture work is underway. No new basic-editing native pass is claimed. See [priority reset](release-basic-editing-reset-20260907.md); older execution priorities and Escape hold are superseded.
+
+Updated 2026-09-07 after source7 Reset/ReadStatus and old6 recovery native passes, OA contextual persistence with rendering open, and reproducible Linux server test deadline evidence. Native Linux core now passed436/0failed/2ignored and its guest shut down cleanly. Old5 full recovery and source7 pending nested-link crash recovery/history/reopen also passed; routing3/3 and full desktop564/564 now pass. Root's private-server/full-server/format/strict-Clippy/bins sequence is running with results pending. [STATE.md](STATE.md) owns current execution/evidence and leases. [PLAN.md](PLAN.md) owns the release plan; [DECISIONS.md](DECISIONS.md) preserves architectural rationale. Full pre-consolidation contents, including superseded requirements interpretations and evidence, remain [archived byte-for-byte](history/2026-09-06-ledgers-before-consolidation/TASK_LEDGER.md).
+
+## Goal and success criteria
+
+The authoritative user objective is `C:\Users\User\.codex\attachments\10b0f701-1743-4de7-9ee1-225920e19649\goal-objective.md`. Deliver a usable, substantially complete OA/SA engineering tool in Rust/Iced on Windows and Linux; equivalent graphical, strict textual/reST and REST workflows; practical artifact traceability; navigable offline guidance; recoverable drafts; reproducible deployment. Completion requires native engineering task evidence and fresh independent end-state review, not implementation or passing tests alone. Later Arcadia layers remain future scope.
+
+## Given facts and constraints
+
+- User prioritizes Capella domain fidelity, useful containment/nesting and explicit typed ports, while avoiding clutter, persistent action overload and awkward navigation. Study real domain workflows rather than mechanically copying Capella classes.
+- Both-layer transitions and reviewed counterpart reconciliation must be intuitive and precise. Behavior/scenario diagrams must be directly editable and preserve selection/camera/task context.
+- Human/AI/Git-friendly modular source, comments/includes, complete graphical/source/API parity and clear rejection are required. One validated model/history boundary must govern every representation.
+- User permits autonomous reversible engineering, experiments, independent agents and authorized native work. Root is the sole native operator in this collaboration. Do not run concurrent shared Cargo writers. No remote push, usage reset, broad target deletion or host restart is implied by current task authorization.
+- User permits isolated Linux work. WSL remains unavailable pending restart; earlier task-local QEMU core and server gates completed and shut down cleanly; the separate source7 core gate also completed and shut down cleanly, as recorded below. The server built and passed real HTTP/restart checks; its full test command timed out during compilation before any test executed. Historical external worktrees/toolchains are not present on this machine.
+
+## Verified facts
+
+- Latest superseding checkpoint: Fit6 and both existing scroll/branch regressions, full desktop570/570, workspace bins, format and strict workspace/all-target Clippy pass. Windows preview565-file ZIP and complete examples are verified; current server56/56 also passed. Native BCC1 OA/SA nested routing and unchanged-source oracles passed, followed by bounded DC50 packaged Fit overview. Earlier pending-build/routing claims below retain their historical scope and are superseded by these exact current results in STATE.md.
+
+- Branch/patch/tree audit established that direct state/scenario/process, data contracts, hosted editing and earlier semantic review are already integrated; no required production transplant was found. [Branch evidence](release-branch-integration-20260906.md).
+- Capella's function input/output exchange endpoints and component Standard/Flow ports are distinct; explicit allocation connects them. Preserve that domain distinction. [Native benchmark](release-capella-workflow-benchmark.md).
+- Source6 introduced participant CommunicationMean, typed explicit transition endpoint decisions, saved exchange categories/view selectors, completeness warnings and presentation duplication; current source7 retains them. Older audit absence claims are superseded; native acceptance remains scoped by reports.
+- Semantic review includes independent scalar/constructor/keyed/order/Child/Incident/artifact facets and multiple source rows. One frozen accepted base, explicit mappings, unique merged candidate slots and one atomic command preserve raw excluded/rejected drafts. Recovery replans; it never restores an unchecked serialized command. [Batch design](release-semantic-batch-foundation-design.md), [artifact contract](release-semantic-artifacts.md).
+- Native Windows artifact MOVE/CREATE/DELETE passed exact complete Save/Undo/Redo oracles, nine first-attempt saves. MOVE invalid raw optional state and CREATE exclusion/reserved identity survived controlled-stop recovery exactly. Destination-only retention is automated evidence, not separately native-applied in that run. [Native report](release-artifacts-native-20260906.md).
+- Native batch, Child/Incident and source-5 checkpoint workflows have scoped exact source/recovery/history evidence. Dense views have persistence/duplicate/hide and bounded readability evidence. Current counts, binaries and remaining cases are in STATE.md; these are not universal usability claims.
+- Native communication means drawing, explicit create/reuse ports and reverse Call/Reply pass independent complete model/source and exact Undo/Redo checks. The reverse navigation/overlapping-placement defect is fixed and reverified against a distinct oracle:10newUUIDs,zero implicit placements, correct Behavior owner and preserved Architecture. [Exact evidence](release-communication-native-20260906.md).
+- Windows semantic108desktop+2core/full527desktop passes remain scoped. Subsequent guide/home and behavior navigation slices passed focused tests/strict Clippy/build; semantic navigation is also natively reverified. Fresh source7 core all-targets433passed/1ignored across44 summaries and server55/55 across4 summaries have recorded exit0. Full desktop561/561 passed263.39s after a real scroll-state regression was fixed with a stable navigation Column; the unchanged test passed. Strict workspace/all-target Clippy and root-observed final format exit0 pass;3 affected semantic tests passed after equivalent lint edits. Subsequent routing3/3 and full desktop564/564 pass; new standalone build and strict/server results remain pending. Logs and exact scope are in STATE.md; do not add affected reruns to full-suite totals.
+- Native Scenario ordered review passed ambiguity rejection, explicit retained-local final order and complete Save/Undo/Redo source oracles at1100×700. Current guide binary passes related-topic heading reset, same-topic search scroll retention and Git auto-selected-topic reset without dirtying the model. Branch/fragment order variants and revised artifact diagnostic rendering remain separate gates. [Native ordered evidence](release-current-native-verification.md), [guide/diagnostic implementation](release-semantic-conflict-diagnostics-20260906.md).
+- Windows user-local GNU/LLVM builds and isolated clean-PATH native launch work. Actual Ubuntu24.04.4/Rust1.90 core/journal tests pass on hashed snapshots. Actual Linux server build and real HTTP modular import/invalidPUT/cleanrestart exact source/model/ETag pass on the older28-source lesson snapshot. Its full server test command timed out during compilation with zero tests executed, then that gate shut down cleanly. The current frozen source7 gate compiled the server in17m10s and passed unit2/2 plus HTTP50/51; the sole504-vs-412 timing assertion failed again alone. Its final persisted-state checks were not reached. Native core436passed/0failed/2ignored and the VM shut down cleanly08:13:56UTC; full desktop/Linux package remain unverified. [Linux evidence](release-linux-validation-options.md).
+- Corrected30-source/37-file teaching project passes minimum-size Home/guide/dirty-source guard, located initial warning, reviewed NameTake and complete exact source/Undo/Redo/reopen checks. The layer/canvas mismatch is corrected and natively reverified. Data/interface/type navigation, saved-view distinctions, invalid-view draft guard and typed state Entry fold/rename/history/reopen pass. The process workspace is cramped at minimum size and artifact navigation required excessive scrolling; targeted source7 UI improvements await native observation. [Native evidence](release-teaching-native-20260906.md).
+- Scope reconciliation established caller-context links into repeated/nested reusable chains (**S1**) and maintained interface-operation selection for parameterless messages (**S2**) as real missing semantics. Their ratified source7 implementation now has fresh full core/server/desktop gates, OpenAPI72 fixtures and strict reST evidence. Old5/6 compatibility and current7 raw recovery tests pass. Root's native Reset and ReadStatus cases passed complete Save/Undo/Redo oracles and reopened with explicit derived allocation30/31. OA First.B persistence/history/reopen passed but rendering is open; old6 recovery passed full30-source/model JSON and exact raw workspace/Ports DTO comparison. Old5 complete raw/accepted recovery, exact repaired30-source save/full-model export pass. Current7 invalid nested draft crash recovery and completed link Save/Undo/Redo/reopen also pass; corrected rendering and remaining native7/Linux workflows remain open. [Native report](release-source7-native-acceptance-20260907.md). [Scope reconciliation](release-scope-reconciliation-20260906.md), [integration decision](release-source7-integration-decision-20260906.md).
+
+## Decisions and candidate designs
+
+Retain three Rust crates, one typed Project and validated atomic Command. Keep semantic ownership, reference/allocation/order relationships and diagram placement separate. Forms remain a closed typed adapter, not a second metamodel. Persistent additions require model validation, references/deletion, transition, parser/updater, API/schema and reachable graphical editing parity.
+
+Semantic reconciliation uses finite typed facets and separate member/presence/order decisions. Compare actual destination slots before constructing the core's complete candidate; two rows never become sequential Apply. Missing identities are not inferred by names. Raw constructor/numeric/keyed/optional drafts survive rejection, exclusion and checkpoint recovery. Artifact Presence means attachment to the reviewed owner; an identified source moved away can delete the destination, whereas a source key of None preserves destination-only membership. No invented tombstone or silent seed acknowledgment.
+
+Source updates preserve lexical ownership/comments/includes and exact history. Checkpoint source5/6→7 upgrade admits only the established token/typed migration contract, validates old base fingerprints and resets transient approvals; it does not silently rebase authored drafts. Hosted saves remain explicit and conditional on the resource/ETag; credentials stay in memory.
+
+For Linux journal publication, ordinary rename lost the empty-target ownership invariant in a real ext4 probe. Selected `renameat2(RENAME_NOREPLACE)` through existing locked libc with no fallback; syscall errors fail before model writes. Alternative overwrite fallback was rejected by that falsifier. Windows native no-replace/retry behavior is retained; other OS behavior is explicit. [Contract, alternatives and measured limits](release-linux-journal-publication.md).
+
+Root selected **F1**, a complete source-6 teaching-project example. Corrected model/replay tests and bounded native onboarding/review/history pass; the full process/scenario/state/data/evidence lesson remains open. **F2**, faithful behavior-canvas SVG export, is deferred: current export scope is architecture-only, not a claim of faithful scenario/process/state export. Record this as an explicit scope decision rather than an accepted behavior-export result.
+
+Behavior-root transition Apply should focus the explicitly requested counterpart and its nearest behavior owner. Without an explicit destination diagram it must preserve unrelated architecture presentation. Ordinary architecture transitions retain their existing path; explicit destination remains honored. This decision follows the independently reproduced reverse scenario placement/navigation failure, not a semantic change to the core transition.
+
+## Assumptions and open questions
+
+- Nested source and contextual editors should reduce authoring effort; additional shorthand/grouping must justify grammar or interaction complexity through real tasks. Dense-view path overlap is not itself a failure when every actual identity remains accessible; arbitrary crossing-free layout is not promised.
+- Remaining native variants must establish useful engineering workflows: CM transitions, advanced OA process/SA chain/scenario reuse/fragment/order, typed state actions, compact/Linux/hosted cases, and uncovered saved-view lifecycle combinations. Do not expand or shrink required OA/SA scope merely to fit implementation convenience.
+- Latest diagnostic/reserved-label corrections have independent review and completed semantic/full-desktop/Clippy/build checks; their revised artifact rendering still needs native verification. The historical source6 process3012 closed cleanly. The6BAB source7 native build passed the scoped cases above;11060 and old6 recovery11240 closed cleanly. Old5 recovery/repair/save/model and current7 nested draft recovery/history/reopen pass on that binary. Later routing/hit-priority changes passed3focused/full564 desktop tests; root is running the server/format/strict/build sequence with results pending, and no corrected-render native acceptance is transferred. Exact binary scope is in STATE.md.
+- Historical Linux evidence includes x86_64/glibc2.39/ext4 core/MSRV and server/HTTP runtime. Current455-file snapshot SHA256 `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279` is frozen; core completed436passes/2ignored before clean VM shutdown08:13:56UTC; its original08:32:43UTC deadline was not reached. The hash-verified cross-built probe executed successfully on Linux, including its Windows macro/build-script build path, but no complete Linux GUI has been built. Syscall failure tests do not establish power-loss durability, network-filesystem behavior or cross-process model CAS. [Current Linux gate](release-source7-linux-gate-20260907.md).
+- Earlier Windows QA packages include runtime/notices and verified archive contents; final accepted-tree optimized distributions and exact provenance/checksums remain a release gate. [Packaging evidence](release-windows-package-review.md).
+
+## Current strategy
+
+The requested Windows preview and whole-run development summary are delivered; the summary is being refreshed with the confirmed package, full570/570 desktop result and final Fit/strict/build gates. Preview DC50 has bounded native launch/overview evidence, not complete minimum-height/pending-form acceptance. Computer Use stopped on user Escape, so leave live GUI processes untouched and advance independent verification.
+
+Preserve the successful immutable458-file Linux GUI cross-build with the Fit fix, exact ELF/package evidence and released compiler lease. Three subsequent guest boots reached terminal IO-APIC timer panic before any tests; exact-kernel extraction succeeded but automatic approval review denied the proposed transient workaround. All task VMs are stopped. Preserve the denied action and evidence without bypassing review. Its snapshot/run/hashes and actual process status belong in STATE.md and the cross-build report. Preserve the original interrupted runs, cache, native core436/2ignored and failed Linux timed-server fixture. The replacement private HTTP preparation test and full server56 pass on Windows; Linux execution remains required.
+
+Guide steps now name Tools/Selection details/Restore panels and the exact Reply label; formatting, independent label review and a fresh Windows workspace-binary build pass. The user-facing preview retains its original tested bytes. Independent full-model/source purpose oracles compiled and passed both self-checks and preserved baseline cases; complete their native authoring/history steps when control resumes. Complete current native OA/SA teaching, artifact, saved-view, process/scenario and hosted cases once control is available. Retain caller-specific budgets, actual port proof, independent channel validation and exact old5/6 recovery bytes. Final optimized packages, current platform gates and fresh independent end-state review remain open; architecture-only SVG and passing slices do not redefine completion.

harness/history/2026-09-10-ledgers-before-second-consolidation/hashes.json

@@ -0,0 +1,14 @@
+[
+  {
+    "file": "STATE.md",
+    "sha256": "24BC64C907A76D8B91A0C0592902DE8AECCC525B9E715363D05A3D4D53111D67"
+  },
+  {
+    "file": "PLAN.md",
+    "sha256": "D5C369B16410B5F5DD948B8E0E006748E7CB666AAD8486E91AFC4E9A8409F1A1"
+  },
+  {
+    "file": "TASK_LEDGER.md",
+    "sha256": "650852EAB950699F6348AFBA851CD9944AEE6F3BB7A0CEB51CA2B1D257F5D379"
+  }
+]

harness/release-behavior-creation-independent-review-20260910.md

@@ -0,0 +1,147 @@
+# Independent local behavior creation review — 2026-09-10
+
+Codex-9e8r6t /root/palette_finish. Read-only review of prepared
+`crates/oa-desktop/src/behavior/creation.rs`, its ten nested tests, the author's
+`release-local-behavior-creation-20260910.md` integration plan, current App
+execution/modal/recovery code and core eligibility rules. No production edits,
+Cargo or native Studio input. The module was not yet declared in the parent at
+review time; this is not compilation or acceptance evidence.
+
+Native comparison: `release-capella-creation-study-20260910.md`. The compact
+family/name/viewpoint card avoids Capella's separate chain semantic creation,
+rename and first representation actions. Explicit OA/SA viewpoint choice and
+source-versus-involvement language fit the observed distinction. The current
+SA boundary wording also respects Studio's actual System/SystemActor endpoint
+contract; it should not be broadened casually to all components.
+
+No material defect was found in the normal prepared command paths. Raw names,
+reserved IDs, family/layer restrictions, valid owner/context checks and failure
+retention are coherent. The opt-in first state view reuses its planner and
+substitutes stable presentation IDs, with no invented state/region. Recovery
+retains raw values and validates references when preparing. Whole-project and
+SourceBundle Undo/Redo/reopen checks are meaningful, although unexecuted at this
+boundary. A same-ID owner rename remains the same semantic identity; rejecting
+all such edits would not be justified by this review.
+
+Three bounded items were sent to the author and root before integration:
+
+1. **Command correlation is narrower than exact draft correlation.**
+   `created_by` matches CreateElement ID/layer/kind/name/parent and an optional
+   CreateDiagram projection, but not a scenario's viewpoint/context/body. A
+   prepared scenario command with only a different valid viewpoint or context
+   still matches. A batch containing the expected create followed by a rename
+   or deletion also matches because the recursive helper uses `any`. These
+   commands are not produced by this module's normal Submit; this is a boundary
+   hardening issue rather than a demonstrated UI failure. Compare the expected
+   command more fully or validate the resulting target before selection, and
+   test changed scenario body and later mutations in the same batch. Do not
+   describe the helper as exact full-command correlation before resolving it.
+
+2. **Captured Escape must preserve modal priority.** The plan correctly avoids
+   globally accepting captured keys. However, emitting Creation(Cancel) merely
+   because a draft exists is insufficient when a Save As, pending navigation,
+   hosted or model-menu overlay owns focus. Current App modal guards recognize
+   ordinary Escape specially. A creation-specific captured message may be
+   swallowed by those guards, or cancel the underlying draft if routed too
+   early. The added subscription must be scoped to the actual visible creation
+   card and respect overlay ownership. Require both a real focused creation
+   input first-Escape test and an overlay-focused captured Escape test proving
+   the underlying raw draft survives.
+
+3. **Minimum-size claims remain a layout/native gate.** `picker_view` limits its
+   candidate iterator to six and places actions outside the field scrollable,
+   which is a sound source-level structure. The 105-owner test only constructs
+   the view and asserts it exists; it does not assert rendered candidate count,
+   wrapping, action bounds or focus. Long Unicode names/aliases can create tall
+   rows. Verify six-candidate pagination and Create/Cancel reachability at the
+   minimum window, with optional scenario context expanded and machine owner
+   search, before describing this as verified usability.
+
+The author already identified the important shared integration risks: do not
+auto-apply a valid property draft while opening creation; include creation in
+all pending guards; select only after successful document execution; use the
+recorded layer for a recovered new SA behavior; retain simultaneous raw source
+and properties rather than calling a destructive sync; batch autofocus with
+existing lint work. These remain tests required of the actual integration, not
+additional confirmed defects in the standalone module.
+
+One deliberate UX limit remains: when a machine has no eligible participant,
+the card tells the user to cancel and create one in Architecture, losing this
+creation intent. A suspended draft plus local Create missing participant would
+better satisfy the revised goal and the observed OAS source-creation pattern.
+It is separate work from this module and must not be claimed as delivered here.
+
+## Integrated boundary review — 2026-09-11
+
+Codex-9e8r6t /root/behavior_audit. Independent read-only review of the uncommitted
+creation integration on `d114a271c5ecffcd7960fb8aa44d45989c10dc33`, after reading
+the revised PROJECT_GOAL, current Gitea decisions through #117, and the existing
+review above. The creation author retained the shared source/Cargo lease. No
+Rust edits, Cargo commands, native input, or new test execution by this reviewer.
+The author's concurrent owner/context label follow-up is outside this correctness
+review; App, behavior and checkpoint seams stayed frozen.
+
+**No additional confirmed blocker was found in the reviewed integration.** The
+earlier command-correlation and captured-Escape concerns have concrete code
+resolutions. This conclusion is bounded to the following source paths and
+counterexamples, not a claim of release or native acceptance:
+
+- **Command and success correlation:** `creation.rs:147` now compares the whole
+  deterministic prepared `Command`, including scenario body and every operation
+  in its batch. Changing only a valid viewpoint/context, adding a later rename
+  or delete, omitting the optional view, or presenting a different command cannot
+  inherit this creation's opening target. In `app.rs:851`, port-owner repair
+  leaves this Batch unchanged; correlation is captured before execution. Only
+  the success arm installs layer, new behavior selection, active owner and
+  opted-in state view. Rejection does not call sync or acknowledgement. Both
+  direct Behavior Submit and `apply_behavior` acknowledge after successful
+  execution. The first-view planner's temporary UUIDs are replaced with all
+  three reserved identities before comparison; the remaining planned fields
+  are deterministic for the current project.
+- **Pending and stale-input boundaries:** `app.rs:2303` rejects an Open event
+  from the previous layer before applying any draft, and creation Open uses its
+  own raw-property/source/pending guard instead of generic implicit Apply.
+  Existing owner/layer navigation and Undo/Redo pass through `apply`, which
+  refuses while creation is pending. Source/property edits and another behavior
+  Start cannot bypass that pending boundary. A retained creation draft rejects
+  field edits/preparation against a different Project ID; current owner/context
+  eligibility and reserved-ID collisions are revalidated before execution.
+  This is not a claim that every local form event carries a canvas-generation
+  token: it does not. No reachable cross-document semantic commit was identified
+  through the reviewed reset/busy/pending routes.
+- **Recovery and selection:** `app/checkpoints.rs:149` fully prepares recovery
+  before replacing the accepted document, reinstalls raw source and property
+  drafts, and uses `creation.pending_layer()` for a root-owned SA draft whose
+  selected project root has no layer. It does not resynchronize accepted text
+  after installing those raw buffers. A restored family-selected card batches
+  name focus with lint. Attempting Submit with simultaneous recovered property
+  or source drafts refuses before preparing/executing creation. The wrapper in
+  `behavior.rs:791` refuses multiple pending behavior drafts rather than choosing
+  one to discard.
+- **Escape ownership:** the new subscription receives only captured Escape and
+  maps it to ordinary `Message::Escape`; the existing subscription ignores that
+  captured event, avoiding a second ordinary Escape from those two listeners.
+  App handles model-menu, hosted, workflow, file, delete and pending overlays
+  before the creation-cancel arm at `app.rs:1756`. A first Escape therefore
+  dismisses the active modal while retaining creation; a subsequent Escape
+  cancels the local draft without a model transaction. Normal guards prevent
+  opening the model menu or architecture placement while creation is pending.
+
+Validation evidence read directly from `.local/behavior-creation-20260911/`:
+`focused-tests-4.log` reports 20/20 creation tests in 0.28 s,
+`behavior-tests.log` reports 166/166 in 13.35 s, and
+`checkpoint-tests.log` reports 13/13 in 2.26 s. These include the author's
+changed-body/trailing-command refusals, actual App selection and raw-input
+guards, a focused Iced TextInput captured-Escape path, and mounted candidate and
+pinned-action bounds. They are author-executed evidence, not an independent
+rerun. Native typography, optional-context expansion and the complete creation
+workflow remain root-owned acceptance. The missing-owner catalog detour above
+remains separate unfinished functionality.
+
+Frozen seam SHA-256 values for the reviewed source:
+
+```text
+app.rs             2CC2CF65CA0E2B999271BF6BE253D026102A4DA769D54A7BC9CF9982375B89F2
+app/checkpoints.rs B5D319E6FDA8DEC3CD068C362E9C35E941EACC32EDCD291D9F66E33A055209CF
+behavior.rs        C957C86226012F8A1E6ED406A6BBE3407424CCEA47C0994130483CE758C8C114
+```

harness/release-behavior-creation-oracle-20260911.md

@@ -0,0 +1,54 @@
+# Independent native creation oracle — 2026-09-11
+
+Codex-9e8r6t /root/behavior_audit. Owns only the new standalone
+`harness/behavior-creation-contract.rs`, fixture README and this report.
+No production Rust, Cargo, native input, commit or push. Read PROJECT_GOAL,
+Gitea issue1 through #120, open PRs (none), Integration3978bbe Wiki, preserved
+baseline and published first-view planner contract. Creation author confirmed
+the exact generated view name/projection/root-only contract before any created
+artifact was read.
+
+The fixture README defines the root's three literal native actions and separate
+creation/Undo/Redo/reopen checkpoints. Expected Project and SourceBundle are
+constructed with explicit core records/commands, using only fresh role-proven
+UUIDs from output. Desktop creation code is not imported. One optional first
+view is a single machine-root placement; the typed core Layout prediction is
+60,60, size 336×104, with nine exact source files after all three operations.
+Earlier diagrams, relations, traces and source comments remain unchanged.
+
+Direct-rustc compilation with `--edition 2024 -D warnings` passed at
+2026-09-11 08:51:12 UTC in 3.43 s; writer lease returned immediately. Self-checks
+and a complete unchanged-baseline check then passed. False metadata/geometry,
+changed scenario viewpoint/context, extra regions/files, unrelated metadata
+and same-model source-comment drift are rejected. These are harness validation,
+not native Studio acceptance. No created checkpoint has been inspected here.
+
+Artifacts under `.local/behavior-creation-oracle-20260911/`:
+`build.log`, `build-result.json`, `self-check.log`, `baseline-check.log`,
+`check-results.json`, `manifest.json`, `behavior-creation-contract.exe`.
+
+| Artifact | SHA-256 |
+| --- | --- |
+| Harness source | `65547C7E1259EB49EC2313184AA13BC1FEB3DBDD4B992A482CA682C9E0F2CF1D` |
+| Checker executable | `73FA81B205457D04700FD25BAE3769969EB9F8413B05D7C2F9C69F7D187A9BFF` |
+| Linked `liboa_core-3e81c616fea1d901.rlib` | `5018A1FD7286ED9DFEDCBBF5B68B399AD5D143F2A9AAAED3078CFC934C9589C4` |
+
+Preserved baseline is the whole directory
+`.local/native-qa/palette-20260910-v3/checkpoint-transition-reopen/`.
+SHA-256 values read before construction and again after harness execution match:
+
+| Source | Bytes | SHA-256 |
+| --- | ---: | --- |
+| `project.arcadia` | 4844 | `B35A3F63F223CC4FE2760D6308E87B016ED1EADFBEF0A3A4BD051B52C9080958` |
+| `rationale.arcadia` | 57 | `C01867C9DC0D40726853119FAC3C6AD24A40D8D362A93A8B9D20DF04EC2E273F` |
+| `traceability.arcadia` | 395 | `F778ACAAA85DE0940CEDCD9514CD803032A11E782D859454203235FEBB73E5F0` |
+| `oa/participants.arcadia` | 403 | `094CAB67F34B64902942C10A35BBCD0F760886D862588A0816D6CEB57BACF51B` |
+| `oa/activities/activity_assess_incident.arcadia` | 376 | `AE41D7C20B062B39C2EDAB7FB890A3D88A9CE18FD8D03018EF2D6F95EEFF62E8` |
+| `sa/participants.arcadia` | 124 | `FB975B83D3EC164C38936BF27FE7D2021CC46805574902A534744B040F7D3AE8` |
+
+Root owns native checks and release claims. Keep the first committed operation
+checkpoint as the role carrier for Redo/reopen so fresh replacement UUIDs cannot
+be mistaken for history preservation. `same` compares all identities and source
+bytes with a previously accepted checkpoint. The reused core transaction/layout
+and source updater define the published model/source contract; independent
+native observations must still establish UI behavior and transaction boundaries.

harness/release-capella-creation-study-20260910.md

@@ -0,0 +1,137 @@
+# Capella behavior creation study — 2026-09-10
+
+Codex-9e8r6t /root/palette_finish. Bounded native reference study under the
+revised PROJECT_GOAL; this is product evidence, not Studio acceptance.
+
+## Environment and limits
+
+Used the installed Capella 7.1 executable
+`C:\Users\User\capella-7.1.0.202606231255-win32-win32-x86_64\capella\capella.exe`
+through the Computer Use skill and `@oai/sky` only. Root granted exclusive native
+input and closed its saved Studio instance first. Launch was 18:42 UTC; final
+save and clean close were 18:56 UTC. Startup/project initialization consumed
+several minutes and briefly showed Windows Not Responding. No helper/user stop
+occurred. Fresh `sky.list_windows()` after Alt+F4 confirmed no Capella windows;
+the input lease was explicitly released to root.
+
+Selected actual returned launcher window 4326384 and workbench 3146748. Used
+new workspace `.local/capella-creation-20260910`, native-created project
+`Local Behavior Creation`, at 1010 × 760. Existing models were not opened or
+changed. Screenshots were inspected as Computer Use tool evidence; no separate
+screenshot archive is claimed. Saved XML provides independent semantic evidence.
+No Studio production edits, Cargo runs, or unrelated product evaluation.
+
+## Observed creation workflows
+
+1. Project workflow → Operational Analysis → **Define Operational Activities
+   and describe Interactions** exposed three explicit task links: OABD activity
+   breakdown, OAIB activity interaction, and OAS activity scenario. Selecting
+   OAS opened **New Activity Scenario**, with one Name field defaulting to
+   `[OAS] OperationalCapability 1`. Entering `Dispatch response` and accepting
+   opened that scenario. Viewpoint was selected through the named entry point,
+   before naming; no general element catalog or secondary viewpoint picker was
+   required. The project became dirty before the Name dialog was accepted.
+   Saved XML confirms an automatically created OperationalCapability owns the
+   scenario. Cancellation side effects were not tested.
+
+2. Inside the empty OAS, **Activities** followed by a canvas click opened a
+   **Transfer Dialog / Selection Wizard** with an eligible Operational Activities
+   tree, search fields, Available and Selected panes, and transfer arrows.
+   It contained Root Operational Activity in this fresh model. The dialog was
+   canceled. **Activity**, then a canvas point, instead created a new activity
+   and its visible lifeline without leaving the scenario. Saving confirmed
+   distinct Activity and InstanceRole identities and the representedInstance
+   reference. The new activity also acquired an explicit capability involvement.
+   This is stronger evidence than a tooltip alone for local missing-source
+   creation. Reusing an existing source through the transfer dialog was observed
+   up to selection UI, not completed in this pass.
+
+3. System Analysis → **Refine System Functions, describe Functional Exchanges**
+   exposed SFBD functional breakdown, SDFB functional dataflow, and FS functional
+   scenario. FS opened **New Function Scenario** with default `[FS] Capability 1`;
+   accepting opened a functional scenario. Its palette contained **System
+   Function**, **Functions**, and functional exchange tools, corresponding to
+   the selected function viewpoint. XML confirms kind FUNCTIONAL under a new
+   Capability. Component/entity/interface viewpoints were not exercised here.
+
+4. SDFB opened a Name dialog defaulting to `[SDFB] Root System Function`. Its
+   palette exposed Functions, Functional Exchanges, and Functional Chains as
+   insertion tools. The Functions tooltip explicitly distinguishes graphical
+   removal from deleting a semantic function. Accelerator choices included
+   Elements from Scenario and Functional Chain Elements; these were read, not
+   executed.
+
+5. From that dataflow diagram, **F8 / Show in Project Explorer** revealed the
+   root System Function. Its context menu **Add Capella Element → Functional
+   Chain** created `FunctionalChain 1` immediately. Renamed it `Dispatch chain`.
+   On the chain, **New Diagram / Table → Functional Chain Description** opened
+   a second Name dialog with default `[SFCD] Dispatch chain`; accepting opened
+   the chain workspace. Thus the exercised path involved separate semantic
+   creation, naming, and first representation creation. It was an owner-filtered
+   menu, not a global type catalog, but still a substantial detour from the canvas.
+
+6. In SFCD, **Function** under Involvements had the tooltip “Creates a new
+   Involvement Function referencing the selected Function.” A canvas point
+   opened **Select a Function to involve in Dispatch chain** with a filtered
+   System Functions tree/search. There was no visible Create new source action
+   in this picker. Canceled without adding an involvement. Other local tools
+   included Exchange, Exchange and Function, AND, AND Construct, Sequence Link,
+   and Function on Sequence Link. Their execution was outside this timebox.
+
+## Saved evidence
+
+Files remain in
+`.local/capella-creation-20260910/Local Behavior Creation/`.
+
+| Saved record | Identity / meaning |
+| --- | --- |
+| OperationalCapability 1 | `69d805a8-8a2f-4218-88f0-566bf0923e7f` |
+| Dispatch response | `b8de31f0-378e-423a-855c-eba3551ca645`, INTERACTION, owned by that capability |
+| OperationalActivity 1 | `30f0691c-a6d7-422d-abf2-fa1746e1b92b` |
+| InstanceRole | `f1b80b8b-7770-4b9d-aad7-0eb8da9be902`, represents that activity |
+| Capability involvement | `b9a781c1-ee73-49e0-a6ec-10d838f2b613`, involved activity reference |
+| Root System Function | `92c6eca2-6fcb-43d9-baa1-bd7b26e633f0` |
+| Dispatch chain | `4ae2255c-4c80-4173-b7f4-b5da43fafe97`, FunctionalChain owned by root function |
+| Capability 1 | `41ef1a86-f1b8-4c62-9ad3-19357d622b04` |
+| [FS] Capability 1 | `693543b9-e3f4-4fa1-a44c-efc5683f9d14`, FUNCTIONAL under Capability 1 |
+
+Final SHA256:
+
+- `Local Behavior Creation.capella`:
+  `829f7faa99907c1efd826c79289bd2a7f795cdab557ec91f3a7e13ddb93417e1`.
+- `Local Behavior Creation.aird`:
+  `354a74cfac5abe29188f3b644e79f84af6136fc67f968be43b4f4c663c0392a8`.
+
+## Proposed Studio application, distinguished from observations
+
+Preferred alternative: one compact **New behavior** entry with a small set of
+task choices; show only relevant name, viewpoint and ownership/context fields.
+For a scenario, explicitly distinguish OA activities/entities and SA
+functions/components. A task entry can preselect the appropriate viewpoint,
+but the choice must stay visible. Starting a named process/chain should open its
+authoring workspace directly after one validated command batch. A first view
+can be explicit where the model separates it. Do not copy Capella's implicit
+capability creation or its owner hierarchy into Studio: Studio's admitted
+ownership and optional semantic context are authoritative.
+
+Within scenario or chain authoring, a compact **Use existing / Create new**
+source choice can preserve work context and filter candidates by layer and
+viewpoint. The existing-source action must state that it creates a lifeline or
+involvement referencing the source. New source creation should be explicit about
+the source type and valid owner, preserve the pending authoring intent, and
+return directly to it. Capella's exercised OAS provides evidence for this local
+creation path; adding it to the chain picker is a proposed improvement.
+
+A viable lower-complexity alternative is a contextual **Create missing source**
+action that suspends and restores the current draft using the existing source
+editor. It avoids duplicating field editors but requires reliable focus, raw
+draft recovery and exact cancellation/history behavior. A single searchable
+global command catalog remains useful for expert discovery; making it the only
+creation route would retain the detour observed in current Studio.
+
+Key findings were delivered directly to /root/release_audit while that worker
+owned `behavior/creation.rs` and tests. OA process creation itself, component
+viewpoints, completed source reuse, chain involvement persistence, and recovery/
+Undo/Redo were not exercised in this bounded study; do not infer their success
+from these observations. The current Studio workflow still requires its own
+automated and native acceptance.

harness/release-integrated-gates-20260910.md

@@ -59,3 +59,46 @@ separate alternate-index check covers all 25 referenced notice files through
 checkout. Native Linux, a real Linux desktop/server archive, container execution
 and final optimized packages remain open gates. See the packaging reports for
 the explicit synthetic/full-graph versus real-Windows evidence distinction.
+
+## Corrected immutable desktop suite — terminal result
+
+The next combined executable, retained at
+`.local/scenario-workspace-20260910/tests-81668f9/arcadia-studio-tests.exe`,
+SHA256 `FF5999466032E4FBDD615969E349720EC6B29A5945F7E3A57CCF976D8A2736E7`,
+completed **631 passed,0 failed,0 ignored** in408.18 test seconds. The wrapper
+started2026-09-10T19:01:51.5576902Z and ended19:08:41.0622262Z,409.3798404
+wall seconds, exit0. Full log and result JSON are siblings. It includes both
+nullable-history fixes and the integrated scenario workspace/Back/OpenUse guards
+committed in3978bbe. The previous three failures are resolved by tested source
+changes, not by relaxed assertions. The creation files present in the input
+manifest were not yet declared and are not covered by this executable.
+
+Independent review then found retained Sensor state across same-size scenario
+owner/document changes. The two-line key correction and real mounted regression
+were committed as `d114a271c5ecffcd7960fb8aa44d45989c10dc33`; affected scenario
+tests passed53/53 (579filtered), logged in `scenario-sensor-tests.log` and its
+status JSON. This correction is later than the631 executable and candidate3
+GUI, so those earlier artifacts must not be relabeled as covering it.
+
+## Named creation and current combined suite — 2026-09-11
+
+The creation integration passed20 focused tests,166 behavior tests and13
+checkpoint tests before an additional reviewed owner-ancestry correction.
+After that correction and guide synchronization, final creation21/21 and guide3/3
+passed. Root then ran the complete immutable executable at
+`.local/behavior-creation-20260911/tests-final/arcadia-studio-tests.exe`, SHA256
+`864B0FE89D0DC33F19D8414531501CB4D9DC5E7527B925A16E74ACA0E1197E86`.
+Result: **653 passed,0 failed,0 ignored**,362.83 test seconds; wrapper
+08:41:23.6872357Z–08:47:26.6151440Z,362.9279083s,exit0. Matching source-input
+manifest, exact libunwind DLL, full log and result JSON are siblings.
+
+Strict desktop Clippy/all-targets/-Dwarnings subsequently passed after converting
+one nested conditional in `forms/history_fields.rs` to an equivalent let-chain;
+workspace fmt/check also passed. This is the only production change after the
+full653 snapshot. Affected history **63/63** passed15.67s, and the matching GUI
+rebuilt successfully19.86s. The original creation GUI40CF05…3F23 matched the
+full653 source, but was not natively used. Current native stage is
+`gui-verified/arcadia-studio.exe`,111163904bytes,SHA256
+`D4D9C2BD937E301FF1009D7CB93A34EE5AA6DFC837FF7E87D468C85371B20C31`.
+Its manifest verifies that the only changed input versus tests-final is that
+history let-chain. Native creation and broader release acceptance remain pending.

harness/release-library-candidate-review-20260910.md

@@ -0,0 +1,91 @@
+# Reusable library candidate review — 2026-09-10
+
+Codex-9e8r6t `/root`. This is a preimplementation falsification brief for the
+independent Codex-956atf library proposal, not a ratified semantic contract.
+The updated user objective explicitly requires reusable model libraries. Existing
+source includes and same-project sequence reuse do not close that requirement.
+
+## Evidence and engineering need
+
+Current `SourceBundle` compiles includes into one Project and one global alias
+table. `Project` has no library revision, instantiation correspondence or update
+baseline. Core reference visitors distinguish typed reference fields from text;
+their existing behavior must survive any extension.
+
+Capella separates shared library references from reusable model patterns. Its
+library can support several projects and other libraries, with reading and
+editing modes. This serves shared data definitions as well as reusable catalogs.
+[Official library concepts](https://github.com/eclipse-capella/capella/blob/master/doc/plugins/org.polarsys.capella.re.doc/html/09.%20Libraries/9.1.%20Introduction.mediawiki).
+
+Its pattern update workflow previews differences and allows individual merges.
+The valuable behavior is a reviewed change with identifiable effects, including
+new members and renamed existing members.
+[Official REC/RPL update workflow](https://github.com/eclipse-capella/capella/blob/master/doc/plugins/org.polarsys.capella.re.doc/html/08.%20Replicable%20Element%20(REC-RPL)/8.3.%20Update%20REC-RPL.mediawiki).
+
+The documented restrictions include missing referenced libraries and replacing
+a library version while its project is open. These motivate testing a portable,
+pinned snapshot and explicit update transaction in Studio; that is a proposed
+improvement, not a claim about newer Capella versions.
+[Official restrictions](https://github.com/eclipse-capella/capella/blob/master/doc/plugins/org.polarsys.capella.re.doc/html/09.%20Libraries/9.4.%20Usage%20Restrictions.mediawiki).
+
+SysML's namespace/import semantics distinguish member identity and visibility.
+This is useful evidence for separating a readable qualified name from an object
+identity; adopting those ideas would not establish SysML conformance.
+[SysML 2.0, section 7.5](https://www.omg.org/spec/SysML/2.0/Language/PDF).
+
+## Alternatives that must remain distinct
+
+| Candidate | Useful capability | Failure to probe |
+| --- | --- | --- |
+| Copy source/includes | Simple portable templates and normal local editing | No recorded correspondence or maintained update; repeat aliases/UUIDs collide. |
+| Live external references | One authoritative shared definition | Missing remote files, moving versions and offline reproducibility; local customization needs separate semantics. |
+| Generic definition/usage metamodel | Rich specialization and instance semantics | Large foundational rewrite; ordinary OA/SA records and source updater become dependent on unresolved new semantics. |
+| Pinned typed package plus explicit use/copy mappings | Offline reproduction, ordinary local records, reviewed updates | Duplicate representations, historical identity confusion and misleading generic merge can invalidate the apparent simplicity. |
+
+The last candidate warrants an experiment, but has not yet won independent
+review. Shared immutable definitions and editable pattern instances are separate
+user needs; one cannot silently substitute for the other.
+
+## Falsification cases and acceptance boundaries
+
+- Reuse the same package twice in one project and once in another. Preserve
+  origin identities, give editable instances distinct local identities, and keep
+  all internal/external bindings explicit. Repeated names must not select by the
+  first alias or UUID. A new package revision must not change an open project.
+- Extract a process with repeated occurrences, ports, scenario bindings,
+  diagrams, artifacts and an OA/SA trace. Define ownership closure separately
+  from external dependencies; neither omit needed references nor capture the
+  whole surrounding system. Show external connections requiring user binding.
+- A library revision must be reproducible offline. Its identity, schema and
+  content pin must survive text/API/export/reopen. A locator is not a content
+  identity. Loading or evaluating a supplied package must not fetch or execute.
+- Reidentify a local instance member. Its foreign origin and historical baseline
+  UUIDs must remain unchanged; local mapping targets and ordinary live references
+  must follow it. Deleting a foreign member must produce a reviewable update,
+  not a dangling reference or a name-based match to another object.
+- Compare old package, new package and local instance explicitly. Probe upstream
+  rename versus local description edit, conflicting rename, deleted locally
+  customized member, reordered occurrences, changed constructor and a new
+  mandatory binding. A whole-record equality merge must not discard unrelated
+  local edits. If a conflict is intentionally coarse, the UI must expose that
+  exact scope before acceptance.
+- Keep local geometry, artifact evidence and engineering mappings when taking an
+  unrelated upstream semantic change. Conversely, do not describe excluded
+  layout/trace content as synchronized. Detachment must preserve the current
+  usable model and remove only the explicit maintenance relationship.
+- Validate the complete model and writeback before committing a package update.
+  Source-budget failure, stale revision, invalid binding and cancellation must
+  retain the original Project, complete SourceBundle, raw draft and history.
+  Accepted update is one Undo/Redo boundary with exact UUID/source restoration.
+- Large catalogs need bounded contextual browsing: package/version → exported
+  task or definition → required bindings → impact. A single flattened list of
+  every imported identity would violate the current user guidance.
+
+## Next decision
+
+Receive the independent package proposal, compare its concrete record/source
+contract against these cases, then run a small pure-core experiment before any
+broad schema migration. Quantity and calculation definitions must be eligible
+for the chosen reuse contract without interpreting descriptive expression text
+or assuming that all UUID-shaped strings are live references. Native creation
+and scenario acceptance continue independently during this design investigation.

harness/release-local-behavior-creation-20260910.md

@@ -0,0 +1,80 @@
+# Local named behavior creation — 2026-09-10
+
+Codex-9e8r6t `/root/release_audit`. Read the full updated objectives, behavior gap audit finding 2, current core ownership/viewpoint rules, process header, state-view planner and draft/recovery adapters. Packaging stays frozen. Initial isolated preparation has now been integrated through the parent Behavior/App/checkpoint adapters in the root-authorized shared window. Native Studio input remains root-owned.
+
+**Current verification, 2026-09-11:** creation **21/21**, guide **3/3**, broader behavior **166/166**, checkpoints **13/13** pass. Root's immutable full suite passes **653/653**. The subsequent behavior-equivalent history lint correction passes affected history **63/63**, strict Clippy, workspace formatting and a matching GUI rebuild. Independent shared-seam review found no additional blocker; repeated-owner ambiguity was fixed and independently reread. Native acceptance is in progress. The mounted tests use the actual Iced widget tree with the unit renderer; they establish pagination and layout bounds, not native font shaping or whole-window acceptance.
+
+## Engineering task and design decision
+
+An engineer should start a named process, scenario or state machine inside Behavior, with a visible ownership/viewpoint decision, then immediately work on that behavior. Three small alternatives were considered:
+
+| Alternative | Benefit | Cost |
+| --- | --- | --- |
+| Three permanent creation buttons in every header | One click to a form | Adds permanent competing actions to already dense process/scenario tools. |
+| New → three task choices → one focused card | Keeps normal editing compact; only relevant creation decisions appear together | One extra choice click, and the current diagram temporarily gives way to the draft. |
+| Multi-page creation wizard | Explains semantics progressively | Separates name, ownership and viewpoint across navigation and increases correction/recovery burden for a small task. |
+
+Selected the second approach. It follows the existing compact workspace pattern without a generic kind catalog. The card's fields scroll, while Create/Cancel remain outside the scroll region. Machine owner and optional scenario context searches show at most six named candidates per page, with alias/kind and selected identity visible. No first match is silently selected. The optional scenario context starts collapsed so name/viewpoint remain the primary decisions; expanding or hiding it retains the authored reference and raw search.
+
+Concurrent native Capella study by `/root/palette_finish` observed OA task links OABD/OAIB/OAS. OAS opens a single name dialog with the viewpoint chosen through the entry link, without a global kind catalog. The project became dirty before accepting the dialog, suggesting a prerequisite capability side effect; this is an observation/inference to be retained in that study's own report. Studio's proposed explicit viewpoint choice serves the same task, with no implicit capability or shared-source creation. This source slice has not been compared against running Studio yet.
+
+## Implemented module contract
+
+`creation::State` owns a serializable raw draft, stable reserved semantic/view/placement UUIDs and a captured document identity. `Event::Open(layer)` presents three task choices; `Choose(Family)` selects a layer-correct Process/Functional chain, Scenario or State machine. A family/layer change while pending refuses until cancellation. `Cancel` clears only the draft and returns no command. `Submit`/`prepare_pending` produce a validated `Command::Batch`; acknowledgement is explicitly separate and must follow successful `Document::execute`.
+
+Names are retained exactly, including meaningful Unicode and whitespace. Blank names refuse. Scenarios require one of the two layer-specific viewpoints; `MixedLegacy` is unavailable for new creation. Current core containment permits Process/Scenario only at layer root; the card states that fact. Optional Scenario context is a separate same-layer reference matching the core's existing context contract. A State machine requires a valid existing same-layer participant owner. Missing sources are never guessed or created by this form.
+
+The first machine view is opt-in. Its geometry comes from the existing `state_edit::create_view` planner, with reserved view/root-placement IDs substituted and the exact expected CreateDiagram+Layout contract checked. The final batch creates only the machine and optional view; it invents no region, state or transition. The module returns `Created { behavior, layer, diagram }` for selection only after commit. Every prepare revalidates current owner/context, document and reserved-ID availability; stale references or source rejection retain all inputs.
+
+The initial ten nested tests covered: OA/SA sequence exact names and root ownership; all four explicit scenario viewpoints/context; both layers' owner validation and opt-in view without implicit states; cancellation and family/layer guards; raw recovery/stale owner/document; rejected source-budget transaction with exact accepted Project/SourceBundle/history preservation; search over 105 owners with same-layer/kind filtering and stale-page clamping; recovery-schema/reserved-identity rejection; command-correlated post-commit selection; and optional-context collapse/recovery retaining raw values. Shared Document tests compare complete Project and SourceBundle before/after Undo, Redo and reopen, preserving IDs rather than rediscovering them.
+
+## Review while shared compilation is frozen
+
+Four integration risks were identified before wiring. First, `apply_behavior` and direct Behavior Submit each execute and acknowledge; duplicated selection handling can diverge, while merely reading reserved IDs in generic App::execute can redirect an unrelated command. Added `creation.created_by(&Project, &Command)` which compares the complete deterministic prepared batch, including scenario body and all subsequent operations; unrelated or altered commands return no target. The shared execute path should use that helper, then select/open only on success and before syncing. Second, checkpoint restore currently infers a layer only through an existing selected or pending-owner element. A new rootless SA behavior instead requires its recorded `pending_layer`, without syncing away simultaneously recovered raw property/source text. Third, captured Escape is filtered globally; add a creation-only captured-Escape subscription, letting the ordinary route handle uncaptured events once. Fourth, always exposing the optional context list made six irrelevant choices compete with mandatory name/viewpoint; the section is now opt-in and retains its values when hidden.
+
+Further native Capella findings from the separate worker reinforce occurrence/source separation: named Functional chain creation was followed by a separate Functional Chain Description diagram action; its Function palette involved an existing function through a filtered picker, with no create-source option in that observed picker. Combining a named chain with its ready workspace is the intended Studio improvement. Additional shared-source creation remains a separately explicit operation.
+
+The preparation-stage review preceded source integration. Its command-correlation and captured Escape findings are addressed in the integrated code and tests described below; native UI acceptance remains pending.
+
+## Exact integration boundary
+
+Root accepted the following shared-file boundary; it is now implemented after the focused layout gate:
+
+1. Declare `pub(crate) mod creation` in `behavior.rs`; add `State.creation` and `Event::Creation(creation::Event)` plus outer recovery `RecoveryKind::Creation`. Extend capture/restore, `has_pending`, prepare and successful acknowledgement. Keep creation `pending_layer` distinct from `pending_owner`: a new behavior is not an existing owner and must not drive the old selected-owner fallback.
+2. Add New to the compact owner header and the empty Behavior view. If the creation card exists, render it before existing selected-owner lookup; map its local `Element<Event>` to `Message::Behavior(Event::Creation(...))`. Focus `creation::NAME_INPUT` when a family is chosen, including a restored named draft.
+3. In App, guard creation start explicitly against raw source/property/other-behavior drafts. **Do not use the current generic starts-form `self.apply()` path**, which can silently commit a different editor's valid draft. The layout worker independently identified and is repairing the analogous scenario-tool defect.
+4. In the common execute path, correlate `creation.created_by(self.project(), &command)` before document execution. Only after successful execution, set layer, selected semantic behavior, `behavior.active_owner` and optional `behavior.diagram.diagram`, then sync. Both direct Submit and `apply_behavior` acknowledge afterward. Failure must retain raw fields and prior accepted state; unrelated commands must never select reserved creation IDs.
+5. Handle first Escape for this creation card even when a text input consumes keyboard events, using a narrowly scoped captured-Escape route. Escape must create nothing, not apply another draft. Keep other behavior form semantics unchanged.
+6. Restore the creation draft's layer/name focus without creating anything, alongside existing behavior recovery. Add App-level tests for empty-project New → create/open, explicit all-draft guards, selection after commit, captured Escape, reserved IDs through recovery, source failure retention, and opening a lesson while a draft exists. Then compile/focused tests and run native Create/Undo/Redo/save/reopen at normal/minimum window sizes.
+
+No diagram/scenario-view files are owned by this work. Native behavior acceptance, broad release integration and task ledgers remain root-controlled.
+
+## 2026-09-11 integration in progress
+
+Read the full new objective `C:/Users/User/.codex/attachments/815ff7b9-73c4-41a2-a809-635ecf8389d6/goal-objective.md`, including the strengthened uncluttered text-only modeling requirement. The source creation uses the existing typed core/Document transactions, so names, ownership and explicit viewpoints are exercised through exact textual SourceBundle and JSON command round trips rather than separate graphical semantics.
+
+Root released the shared source window and sole Cargo lease after the corrected scenario 53/53 gate. State/Event/recovery/header, App command correlation and draft guards, checkpoint layer/name focus and captured Escape are now wired. The independent command-boundary finding changed `created_by` to `created_by(&Project, &Command)`: it compares the complete deterministic prepared batch before execution, caches its target, and applies selection only after success. This also refuses valid changed scenario viewpoints/contexts and creation batches followed by rename/delete. The captured-only subscription is active only during creation and emits ordinary `Message::Escape`, preserving existing file/confirmation/hosted/workflow/menu overlay priority.
+
+Twelve planner/Document/mounted-layout tests and six App tests are prepared. The new mounted test lays out actual creation widgets at 500×320, 500×570 and 1050×570, checks the field scroll region and footer bounds, and counts six rendered candidate containers among 105 long-name owners. A focused text-input test sends actual captured Iced Escape through file and pending-confirmation overlays, requiring the first Escape to close the overlay while retaining the draft and the second to cancel only creation. Native typography and whole-window acceptance remain separate gates.
+
+Two compilation attempts exposed local import/test typing errors, corrected without changing product semantics. The first executable gate passed 18/19: one new test incorrectly dispatched property `Message::Apply`, which deliberately refuses a pending behavior form. It now dispatches the actual generic Behavior Submit route and retains all machine/view/history assertions. A stale previous-layer New event now refuses without replacing any pending raw draft.
+
+Final focused verification passed **20/20**, 632 filtered, after 40.34 s compilation and 0.28 s execution (`focused-tests-4.log`, `focused-tests-4-status.json`). Broader behavior passed **166/166**, 486 filtered, in 13.35 s (`behavior-tests.log`, status JSON); checkpoints passed **13/13**, 639 filtered, in 2.26 s (`checkpoint-tests.log`, status JSON). All paths are beneath `.local/behavior-creation-20260911/`. The current total is 12 planner/Document/mounted tests and eight App tests. All earlier failure logs remain retained.
+
+Frozen test handoff: `tests-candidate/arcadia-studio-tests.exe`, 105,347,072 bytes, SHA256 `30FCD4E8258512064FD30B64C4F0249067A0318CE2ABDC6BB4D49504591E0000`. Sibling `libunwind.dll` is 190,976 bytes, SHA256 `F45604A12E8BCD839FD86F667C1BE1CC7C4F9DA2B3C69FF381AC708F0E1AE7D4`. `manifest.json` records actual source input hashes and the uncommitted integration boundary, including the scenario Sensor correction. Root owns full 652-test execution and native acceptance. GUI/strict Clippy are pending independent-review triage.
+
+## Final source and artifact checkpoint
+
+The initial candidate above is superseded by the following explicit snapshots; none was overwritten.
+
+Ergonomics review found that name/kind/alias alone did not identify repeated nested participants, while a collapsed scenario context lost even kind/alias. Candidates now show a name line and a second line containing kind, alias, layer and ancestor path; search includes that context. Selected and collapsed references retain the same distinguishing information. The new North/South station Pump regression proves search discrimination and the exact created machine owner. The reviewer independently confirmed this correction; long native text wrapping remains a runtime gate. Missing-owner creation still requires canceling and creating the participant in Architecture, a documented separate workflow limitation.
+
+The in-app Chains, Scenarios, States and Recovery guide topics now describe the actual named New flow, explicit viewpoints/root semantics, searched machine owner, optional first view, raw-draft guards, Escape and recovery. The final creation filter passes **21/21** in 0.31 s and guide **3/3** in 0.06 s (`focused-final` and `guide-tests` logs/status).
+
+Root executed the frozen `tests-final/arcadia-studio-tests.exe`: **653/653 passed** in 362.83 s. It is 105,356,288 bytes, SHA256 `864B0FE89D0DC33F19D8414531501CB4D9DC5E7527B925A16E74ACA0E1197E86`; source manifest and `full-desktop.log` / `full-result.json` are siblings. These results are root-executed evidence, independently read back here.
+
+Strict Clippy then identified one existing `collapsible_if` in `forms/history_fields.rs:582`. Root authorized its equivalent let-chain spelling. The conditional lookup, action and evaluation order are unchanged. Afterward **strict Clippy with all targets and -D warnings passed**, **cargo fmt --all -- --check passed**, **history filter 63/63 passed** in 15.67 s, and the matching GUI rebuilt in 19.86 s. Logs/status are `clippy-final`, `fmt-final`, `history-final` and `gui-lint-final` beneath `.local/behavior-creation-20260911/`. No duplicate full suite was run after this approved lint-only change.
+
+Final immutable GUI: `.local/behavior-creation-20260911/gui-verified/arcadia-studio.exe`, 111,163,904 bytes, SHA256 `D4D9C2BD937E301FF1009D7CB93A34EE5AA6DFC837FF7E87D468C85371B20C31`. Its sibling runtime DLL has the hash above. `manifest.json` records exact current input hashes and verifies that the only difference from the passing full-suite source snapshot is that history let-chain. Earlier `gui-final` (SHA `40CF0506AE29298D3CB958DD9BBD7312EFFFF3716BDC2D99DFFDFBE63EF43F23`) is preserved as the pre-lint build, not the final native handoff.
+
+Owned source files for integration: `behavior/creation.rs`, `behavior/creation/tests.rs`, `behavior/creation/app_tests.rs`, parent `behavior.rs`, `app.rs`, `app/checkpoints.rs`, `guide.rs`, and the approved narrow `forms/history_fields.rs` lint correction, all under `crates/oa-desktop/src/`. This report is the only owned harness narrative. Independent reports, root ledgers and native/oracle evidence retain their separate owners. No commits, pushes, index staging or native input were performed by this worker. Cargo writer lease was explicitly released after all terminal gates; palette_finish owns native cancellation/focus/long-label QA and root owns actual creation/oracle/save/reopen acceptance.

harness/release-palette-native-20260910.md

@@ -166,3 +166,62 @@ The subsequent process query found process 648 absent; stderr was empty. Root
 transferred the exclusive native-input lease to the independent Capella creation
 workflow investigator. A future current-build session can resume from the whole
 `checkpoint-actor` directory without redoing earlier accepted fixture creation.
+
+## Candidate 3: complete basic model and counterpart persistence
+
+Root resumed on 2026-09-10/11 with the whole Actor checkpoint in
+`.local/native-qa/palette-20260910-v3/resume-actor`. Executable SHA256
+`9BA479FB3B6DF2139E77D992396CEB0108EE039A916F694AB3BD19F54677FBE6`,
+process9312, isolated profile and runtime inputs in the stage's `process.json`.
+This binary includes the earlier scenario workspace but predates its corrected
+Sensor identity; it is not accepted for current scenario behavior or creation.
+
+At 1442×932 outer size, ordinary Activity tool → chosen point → focused name
+`Assess incident` → Enter created the root Activity at the clicked location.
+The canvas origin remained stable through the naming phases. Its independently
+required placement was explicitly set to (160,300), size224×94. The complete
+four-source intermediate bundle is retained as `checkpoint-activity`.
+
+Add existing showed only the compatible unplaced `Report status`; the unrelated
+SA Function and OA Capability were absent. Including already shown elements
+offered three Locate actions and one Add. The existing activity retained its
+seed UUID and was explicitly placed at (680,300). The interrupted earlier click
+had not placed it; a fresh observation established that before root continued.
+
+An explicit relationship form created Allocation `Performs`, Rescue team →
+Assess incident. The diagram then visibly nested the work beneath its performer,
+without changing the activity's semantic parent. The Interaction palette gesture
+connected Assess incident → Report status. F2 changed the activity display name
+to `Assess rescue incident`; its alias and the original authored Interaction
+name remained unchanged. Save passed the unchanged independent checker:
+**complete basic model and all four exact SourceBundle files**. The expected
+model adopted only fresh UUIDs proven through literal roles, never geometry or
+other observed metadata. `checkpoint-basic` and `basic-check.log` retain evidence.
+
+The native transition explicitly selected **System actor**, **Selected only**,
+and **System rescue architecture**. Apply opened that Allocation view, selected
+the new SystemActor, and retained the OA source. Its placement (60,60),224×94,
+typed trace, both decoy views and every source field matched the independent
+transition contract. The incompatible StateMachine destination was absent;
+Capabilities remained a legitimate but unchosen destination, visibly described
+as not an allocation view. **Complete transition model and six exact sources
+passed**, preserved as `checkpoint-transition` and `transition-check.log`.
+
+One Ctrl+Z followed by Save passed the complete four-source basic oracle;
+one Ctrl+Y followed by Save passed the six-source transition oracle. Distinct
+`checkpoint-transition-undo` and `checkpoint-transition-redo` copies and logs
+preserve those boundaries. Reopening the actual entry through the file picker
+succeeded. Reopening counterpart creation then displayed `Rescue team · SA`
+and `Reuse · Rescue team`, with review wording instead of a new counterpart.
+Cancel and Save passed the transition oracle again. All six physical files
+matched the pre-reopen snapshot byte-for-byte, including stable identities;
+`transition-reopen-bytes.json`, `transition-reopen-check.log` and
+`checkpoint-transition-reopen` retain that evidence. A durable wide OA image is
+`basic-reopened-oa.png`.
+
+This closes the declared main model/transition/history/reopen sequence at wide
+size. It does not close the supplementary meaningful-move/pan/zoom, invalid raw
+draft, minimum-size, allocated-work and recovered-focus matrix. An attempted
+border drag and native Size command did not visibly resize candidate3; no new
+minimum-window pass is claimed. Earlier candidate1/2 observations remain scoped
+to those executables. The app remains open pending the next verified GUI stage.

harness/release-scenario-lifecycle-independent-review-20260911.md

@@ -0,0 +1,38 @@
+# B4 lifecycle projection review — 2026-09-11
+
+Reviewer: **Codex-9e8r6t /root/behavior_audit**. Read the updated `PROJECT_GOAL.md`, issue #1 through comment 104, open PRs (none), and the integration Wiki. Reviewed verified local `codex/behavior-snapshot-eb5161b` through `git show`, with isolated read-only copies in `.local/scenario-lifecycle-review-20260911/`. No checkout, shared Rust edit, Cargo, native input or new executed Rust result. Creation owns shared wiring/Cargo; root owns integration/native acceptance.
+
+The 283-line pure module has no confirmed branch/reply/reuse propagation defect in this review. It reads exact local receiver IDs, never borrows a missing receiver from exchange endpoints, treats siblings independently, keeps conditional/repeated/parallel exits explicitly unresolved, and never traverses a ScenarioUse target. Replies remain correlation events, not births/deaths. Source/history purity follows from the borrowed inputs and absence of commands or serialization writes. The other host reports its ten tests passing in comment 102; those use hand-authored geometry and do not establish compatibility with the current Scene.
+
+Three concrete integration issues must be resolved before accepting B4 rendering:
+
+## 1. P2 — insertion bounds are not visible lifetime bounds
+
+`Scene::sequence` starts occurrences at **y=148**; `occurrences` records sequence bounds as **(initial y−42, final y−42)** (`behavior.rs:1234,1311,1526`). Visible lane guides instead run from **85** to **scene height−20**, where height is `max(final y+45,210)` (`:1261–1268`). B4 `sequence` uses the supplied span unchanged and `interval` drops zero-length spans (`scenario_lifecycle.rs:169–179,275`).
+
+Consequences of passing the current maps unchanged, as the handoff proposes:
+
+- An empty scenario has root bounds **106..106** but a visible guide **85..190**. Every pre-existing lifeline receives **no lifetime intervals and no uncertainty**, despite the chosen pre-existing-lifeline convention.
+- A scenario with just Create at row 148 has root bounds **106..198**, so its live interval ends at 198 even without Delete; the visible guide continues to 265. The proposed “continues to scenario bottom” behavior therefore leaves an unexplained 67 px tail. Nonempty root sequences also omit the 21 px region below the identity header.
+
+**Required integration change:** distinguish visible lifetime extents from insertion/activation bounds. Supply an explicit root lifetime span or a dedicated rendering span map; preserve the existing slot/activation maps. Use actual Scene geometry in regressions for an empty scenario and one Create with no Delete. The existing synthetic root span `0..600` cannot catch this mismatch.
+
+## 2. P2 — an open activation can continue beyond a branch-local death
+
+`activation_sequence` handles a correlated Reply and fragment splits, but treats Delete as the default no-op (`behavior.rs:1553–1640`). On an entered operand it draws an unreplied activation through that operand's end. B4 correctly switches that same path to Absent at Delete (`scenario_lifecycle.rs:239–241`). Keeping the existing activation geometry unchanged therefore produces contradictory geometry after an X.
+
+Concrete source-derived case: **Call A→B; ALT { left: Delete B; right: empty }**. The core lifetime ordering rule allows the earlier call and keeps the exclusive empty sibling independent (`validation.rs:1505,1766`); an ordinary admission assertion should remain part of the new regression. Current Scene arithmetic places the call at 148, ALT at 240, left operand at 343..435 and Delete at 385. The inherited call activation extends to **435**, **50 px beyond B's death at 385**. The right operand must retain its independent activation status.
+
+**Required integration change:** clip or explicitly terminate the activation's visible path at the local death while preserving the unresolved-call diagnostic and original correlation. Do not invent a Reply or close every sibling path. The test must inspect real Scene activation geometry alongside B4 lifetime intervals, with exact model/source/history unchanged.
+
+## 3. P2 — the interactive lane map omits valid incomplete lifelines
+
+B4 returns every direct Lifeline, including `represented=None` (`scenario_lifecycle.rs:80–84`). Current Scene computes positions and draws headers/guides for all those lifelines, but copies only represented ones into **`Scene.lanes`** (`behavior.rs:1215–1232`). That filtered map serves endpoint placement; it is not the complete rendering-position map.
+
+**Required integration change:** use the complete local `lane_x` map or a separate full rendering map for B4 intervals and markers. Indexing B4 output through `Scene.lanes` would panic or silently omit an unassigned lifeline. Preserve the existing placement eligibility filter separately. Add an ordinary warning-admitted unassigned-lifeline fixture, including an explicit local receiver with unresolved exchange, and verify marker/header selection retains real IDs.
+
+## Acceptance boundary
+
+These are source-derived integration findings, not claims of a running B4 UI defect: the module is still standalone on this host. Its pure state rules can be integrated after the three boundaries above are addressed. Also pin receiver geometry when wiring self-Create/Delete: current self arrows arrive at `row+24` while B4 markers use the recorded row, so endpoint adaptation must deliberately align the capsule/X and arrow. This alignment was already required by the author's design and is not a fourth newly discovered semantic defect.
+
+The new text-only usability requirement does not justify adding source annotations for derived lifetime geometry. Create/Delete, operands, explicit lifelines and ScenarioUse bindings already carry the semantics. Keep interval/marker/uncertainty state derived, preserve accepted text exactly, and use real graphical/source/API fixtures plus minimum/wide native checks for integration acceptance.

harness/release-scenario-workspace-20260910.md

@@ -47,7 +47,7 @@ The GUI build passed in **4m17s** (`gui-build.log` and `gui-build-status.json`).
 
 The correction keys the actual canvas Sensor by `(document, scenario)`. A new mounted regression opens a different owner with exactly the same pane dimensions, then replaces the document while retaining the owner UUID and dimensions; both must re-observe the viewport and make Fit work immediately. Existing scrollable/observer identity and camera restoration remain unchanged. The corrected complete scenario filter passed **53/53**, 579 filtered (**632 total**), in 30.90s after a 2m17s compile. It includes eleven workspace tests. Evidence: `scenario-sensor-tests.log` and matching status JSON.
 
-Scoped rustfmt and diff checks pass. After this gate, root explicitly transferred shared App/behavior/checkpoints integration and the sole Cargo writer lease to the creation worker. Exact shared boundaries were handed over; this worker has stopped Rust edits. Root owns the sensor correction commit and final combined GUI/fmt/strict Clippy after the creation focused gate. The corrected/combined GUI and native acceptance remain pending. Root's earlier immutable artifact had 615 passes and three failures; all three failing cases now pass the focused current gates above. The full 631-test run belongs to root and must not be duplicated.
+Scoped rustfmt and diff checks pass. After this gate, root explicitly transferred shared App/behavior/checkpoints integration and the sole Cargo writer lease to the creation worker. Exact shared boundaries were handed over; this worker has stopped Rust edits. Root owns the sensor correction commit and final combined GUI/fmt/strict Clippy after the creation focused gate. The corrected/combined GUI and native acceptance remain pending. Root's earlier immutable artifact had 615 passes and three failures; all three failing cases now pass the focused current gates above. On resumption, root's `tests-81668f9/full-desktop.log` and `full-result.json` confirm the subsequent immutable full run **631/631 passed in 408.18s** (409.38s wrapper wall time), executable hash `FF599946…A2736E7`. This full result predates the Sensor correction, whose affected 53-test gate passed separately; no duplicate full run was performed.
 
 ## Native handoff and remaining limits
 

harness/release-textual-usability-audit-20260911.md

@@ -0,0 +1,150 @@
+# Text-only systems engineering usability audit — 2026-09-11
+
+Author: Codex-9e8r6t /root/palette_finish. Coordination: Gitea issue #1, comment 105. Scope: the complete `815ff7b9-73c4-41a2-a809-635ecf8389d6/goal-objective.md`, especially human/AI text authoring, low cognitive load, and small/large systems. Source snapshot sampled at `d114a271c5ecffcd7960fb8aa44d45989c10dc33`; shared creation integration was in progress. This is an independent static task walkthrough, not a timed user study, executed language test, native acceptance, or ratified notation redesign. No production edits, Cargo, or native input were used.
+
+## Main finding
+
+The existing notation can express the three tasks without diagrams. Its concise authoring capabilities are stronger than its canonical examples suggest. The larger obstacle is maintaining an engineering context across declarations and files: finding the right reference, understanding definition versus occurrence, safely changing all uses, and knowing which omissions change meaning. Shorter syntax could help, but cannot by itself supply those capabilities.
+
+Preserve the useful foundations: one typed model; readable alias references; stable UUID identity distinct from names; forward references; explicit allocation and reuse; strict structural checks with advisory completeness warnings; per-file drafts and one atomic bundle Apply; source-preserving updates. Evaluate authoring improvements against those properties rather than replacing them with implicit name matching or silent repair.
+
+## Evidence and method
+
+Read production parser/conversion in `crates/oa-core/src/language.rs` (identity at 1226, version admission at 1404, defaults/ownership at 1634–1684), bundle compilation/updating in `crates/oa-core/src/source_project.rs` (286, 759, 780), the language reference sections 4.2–4.3 and 6–8, and the source editor/navigation/workspace implementations. Read the release1 engineering walkthrough and its OA process/scenario modules, plus the older nested `examples/source-project/oa.arcadia` as an ownership/allocation teaching pattern. The older example is a migration fixture, not evidence that a new source-7 recipe was executed.
+
+Current editor evidence: `views.rs:1115` mounts a highlighted plain text editor; the source toolbar offers Apply all, Revert file, text/model Undo/Redo and Find/go. `source_navigation.rs:29` searches the supplied current buffer literally and case-sensitively; `app.rs:2900` supplies only that buffer. File navigation, diagnostic/related-location navigation, and selected-model-to-source navigation (`app.rs:2883`) exist. The reviewed source path exposes no source-token go-to-definition, project-wide reference search/rename, completion, or folding. This is a statement about the inspected production UI, not a claim that the core lacks symbol information: `language::analyze` and the compiled SourceIndex already expose declarations and locations.
+
+Counts below were computed read-only with PowerShell over exact checked-in text. A UUID clause means `id "<36-character UUID>"`. A default line means a complete line containing only empty description/precondition/postcondition/guard or `parent none`, plus indentation/semicolon. Reference count means lexical `@alias` occurrences. Counts describe these examples, not minimum language cost or measured cognitive load.
+
+| Source artifact | Lines | UUID clauses | Counted default lines | Reference occurrences |
+| --- | ---: | ---: | ---: | ---: |
+| `examples/release1/oa/behavior/process_oa_response.arcadia` | 128 | 14 | 31 | 30 |
+| `examples/release1/oa/behavior/scenario_oa_conversation.arcadia` | 64 | 5 | 10 | 18 |
+| `examples/release1/oa/behavior/scenario_oa_full_scenario.arcadia` | 41 | 4 | 7 | 12 |
+
+The complete release1 example has 30 `.arcadia` files, 258 UUID clauses and 483 reference occurrences. It is a useful modular teaching fixture, not evidence of large-model performance. Desktop admission allows 256 files, 64 MiB source, 100,000 graph objects, 250,000 records and 500,000 ordered references (`source_workspace.rs:10`); limits alone establish no usable latency or navigation scale.
+
+## Task 1 — start a small operational model entirely in text
+
+Engineering intent: a vessel reports distress; a rescue team assesses the report. State participants, work, responsibility and the exchange before drawing anything.
+
+Current steps:
+
+1. Create/open a source entry, or edit its existing project body. Use source version 7. Keep the existing project's identity if extending it.
+2. Declare the two participants and two activities. Choose unique aliases and readable display names independently.
+3. Add an allocation from each participant to its activity. Add an interaction from reporting to assessment. Work decomposition/lexical nesting is a separate choice and does not substitute for allocation.
+4. Apply all; read located errors and advisory behavior-coverage warnings. Save the returned stabilized source, including generated IDs. Later edits must retain those identity clauses.
+
+A candidate first-authoring recipe using existing grammar follows. It is statically derived from production defaults and relation requirements, **not parser-executed in this audit**:
+
+```text
+arcadia 7;
+project distress "Distress response" {
+    oa_actor vessel "Vessel in distress" {}
+    oa_entity rescue "Rescue coordination" {}
+    oa_activity report "Report distress" {}
+    oa_activity assess "Assess incident" {}
+    allocation vessel_reports "Crew reports" { source @vessel; target @report; }
+    allocation rescue_assesses "Team assesses" { source @rescue; target @assess; }
+    interaction distress_report "Distress report" { source @report; target @assess; }
+}
+```
+
+This requires eight declaration aliases including the project and six endpoint references; it requires no handwritten UUID, diagram, node placement, empty description, or explicit root parent. Successful stabilization would insert eight identities. Missing behavior context should remain a warning, allowing this useful intermediate model to be saved. The core/parser contract supports this staged authoring; blanket completion requirements would make the task harder.
+
+Avoidable burden: a newcomer copying canonical text learns IDs and empty defaults before engineering relationships. Keywords plus aliases plus names can also obscure which label to change: renaming the displayed activity requires changing its string only; changing the alias requires repairing its references; changing/removing an accepted UUID is an identity change. These are different tasks and deserve a compact explanation next to the recipe.
+
+The seven semantic records here are not all boilerplate. Explicit allocations and the directed interaction are the engineering assertion. Any shorthand experiment must preserve the distinction between work ownership and performer responsibility. A text-only user should not need an architecture view to discover that distinction.
+
+## Task 2 — reuse meaningful behavior without copying its definition
+
+Use the release1 pressure-restoration model: reuse the reviewed repair call/reply conversation inside a larger scenario; separately use an assessment or field procedure in a process/chain.
+
+Current scenario steps:
+
+1. Open `oa/behavior/scenario_oa_conversation.arcadia`. Identify its viewpoint, context, semantic participants, two lifelines, ordered Call/Reply and reply correlation. Reuse the scenario alias, not its name.
+2. In the caller module, declare the larger scenario with explicit `viewpoint ParticipantInteraction`, suitable context and engineering pre/postconditions.
+3. Declare caller lifelines representing the same controller/technician (or a valid explicit role realization). These are local participation records, not new semantic participants.
+4. Declare an occurrence whose `body` is `ScenarioUse`, reference `@oa_conversation`, and write both `{ referenced @callee_line; local @caller_line; }` bindings. Include that occurrence in the caller's explicit `steps` list and give it the caller as semantic parent.
+5. Apply all and inspect binding/viewpoint/recursion diagnostics. Change the reviewed conversation once and verify both callers still refer to that definition. Delete only the use to remove one usage; do not delete the shared definition.
+
+Current process/chain steps:
+
+1. Inspect the reusable same-layer process/chain and its work contribution aliases.
+2. Add a `SequenceReference { sequence @definition; }` occurrence under the caller and include it in `steps`.
+3. Author explicit SequenceLinks for precedence/guards. The `steps` list does not synthesize branching links. To connect inside a reused procedure, a source-7 ContextualLink carries the reference-occurrence path and leaf occurrence; the sequence definition ID alone does not identify one use.
+4. For two uses of the same procedure, choose the intended occurrence path explicitly. Validate the whole bundle, preserving the callee and the other use.
+
+Useful existing features: no copied activities, exchanges or scenario definition; explicit lifeline mapping; recursion checks; strict viewpoint compatibility; distinct identities for repeated reference occurrences; contextual links that can target one contribution without changing the reusable definition. Lexical nesting can remove redundant `parent` fields, but still requires explicit `steps`, links and binding pairs. This is documented semantics, not missing parser inference.
+
+Avoidable burden: the author must inspect multiple modules, carry global aliases in working memory, and translate an engineering statement into constructor wrappers, membership lists and ownership. The existing 41-line caller spends seven lines on counted defaults and four headers on UUIDs. Those costs can be reduced by authored examples and presentation without removing essential binding or occurrence information. An abbreviated form that silently binds same-named lifelines would hide errors; a context-aware insertion operation that previews exact aliases could help both human and AI editing.
+
+Specific omission trap: `language.rs:1668–1672` assigns `MixedLegacy` whenever a scenario lacks `viewpoint`, including source 7. The accompanying comment and documentation explain legacy preservation. A new text author omitting the field therefore gets legacy semantics with a warning, not a strict OA/SA viewpoint chosen from intent. Recipes should make viewpoint explicit and diagnostics should explain the choice. Changing backward compatibility or introducing new shorthand is a separate decision.
+
+## Task 3 — safely change a large modular model using text
+
+Representative change: rename a work alias, move its declaration into a better module, and change an exchange endpoint while preserving unrelated comments, identities and reviewed links. First rehearse on release1; then use a purpose-built larger fixture with repeated display names and many modules. The latter has not been run here.
+
+Current steps:
+
+1. Start from the accepted source bundle and a known saved/revision baseline. Determine whether the request changes a name, alias, identity, ownership, allocation or actual exchange contract. Keep existing UUIDs for surviving objects.
+2. Locate the declaration through its file or selected model object. For a text-only author starting at a reference, current in-app Find requires switching to and searching candidate files. An external editor/`rg` can search the bundle, but raw replacement also matches comments, strings and longer aliases unless carefully constrained.
+3. Edit all affected buffers before Apply. Repair every alias use across modules. Move the declaration with its ID and update include directives as needed. A module move creates no namespace or implicit parent; lexical reparenting changes model ownership and must be deliberate.
+4. For semantic retargeting, inspect dependent allocations, ports, behavior occurrences, lifelines, contextual paths and traces. The compiler catches invalid candidates, but structural validity alone cannot prove that the new endpoint is the engineer's intended endpoint.
+5. Apply all once. `App::apply_source` compiles the reachable bundle before adoption; failure preserves drafts and the accepted model. Located diagnostics and related declarations help repair errors. Successful Apply is one model history operation; save/reopen and examine the source/semantic diff against the baseline.
+
+Useful existing guarantees: cross-file forward resolution; duplicate aliases/IDs with related locations; explicit include graph; compiler with no ambient filesystem/network reads; stabilized UUIDs; raw draft retention; model/source transaction equality; surgical accepted-model updates that preserve unchanged fields/comments/files; revision/ETag protection for hosted bundle changes. Canonical export is explicit and separate from Apply. These are strong prerequisites for AI editing and review.
+
+Remaining usability burden: files do not provide alias namespaces, so large projects need a global naming discipline; a clean module layout alone does not solve collision handling. Text-only alias rename lacks an exposed semantic refactor. The canonical model representation makes broad regeneration tempting, yet accepted identity and authored trivia must survive. An AI given stale or pre-stabilized buffers can accidentally recreate objects by omitting IDs. Provide accepted-source/revision context and a bounded patch workflow; do not equate valid generated text with preservation of engineering intent.
+
+Syntax/conversion parsing may stop at the first error. Incremental feedback is therefore valuable, but a cascade of manual Apply attempts should be measured before adding speculative syntax recovery. Warning counts and task-relevant locations should remain visible without forcing completion of the entire engineering model.
+
+## Priorities, alternatives and falsifiable acceptance cases
+
+These are proposed experiments and gates for root synthesis, not requirements already implemented or measured.
+
+| Priority / hypothesis | Bounded option and alternative | Acceptance case |
+| --- | --- | --- |
+| P1: authors can already start with substantially less clutter | Add current-version task recipes that omit safe defaults and initial IDs, followed by the stabilized result. Alternative: an editor snippet using exactly the same grammar. | A first-time author completes Task 1 without diagrams or manual UUID work; compile/save/reopen preserve all seven semantic records and six endpoints; second edit preserves all IDs; expected coverage warnings do not block progress. Compare errors/time with canonical-example-only guidance. |
+| P1: cross-file context costs more than token count | Project-wide symbol search, source-reference definition/references, and an explicit alias-rename preview using parser identity. Alternative: expose the same language service to an external editor instead of building a richer native editor. | In a 100-module fixture with 1,000 declarations and repeated display names, locate the intended work by kind/layer/owner and inspect all typed uses. Rename one alias atomically; no UUID changes, comments/string lookalikes untouched, no omitted cross-file uses; malformed unrelated drafts remain retained. Measure navigation actions and p95 latency rather than declaring success from model size. |
+| P1: reusable behavior needs identity-aware assistance | A text insertion recipe/command that asks for family, viewpoint, callee and caller bindings, then previews ordinary source. Alternative: concise manual examples plus definition/reference navigation. | Reuse one conversation twice; local lifeline IDs remain distinct, both uses resolve to one definition, reply correlation remains in the callee. Wrong viewpoint/represented object and recursive use are diagnosed. A contextual link targets only the first of two chain references; the callee and second use are unchanged. No silent name matching or copied definition. |
+| P1: safe changes must be reviewable by humans and AI | Baseline-aware multi-file patch/preview with semantic change summary. Alternative: external Git diff plus existing atomic bundle API and explicit revision checks. | Rename a display name, rename an alias, and move a declaration as three separate cases: expected identity/reference changes only. Retarget to a structurally valid but unintended object is visible in the summary. Stale base, dangling reference and incompatible retarget refuse adoption while preserving all raw drafts; repair succeeds as one transaction and Undo restores exact accepted source. |
+| P2: canonical detail should be available without dominating authoring | Optional editor folding/dimming of identity clauses and unchanged defaults, preserving exact source and reliable copy/search/diagnostics. Alternative: author-focused formatter/export distinct from canonical export, with explicit preservation guarantees. | Compare the 128-line process task in both presentations; author correctly identifies branches, guards, reusable definitions and occurrences. Selection/copy/patch/save preserves every hidden identity. Normal Apply never expands omitted defaults or reorders authored text. No improvement claim based on fewer visible lines alone. |
+| P2: module names need to support discovery and collision management | Document alias conventions and offer collision-aware proposals/search. Alternative: later evaluate explicit namespace/import qualification with migration and ambiguity rules. | Two modules contain same-named work with distinct aliases; author resolves each from a reference without guessing. A colliding new alias reports both definitions and retains draft. Moving a module preserves resolution. Any namespace proposal must outperform current global aliases on these tasks before ratification. |
+
+For these studies collect task completion, incorrect semantic assertions, unnoticed identity replacement, number of file/context switches, diagnosis/repair attempts, and subjective confidence. Syntax length is a supporting measure. Include both engineers editing manually and an AI producing reviewed patches from the same bounded task; test small models and repeated-name modular fixtures. Do not infer large-system usability from a parser throughput test or a single tutorial.
+
+## Concrete documentation corrections for the owning worker
+
+1. `docs/language.rst:1599` still defines `document = "arcadia" "5" ...`, while the surrounding section uses source 7 and production admits 3–7. Make the grammar's current form consistent and explain migration separately.
+2. `examples/release1/README.md:68` and `:73` describe/expect schema 6, but `examples/release1/model.json:3106` is schema 7 and the entry declares source 7. Correct the two expectations.
+3. Explain omitted viewpoint behavior for new textual scenarios explicitly; the current parser applies MixedLegacy beyond schema-2 migration. A fresh strict scenario recipe must not rely on omission.
+
+No source changes or validations are claimed by this report. The candidate minimal recipe needs an executable core round-trip gate before becoming teaching material. Native source-editor performance, discoverability, keyboard use and minimum-window readability remain unmeasured here. These findings complement the creation/behavior/native work; they do not establish release acceptance or authorize a new notation.
+
+## Executed follow-up — existing source-7 REST server, 2026-09-11
+
+This appendix supersedes the preceding **unexecuted** qualification for the Task 1 recipe and the fresh explicit-viewpoint snippet added to `docs/language.rst`. Root separately authorized a bounded non-GUI experiment. It does not supersede the static-only qualification for the reuse/large-model walkthroughs or establish native/overall release acceptance.
+
+The existing executable `.local/target-gnullvm/debug/arcadia-server.exe` reports `arcadia-server 0.2.0`; `--help` exposes a REST service, not a standalone parse/check CLI. Executable size is 39,743,488 bytes, SHA256 `efeeb89c0d2e0f93df4472cb3e9f48b2b722a37ae1043c90a5a56f2e845fe665`. This matches the preserved Windows server documented in `release-source7-native-acceptance-20260907.md:84`. The binary's timestamp alone does not establish its grammar version; the initial suspicion that it predated source 7 was withdrawn before drawing a result.
+
+Compared preserved snapshot `.local/linux-qa/runtime/source7-20260907T082753190288Z.tar.gz` (SHA256 `cbb371a93a562e1e641d7629fe351e016d63e66fc9112499b3fed6d5cd171f78`) to the current core/server: **all 120 files match byte-for-byte, with identical file inventory**. `provenance.json` retains each digest and `review-results.json` verifies the set equality. This establishes relevant source correspondence to that preserved snapshot and the documented binary lineage; it is not a fresh build of today's entire desktop workspace.
+
+Experiment artifacts live in `harness/experiments/textual-authoring-20260911-local/`. `run_experiment.py` starts only its own hidden server with a private fresh store and `--bind 127.0.0.1:0`. It imports each exact single-file SourceBundle, retrieves accepted source/model, and uses conditional source-project PUT with the returned ETag. A final restart checks persisted source/model. The server is stopped afterward; no server remains from this experiment. No Cargo, Rust/direct-rustc, desktop launch, or native input occurred.
+
+**Complete run: PASS, 26 real HTTP requests, 0.902 seconds measured script wall time.** This small-fixture timing is not a throughput or large-model latency result. Independent semantic expectations were written in the experiment before comparing responses:
+
+| Case | Verified accepted meaning | Normalization and next edit |
+| --- | --- | --- |
+| Exact Task 1 OA recipe | Exactly four root OA elements: Actor vessel, Entity rescue, Activity report, Activity assess; exactly two participant→activity Allocations and one report→assess Interaction with empty carried-items list; no diagrams, artifacts or traces. | Only eight UUID clauses inserted, including the project; all other input bytes preserved. Rename only `Assess incident` to `Assess incident carefully`: same complete model except that string, all IDs/endpoints/aliases unchanged; accepted source equals the exact requested one-string patch. |
+| Documented fresh OA scenario | Exactly one root Scenario, explicit OperationalActivity viewpoint, no context, empty pre/postconditions and steps; no relations, diagrams, artifacts or traces. | Only two UUID clauses inserted. Rename only its display name to `Assess the reported distress`: exact identity/model/source preservation outside that string. |
+
+For **each** case, resubmitting the stabilized bundle returned `changed: false` with unchanged ETag and exact source; the name-only edit returned `changed: true` with a new ETag. Reusing the old ETag returned 412. Appending an invalid declaration returned 422. Both rejections left accepted source and model unchanged. After restarting the server on the same private store, both complete models and source bundles matched the saved post-rename values exactly.
+
+The successful PUT diagnostics confirm staged authoring works: the OA recipe produces two `work_without_behavior_context` warnings and one `exchange_without_behavior_context`; the empty explicit-viewpoint scenario produces one `empty_sequence` warning. They do not prevent acceptance. These exact warning lists were separately asserted from the recorded responses in `review-results.json`.
+
+The first attempt had an experiment-only JSON-shape mistake in the scenario assertion after the OA case passed: expected `Shared/layer/body/Scenario` instead of the schema's `Oa/Shared/Scenario`. The existing release1 JSON and production model enum independently confirmed the correction. Both source inputs and every semantic expectation remained unchanged. Initial response/failure artifacts are retained; the passing count comes only from the subsequent complete run.
+
+Exact submitted/accepted source newlines are retained inside the JSON response/summary strings. Standalone `.arcadia` text snapshots use the host's Windows newlines; the preservation assertions compare the original HTTP strings before snapshot writing, so those display files are not a claim of byte-identical transport capture.
+
+This closes the bounded executable acceptance gap for the two snippets, including first identity stabilization, a safe subsequent edit and retained persistence. It does not test GUI Undo, editor discoverability, aliases across modules, scenario reuse, large-system performance, or an AI authoring task. The prioritized acceptance cases above remain proposed work.