Save unverified allocation and repair work at user-requested pause

docs/language.rst

@@ -2037,6 +2037,23 @@ will occur. Reparenting work must not silently change its performer. A computed
 parent summary must remain distinguishable from direct allocation. A collapse
 operation hides presentation detail without deleting the children.
 
+In an Allocation view, dragging an Activity or Function body MAY combine a
+performer change with diagram placement. The preview MUST identify the
+destination and preserve readable work and performer labels. A clean click
+selects without applying unrelated drafts. A refused work press with an unapplied
+property draft MUST preserve its text, caret and focused editor. An accepted drag is one atomic
+model/source/history transaction: semantic ownership and work identities are
+preserved; only leaf direct Allocation relations, their own retired routes and
+the affected view geometry change. Existing Allocation identities are retained on reassignment. Role
+realizations and assignments MUST NOT be silently changed. Uniform work groups
+may move their leaf responsibilities together; ambiguous or distributed groups
+and changes requiring collateral record edits MUST be refused with an explanation.
+Moving outside performer regions removes direct assignment only when the
+effective role responsibility is also absent. Releasing outside the viewport
+cancels the gesture. Explicit Arrange next drag applies geometry alone for one
+gesture. Refused and snapped no-op drops MUST NOT create history entries or
+discard Redo. Undo restores the exact source bundle and identities together.
+
 Applying a reachable source bundle is one model transaction. Graphical edits
 update its owning declarations through the source-preserving updater. Both
 paths validate their candidate and model/source equality before