Merge commit '1a3164b' into codex/data-contract-integration

harness/STATE.md

@@ -2,6 +2,23 @@
 
 ## Objective and phase
 
+Direct process/chain editing is frozen in `codex/process-direct` at production
+8bc564b, based on 1bf8ebc, in `D:/CodexBuilds/Capella2-scenario-direct`. The prior
+scenario branch is retained. Independent review found and this revision fixes
+the empty-owner → first exchange continuation dead end: **Append exchange…**
+captures the last ordered contribution and creates the next occurrence plus its
+explicit sequence link in one validated model/source Batch. No mode flag or
+arbitrary topology is added. Both OA/SA regressions cover exact source history,
+reopen, preservation of longer ordered paths and incompatible-source rejection.
+Full Windows desktop tests pass 305/305; strict all-target desktop Clippy and
+optimized build pass. Original independent core topology/diagnostics/nested-source
+verification remains 19/19 at 7a1e12b. The current frozen binary, manifest and logs
+are at `D:/CodexBuilds/Capella2-scenario-target/freeze-process-8bc564b`.
+`release-process-editing.md` records behavior, verification and exact artifact hash.
+No native operation was performed by this worker. Root review/native follow-up
+must include empty → first exchange → Append exchange on Windows/Linux. The
+accepted model/source/API contract is unchanged; cross-reference inner-chain
+linking and disconnected exchange-only topology remain explicit model boundaries.
 Direct scenario work is now in isolated `codex/scenario-direct`, checkout
 `D:/CodexBuilds/Capella2-scenario-direct`, base ab661f2, dedicated target
 `D:/CodexBuilds/Capella2-scenario-target`. Scope and acceptance are recorded in

harness/release-process-editing.md

@@ -0,0 +1,186 @@
+# Direct process / functional-chain editing
+
+Status: implementation and automated Windows verification passed on 2026-09-06 in `codex/process-direct`, based on
+1bf8ebc in `D:/CodexBuilds/Capella2-scenario-direct`; dedicated target remains
+`D:/CodexBuilds/Capella2-scenario-target`. The prior scenario branch is retained.
+No native acceptance is claimed; root owns Windows/Linux native operation.
+
+## Decisions and observable outcome
+
+An engineer can involve existing work/exchanges more than once, draw guarded
+sequence links and controls, insert on a selected path, reconnect its endpoint,
+inspect/reuse a subprocess, and undo/save/reopen with contextual identities intact.
+Extend the existing derived topology graph and ordinary typed drafts. No core
+schema, persisted geometry, source grammar or REST route is added.
+
+Palette tools capture document/owner/revision/epoch and a specific contribution,
+link or presentation slot. Canvas click-click and drag connect local occurrence
+IDs. A link insertion preserves the captured link UUID, alias, description and
+guard on the upstream segment, creates the downstream segment and new occurrence,
+and updates `steps` in one validated Batch. Membership/presentation order remains
+separate from SequenceLink topology. Incomplete control guards/cardinalities are
+warnings, as in the core. Reconnection retains the link's authored properties.
+
+Select always means the local occurrence/relation. Shared source navigation uses
+explicit Open; reusable previews expand without copying or reparenting source
+contributions. Inner preview endpoints are not caller-owned endpoints. Capella's
+richer cross-reference hierarchy linking is an unresolved semantic extension,
+not implied by this milestone. Existing explicit legacy-path conversion remains.
+
+Keep canvas and bounded draft independently scrollable, use searchable paged
+contextual choices, and default to readable zoom with explicit Fit and scrolling.
+Transient drawing cancels on context, tool, bounds, scroll, resize or focus changes;
+form inputs survive failed validation/source updates. Reuse passive scroll
+observations including async-save delivery. Commit through Document::execute,
+acknowledging and selecting the created occurrence only after model/source success.
+
+## Ownership and verification
+
+Own `behavior/topology.rs` and local tests, with narrow `behavior.rs` and `app.rs`
+routing/lifecycle changes. Do not change DATA/Linux/semantic checkouts or perform
+native input. Verify production pointer events, planners, App and model/source:
+
+1. OA/SA repeated work/exchange involvement preserves shared records.
+2. Alternative/parallel/loop creation, guards and incomplete warnings.
+3. Specific guarded-link insertion preserves metadata; incompatible adjacency rejects.
+4. Reconnect/delete/Undo/Redo retain unrelated paths and exact source.
+5. Repeated subprocess reuse, explicit navigation, expansion and recursive rejection.
+6. Legacy conversion and presentation reorder independent of explicit topology.
+7. Dirty/source-failure/stale/scroll-save/resize/Escape/focus lifetimes retain drafts.
+8. Nested source save/reopen and ordinary serialized command/model parity.
+
+Run focused invariants, all desktop tests, strict all-target desktop Clippy and
+optimized desktop build with --locked --offline and the dedicated target. Record
+actual evidence and remaining native tasks before freezing. Root independently
+reviews and native-tests the freeze; full-release completeness remains separate.
+
+## Original implementation freeze and actual evidence — 2026-09-06
+
+Production is `7a1e12bc7c18c5693de688f054293bacd095f4d8` (`7a1e12b`).
+The prior `codex/scenario-direct` branch remains at its original head. Production
+changes are confined to desktop topology and its local direct/view/test modules,
+App process routing, the existing passive-scroll observer and one updated passive
+lifecycle regression. `scenario.rs` and scenario message-label construction are
+unchanged, allowing the root's separate DATA native fixes to merge independently.
+
+The palette now draws work/exchange/reuse/control contributions and sequence links
+with click-click or drag. Selected link endpoint handles reconnect by identity;
+selected contribution handles reorder peers within one derived path column.
+Source navigation is explicit. Expanded reference previews expose all directly
+owned source contributions without copying them or making inner endpoints local.
+Every picker has search and 24-item pages. Active tools have distinct styling.
+Create/Cancel are outside the form's internal scroller. The canvas stays visible
+while forms are pending. New occurrence selection is restored after the final
+SetSteps command, and successful edits reveal it in the graph.
+
+The 100% default and manual 50% zoom floor keep authoring legible. Explicit Fit
+may produce a small overview; choosing a drawing tool leaves that overview at
+100%. No positions are persisted. A source-only exchange sequence retains its
+legacy linear meaning: two or more entries have explicit Convert. The original
+one-exchange fallback offered only Work/Control/Reuse; independent review found
+that this blocked exchange-only continuation. The correction is recorded below.
+Disconnected exchange-only topology cannot be represented by the accepted
+contract; the editor does not introduce an invisible mode flag.
+
+The new App resize regression initially failed because existing window handling
+only invalidated scenario contexts; it now invalidates process contexts too.
+Passive viewport and both scroll reports are accepted before busy/modal gates,
+validated by document/owner/revision, and cannot apply properties or discard a
+behavior draft. The shared observer distinguishes its scenario/process delivery.
+A separate captured-link probe failed because two existing parallel guards had
+the same hit target. Distinct derived routes now make each relation selectable;
+source/target/UUID/guard remain unchanged. The failing probe is saved alongside
+the passing final suite as `process-parallel-selection-before.log`.
+
+Actual commands used `--locked --offline` and the dedicated scenario target:
+
+- Full desktop tests: **303 passed**, zero failed/ignored. Seventeen new process
+  tests exercise production pointer sequences, exact guarded-link insertion,
+  duplicate-link selection, same-owner reorder, source failure/drafts, busy save
+  scrolling, dirty source/properties, real resize, reusable-source Open/Back,
+  bounded widget trees and nested multi-file source/serialized-command parity.
+- Strict all-target desktop Clippy: **passed** (`-D warnings`).
+- Independent existing core suites `release_topology`, `process_diagnostics` and
+  `source_nested_updates`: **19 passed**. These cover complete alternative,
+  parallel and loop topology; two-direction transition closure; deletion and
+  reidentification; legacy sequences and exact nested source ownership/history.
+- Optimized desktop build: **passed**. Owned sources were formatted with Rustfmt
+  edition 2024; `git diff --check` passed before the production commit.
+
+The source/JSON commands and core invariants are unchanged. These tests do not
+claim a new actual HTTP transport trial or native acceptance.
+
+Frozen Windows directory:
+`D:/CodexBuilds/Capella2-scenario-target/freeze-process-7a1e12b`.
+It contains the binary, manifest and five verification/probe logs. Binary size:
+20409856 bytes. SHA-256:
+`701ECE6CD329A1CBE50D4DAEBFCE33AD7A93E6906295E74C3290653706F8455A`.
+The frozen copy was hash-compared with the release target binary.
+
+## Independent-review correction — exchange-only continuation
+
+Production follow-up is `8bc564b4b2c3b6d12eb61fc09aec7f129f6e45b7` (`8bc564b`).
+Independent review found a real dead end: after the first Exchange was created in
+an empty process/chain, the accepted model classified it as an ordered exchange
+path. There was no path to convert and the fallback omitted another Exchange.
+
+Ordered paths now offer **Append exchange…**, including a single contribution.
+The form names the captured final contribution and explains that Create adds an
+explicit sequence link. Its contextual picker accepts exchanges whose source
+matches the preceding exchange's target. Create emits one existing validated
+Batch: new exchange occurrence, preceding-to-new SequenceLink and SetSteps;
+existing implied links in longer ordered paths are materialized in that same
+transaction. The second contribution therefore restores the direct topology
+palette without inventing disconnected topology, global exchanges or a mode flag.
+Source reuse, same-owner endpoints and the cross-reference semantic boundary remain.
+
+Two new regressions both exercise OA and SA. The App regression starts with an
+empty owner, creates its first exchange, invokes the actual Append event and
+creates its second exchange. It verifies exactly one link, two distinct occurrence
+IDs, unchanged shared records, one history entry per Create, exact model/source
+Undo/Redo and source reopen. The independent proposal regression preserves a
+multi-entry ordered path, rejects an incompatible exchange without losing its
+form, and validates the serialized ordinary Batch through core execution.
+
+Focused regressions: **2 passed**. Full desktop tests: **305 passed**, zero
+failed/ignored. Strict all-target desktop Clippy: **passed** (`-D warnings`).
+Commands used `--locked --offline` and the same dedicated target. The final full
+suite took 10.75 seconds; Clippy took 4.96 seconds. Production changes are confined
+to `topology/direct.rs`, `topology/view.rs`, local tests and `app/process_canvas.rs`.
+No native input or new actual HTTP transport trial was performed.
+
+Updated optimized build: **passed** in 38.80 seconds. Current frozen Windows
+artifact, manifest and three verification logs are in
+`D:/CodexBuilds/Capella2-scenario-target/freeze-process-8bc564b`.
+Binary size: 20430336 bytes; SHA-256:
+`8BD5C84DF0F4E333C1955E6E9299F431081912E1A504ED13355E0BFA70F8B8BD`.
+The frozen copy was hash-compared with the release target binary. The prior
+`freeze-process-7a1e12b` remains available as historical evidence.
+
+## Root-owned native acceptance still required
+
+At 1440x900 and 1100x700 on Windows and Linux, operate the actual application:
+
+1. Start an OA process and SA chain, involve matching existing work/exchanges,
+   repeat a shared source with a distinct contextual name, and draw links with
+   both click-click and drag. Inspect source identity and contextual properties.
+2. Draw Choice/Merge alternatives and Fork/Join parallel paths; enter `ready` and
+   `else`, create a loop repeat/exit, and inspect incomplete warnings. Insert an
+   exchange/control on an existing guarded path, reconnect an endpoint and reject
+   an incompatible target; confirm the original path metadata and other branch.
+3. Reuse a subprocess twice, select its body without navigation, expand one local
+   reference and inspect the count, Open the shared source, then Back to its caller.
+   Reorder peer contributions and verify links are unchanged; cross-column movement
+   is rejected with the existing topology explanation.
+4. Test Fit/100%, inner and outer wheel/scrollbar changes, resize, Escape and
+   unfocus during an armed or held gesture. Verify no stale endpoint/slot commits.
+   Confirm Create/Cancel remains accessible while a long form is open, search/page
+   changes retain its values, navigation is guarded and save-time scrolling recovers.
+5. Start an empty owner, add its first exchange, use Append exchange for its second,
+   and verify the visible link/direct palette. Also append/convert a legacy multi-exchange path.
+   Undo/Redo the conversion and direct edits, save/reopen a nested source project,
+   then inspect the same occurrence/link IDs, guards and shared source records.
+
+No native/UI input was performed in this task. Cross-reference inner-chain linking
+remains an explicit unresolved semantic extension; this milestone does not claim
+full Capella functional-chain equivalence or complete the first release.