Make participant ports and hierarchical model navigation discoverable

Add focused containment browsing, contextual paged search, clear outline depth and direct component-port creation and connection actions. Share exact boundary feasibility checks to avoid whole-project validation for each picker candidate. Preserve source/property drafts and interrupted-save recovery state, document source-project behavior, and record Windows/Linux native verification and independent review fixes.

docs/language.rst

@@ -996,16 +996,23 @@ entries receive formatted syntax. These rules preserve comments without silently
 attaching new semantic identity to an ambiguous list entry.
 
 Retained declaration UUIDs and source ownership remain unchanged. Records match
-by UUID, not display name or alias; an explicit UUID replacement is a removal
-and creation, retaining the removed record's comments in its original file. The
+by UUID, not display name or alias. The model-only ``update_bundle`` treats an
+explicit UUID replacement as removal and creation. The desktop instead uses
+``update_bundle_with_identity_map`` with the surviving-record provenance from
+``prepare_command``: explicit identity edits and sequential identity swaps MUST
+preserve each original declaration's owning file and attached source trivia.
+New records have no original identity mapping. The mapping MUST be injective,
+refer to existing records and preserve record classes. The
 result is recompiled, reindexed and checked for equality with the requested
 model before return. Source changes needed for undo are workspace history data;
 callers should retain complete compiled workspace snapshots rather than infer
 past omission/layout choices from a model-only undo.
 
 Canonical modular export is a distinct, explicit operation and does not promise
-original comment/layout preservation. No native multi-file editor, project save
-transaction or REST bundle endpoint is claimed by the pure core APIs.
+original comment/layout preservation. The native editor integrates per-file
+drafts and source-project saves as specified below. The pure compiler performs
+no filesystem access. REST source endpoints currently exchange a canonical
+model; they do not yet exchange the multi-file source bundle.
 
 ``parse`` returns a complete structurally validated candidate or error
 diagnostics and no model. Engineering warnings alone MUST NOT reject a valid
@@ -1054,8 +1061,9 @@ will occur. Reparenting work must not silently change its performer. A computed
 parent summary must remain distinguishable from direct allocation. A collapse
 operation hides presentation detail without deleting the children.
 
-Applying complete source is one model transaction. Graphical edits regenerate
-the matching canonical source. Both paths validate their candidate before
+Applying a reachable source bundle is one model transaction. Graphical edits
+update its owning declarations through the source-preserving updater. Both
+paths validate their candidate and model/source equality before
 adoption; failure preserves the committed model, save baseline, and history.
 Incomplete but structurally safe references and coverage gaps produce warnings
 that allow continued authoring and saving.
@@ -1064,7 +1072,11 @@ Source and property drafts contribute to unsaved-work state. Invalid drafts
 MUST NOT be replaced by generated text or lost on ordinary navigation. Undoing
 source-buffer edits and undoing committed model changes are distinct operations.
 Successful source Apply creates one model-history entry. Undo/redo restores
-the full stored model, including aliases, trace links, and occurrence identity.
+the full stored model and exact accepted source bundle, including aliases,
+trace links, occurrence identity, comments and file ownership. Each open file
+retains its own unapplied draft across file navigation. Located lint diagnostics
+refer to the raw draft bytes rather than an identity-stabilized intermediate.
+Property editing MUST NOT silently discard a pending source draft.
 
 Changing a graphical UUID must atomically update map keys and every reference.
 Alias changes preserve UUID identity. Deletion must account for owned elements,
@@ -1079,10 +1091,21 @@ explicitly before Apply succeeds.
 
 Loading detects JSON from its first non-whitespace ``{``; other input is parsed
 as Arcadia source regardless of filename. Saving an ``.arcadia`` suffix uses
-canonical V3 text (``arcadia 3``); other suffixes use V3 JSON. Both forms preserve the same
+the accepted V3 source bundle (``arcadia 3``); other suffixes use V3 JSON. Both forms preserve the same
 complete model. JSON rejects unknown fields throughout typed payloads,
 duplicate maps, unsupported versions, and structural errors.
 
+Native source Save All checks the original contents of observed dependencies
+before staging writes. Existing target files are replaced individually and the
+entry is installed last. A transaction journal records originals and intended
+writes; explicit recovery restores originals only when current bytes match a
+known transaction state. Unrelated external contents MUST NOT be overwritten
+by recovery. Missing entry files and lint updates MUST NOT hide a detected
+pending-recovery action. This is not cross-process compare-and-swap or atomic
+multi-file visibility. Save failures retain the accepted model and drafts.
+Detached dirty buffers MUST be reattached or reverted before source saving;
+JSON export does not replace the source project's saved baseline or location.
+
 The frozen schema-2 reader retains staged compatibility defaults. Old Scenario bodies without a
 ``viewpoint`` retain MixedLegacy, and old Exchange occurrence bodies without
 ``message_kind``, ``reply_to`` or ``values`` retain Asynchronous, none and [].