Checkpoint source 7 workflows and in-progress diagram authoring redesign

Preserve current core, source, REST, desktop, recovery, documentation and validation work, including AGENTS.md and the development summary. This is a work-in-progress checkpoint: the new compact palette has outstanding compilation errors and native acceptance; earlier passing gates retain their documented scope.

docs/language.html

@@ -2,7 +2,7 @@
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
 <meta charset="utf-8" />
-<meta name="generator" content="Docutils 0.23: https://docutils.sourceforge.io/" />
+<meta name="generator" content="Docutils 0.22.2: https://docutils.sourceforge.io/" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <title>Arcadia Studio OA / SA Language and Editing Contract</title>
 <style type="text/css">
@@ -623,9 +623,9 @@ a { text-decoration: none; }
 <h1 class="title">Arcadia Studio OA / SA Language and Editing Contract</h1>
 <dl class="docinfo simple">
 <dt class="version">Version<span class="colon">:</span></dt>
-<dd class="version">5</dd>
+<dd class="version">7 (integration in progress)</dd>
 <dt class="status">Status<span class="colon">:</span></dt>
-<dd class="status">Normative current implementation contract; first-release integration</dd>
+<dd class="status">Source-7 contract under integration; native and API acceptance pending</dd>
 <dt class="core-implementation">Core implementation<span class="colon">:</span></dt>
 <dd class="core-implementation"><p><span class="docutils literal"><span class="pre">crates/oa-core</span></span></p>
 </dd>
@@ -637,9 +637,13 @@ a { text-decoration: none; }
 <h2>1. Scope and conformance</h2>
 <p>This specification defines the shared Operational Analysis (OA) and System
 Analysis (SA) model, its textual language, graphical editing obligations,
-validation, persistence, and explicit migration from versions 1, 2, 3 and 4. MUST, MUST NOT,
+validation, persistence, and explicit migration from versions 1, 2, 3, 4, 5 and 6. MUST, MUST NOT,
 and MAY indicate requirements, prohibitions, and permitted choices.</p>
-<p>Schema 5 adds closed typed semantic review facts to trace baselines, including
+<p>Schema 7 adds caller-qualified process/chain links and explicit interface-operation
+selection on boundary scenario invocations. Schema 6 added OA communication means,
+exchange categories and saved view options. Integration and acceptance are tracked
+separately; this version label does not claim completed graphical/API parity.
+Schema 5 added closed typed semantic review facts to trace baselines, including
 historical references that may no longer exist in the live model. It retains
 schema 4 bounded reusable data types, typed defaults, exchange mechanisms,
 qualified values, specialization, interface allocations and associations, and
@@ -663,7 +667,7 @@ Actual verification evidence is separate from this contract.</p>
 </section>
 <section id="one-authoritative-model">
 <h2>2. One authoritative model</h2>
-<p>A Project stores <span class="docutils literal">schema_version</span> (5), <span class="docutils literal">id</span>, <span class="docutils literal">alias</span>, <span class="docutils literal">name</span>,
+<p>A Project stores <span class="docutils literal">schema_version</span> (6), <span class="docutils literal">id</span>, <span class="docutils literal">alias</span>, <span class="docutils literal">name</span>,
 <span class="docutils literal">description</span>, and maps named <span class="docutils literal">elements</span>, <span class="docutils literal">relations</span>, <span class="docutils literal">diagrams</span>,
 <span class="docutils literal">artifact_links</span>, and <span class="docutils literal">traces</span>. Each map is keyed by the UUID contained in
 its record. Duplicate map keys and mismatching keys/identities are errors.</p>
@@ -904,6 +908,10 @@ references. Their kind is the declaration keyword:</p>
 <td><p>Different participant owners; typed component ports have matching kinds</p></td>
 <td><p><span class="docutils literal">oriented</span> bool / true; <span class="docutils literal">items</span> refs / []</p></td>
 </tr>
+<tr><td><p><span class="docutils literal">communication_mean</span></p></td>
+<td><p>Different OA Entity/Actor elements; no operational ports or role inference</p></td>
+<td><p><span class="docutils literal">oriented</span> bool / false; <span class="docutils literal">items</span> refs / []</p></td>
+</tr>
 <tr><td><p><span class="docutils literal">port_allocation</span></p></td>
 <td><p>SA Component port → SA FunctionInput/FunctionOutput port</p></td>
 <td><p>Requires the function's actual work Allocation to that component</p></td>
@@ -957,7 +965,7 @@ references. Their kind is the declaration keyword:</p>
 <td><p>None</p></td>
 </tr>
 <tr><td><p><span class="docutils literal">exchange_allocation</span></p></td>
-<td><p>Boundary-exchange relation → SA functional-exchange relation</p></td>
+<td><p>CommunicationMean → OA Interaction, or BoundaryExchange → same-layer Interaction/FunctionalExchange</p></td>
 <td><p>None</p></td>
 </tr>
 <tr><td><p><span class="docutils literal">interface_provision</span>, <span class="docutils literal">interface_requirement</span></p></td>
@@ -974,6 +982,79 @@ references. Their kind is the declaration keyword:</p>
 exchanges with distinct identities are permitted. Self-relations are invalid
 except for a state transition that returns to its source state or an explicit
 DataAssociation between two ends of the same Record type.</p>
+<section id="source-6-communication-and-exchange-categories">
+<h3>Source-6 communication and exchange categories</h3>
+<p>An OA <span class="docutils literal">communication_mean</span> joins two distinct Entity/Actor records directly.
+Its stable source/target tuple does not create operational ports. An unoriented
+means permits either direction; an oriented ordinary use follows source to target.
+The empty carried-item set is explicit, not a wildcard. Every item carried by an
+allocated Interaction must specialize or equal a declared means item, using the
+same inheritance rule as existing exchange allocations.</p>
+<p><span class="docutils literal">exchange_allocation</span> remains a separately identified relation. A means may
+allocate several Interactions and an Interaction may have several explicit means.
+Allocation compares actual activity-to-participant Allocations, without inferring
+responsibility from roles or nesting. Every known performer must fit one complete
+permitted endpoint pair. A known contradiction is an error; a missing actual
+performer is an incomplete-model warning. Reorienting or reconnecting a means
+validates all dependent allocations and scenario uses in one candidate.</p>
+<p>ParticipantInteraction and compatible MixedLegacy scenarios may reference means.
+For bidirectional use, explicit sender and receiver lifelines determine one
+compatible ordered endpoint pair. Missing or ambiguous bindings do not guess a
+direction. A Reply reusing its Call's means reverses the resolved actual Call,
+including a reverse Call on an unoriented means. The existing operation-response
+exception permits the correlated Reply on an oriented means; this implies no
+physical transport property. OA process contributions continue to use Interaction.</p>
+<p>Mapped unoriented SA BoundaryExchange messages use the same explicit lifeline
+resolution. Ordinary messages also respect component-port direction; legacy
+port boundaries retain their stored direction. A correlated same-channel Reply
+still reverses the actual Call, including across directional Flow ports.</p>
+<p>CommunicationMean and SA BoundaryExchange support Exchange traces. OA-to-SA
+transition requires a separate component-port choice for each end of each means:
+reuse an existing compatible port, or create a port with explicitly chosen
+Standard/Flow kind and orientation. Participant correspondence never substitutes
+a port UUID for its participant UUID. Interfaces and PortAllocations are not
+invented; unresolved technical allocations must be reviewed or omitted from the
+selection and authored explicitly. Reverse transition projects SA port owners to
+reviewed OA participant counterparts, without copying typed SA ports into OA.
+Source/Target review retains the exact participant/port identities in history.
+Taking an OA endpoint requires the scoped technical port decision, while Keep
+and a valid Candidate retain explicit technical choices.</p>
+<p><span class="docutils literal">oa_exchange_category</span> and <span class="docutils literal">sa_exchange_category</span> are root-level named
+semantic elements with <span class="docutils literal">family</span> Work (default) or Participant, and <span class="docutils literal">exchanges</span>
+references (default []). Work categories contain Interaction/FunctionalExchange;
+Participant categories contain CommunicationMean/BoundaryExchange. Members must
+be distinct and in the category's layer; categories never own or merge exchanges.
+Category transition requires mapped counterpart members. <span class="docutils literal">Category.Family</span> and
+<span class="docutils literal">Member { collection CategoryExchanges; ... }</span> are closed typed semantic facts.
+Deleting an exchange removes its category membership; deleting a category does
+not remove its exchanges. Reidentification preserves all live references and
+typed historical reference provenance.</p>
+<p>Each Diagram has optional <span class="docutils literal">view_options</span> (all selections unrestricted, no hidden
+edges, Name labels by default). Its closed fields are <span class="docutils literal">hidden_edges</span>,
+<span class="docutils literal">relation_kinds</span>, <span class="docutils literal">work_categories</span>, <span class="docutils literal">participant_categories</span>, <span class="docutils literal">coverage</span>,
+<span class="docutils literal">work_contexts</span> and <span class="docutils literal">exchange_labels</span>. Relation kinds use All or Only with
+Relation(kind)/Trace entries; Only([]) draws no lines, including traces. Category
+selectors use All or Any(category IDs); Any([]) draws none of that exchange family.
+Selected categories are unioned within each family; independent restrictions
+intersect. Coverage is All/InBehavior/OutsideBehavior; work contexts are All or
+Any(explicit process, chain or scenario IDs). Contexts follow ordered owned
+contributions and explicit reuse, sharing the advisory diagnostic evidence walk.
+Labels are Name, Items or NameAndItems. These settings alter presentation only;
+automatic port positions use unfiltered eligible lines. Hidden routes and semantic
+identities remain saved. Removing a referenced selection preserves explicit empty
+filters rather than widening them to All.</p>
+<p>Traceability views retain their established two-layer projection: default options
+preserve eligible OA and SA lines. Their hidden-edge, category and context
+references may therefore select either layer. All ordinary projections require
+these references in the declared diagram layer. A filter never hides the other
+layer merely because the Traceability diagram has an OA or SA layer label.</p>
+<p>Versions 1–5 reject the new relation, category constructor, diagram field (even
+an explicitly supplied default), and category historical facts. Reading version 5
+preserves existing records, legacy OA boundaries and reviewed facts, with an
+explicit upgrade report to the current version 7. Source upgrading changes the version token
+without rewriting unrelated authored trivia. No old boundary is automatically
+converted into communication means. Source-6 graphical/API/native acceptance is
+still tracked separately from this integration contract.</p>
 <p>Direct Allocation has at most one performer per leaf. Role sharing is a
 different relationship: several OA participants can realize a Role. A direct
 allocation inconsistent with its role's realized performers produces an
@@ -1022,7 +1103,7 @@ not create endpoints. Graphical/command FE creation plans ports atomically,
 using unique compatible typed-port reuse or deterministic new endpoints.
 Port deletion cascades to incident FEs; FE deletion retains independent ports.</p>
 <p>For example:</p>
-<pre class="literal-block">arcadia 5;
+<pre class="literal-block">arcadia 7;
 project ports_example &quot;Typed function contract&quot; {
     sa_function send &quot;Send&quot; {}
     sa_function receive &quot;Receive&quot; {}
@@ -1052,6 +1133,7 @@ most one outgoing transition; their outgoing transition has no trigger/guard.
 Final states have no outgoing transitions. Mixing State and Mode entries is
 permitted by this Studio profile. StateAction links provide typed work
 references alongside the descriptive entry/exit/do strings.</p>
+</section>
 <section id="capabilities-and-missions">
 <h3>4.1. Capabilities and missions</h3>
 <p>Include means the including capability requires the included capability's
@@ -1101,6 +1183,71 @@ SequenceReference prohibition is a different rule. A legacy exchange-only
 sequence without explicit links retains its ordered linear meaning and
 adjacent-exchange gap diagnostics. Implementations MUST NOT silently invent
 topology links when loading or reordering such a sequence.</p>
+<section id="links-into-reusable-sequences">
+<h4>4.2.1. Links into reusable sequences</h4>
+<p><span class="docutils literal">ContextualLink</span> owns an explicit <span class="docutils literal">owner</span> Process or FunctionalChain and two
+<span class="docutils literal">OccurrenceEndpoint</span> records. Each endpoint contains an ordered <span class="docutils literal">references</span>
+list of SequenceReference occurrence identities and an <span class="docutils literal">occurrence</span> leaf
+identity. Start at the link owner; each path member MUST be a contribution of the
+current sequence and reference a valid same-layer sequence of the owner's kind.
+Descend into that referenced definition before resolving the next path member or
+leaf. The final leaf MUST be a contribution of the resulting sequence. A path
+contains reference occurrences, never work elements or sequence-definition IDs.
+An empty path denotes a direct contribution of the owner. Missing targets,
+wrong owners, wrong kinds/layers and recursive reuse are errors.</p>
+<p>Repeated references remain distinct. Given P with A→B→C and two references R1(P)
+and R2(P), a link from direct X to <span class="docutils literal">[R1], B</span> affects only the R1 contribution
+of B. It MUST NOT target R2.B, alter P's definition, delay R1.A by replacing the
+endpoint with the whole R1 reference, or duplicate A/B/C. Two endpoints with the
+same leaf identity but distinct paths are distinct caller contributions.</p>
+<p>The closed <span class="docutils literal">purpose</span> has exactly three alternatives:</p>
+<ul class="simple">
+<li><p><span class="docutils literal">Precedence { guard }</span> describes predecessor/successor order; guard is prose.
+When both paths are empty, use the existing SequenceLink. All-direct
+ContextualLink Precedence MUST be rejected, preserving one canonical encoding.</p></li>
+<li><p><span class="docutils literal">Exchange { exchange }</span> identifies the same-layer work exchange connecting
+the addressed work contributions; both endpoint works MUST match its actual
+source and target. It records assembly incidence, not an implicit extra
+precedence edge.</p></li>
+<li><p><span class="docutils literal">CommonWork { work }</span> requires both addressed contributions to reference that
+same-layer Activity or Function. It states shared work identity, without
+fusing executions, deleting contributions or asserting precedence.</p></li>
+</ul>
+<p>For example, within a complete source-7 project with the referenced declarations:</p>
+<pre class="literal-block">contextual_link after_check &quot;Continue this assessment&quot; {
+    owner &#64;alarm_process;
+    source { references []; occurrence &#64;external_check; };
+    target { references [&#64;first_assessment]; occurrence &#64;assessment_b; };
+    purpose { Precedence { guard &quot;check accepted&quot;; }; };
+}</pre>
+<p>The owner controls persistence/module placement and graphical editing context,
+including when neither leaf belongs directly to it. Generic leaf source/target
+accessors MUST NOT be used to infer ownership. Rename and reidentification visit
+every typed owner/path/leaf/purpose reference. Normal deletion of any such live
+dependency removes the entire dependent link in the same transaction; it MUST
+NOT shorten a path, substitute another reference instance or change purpose.
+Retargeting a reference that invalidates a surviving link MUST refuse unless an
+explicit repair batch makes the whole candidate valid. Undo restores complete
+identities, links and authored source.</p>
+<p>Admission permits at most 64reference occurrences per endpoint and counts all
+authored reference-list entries against the caller's ordered-reference budget:
+50,000 for the REST service and 500,000 for the desktop source workspace. Core
+callers select their ParseLimits policy explicitly. Duplicate work definitions
+do not erase this accounting. Cache capacity,
+cache warmth, expansion order and diagram folding MUST NOT change admission.
+Cache eviction is permitted; rejecting a valid address because a cache is full
+is not.</p>
+<p>Contextual diagnostics use separate precedence, exchange/common-work incidence
+and caller coverage projections. Expand callee topology separately for each
+reference path. Synthetic entry/exit connectivity is identifiable and MUST NOT
+count as authored degree or satisfy authored guards. Missing or empty definitions
+and expansion beyond 50,000 nodes/100,000 edges MUST report incomplete analysis;
+they MUST NOT produce a guessed bypass or a complete-looking reachability result.
+For X→R1.B plus P's A→B, an advisory may report two incoming authored links at
+R1.B. It MUST NOT invalidate the model, require an invented Join, change the
+standalone P or R2 diagnostics, or claim executable synchronization semantics.
+Existing direct-only diagnostics remain unchanged.</p>
+</section>
 </section>
 <section id="typed-scenarios-and-reusable-behavior">
 <h3>4.3. Typed scenarios and reusable behavior</h3>
@@ -1151,6 +1298,61 @@ an ambiguous preserved legacy nested annotation warns <span class="docutils lite
 until an explicit path is selected. New graphical choices always identify a path.
 Values never overwrite types or items. Expression text is descriptive, preserved
 exactly and not evaluated; an empty expression warns.</p>
+<section id="explicit-interface-operation-invocations">
+<h4>4.3.1. Explicit interface-operation invocations</h4>
+<p>The optional Exchange occurrence field <span class="docutils literal">operation</span> distinguishes ordinary
+messages from explicit operation intent. Omitted or <span class="docutils literal">none</span> retains ordinary
+channel semantics and is omitted in canonical output. A present closed record
+with absent/<span class="docutils literal">none</span> <span class="docutils literal">allocation</span> means an explicitly unresolved operation.
+A present <span class="docutils literal">allocation &#64;service_operation</span> selects that exact
+InterfaceItemAllocation relation, not its item UUID, a name, a port or whichever
+allocation happens to carry the same parameters. Thus parameterless Reset and
+ReadStatus operations on one channel remain distinct maintained identities.</p>
+<p>Operation intent is permitted only on SA BoundaryInterface scenario Call or
+Asynchronous occurrences. A selected allocation MUST expose an Information
+Operation item through the actual concrete Standard component ports used by the
+invocation: receiver Provides, sender Requires a compatible interface exposing
+that same allocation, using the normal interface inheritance rules. Containment
+does not inherit participant interface roles onto a port. A separately allocated
+same item is not the selected allocation. The actual channel traversal determines
+direction, including an unoriented channel used in reverse. Call requires
+Synchronous transmission; Asynchronous requires Asynchronous transmission;
+Unspecified is incomplete and warns. A selected allocation without these proofs
+is an error. Explicit unresolved intent remains editable with a located warning.</p>
+<p>Reply MUST store no operation selection. It derives allocation, provider and
+signature from its exact correlated Call, while independently satisfying the
+existing reply order, reverse-participant and channel checks. It may reuse the
+Call channel in reverse or use a separate explicit return channel. The separate
+channel MUST carry the selected item or an admitted subtype and satisfy its own
+actual endpoint contract, including for a parameterless/void return. The Reply
+receiver need not provide the operation; the provider was established by the
+Call. No operation or correlation may be guessed from similar names or fields.</p>
+<p>Selected Call/Asynchronous values use only that operation's In/InOut signature;
+Reply values use Out/InOut/Return. All ordinary nested-path and multiplicity rules
+still apply. Unresolved operation intent preserves still-live expressions and
+performs independent live-reference/path checks with an incomplete-signature
+warning. It MUST NOT fall back to the union of items carried by the channel.
+Selecting a new allocation validates all retained values and refuses incompatible
+values without silently pruning them or creating defaults.</p>
+<p>Deletion cleanup clears a deleted selected allocation to explicit unresolved
+intent and preserves still-live values; it does not erase the Call or Reply.
+The whole candidate MUST still satisfy independent channel contracts. Deleting
+the sole allocation can therefore refuse while a boundary still carries its
+now-unadmitted item. An explicit repair batch must address every affected channel,
+including a separate Reply channel. If a surviving allocation admits the item,
+deletion can succeed, but it MUST NOT select that surviving allocation as the
+operation. Item/field deletion uses the normal proven-reference cleanup rules.</p>
+<p>SA→OA transition of operation intent requires one explicit
+<span class="docutils literal">OperationOmission { source, rationale }</span> per selected invocation. Rationale
+MUST be nonempty. Missing, irrelevant, duplicate or wrong-direction decisions
+are errors. Reply derives its Call's abstraction without a second operation
+choice. The source model retains its operation; other facts and values are mapped
+explicitly and the complete target is validated. The transition MUST NOT invent
+OA technical ports, operation identities or functional refinement to avoid this
+decision.</p>
+</section>
+<section id="scenario-reuse">
+<h4>4.3.2. Scenario reuse</h4>
 <p>ScenarioUse references an existing same-layer scenario and maps its lifelines
 with <span class="docutils literal">bindings [ { referenced &#64;callee_line; local &#64;caller_line; } ];</span>.
 Each binding is one-to-one and references a direct lifeline of the appropriate
@@ -1161,6 +1363,7 @@ Direct/transitive recursive scenario use is invalid; repetition uses a Loop
 fragment instead. ScenarioUse owns neither its referenced scenario nor its
 lifelines; deleting a use does not delete the reusable definition.</p>
 </section>
+</section>
 <section id="state-vertices-events-and-transition-contracts">
 <h3>4.4. State vertices, events and transition contracts</h3>
 <p>StateKind comprises State, Mode, Initial, Final, Choice, Junction, Fork, Join,
@@ -1397,7 +1600,7 @@ invalid ranges reject. Composition/shared aggregation, multiple inheritance,
 redefinition, instance literals and arbitrary-precision decimal arithmetic are
 outside this bounded contract.</p>
 <p>This complete data contract example is also exercised through the REST API:</p>
-<pre class="code text literal-block"><code>arcadia 5;
+<pre class="code text literal-block"><code>arcadia 7;
 project engineering_data &quot;Engineering data&quot; {
     sa_data_type voltage &quot;Voltage&quot; {
         definition { Real { minimum 0.0; maximum 48.0; }; };
@@ -1460,7 +1663,7 @@ remove or relocate incompatible placements in the same transaction. Context
 errors use <span class="docutils literal">state_diagram_context</span>; incompatible placements use
 <span class="docutils literal">state_diagram_member</span>. Neither case silently hides invalid members.</p>
 <p>This complete source example places one state from an existing machine:</p>
-<pre class="code text literal-block"><code>arcadia 5;
+<pre class="code text literal-block"><code>arcadia 7;
 project operating &quot;Operating modes&quot; {
     oa_entity crew &quot;Crew&quot; {}
     oa_state_machine modes &quot;Modes&quot; { parent &#64;crew; }
@@ -1922,7 +2125,7 @@ change.</p>
 <h3>5.5. Source examples and historical token rules</h3>
 <p>This valid source records deliberately different constructor/unit observations.
 Its historical integer minimum is absent; the Real side has no integer branch:</p>
-<pre class="literal-block">arcadia 5;
+<pre class="literal-block">arcadia 7;
 project reviewed_dimensions &quot;Reviewed dimensions&quot; {
     oa_data_type oa_dimension &quot;Operational distance&quot; {
         definition { Integer { minimum 0; maximum 10; }; };
@@ -2063,7 +2266,7 @@ MAY also be <span class="docutils literal">include string &quot;;&quot;</span>.
 declarations and include statements; it MUST NOT contain another version header,
 project wrapper, or project description. Includes MUST occur at document level,
 never inside an element body or typed field value. For example:</p>
-<pre class="literal-block">arcadia 5;
+<pre class="literal-block">arcadia 7;
 project rescue &quot;Rescue&quot; id &quot;00000000-0000-4000-8000-000000000001&quot; {
     description &quot;Operational model&quot;;
     include &quot;oa/participants.arcadia&quot;;
@@ -2275,6 +2478,52 @@ column, and a half-open UTF-8 byte Span. Tabs count as one scalar; LF advances
 the line. Structural errors and engineering warnings point to a relevant
 declaration or field when available. Clients MUST use severity/code rather than
 parse the human message; diagnostic wording is not a stable machine API.</p>
+<p class="rubric">Explicit behavior coverage diagnostics</p>
+<p>The following shared engineering checks are advisory <span class="docutils literal">Warning</span> diagnostics.
+They MUST NOT reject graphical Apply, source compilation, Save, or an API
+transaction solely because the model is incomplete. They run only after the
+structural pass reports no <span class="docutils literal">Error</span>, avoiding cascades from invalid ownership,
+references, layers, or recursion. Their policy concerns explicit evidence in
+the authored model, not proof that no engineering behavior exists.</p>
+<ul class="simple">
+<li><p><span class="docutils literal">non_leaf_work_exchange</span> locates each <span class="docutils literal">source</span> or <span class="docutils literal">target</span> of an
+Interaction or FunctionalExchange that has direct same-kind child work.
+Repair the exchange to name its responsible leaf Activity/Function, keeping
+SA function-port ownership consistent.</p></li>
+<li><p><span class="docutils literal">work_without_behavior_context</span> locates a leaf Activity/Function lacking
+an included Action or an included Interaction/FunctionalExchange occurrence
+that explicitly names it as an endpoint.</p></li>
+<li><p><span class="docutils literal">exchange_without_behavior_context</span> locates an Interaction or
+FunctionalExchange lacking an included Exchange occurrence. It is suppressed
+while a more specific non-leaf endpoint warning applies to that exchange.</p></li>
+<li><p><span class="docutils literal">mission_without_capability</span> locates an OperationalMission/Mission lacking
+a valid same-layer outgoing MissionCapability. Participant responsibility
+through MissionInvolvement does not satisfy this check.</p></li>
+<li><p><span class="docutils literal">capability_without_behavior_context</span> locates a supported leaf
+Capability/SystemCapability lacking either an incoming ChainInvolvement or
+a same-layer Scenario explicitly naming it as <span class="docutils literal">context</span>. It MUST NOT
+duplicate <span class="docutils literal">unsupported_capability</span> on the same record.</p></li>
+</ul>
+<p>Record-level checks have no invented field path. Coverage traverses all Process,
+FunctionalChain and Scenario roots, following only their explicitly listed,
+correctly owned occurrences and Fragment branches. Reusable sequence/scenario
+contents are traversed with identity-based cycle guards. Known work/exchange
+references count despite unfinished lifelines; unordered occurrences do not.
+Repeated exchanges and correlated replies contribute the same identity once.
+Parent work does not cover its children. Bare lifelines, state observations,
+StateAction/Availability links, timer-only occurrences, and participant/boundary
+messages do not imply work/exchange coverage. Allocation does not imply that
+every exchange carried by a boundary message occurs. Diagram layout is irrelevant.</p>
+<p>As an explicit Studio completeness policy, same-kind capability grouping parents
+are excluded from both capability support warnings; their leaf capabilities are
+checked independently. A valid direct Scenario context also satisfies existing
+<span class="docutils literal">unsupported_capability</span> support. An empty linked process/chain or scenario
+satisfies explicit context presence while retaining its own <span class="docutils literal">empty_sequence</span>
+warning. Include/extend/generalization, parent containment, and shared performers
+MUST NOT manufacture a context. These advisory checks follow the distinction
+between dataflow and its usage contexts described in the official
+<a class="reference external" href="https://mbse-capella.org/arcadia-qna.html">Arcadia Questions and Answers</a>;
+they are not a declaration of full Capella conformance.</p>
 <p><span class="docutils literal">parse_limited</span> and <span class="docutils literal">decode_limited</span> accept caller admission budgets for
 input bytes, graph objects, total persistent records and ordered step references.
 Counts MUST be checked before expensive structural validation; migration budgets
@@ -2335,7 +2584,7 @@ explicitly before Apply succeeds.</p>
 <h2>9. Persistence and explicit migration</h2>
 <p>Loading detects JSON from its first non-whitespace <span class="docutils literal">{</span>; other input is parsed
 as Arcadia source regardless of filename. Saving an <span class="docutils literal">.arcadia</span> suffix uses
-the accepted V5 source bundle (<span class="docutils literal">arcadia 5</span>); other suffixes use V5 JSON. Both forms preserve the same
+the accepted V7 source bundle (<span class="docutils literal">arcadia 7</span>); other suffixes use V7 JSON. Both forms preserve the same
 complete model. JSON rejects unknown fields throughout typed payloads,
 duplicate maps, unsupported versions, and structural errors.</p>
 <p>The explicit schema-4 reader retains the exact old Project/Trace/TraceBaseline
@@ -2344,7 +2593,7 @@ diagrams and artifacts. Version4 prose baselines migrate with semantic none;
 their names/descriptions remain exact even when live endpoint values differ.
 The adapter MUST NOT infer semantic review from live values, and version3/4
 inputs MUST reject semantic baseline fields. The migration report retains the
-original from_schema and current to_schema 5. Reopening a current5 save produces
+original from_schema and current to_schema 7. Reopening a current7 save produces
 no migration report. The real V4 reviewed-prose fixtures remain compatibility input.</p>
 <p>The schema-3 reader freezes the changed data payloads and old constructor catalog;
 schema-4 fields/constructors MUST NOT be silently accepted as schema 3. Existing
@@ -2367,7 +2616,21 @@ order) and <span class="docutils literal">unresolved_message_values</span> (occu
 report arrays default empty when reading older responses. Version 1 normalizes
 through V2, then the typed-port V3 adapter, shared V4 data upgrade and V5 review
 adapter. Original V2 and real V3 fixtures remain unchanged compatibility inputs. Current exports
-always use version 5; reading/migrating alone never saves or changes revisions.</p>
+always use version 7; reading/migrating alone never saves or changes revisions.</p>
+<p>Versions 1–6 MUST reject ContextualLink, operation fields (including explicit
+null/default values) and their new typed semantic facets. Current semantic review
+adds Occurrence.Operation and Relation.ContextOwner/ContextSource/ContextTarget/
+ContextPurpose. Historical endpoints and operation selections remain typed
+historical UUIDs, never live graph references or inferred current facts.
+Version 5/6 migration preserves old Call/Reply/values, direct SequenceLinks,
+traces, and version-appropriate view selectors without guessing operation intent
+or contextual links. An authored source upgrade changes only the version token
+until an actual model edit requires further writeback.</p>
+<p>Desktop recovery MUST verify old 5/6 checkpoint fingerprints with the exact
+historical serializer and closed old-version admission before accepting the
+migrated model. It retains invalid raw buffers and authored review decisions;
+transient impact approvals are reset and plans are recomputed against the
+accepted base. A saved unchecked executable plan/command MUST NOT be restored.</p>
 <p>Native source Save All checks the original contents of observed dependencies
 before staging writes. Existing target files are replaced individually and the
 entry is installed last. A transaction journal records originals and intended
@@ -2443,7 +2706,7 @@ V5 projects. Future versions remain errors until a separate migration exists.</p
 <h2>10. Complete authoring example</h2>
 <p>This document intentionally omits IDs for new authoring. Apply and Save write
 the assigned UUIDs explicitly.</p>
-<pre class="code text literal-block"><code>arcadia 5;
+<pre class="code text literal-block"><code>arcadia 7;
 project harbor &quot;Harbor assistance&quot; {
     oa_entity control &quot;Harbor control&quot; {}
     oa_activity assess &quot;Assess assistance&quot; {}