Index measured label field overlap lookups with exact differential oracles

Assert RTL-leading full and ellipsized paragraph preconditions and complete independent rectangle sets. Record system-font limitations and add one ignored bounded 4096-scalar lookup diagnostic with exact full-coverage oracles. Format the two experiment inputs only. Format and diff checks passed; no compiler, tests, native execution or production wiring.

AGENTS.md

@@ -35,26 +35,26 @@ Use Gitea for live coordination and the relevant code version for implementation
 
 ## Coordination and integration
 
+All independent agents coordinating through Gitea run on completely separate machines, each with its own clone, filesystem, tools, processes, and runtime. Gitea and pushed Git history are the shared communication and delivery channels. Local files (including `harness`), unpushed commits, worktrees, test results, and localhost services are not accessible to peers. Matching branch names or paths do not imply synchronized contents.
+
 1. On starting or resuming, including after compaction, inspect the working branch, local changes, applicable instructions, relevant shared records, and existing implementation. Recover context from authoritative records. Check for newer shared instructions on the actual remote default branch without overwriting local work. Read what is relevant; avoid repeated full-history scans and constant polling.
-2. Search before creating tasks. Claim a meaningful outcome in its Gitea issue with a stable session identity, scope, branch/worktree, and acceptance criteria. Keep small steps within that task. Recheck after claiming; comments are not atomic locks. Respect existing ownership and resolve overlapping claims before overlapping work.
-3. Independent sessions are peers. Each owns its contribution and delegated work. Record one integration/release owner when a milestone needs shared coordination. Use separate worktrees or checkouts, partition files/interfaces, and coordinate changes to shared specifications and documents.
-4. At meaningful checkpoints or handoffs, record changed results, commit/PR links, verification commands and environment, blockers, and next actions. Identify the tested code version and uncommitted or unpublished work; make required artifacts accessible to other sessions. Do not assume another agent is running or has read a message; silence alone does not establish abandonment. Record evidence and preserve existing work when reassigning a task.
-5. Follow project review and merge conventions. Inspect upstream changes, resolve conflicts while preserving others' edits, and verify the combined result. Do not overwrite others' work or force-push shared history to resolve coordination problems.
+2. Search before creating tasks. Claim a meaningful outcome in its Gitea issue with a stable session identity, scope, remote repository/branch, and acceptance criteria. Keep small steps within that task. Recheck after claiming; comments are not atomic locks. Respect existing ownership and resolve overlapping claims before overlapping work.
+3. Independent sessions are peers. Each owns its contribution and delegated work on its own machine. Record one integration/release owner when a milestone needs shared coordination. Use distinct remote work branches, partition files/interfaces, and coordinate changes to shared specifications and documents. Worktrees provide local isolation only; they do not share work between machines.
+4. At meaningful checkpoints or handoffs, record changed results, commit/PR links, verification commands and environment, blockers, and next actions. Identify the tested code version and label uncommitted or unpublished work as local-only. Before asking peers to consume results, push the required code and versioned documentation, including relevant `harness` updates; publish other required artifacts in Gitea and link them. Use repository-relative paths with commit references, reproducible commands, and necessary environment details; local paths and localhost URLs alone are not handoffs. Do not assume another agent is running or has read a message; silence alone does not establish abandonment. Record evidence and preserve existing work when reassigning a task.
+5. Follow project review and merge conventions. Fetch the relevant remote branches and inspect the identified commits before reviewing or integrating another machine's work. Resolve conflicts while preserving others' edits, and verify the combined result locally; report material environment differences. Local instruction-file edits reach peers only after publication and retrieval. Do not overwrite others' work or force-push shared history to resolve coordination problems.
 6. Close work when its acceptance criteria are met and the result is integrated or delivered as appropriate. Mark duplicates and superseded tasks explicitly with replacement links. Then choose further useful unowned work while the requested objective remains incomplete.
 
 Use Gitea MCP for shared coordination. If unavailable, report the failure, buffer necessary handoff information locally, and continue already-owned or clearly non-overlapping work. Reconcile with current Gitea state when access returns; do not claim an ownership update, review, or publication succeeded without confirmation.
 
 ## Delegation and reasoning
 
-Use GPT-6 Astra exclusively. Delegate bounded independent research, design, implementation, or review when it improves progress, judgment, or preserves the parent's context. Give subagents the relevant context, ownership boundaries, result format, and evidence requirements. Use fresh critics when practical. The parent owns synthesis and integration and normally consolidates results into Gitea. Choose concurrency according to useful independent work and available resources, including other sessions; there is no agent-count quota.
+Use GPT-6 Astra exclusively. Gitea peers are independent remote sessions, not subagents controlled by this session. Spawned subagents use the execution environment actually provided by the agent tools; do not assume they share files, and publish their results before Gitea peers need them. Delegate bounded independent research, design, implementation, or review when it improves progress, judgment, or preserves the parent's context. Give subagents the relevant context, ownership boundaries, result format, and evidence requirements. Use fresh critics when practical. The parent owns synthesis and integration and normally consolidates results into Gitea. Choose concurrency according to useful independent work and available resources, including other sessions; there is no agent-count quota.
 
 Optimize reasoning effort for verified outcomes per cost, including review, retries, and repair:
 
-Main agent: default to high for planning, synthesis, integration, and acceptance decisions; medium for dispatching a settled plan and routine coordination.
-
-Subagents: default to medium for bounded implementation and targeted research; low for straightforward retrieval, mechanical edits, and running established checks; high for complex debugging, correctness review, adversarial analysis, or ambiguous design.
-
-Use extra-high selectively for difficult foundational semantic, methodological, formal, or cross-domain decisions. Reserve max for exceptional unresolved problems where additional reasoning is likely to justify its cost. Retain higher settings when evidence supports their value.
+- Main agent: default to high for planning, synthesis, integration, and acceptance decisions; medium for dispatching a settled plan and routine coordination.
+- Subagents: default to medium for bounded implementation and targeted research; low for straightforward retrieval, mechanical edits, and running established checks; high for complex debugging, correctness review, adversarial analysis, or ambiguous design.
+- Use extra-high selectively for difficult foundational semantic, methodological, formal, or cross-domain decisions. Reserve max for exceptional unresolved problems where additional reasoning is likely to justify its cost. Retain higher settings when evidence supports their value.
 
 Allocate by task difficulty and consequences, not role or length alone. Start higher when a clearly difficult decision has expensive downstream consequences. Escalate for concrete reasoning difficulties; resolve missing evidence or unclear requirements at their source. Set subagent effort explicitly through supported controls to avoid unintended inheritance. Do not claim an unapplied change or alter global configuration merely to enforce these preferences.
 

crates/oa-core/examples/release_dense_views.rs

@@ -230,7 +230,7 @@ fn fixture() -> (Project, Id, Vec<Id>, Vec<Id>, Vec<Id>) {
             )
         })
         .collect();
-    p.diagrams.insert(diagram, Diagram { id: diagram, alias: "forty_exchange_view".into(), name: "Forty service exchanges · all concerns".into(), description: "Start with All. Compare first category, overlapping concerns, global coverage and chosen processes. No hand-routed edges.".into(), layer: Layer::Oa, projection: ProjectionKind::FunctionalDataflow, view_options: ViewOptions::default(), nodes, routes: vec![] });
+    p.diagrams.insert(diagram, Diagram { id: diagram, alias: "forty_exchange_view".into(), name: "Forty service exchanges · all concerns".into(), description: "Start with All. Compare first category, overlapping concerns, global coverage and chosen processes. No hand-routed edges.".into(), layer: Layer::Oa, projection: ProjectionKind::FunctionalDataflow, view_options: ViewOptions::default(), nodes, layout: None, routes: vec![] });
     (p, diagram, exchanges, categories, contexts)
 }
 

crates/oa-core/src/demo.rs

@@ -81,6 +81,7 @@ fn diagram(
             projection,
             view_options: Default::default(),
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-core/src/language.rs

@@ -1823,7 +1823,7 @@ pub(crate) fn resolve_declarations(
                         return Err(conversion_error(std::format!("Unknown diagram field '{key}' in the frozen pre6 contract.")));
                     }
                     let defaults =
-                        serde_json::json!({"description":"","layer":"Oa","projection":"Overview","routes":[],"view_options":crate::view_options::ViewOptions::default()});
+                        serde_json::json!({"description":"","layer":"Oa","projection":"Overview","routes":[],"view_options":crate::view_options::ViewOptions::default(),"layout":null});
                     let mut record = merge_fields(defaults.as_object().unwrap().clone(), fields)
                         .map_err(&conversion_error)?;
                     header(&mut record, d, true);

crates/oa-core/src/lib.rs

@@ -8,6 +8,7 @@ pub mod ports;
 pub mod projection;
 pub mod references;
 pub mod routing;
+pub mod scenario_layout;
 pub mod semantic;
 pub mod session;
 pub mod source_files;
@@ -18,6 +19,9 @@ pub mod validation;
 pub mod view_options;
 pub use model::*;
 pub use ports::*;
+pub use scenario_layout::{
+    DiagramLayout, ScenarioLanePosition, ScenarioLayout, ScenarioMessagePosition,
+};
 pub use semantic::*;
 pub use session::*;
 mod demo;

crates/oa-core/src/model.rs

@@ -1436,6 +1436,7 @@ pub enum ProjectionKind {
     FunctionalDataflow,
     Capabilities,
     StateMachine { machine: Id },
+    Scenario { scenario: Id },
 }
 impl ProjectionKind {
     pub fn state_machine(self) -> Option<Id> {
@@ -1445,8 +1446,30 @@ impl ProjectionKind {
         }
     }
 
+    /// The semantic owner of a saved Scenario representation.
+    pub fn scenario(self) -> Option<Id> {
+        match self {
+            Self::Scenario { scenario } => Some(scenario),
+            _ => None,
+        }
+    }
+
+    /// Explicitly classify architecture views; absence of a state machine is insufficient.
+    pub fn is_architecture(self) -> bool {
+        match self {
+            Self::Overview
+            | Self::Decomposition
+            | Self::Allocation
+            | Self::Traceability
+            | Self::FunctionalDataflow
+            | Self::Capabilities => true,
+            Self::StateMachine { .. } | Self::Scenario { .. } => false,
+        }
+    }
+
     pub fn includes(self, kind: Kind) -> bool {
         match self {
+            Self::Scenario { .. } => false,
             Self::StateMachine { .. } => {
                 matches!(kind, Kind::StateMachine | Kind::Region) || kind.is_state()
             }
@@ -1471,6 +1494,7 @@ impl std::fmt::Display for ProjectionKind {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(match self {
             Self::StateMachine { .. } => "State machine",
+            Self::Scenario { .. } => "Scenario",
             Self::Allocation => "Architecture · allocated work",
             Self::FunctionalDataflow => "Functional dataflow",
             Self::Capabilities => "Missions & capabilities",
@@ -1495,6 +1519,8 @@ pub struct Diagram {
     pub nodes: BTreeMap<Id, NodePlacement>,
     #[serde(default)]
     pub routes: Vec<EdgeRoute>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub layout: Option<crate::scenario_layout::DiagramLayout>,
 }
 /// Authored presentation for one existing relation or trace in one diagram.
 /// Computed endpoints and automatic routing elbows are never persisted here.
@@ -1921,6 +1947,7 @@ impl Project {
                 view_options: crate::view_options::ViewOptions::default(),
                 nodes: BTreeMap::new(),
                 routes: vec![],
+                layout: None,
             },
         );
         id

crates/oa-core/src/projection.rs

@@ -278,6 +278,11 @@ fn project_diagram_impl(
     mut availability: Option<&mut BTreeMap<Id, crate::view_options::EdgeAvailability>>,
     index: Option<&crate::view_options::ViewIndex>,
 ) -> ProjectedView {
+    // Saved Scenario layout is not an architecture/state projection. Its dedicated
+    // renderer is not wired yet; never interpret its payload through this fallback.
+    if d.projection.scenario().is_some() {
+        return ProjectedView::default();
+    }
     let parents = parents(p, d);
     let mut nodes = Vec::new();
     for n in d.nodes.values() {
@@ -394,6 +399,7 @@ fn project_diagram_impl(
             continue;
         }
         let included = match d.projection {
+            ProjectionKind::Scenario { .. } => false,
             ProjectionKind::StateMachine { machine } => matches!(&r.body,
                 RelationBody::StateTransition { transition_kind, .. }
                     if *transition_kind != TransitionKind::Internal

crates/oa-core/src/references.rs

@@ -203,7 +203,81 @@ pub fn visit_relation_refs(r: &mut Relation, mut visit: impl FnMut(&mut Id)) {
         _ => {}
     }
 }
-pub fn remap_references(p: &mut Project, old: Id, new: Id) {
+/// Every semantic/presentation reference in a diagram, excluding its own identities.
+pub fn diagram_references(d: &Diagram) -> Vec<Id> {
+    let mut copy = d.clone();
+    let mut refs = Vec::new();
+    visit_diagram_refs(&mut copy, |id| refs.push(*id));
+    refs
+}
+
+pub fn visit_diagram_refs(d: &mut Diagram, mut visit: impl FnMut(&mut Id)) {
+    d.view_options.visit_references(&mut visit);
+    match &mut d.projection {
+        ProjectionKind::StateMachine { machine } => visit(machine),
+        ProjectionKind::Scenario { scenario } => visit(scenario),
+        _ => {}
+    }
+    if let Some(layout) = &mut d.layout {
+        layout.visit_references(&mut visit);
+    }
+    for route in &mut d.routes {
+        visit(&mut route.edge);
+    }
+    for node in d.nodes.values_mut() {
+        for anchor in &mut node.port_anchors {
+            visit(&mut anchor.port);
+        }
+        visit(&mut node.element);
+    }
+}
+
+/// Preflight reference-key collisions before the caller changes object identities.
+/// Fresh targets are allowed. This is not whole-project admission: unrelated
+/// invalid records remain repairable within a transaction. Future typed reference
+/// domains must compose their own preflight here before any remap mutation.
+pub fn check_remap(p: &Project, old: Id, new: Id) -> Result<(), ModelError> {
+    if old == new {
+        return Ok(());
+    }
+    let remap = |id: Id| if id == old { new } else { id };
+    for diagram in p.diagrams.values() {
+        let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+            continue;
+        };
+        let mut lanes = std::collections::BTreeMap::new();
+        for lane in &layout.lanes {
+            let affected = lane.lifeline == old;
+            if let Some(previous_affected) = lanes.insert(remap(lane.lifeline), affected)
+                && (affected || previous_affected)
+            {
+                return Err(ModelError(
+                    "Identity remap would collide with a Scenario lane position.".into(),
+                ));
+            }
+        }
+        let mut messages = std::collections::BTreeMap::new();
+        for message in &layout.messages {
+            let mut address = message.address.clone();
+            let affected = address.occurrence == old || address.references.contains(&old);
+            address.occurrence = remap(address.occurrence);
+            for reference in &mut address.references {
+                *reference = remap(*reference);
+            }
+            if let Some(previous_affected) = messages.insert(address, affected)
+                && (affected || previous_affected)
+            {
+                return Err(ModelError(
+                    "Identity remap would collide with a Scenario message position.".into(),
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+pub fn remap_references(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
+    check_remap(p, old, new)?;
     for e in p.elements.values_mut() {
         visit_element_refs(e, |id| {
             if *id == old {
@@ -219,31 +293,11 @@ pub fn remap_references(p: &mut Project, old: Id, new: Id) {
         });
     }
     for d in p.diagrams.values_mut() {
-        d.view_options.visit_references(|id| {
+        visit_diagram_refs(d, |id| {
             if *id == old {
                 *id = new;
             }
         });
-        if let ProjectionKind::StateMachine { machine } = &mut d.projection
-            && *machine == old
-        {
-            *machine = new;
-        }
-        for route in &mut d.routes {
-            if route.edge == old {
-                route.edge = new;
-            }
-        }
-        for n in d.nodes.values_mut() {
-            for anchor in &mut n.port_anchors {
-                if anchor.port == old {
-                    anchor.port = new;
-                }
-            }
-            if n.element == old {
-                n.element = new;
-            }
-        }
     }
     for a in p.artifact_links.values_mut() {
         if a.owner == old {
@@ -265,6 +319,7 @@ pub fn remap_references(p: &mut Project, old: Id, new: Id) {
             });
         }
     }
+    Ok(())
 }
 /// IDs removed by a cascade. Cross-layer traced counterparts are never included.
 pub fn deletion_impact(p: &Project, id: Id) -> BTreeSet<Id> {
@@ -339,7 +394,8 @@ fn deletion_impact_inner(p: &Project, id: Id, defer_exchange_allocations: bool)
         for d in p.diagrams.values() {
             if d.projection
                 .state_machine()
-                .is_some_and(|machine| removed.contains(&machine))
+                .or_else(|| d.projection.scenario())
+                .is_some_and(|owner| removed.contains(&owner))
             {
                 removed.insert(d.id);
             }
@@ -412,6 +468,7 @@ fn remove_objects(p: &mut Project, removed: BTreeSet<Id>) {
     p.artifact_links.retain(|id, _| !removed.contains(id));
     for d in p.diagrams.values_mut() {
         d.view_options.retain_references(|id| !removed.contains(id));
+        crate::scenario_layout::prune_deleted(d, &removed);
         d.nodes.retain(|id, _| !removed.contains(id));
         d.routes.retain(|route| !removed.contains(&route.edge));
         for node in d.nodes.values_mut() {
@@ -589,3 +646,7 @@ fn remove_objects(p: &mut Project, removed: BTreeSet<Id>) {
         }
     }
 }
+
+#[cfg(test)]
+#[path = "references/scenario_layout_tests.rs"]
+mod scenario_layout_tests;

crates/oa-core/src/references/scenario_layout_tests.rs

@@ -0,0 +1,388 @@
+use super::*;
+use std::collections::BTreeMap;
+
+struct Fixture {
+    project: Project,
+    owner: Id,
+    lanes: [Id; 2],
+    messages: [Id; 2],
+    views: [Id; 2],
+}
+
+fn address(occurrence: Id) -> OccurrenceEndpoint {
+    OccurrenceEndpoint {
+        references: vec![],
+        occurrence,
+    }
+}
+
+fn layout(project: &Project, view: Id) -> &ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) = &project.diagrams[&view].layout else {
+        panic!("expected authored Scenario positions")
+    };
+    layout
+}
+
+fn layout_mut(project: &mut Project, view: Id) -> &mut ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) =
+        &mut project.diagrams.get_mut(&view).unwrap().layout
+    else {
+        panic!("expected authored Scenario positions")
+    };
+    layout
+}
+
+fn admitted(project: &Project) {
+    let errors: Vec<_> = crate::validation::validate(project)
+        .into_iter()
+        .filter(|issue| issue.severity == crate::validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+}
+
+fn fixture() -> Fixture {
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::Scenario, Layer::Oa, "Delivery", None)
+        .unwrap();
+    let lanes = ["Sender", "Receiver"].map(|name| {
+        project
+            .add_element(Kind::Lifeline, Layer::Oa, name, Some(owner))
+            .unwrap()
+    });
+    let messages = ["First message", "Second message"].map(|name| {
+        let id = project
+            .add_element(Kind::Occurrence, Layer::Oa, name, Some(owner))
+            .unwrap();
+        *project.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange {
+                exchange: None,
+                sender: Some(lanes[0]),
+                receiver: Some(lanes[1]),
+                message_kind: MessageKind::Asynchronous,
+                reply_to: None,
+                values: vec![],
+                operation: None,
+            },
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+        id
+    });
+    *project
+        .elements
+        .get_mut(&owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = messages.to_vec();
+    let views = ["delivery_view", "review_view"].map(|alias| {
+        let id = Id::new_v4();
+        project.diagrams.insert(
+            id,
+            Diagram {
+                id,
+                alias: alias.into(),
+                name: alias.into(),
+                description: String::new(),
+                layer: Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: owner },
+                view_options: Default::default(),
+                nodes: BTreeMap::new(),
+                routes: vec![],
+                layout: Some(DiagramLayout::Scenario(ScenarioLayout {
+                    lanes: vec![
+                        ScenarioLanePosition {
+                            lifeline: lanes[0],
+                            x: 120.,
+                        },
+                        ScenarioLanePosition {
+                            lifeline: lanes[1],
+                            x: 420.,
+                        },
+                    ],
+                    messages: vec![
+                        ScenarioMessagePosition {
+                            address: address(messages[0]),
+                            send_y: 220.,
+                        },
+                        ScenarioMessagePosition {
+                            address: address(messages[1]),
+                            send_y: 360.,
+                        },
+                    ],
+                })),
+            },
+        );
+        id
+    });
+    admitted(&project);
+    Fixture {
+        project,
+        owner,
+        lanes,
+        messages,
+        views,
+    }
+}
+
+#[test]
+fn fresh_identity_swap_preserves_coordinates_and_semantic_sequence() {
+    let mut f = fixture();
+    let before = f.project.clone();
+    let temporary = Id::new_v4();
+    for ids in [f.lanes, f.messages] {
+        f.project = crate::execute_batch(
+            &f.project,
+            &[
+                Command::Reidentify(ids[0], temporary),
+                Command::Reidentify(ids[1], ids[0]),
+                Command::Reidentify(temporary, ids[1]),
+            ],
+        )
+        .unwrap();
+    }
+    admitted(&f.project);
+    assert_eq!(
+        f.project.elements[&f.owner].steps().unwrap(),
+        &vec![f.messages[1], f.messages[0]]
+    );
+    for view in f.views {
+        let rows = layout(&f.project, view);
+        assert_eq!(
+            rows.lanes,
+            vec![
+                ScenarioLanePosition {
+                    lifeline: f.lanes[1],
+                    x: 120.
+                },
+                ScenarioLanePosition {
+                    lifeline: f.lanes[0],
+                    x: 420.
+                }
+            ]
+        );
+        assert_eq!(
+            rows.messages,
+            vec![
+                ScenarioMessagePosition {
+                    address: address(f.messages[1]),
+                    send_y: 220.
+                },
+                ScenarioMessagePosition {
+                    address: address(f.messages[0]),
+                    send_y: 360.
+                }
+            ]
+        );
+    }
+    // Reverse the swaps: no values or identities other than those requested drift.
+    for ids in [f.lanes, f.messages] {
+        f.project = crate::execute_batch(
+            &f.project,
+            &[
+                Command::Reidentify(ids[0], temporary),
+                Command::Reidentify(ids[1], ids[0]),
+                Command::Reidentify(temporary, ids[1]),
+            ],
+        )
+        .unwrap();
+    }
+    assert_eq!(f.project, before);
+}
+
+#[test]
+fn colliding_lane_or_message_remap_rejects_before_any_reference_changes() {
+    for message in [false, true] {
+        let mut f = fixture();
+        let [old, new] = if message { f.messages } else { f.lanes };
+        let before = f.project.clone();
+        assert!(check_remap(&f.project, old, new).is_err());
+        assert!(remap_references(&mut f.project, old, new).is_err());
+        assert_eq!(f.project, before);
+    }
+}
+
+#[test]
+fn reidentify_preflight_precedes_object_map_mutation_for_fresh_colliding_target() {
+    let mut f = fixture();
+    let fresh = Id::new_v4();
+    // A repair candidate can already have a dangling coordinate key. It must not
+    // silently merge with the live lane, even though the destination ID is vacant.
+    layout_mut(&mut f.project, f.views[0]).lanes[1].lifeline = fresh;
+    let before = f.project.clone();
+    assert!(crate::session::reidentify(&mut f.project, f.lanes[0], fresh).is_err());
+    assert_eq!(f.project, before);
+}
+
+#[test]
+fn full_address_paths_are_walked_and_collision_checked_without_admitting_expansion() {
+    let mut f = fixture();
+    let [old, new] = [Id::new_v4(), Id::new_v4()];
+    let rows = layout_mut(&mut f.project, f.views[0]);
+    // Future/invalid expanded candidates still participate in reference safety.
+    rows.messages[0].address.references = vec![old];
+    rows.messages[1].address = OccurrenceEndpoint {
+        references: vec![new],
+        occurrence: f.messages[0],
+    };
+    let refs = diagram_references(&f.project.diagrams[&f.views[0]]);
+    assert!(refs.contains(&f.owner) && refs.contains(&old) && refs.contains(&new));
+    let before = f.project.clone();
+    assert!(remap_references(&mut f.project, old, new).is_err());
+    assert_eq!(f.project, before);
+    let fresh = Id::new_v4();
+    remap_references(&mut f.project, old, fresh).unwrap();
+    let rows = layout(&f.project, f.views[0]);
+    assert_eq!(rows.messages[0].address.references, vec![fresh]);
+    assert_eq!(rows.messages[0].address.occurrence, f.messages[0]);
+    assert_eq!(rows.messages[1].address.references, vec![new]);
+}
+
+#[test]
+fn owner_reidentify_and_delete_cover_all_saved_views_without_deleting_other_owners() {
+    let mut f = fixture();
+    let other_owner = f
+        .project
+        .add_element(Kind::Scenario, Layer::Oa, "Independent", None)
+        .unwrap();
+    let mut other_view = f.project.diagrams[&f.views[0]].clone();
+    other_view.id = Id::new_v4();
+    other_view.alias = "independent_view".into();
+    other_view.projection = ProjectionKind::Scenario {
+        scenario: other_owner,
+    };
+    other_view.layout = None;
+    f.project.diagrams.insert(other_view.id, other_view.clone());
+    admitted(&f.project);
+    let fresh_owner = Id::new_v4();
+    f.project = crate::prepare_command(&f.project, &Command::Reidentify(f.owner, fresh_owner))
+        .unwrap()
+        .project;
+    for view in f.views {
+        assert_eq!(
+            f.project.diagrams[&view].projection.scenario(),
+            Some(fresh_owner)
+        );
+    }
+    let impact = deletion_impact(&f.project, fresh_owner);
+    assert!(
+        f.views
+            .iter()
+            .chain(&f.lanes)
+            .chain(&f.messages)
+            .all(|id| impact.contains(id))
+    );
+    assert!(!impact.contains(&other_owner) && !impact.contains(&other_view.id));
+    delete_cascade(&mut f.project, fresh_owner);
+    assert_eq!(f.project.diagrams[&other_view.id], other_view);
+    assert!(
+        f.views
+            .iter()
+            .all(|id| !f.project.diagrams.contains_key(id))
+    );
+    admitted(&f.project);
+}
+
+#[test]
+fn deletion_then_recreation_never_resurrects_lane_or_message_coordinates() {
+    let mut f = fixture();
+    let lane = f.project.elements[&f.lanes[0]].clone();
+    let message = f.project.elements[&f.messages[0]].clone();
+    delete_cascade(&mut f.project, lane.id);
+    for view in f.views {
+        let rows = layout(&f.project, view);
+        assert_eq!(rows.lanes.len(), 1);
+        assert_eq!(rows.lanes[0].lifeline, f.lanes[1]);
+        // Missing endpoint assignment does not erase a still-live message's spacing.
+        assert_eq!(rows.messages.len(), 2);
+    }
+    let mut pending = BTreeSet::new();
+    delete_cascade_deferred(&mut f.project, message.id, &mut pending);
+    // Pruning happens during deletion, before later batch commands can recreate IDs.
+    assert!(
+        layout(&f.project, f.views[0])
+            .messages
+            .iter()
+            .all(|row| row.address.occurrence != message.id)
+    );
+    f.project.elements.insert(lane.id, lane);
+    f.project.elements.insert(message.id, message);
+    f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .insert(0, f.messages[0]);
+    finish_deletions(&mut f.project, &pending);
+    for view in f.views {
+        let rows = layout(&f.project, view);
+        assert_eq!(rows.lanes.len(), 1);
+        assert_eq!(
+            rows.messages,
+            vec![ScenarioMessagePosition {
+                address: address(f.messages[1]),
+                send_y: 360.
+            }]
+        );
+    }
+    admitted(&f.project);
+}
+
+#[test]
+fn unrelated_invalid_records_do_not_block_scoped_remap_or_get_repaired_implicitly() {
+    let mut f = fixture();
+    let unrelated = Id::new_v4();
+    let rows = layout_mut(&mut f.project, f.views[1]);
+    let invalid = ScenarioLanePosition {
+        lifeline: unrelated,
+        x: MAX_COORDINATE * 2.,
+    };
+    rows.lanes.extend([invalid.clone(), invalid]);
+    let fresh = Id::new_v4();
+    let untouched = f.project.diagrams[&f.views[1]].clone();
+    let before = f.project.clone();
+    remap_references(&mut f.project, f.owner, f.owner).unwrap();
+    assert_eq!(f.project, before);
+    // The duplicate lane records do not involve the remapped message identity.
+    remap_references(&mut f.project, f.messages[0], fresh).unwrap();
+    assert_eq!(
+        layout(&f.project, f.views[1]).lanes,
+        layout_from(&untouched).lanes
+    );
+    assert_eq!(
+        layout(&f.project, f.views[1]).messages[0]
+            .address
+            .occurrence,
+        fresh
+    );
+    assert_eq!(layout(&f.project, f.views[1]).messages[0].send_y, 220.);
+}
+
+fn layout_from(diagram: &Diagram) -> &ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+        panic!("missing layout")
+    };
+    layout
+}
+
+#[test]
+fn deletion_prunes_an_explicit_address_path_without_pruning_other_message_rows() {
+    let mut f = fixture();
+    // Expanded addresses are not admitted in this slice, but deleting their
+    // explicit references must still make an intermediate repair candidate safe.
+    layout_mut(&mut f.project, f.views[0]).messages[0]
+        .address
+        .references = vec![f.lanes[0]];
+    delete_cascade(&mut f.project, f.lanes[0]);
+    assert_eq!(
+        layout(&f.project, f.views[0]).messages,
+        vec![ScenarioMessagePosition {
+            address: address(f.messages[1]),
+            send_y: 360.
+        }]
+    );
+    assert_eq!(layout(&f.project, f.views[1]).messages.len(), 2);
+    assert!(f.project.elements.contains_key(&f.messages[0]));
+    admitted(&f.project);
+}

crates/oa-core/src/scenario_layout.rs

@@ -0,0 +1,429 @@
+//! Authored Scenario presentation. Structural admission never changes event order.
+use crate::{
+    Diagram, Id, Kind, Layer, MAX_COORDINATE, ModelError, OccurrenceBody, OccurrenceEndpoint,
+    Project, SharedBody, validation,
+};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeSet;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum DiagramLayout {
+    Scenario(ScenarioLayout),
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
+pub struct ScenarioLayout {
+    #[serde(default)]
+    pub lanes: Vec<ScenarioLanePosition>,
+    #[serde(default)]
+    pub messages: Vec<ScenarioMessagePosition>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ScenarioLanePosition {
+    pub lifeline: Id,
+    pub x: f32,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ScenarioMessagePosition {
+    pub address: OccurrenceEndpoint,
+    /// Actual send endpoint, not the renderer's receive-oriented lifecycle row.
+    pub send_y: f32,
+}
+
+impl DiagramLayout {
+    /// Visit every explicit reference, including unsupported paths in a candidate.
+    /// The caller owns remap preflight and final atomic validation.
+    pub fn visit_references(&mut self, mut visit: impl FnMut(&mut Id)) {
+        match self {
+            Self::Scenario(layout) => {
+                for lane in &mut layout.lanes {
+                    visit(&mut lane.lifeline);
+                }
+                for message in &mut layout.messages {
+                    for reference in &mut message.address.references {
+                        visit(reference);
+                    }
+                    visit(&mut message.address.occurrence);
+                }
+            }
+        }
+    }
+}
+
+/// Proposed aggregate accounting contribution; the shared admission owner applies it.
+/// One payload plus one record per lane/message. No graph objects are introduced.
+pub fn record_count(diagram: &Diagram) -> usize {
+    match &diagram.layout {
+        None => 0,
+        Some(DiagramLayout::Scenario(layout)) => 1usize
+            .saturating_add(layout.lanes.len())
+            .saturating_add(layout.messages.len()),
+    }
+}
+
+fn coordinate(value: f32) -> bool {
+    value.is_finite() && value.abs() <= MAX_COORDINATE
+}
+
+fn owner(p: &Project, diagram: &Diagram) -> Result<Id, ModelError> {
+    let scenario = diagram
+        .projection
+        .scenario()
+        .ok_or_else(|| ModelError("Scenario layout requires a Scenario projection.".into()))?;
+    if !p
+        .elements
+        .get(&scenario)
+        .is_some_and(|element| element.kind() == Kind::Scenario && element.layer() == diagram.layer)
+    {
+        return Err(ModelError(
+            "Scenario projection requires an existing Scenario in the diagram layer.".into(),
+        ));
+    }
+    Ok(scenario)
+}
+
+fn lane_member(p: &Project, owner: Id, layer: Layer, lifeline: Id) -> bool {
+    p.elements.get(&lifeline).is_some_and(|element| {
+        element.kind() == Kind::Lifeline
+            && element.parent == Some(owner)
+            && element.layer() == layer
+    })
+}
+
+/// Only actual steps of this Scenario and its own Fragment/Branch sequences.
+/// ScenarioUse/SequenceReference are deliberately never expanded. Invalid graph
+/// cycles terminate, and malformed parent/step links do not manufacture membership.
+fn direct_messages(p: &Project, owner: Id, layer: Layer) -> BTreeSet<Id> {
+    let mut messages = BTreeSet::new();
+    let mut visited = BTreeSet::new();
+    let mut pending = vec![owner];
+    while let Some(scope) = pending.pop() {
+        if !visited.insert(scope) {
+            continue;
+        }
+        let Some(element) = p.elements.get(&scope) else {
+            continue;
+        };
+        for id in element.steps().into_iter().flatten() {
+            let Some(item) = p.elements.get(id) else {
+                continue;
+            };
+            if item.parent != Some(scope) || item.layer() != layer {
+                continue;
+            }
+            match item.shared() {
+                Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Exchange { .. },
+                    ..
+                }) => {
+                    messages.insert(*id);
+                }
+                Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Fragment { branches, .. },
+                    ..
+                }) => {
+                    for branch in branches {
+                        if p.elements.get(branch).is_some_and(|operand| {
+                            operand.parent == Some(*id)
+                                && operand.layer() == layer
+                                && matches!(
+                                    operand.shared(),
+                                    Some(SharedBody::Occurrence {
+                                        body: OccurrenceBody::Branch { .. },
+                                        ..
+                                    })
+                                )
+                        }) {
+                            pending.push(*branch);
+                        }
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+    messages
+}
+
+pub(crate) fn validate_diagram(p: &Project, diagram: &Diagram, out: &mut Vec<validation::Issue>) {
+    if diagram.projection.scenario().is_none() {
+        if diagram.layout.is_some() {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_projection",
+                "layout",
+                "Only a Scenario projection accepts a Scenario layout, including an empty payload.",
+            );
+        }
+        return;
+    }
+    let scenario = match owner(p, diagram) {
+        Ok(owner) => owner,
+        Err(error) => {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_diagram_context",
+                "projection",
+                error.0,
+            );
+            return;
+        }
+    };
+    if !diagram.nodes.is_empty() || !diagram.routes.is_empty() {
+        validation::error(
+            out,
+            diagram.id,
+            "scenario_diagram_content",
+            "layout",
+            "Scenario views do not accept architecture node placements or edge routes.",
+        );
+    }
+    let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+        return;
+    };
+    let mut lanes = BTreeSet::new();
+    for lane in &layout.lanes {
+        if !lanes.insert(lane.lifeline) {
+            validation::error(
+                out,
+                diagram.id,
+                "duplicate_scenario_lane",
+                "layout",
+                "A Scenario layout has at most one position per lifeline.",
+            );
+        }
+        if !lane_member(p, scenario, diagram.layer, lane.lifeline) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_lifeline",
+                "layout",
+                "Lane positions reference a Lifeline directly owned by the projected Scenario.",
+            );
+        }
+        if !coordinate(lane.x) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_coordinate",
+                "layout",
+                "Scenario positions must be finite and within the shared coordinate bounds.",
+            );
+        }
+    }
+    let members = direct_messages(p, scenario, diagram.layer);
+    let mut addresses = BTreeSet::new();
+    for message in &layout.messages {
+        // Reject expanded paths without cloning or indexing their potentially large contents.
+        if !message.address.references.is_empty() {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_address",
+                "layout",
+                "Expanded-reference message positions are not supported; references must be empty.",
+            );
+        } else if !addresses.insert(message.address.occurrence) {
+            validation::error(
+                out,
+                diagram.id,
+                "duplicate_scenario_message",
+                "layout",
+                "A Scenario layout has at most one position per message address.",
+            );
+        }
+        if !members.contains(&message.address.occurrence) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_message",
+                "layout",
+                "Message positions reference Exchange occurrences in the Scenario's own ordered sequence tree.",
+            );
+        }
+        if !coordinate(message.send_y) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_coordinate",
+                "layout",
+                "Scenario positions must be finite and within the shared coordinate bounds.",
+            );
+        }
+    }
+}
+
+fn editable(p: &Project, id: Id) -> Result<(&Diagram, Id), ModelError> {
+    let diagram = p
+        .diagrams
+        .get(&id)
+        .ok_or_else(|| ModelError("Scenario diagram does not exist.".into()))?;
+    let scenario = owner(p, diagram)?;
+    if !diagram.nodes.is_empty() || !diagram.routes.is_empty() {
+        return Err(ModelError(
+            "Scenario views do not accept architecture node placements or edge routes.".into(),
+        ));
+    }
+    Ok((diagram, scenario))
+}
+
+fn check_message(
+    p: &Project,
+    diagram: &Diagram,
+    owner: Id,
+    address: &OccurrenceEndpoint,
+) -> Result<(), ModelError> {
+    if !address.references.is_empty() {
+        return Err(ModelError(
+            "Expanded-reference message positions are not supported; references must be empty."
+                .into(),
+        ));
+    }
+    if !direct_messages(p, owner, diagram.layer).contains(&address.occurrence) {
+        return Err(ModelError("Message position requires an Exchange occurrence in the Scenario's own ordered sequence tree.".into()));
+    }
+    Ok(())
+}
+
+fn payload(diagram: &mut Diagram) -> &mut ScenarioLayout {
+    let DiagramLayout::Scenario(layout) = diagram
+        .layout
+        .get_or_insert_with(|| DiagramLayout::Scenario(ScenarioLayout::default()));
+    layout
+}
+
+/// Target-scoped preparation, not whole-project or whole-layout validation.
+/// Unrelated intermediate errors remain repairable by later commands in a batch.
+pub fn set_lane(
+    p: &Project,
+    diagram: Id,
+    position: ScenarioLanePosition,
+) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    if !lane_member(p, owner, current.layer, position.lifeline) || !coordinate(position.x) {
+        return Err(ModelError(
+            "Lane position requires an owned Lifeline and a finite bounded x coordinate.".into(),
+        ));
+    }
+    let mut result = current.clone();
+    let layout = payload(&mut result);
+    if layout
+        .lanes
+        .iter()
+        .filter(|row| row.lifeline == position.lifeline)
+        .count()
+        > 1
+    {
+        return Err(ModelError(
+            "Cannot set an ambiguous duplicate lane position.".into(),
+        ));
+    }
+    if let Some(existing) = layout
+        .lanes
+        .iter_mut()
+        .find(|row| row.lifeline == position.lifeline)
+    {
+        if existing.x != position.x {
+            *existing = position;
+        }
+    } else {
+        layout.lanes.push(position);
+    }
+    Ok(result)
+}
+
+pub fn remove_lane(p: &Project, diagram: Id, lifeline: Id) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    if !lane_member(p, owner, current.layer, lifeline) {
+        return Err(ModelError(
+            "Removing a lane position requires an owned Lifeline.".into(),
+        ));
+    }
+    let mut result = current.clone();
+    if let Some(DiagramLayout::Scenario(layout)) = &mut result.layout {
+        layout.lanes.retain(|row| row.lifeline != lifeline);
+    }
+    Ok(result)
+}
+
+pub fn set_message(
+    p: &Project,
+    diagram: Id,
+    position: ScenarioMessagePosition,
+) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    check_message(p, current, owner, &position.address)?;
+    if !coordinate(position.send_y) {
+        return Err(ModelError(
+            "Message position requires a finite bounded send_y coordinate.".into(),
+        ));
+    }
+    let mut result = current.clone();
+    let layout = payload(&mut result);
+    if layout
+        .messages
+        .iter()
+        .filter(|row| row.address == position.address)
+        .count()
+        > 1
+    {
+        return Err(ModelError(
+            "Cannot set an ambiguous duplicate message position.".into(),
+        ));
+    }
+    if let Some(existing) = layout
+        .messages
+        .iter_mut()
+        .find(|row| row.address == position.address)
+    {
+        if existing.send_y != position.send_y {
+            *existing = position;
+        }
+    } else {
+        layout.messages.push(position);
+    }
+    Ok(result)
+}
+
+pub fn remove_message(
+    p: &Project,
+    diagram: Id,
+    address: &OccurrenceEndpoint,
+) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    check_message(p, current, owner, address)?;
+    let mut result = current.clone();
+    if let Some(DiagramLayout::Scenario(layout)) = &mut result.layout {
+        layout.messages.retain(|row| &row.address != address);
+    }
+    Ok(result)
+}
+
+/// Prune only identities in the caller's actual deletion closure, never visibility
+/// or missing endpoint assignments. Owner-view cascade remains the caller's job.
+pub fn prune_deleted(diagram: &mut Diagram, deleted: &BTreeSet<Id>) {
+    if let Some(DiagramLayout::Scenario(layout)) = &mut diagram.layout {
+        layout
+            .lanes
+            .retain(|lane| !deleted.contains(&lane.lifeline));
+        layout.messages.retain(|message| {
+            !deleted.contains(&message.address.occurrence)
+                && !message
+                    .address
+                    .references
+                    .iter()
+                    .any(|id| deleted.contains(id))
+        });
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/scenario_layout/tests.rs

@@ -0,0 +1,800 @@
+use super::*;
+use crate::{
+    Element, FragmentOperator, MessageKind, ProjectionKind, Relation, RelationBody, RelationKind,
+    ScenarioViewpoint,
+};
+use std::collections::BTreeMap;
+
+struct Fixture {
+    project: Project,
+    owner: Id,
+    performer: Id,
+    lane: Id,
+    repeated_lane: Id,
+    first: Id,
+    second: Id,
+    nested: Id,
+    fragment: Id,
+    branch: Id,
+    view: Id,
+    other_view: Id,
+    exchange: Id,
+}
+
+fn set_body(element: &mut Element, body: OccurrenceBody) {
+    *element.shared_mut().unwrap() = SharedBody::Occurrence {
+        body,
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+}
+fn address(occurrence: Id) -> OccurrenceEndpoint {
+    OccurrenceEndpoint {
+        references: vec![],
+        occurrence,
+    }
+}
+fn diagram(owner: Id, alias: &str) -> Diagram {
+    Diagram {
+        id: Id::new_v4(),
+        alias: alias.into(),
+        name: alias.into(),
+        description: String::new(),
+        layer: Layer::Oa,
+        projection: ProjectionKind::Scenario { scenario: owner },
+        view_options: Default::default(),
+        nodes: BTreeMap::new(),
+        routes: vec![],
+        layout: None,
+    }
+}
+fn assert_admitted(project: &Project) {
+    let errors: Vec<_> = validation::validate(project)
+        .into_iter()
+        .filter(|issue| issue.severity == validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+}
+fn has_code(project: &Project, code: &str) -> bool {
+    validation::validate(project)
+        .iter()
+        .any(|issue| issue.code == code)
+}
+fn layout(diagram: &Diagram) -> &ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+        panic!("expected saved payload")
+    };
+    layout
+}
+fn save(project: &mut Project, replacement: Diagram) {
+    project.diagrams.insert(replacement.id, replacement);
+}
+fn fixture() -> Fixture {
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::Scenario, Layer::Oa, "Nominal", None)
+        .unwrap();
+    let Some(SharedBody::Scenario { viewpoint, .. }) =
+        project.elements.get_mut(&owner).unwrap().shared_mut()
+    else {
+        panic!("Scenario fixture body");
+    };
+    *viewpoint = ScenarioViewpoint::ParticipantInteraction;
+    let performer = project
+        .add_element(Kind::Entity, Layer::Oa, "Controller", None)
+        .unwrap();
+    let receiver = project
+        .add_element(Kind::Entity, Layer::Oa, "Provider", None)
+        .unwrap();
+    let lane = project
+        .add_element(Kind::Lifeline, Layer::Oa, "Controller lane", Some(owner))
+        .unwrap();
+    let repeated_lane = project
+        .add_element(
+            Kind::Lifeline,
+            Layer::Oa,
+            "Controller review lane",
+            Some(owner),
+        )
+        .unwrap();
+    let receiver_lane = project
+        .add_element(Kind::Lifeline, Layer::Oa, "Provider lane", Some(owner))
+        .unwrap();
+    for (id, represented) in [
+        (lane, performer),
+        (repeated_lane, performer),
+        (receiver_lane, receiver),
+    ] {
+        *project.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Lifeline {
+            represented: Some(represented),
+        };
+    }
+    let exchange = Id::new_v4();
+    project.relations.insert(
+        exchange,
+        Relation {
+            id: exchange,
+            alias: "delivery_channel".into(),
+            name: "Delivery".into(),
+            description: String::new(),
+            body: RelationBody::new(RelationKind::CommunicationMean, performer, receiver),
+        },
+    );
+    let first = project
+        .add_element(Kind::Occurrence, Layer::Oa, "First delivery", Some(owner))
+        .unwrap();
+    let second = project
+        .add_element(Kind::Occurrence, Layer::Oa, "Second delivery", Some(owner))
+        .unwrap();
+    for (id, sender) in [(first, lane), (second, repeated_lane)] {
+        set_body(
+            project.elements.get_mut(&id).unwrap(),
+            OccurrenceBody::Exchange {
+                exchange: Some(exchange),
+                sender: Some(sender),
+                receiver: Some(receiver_lane),
+                message_kind: MessageKind::Asynchronous,
+                reply_to: None,
+                values: vec![],
+                operation: None,
+            },
+        );
+    }
+    let fragment = project
+        .add_element(
+            Kind::Occurrence,
+            Layer::Oa,
+            "Optional delivery",
+            Some(owner),
+        )
+        .unwrap();
+    set_body(
+        project.elements.get_mut(&fragment).unwrap(),
+        OccurrenceBody::Fragment {
+            operator: FragmentOperator::Optional,
+            branches: vec![],
+        },
+    );
+    let branch = project
+        .add_element(Kind::Occurrence, Layer::Oa, "Option body", Some(fragment))
+        .unwrap();
+    let nested = project
+        .add_element(
+            Kind::Occurrence,
+            Layer::Oa,
+            "Unfinished nested delivery",
+            Some(branch),
+        )
+        .unwrap();
+    set_body(
+        project.elements.get_mut(&nested).unwrap(),
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: None,
+            receiver: None,
+            message_kind: MessageKind::Asynchronous,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    set_body(
+        project.elements.get_mut(&branch).unwrap(),
+        OccurrenceBody::Branch {
+            guard: "requested".into(),
+            occurrences: vec![nested],
+        },
+    );
+    set_body(
+        project.elements.get_mut(&fragment).unwrap(),
+        OccurrenceBody::Fragment {
+            operator: FragmentOperator::Optional,
+            branches: vec![branch],
+        },
+    );
+    *project
+        .elements
+        .get_mut(&owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![first, second, fragment];
+    let view_record = diagram(owner, "nominal_view");
+    let other_record = diagram(owner, "review_view");
+    let view = view_record.id;
+    let other_view = other_record.id;
+    save(&mut project, view_record);
+    save(&mut project, other_record);
+    assert_admitted(&project);
+    Fixture {
+        project,
+        owner,
+        performer,
+        lane,
+        repeated_lane,
+        first,
+        second,
+        nested,
+        fragment,
+        branch,
+        view,
+        other_view,
+        exchange,
+    }
+}
+
+#[test]
+fn two_views_and_repeated_semantic_definitions_keep_independent_overrides() {
+    let mut f = fixture();
+    let semantics = (f.project.elements.clone(), f.project.relations.clone());
+    for (view, line, x) in [
+        (f.view, f.lane, 420.),
+        (f.view, f.repeated_lane, 680.),
+        (f.other_view, f.lane, 900.),
+    ] {
+        let result =
+            set_lane(&f.project, view, ScenarioLanePosition { lifeline: line, x }).unwrap();
+        save(&mut f.project, result);
+    }
+    for (view, id, y) in [
+        (f.view, f.first, 200.),
+        (f.view, f.second, 350.),
+        (f.other_view, f.first, 260.),
+    ] {
+        let result = set_message(
+            &f.project,
+            view,
+            ScenarioMessagePosition {
+                address: address(id),
+                send_y: y,
+            },
+        )
+        .unwrap();
+        save(&mut f.project, result);
+    }
+    assert_eq!(
+        layout(&f.project.diagrams[&f.view]).lanes,
+        vec![
+            ScenarioLanePosition {
+                lifeline: f.lane,
+                x: 420.
+            },
+            ScenarioLanePosition {
+                lifeline: f.repeated_lane,
+                x: 680.
+            },
+        ]
+    );
+    assert_eq!(
+        layout(&f.project.diagrams[&f.view])
+            .messages
+            .iter()
+            .map(|r| (r.address.occurrence, r.send_y))
+            .collect::<Vec<_>>(),
+        vec![(f.first, 200.), (f.second, 350.)]
+    );
+    assert_eq!(
+        layout(&f.project.diagrams[&f.other_view]).messages[0].send_y,
+        260.
+    );
+    assert_eq!(layout(&f.project.diagrams[&f.other_view]).lanes[0].x, 900.);
+    assert_eq!(
+        (f.project.elements.clone(), f.project.relations.clone()),
+        semantics
+    );
+    assert_admitted(&f.project);
+}
+
+#[test]
+fn own_nested_unfinished_message_is_admitted_but_expansion_is_not() {
+    let mut f = fixture();
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.nested),
+            send_y: -80.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    assert_admitted(&f.project);
+    let before = f.project.clone();
+    let expanded = OccurrenceEndpoint {
+        references: vec![f.fragment],
+        occurrence: f.nested,
+    };
+    assert!(
+        set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: expanded.clone(),
+                send_y: 400.
+            }
+        )
+        .is_err()
+    );
+    assert!(remove_message(&f.project, f.view, &expanded).is_err());
+    assert_eq!(f.project, before);
+    payload(f.project.diagrams.get_mut(&f.view).unwrap()).messages[0].address = expanded;
+    assert!(has_code(&f.project, "scenario_layout_address"));
+}
+
+#[test]
+fn only_ordered_message_appearances_and_owned_lifelines_are_targets() {
+    let mut f = fixture();
+    assert!(
+        set_lane(
+            &f.project,
+            f.view,
+            ScenarioLanePosition {
+                lifeline: f.performer,
+                x: 10.
+            }
+        )
+        .is_err()
+    );
+    for id in [f.exchange, f.fragment, f.branch, f.owner, Id::new_v4()] {
+        assert!(
+            set_message(
+                &f.project,
+                f.view,
+                ScenarioMessagePosition {
+                    address: address(id),
+                    send_y: 100.
+                }
+            )
+            .is_err()
+        );
+    }
+    let foreign = f
+        .project
+        .add_element(Kind::Scenario, Layer::Oa, "Foreign", None)
+        .unwrap();
+    let foreign_lane = f
+        .project
+        .add_element(Kind::Lifeline, Layer::Oa, "Foreign lane", Some(foreign))
+        .unwrap();
+    assert!(remove_lane(&f.project, f.view, foreign_lane).is_err());
+    f.project.elements.get_mut(&f.first).unwrap().parent = Some(foreign);
+    assert!(
+        set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: address(f.first),
+                send_y: 100.
+            }
+        )
+        .is_err()
+    );
+    f.project.elements.get_mut(&f.first).unwrap().parent = Some(f.owner);
+    f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .retain(|id| *id != f.first);
+    assert!(
+        set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: address(f.first),
+                send_y: 100.
+            }
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn duplicate_positions_reject_even_when_values_match() {
+    let mut f = fixture();
+    let lane = ScenarioLanePosition {
+        lifeline: f.lane,
+        x: 10.,
+    };
+    let message = ScenarioMessagePosition {
+        address: address(f.first),
+        send_y: 100.,
+    };
+    let entries = payload(f.project.diagrams.get_mut(&f.view).unwrap());
+    entries.lanes = vec![lane.clone(), lane.clone()];
+    entries.messages = vec![message.clone(), message.clone()];
+    assert!(has_code(&f.project, "duplicate_scenario_lane"));
+    assert!(has_code(&f.project, "duplicate_scenario_message"));
+    assert!(set_lane(&f.project, f.view, lane).is_err());
+    assert!(set_message(&f.project, f.view, message).is_err());
+    // Explicit removal can repair all duplicates of the targeted identity.
+    let result = remove_lane(&f.project, f.view, f.lane).unwrap();
+    save(&mut f.project, result);
+    let result = remove_message(&f.project, f.view, &address(f.first)).unwrap();
+    save(&mut f.project, result);
+    assert_admitted(&f.project);
+}
+
+#[test]
+fn sparse_absence_empty_payload_and_signed_zero_are_preserved() {
+    let mut f = fixture();
+    let absent = f.project.diagrams[&f.view].clone();
+    assert_eq!(remove_lane(&f.project, f.view, f.lane).unwrap(), absent);
+    assert_eq!(
+        remove_message(&f.project, f.view, &address(f.first)).unwrap(),
+        absent
+    );
+    assert!(
+        serde_json::to_value(&absent)
+            .unwrap()
+            .get("layout")
+            .is_none()
+    );
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: -0.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: -0.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 0.,
+        },
+    )
+    .unwrap();
+    assert_eq!(layout(&result).lanes[0].x.to_bits(), (-0.0_f32).to_bits());
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: 0.,
+        },
+    )
+    .unwrap();
+    assert_eq!(
+        layout(&result).messages[0].send_y.to_bits(),
+        (-0.0_f32).to_bits()
+    );
+    assert_eq!(
+        serde_json::to_string(&result).unwrap(),
+        serde_json::to_string(&f.project.diagrams[&f.view]).unwrap()
+    );
+    let result = remove_lane(&f.project, f.view, f.lane).unwrap();
+    save(&mut f.project, result);
+    let result = remove_message(&f.project, f.view, &address(f.first)).unwrap();
+    assert_eq!(
+        result.layout,
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()))
+    );
+    assert_ne!(result, absent);
+}
+
+#[test]
+fn bounds_are_structural_and_rejected_helpers_do_not_mutate_project() {
+    let mut f = fixture();
+    for value in [-MAX_COORDINATE, MAX_COORDINATE, -7., 0.] {
+        let result = set_lane(
+            &f.project,
+            f.view,
+            ScenarioLanePosition {
+                lifeline: f.lane,
+                x: value,
+            },
+        )
+        .unwrap();
+        save(&mut f.project, result);
+        let result = set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: address(f.first),
+                send_y: value,
+            },
+        )
+        .unwrap();
+        save(&mut f.project, result);
+        assert_admitted(&f.project);
+    }
+    let before = serde_json::to_string(&f.project).unwrap();
+    for value in [
+        f32::NAN,
+        f32::INFINITY,
+        f32::NEG_INFINITY,
+        MAX_COORDINATE + 1.,
+    ] {
+        assert!(
+            set_lane(
+                &f.project,
+                f.view,
+                ScenarioLanePosition {
+                    lifeline: f.lane,
+                    x: value
+                }
+            )
+            .is_err()
+        );
+        assert!(
+            set_message(
+                &f.project,
+                f.view,
+                ScenarioMessagePosition {
+                    address: address(f.first),
+                    send_y: value
+                }
+            )
+            .is_err()
+        );
+    }
+    assert_eq!(serde_json::to_string(&f.project).unwrap(), before);
+    payload(f.project.diagrams.get_mut(&f.view).unwrap()).messages[0].send_y = f32::NAN;
+    assert!(has_code(&f.project, "scenario_layout_coordinate"));
+}
+
+#[test]
+fn helpers_do_not_validate_unrelated_transient_records_in_repair_batches() {
+    let mut f = fixture();
+    payload(f.project.diagrams.get_mut(&f.view).unwrap())
+        .messages
+        .push(ScenarioMessagePosition {
+            address: address(f.second),
+            send_y: f32::INFINITY,
+        });
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 420.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    assert!(has_code(&f.project, "scenario_layout_coordinate"));
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.second),
+            send_y: 300.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    assert_admitted(&f.project);
+}
+
+#[test]
+fn projection_context_and_architecture_payloads_are_explicitly_separate() {
+    let mut f = fixture();
+    let scenario = f.project.diagrams[&f.view].projection;
+    assert_eq!(scenario.scenario(), Some(f.owner));
+    assert!(!scenario.is_architecture());
+    assert!(!scenario.includes(Kind::Lifeline));
+    assert!(ProjectionKind::Overview.is_architecture());
+    assert!(!ProjectionKind::StateMachine { machine: f.owner }.is_architecture());
+    f.project.diagrams.get_mut(&f.view).unwrap().layer = Layer::Sa;
+    assert!(has_code(&f.project, "scenario_diagram_context"));
+    assert!(remove_lane(&f.project, f.view, f.lane).is_err());
+    f.project.diagrams.get_mut(&f.view).unwrap().layer = Layer::Oa;
+    f.project
+        .diagrams
+        .get_mut(&f.view)
+        .unwrap()
+        .routes
+        .push(crate::EdgeRoute {
+            edge: f.exchange,
+            waypoints: vec![],
+            label: None,
+        });
+    assert!(has_code(&f.project, "scenario_diagram_content"));
+    f.project.diagrams.get_mut(&f.view).unwrap().routes.clear();
+    payload(f.project.diagrams.get_mut(&f.view).unwrap());
+    f.project.diagrams.get_mut(&f.view).unwrap().projection = ProjectionKind::Overview;
+    assert!(has_code(&f.project, "scenario_layout_projection"));
+    assert!(
+        set_lane(
+            &f.project,
+            f.view,
+            ScenarioLanePosition {
+                lifeline: f.lane,
+                x: 10.
+            }
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn typed_json_records_round_trip_and_reject_unknown_or_missing_fields() {
+    let mut f = fixture();
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: 200.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let encoded = serde_json::to_value(&f.project.diagrams[&f.view]).unwrap();
+    assert_eq!(
+        serde_json::from_value::<Diagram>(encoded.clone()).unwrap(),
+        f.project.diagrams[&f.view]
+    );
+    assert_eq!(
+        encoded["layout"]["Scenario"]["messages"][0]["address"]["occurrence"],
+        serde_json::json!(f.first)
+    );
+    let mut unknown = encoded.clone();
+    unknown["layout"]["Scenario"]["messages"][0]["extra"] = serde_json::json!(1);
+    assert!(serde_json::from_value::<Diagram>(unknown).is_err());
+    let mut missing = encoded;
+    missing["layout"]["Scenario"]["messages"][0]["address"]
+        .as_object_mut()
+        .unwrap()
+        .remove("references");
+    assert!(serde_json::from_value::<Diagram>(missing).is_err());
+}
+
+#[test]
+fn deleting_only_actual_ids_preserves_latent_message_positions_and_other_views() {
+    let mut f = fixture();
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 420.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: 200.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let mut copied = f.project.diagrams[&f.view].clone();
+    copied.id = f.other_view;
+    copied.alias = "review_view".into();
+    copied.name = "Review view".into();
+    save(&mut f.project, copied.clone());
+    assert_admitted(&f.project);
+    assert_eq!(layout(&copied).messages[0].address.occurrence, f.first);
+    let mut candidate = f.project.diagrams[&f.view].clone();
+    prune_deleted(&mut candidate, &BTreeSet::from([f.lane, f.exchange]));
+    assert!(layout(&candidate).lanes.is_empty());
+    assert_eq!(layout(&candidate).messages.len(), 1);
+    prune_deleted(&mut candidate, &BTreeSet::from([f.first]));
+    assert!(layout(&candidate).messages.is_empty());
+    assert!(candidate.layout.is_some());
+    assert_eq!(f.project.diagrams[&f.other_view], copied);
+}
+
+#[test]
+fn reference_visitor_and_record_count_cover_explicit_rows() {
+    let f = fixture();
+    let mut d = f.project.diagrams[&f.view].clone();
+    assert_eq!(record_count(&d), 0);
+    let rows = payload(&mut d);
+    rows.lanes.push(ScenarioLanePosition {
+        lifeline: f.lane,
+        x: 50.,
+    });
+    rows.messages.push(ScenarioMessagePosition {
+        address: address(f.first),
+        send_y: 100.,
+    });
+    assert_eq!(record_count(&d), 3);
+    let replacement = Id::new_v4();
+    d.layout.as_mut().unwrap().visit_references(|id| {
+        if *id == f.first {
+            *id = replacement;
+        }
+    });
+    assert_eq!(layout(&d).messages[0].address.occurrence, replacement);
+    assert_eq!(layout(&d).messages[0].send_y, 100.);
+    assert_eq!(layout(&d).lanes[0].lifeline, f.lane);
+}
+
+#[test]
+fn a_real_scenario_use_never_imports_its_called_message_as_a_direct_target() {
+    let mut f = fixture();
+    let called = f
+        .project
+        .add_element(Kind::Scenario, Layer::Oa, "Called sequence", None)
+        .unwrap();
+    let Some(SharedBody::Scenario { viewpoint, .. }) =
+        f.project.elements.get_mut(&called).unwrap().shared_mut()
+    else {
+        panic!("Called Scenario fixture body");
+    };
+    *viewpoint = ScenarioViewpoint::ParticipantInteraction;
+    let called_message = f
+        .project
+        .add_element(Kind::Occurrence, Layer::Oa, "Called delivery", Some(called))
+        .unwrap();
+    set_body(
+        f.project.elements.get_mut(&called_message).unwrap(),
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: None,
+            receiver: None,
+            message_kind: MessageKind::Asynchronous,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    *f.project
+        .elements
+        .get_mut(&called)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![called_message];
+    let usage = f
+        .project
+        .add_element(Kind::Occurrence, Layer::Oa, "Call sequence", Some(f.owner))
+        .unwrap();
+    set_body(
+        f.project.elements.get_mut(&usage).unwrap(),
+        OccurrenceBody::ScenarioUse {
+            scenario: Some(called),
+            bindings: vec![],
+        },
+    );
+    f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(usage);
+    assert_admitted(&f.project);
+    for target in [
+        address(called_message),
+        address(usage),
+        OccurrenceEndpoint {
+            references: vec![usage],
+            occurrence: called_message,
+        },
+    ] {
+        assert!(
+            set_message(
+                &f.project,
+                f.view,
+                ScenarioMessagePosition {
+                    address: target,
+                    send_y: 200.
+                }
+            )
+            .is_err()
+        );
+    }
+}
+
+mod source_lifecycle;

crates/oa-core/src/scenario_layout/tests/source_lifecycle.rs

@@ -0,0 +1,245 @@
+//! Source/command lifecycle checks for the candidate payload. Public version
+//! assignment remains the coordinated codec integration gate.
+use super::*;
+use crate::{Command, Session, language, prepare_command, source_project::*};
+
+fn authored(f: &Fixture) -> CompiledSourceProject {
+    let mut bundle = format_bundle(&f.project);
+    let initial = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let location = &initial.index.declarations[&f.view];
+    let source = bundle.files.get_mut(&location.path).unwrap();
+    let text = format!(
+        r#"diagram nominal_view "Nominal review" id "{}" {{
+ projection {{ Scenario {{ scenario @{}; }}; }};
+ layout {{ Scenario {{
+  lanes [
+   // Controller spacing rationale.
+   {{ lifeline @ // first lane identity
+      {}; x 4.20e2; }},
+   // Repeated performer has its own lane.
+   {{ lifeline @{}; x 680; }}
+  ];
+  messages [
+   // First delivery timing rationale.
+   {{ address {{ references []; occurrence @{}; }}; send_y 2.00e2; }},
+   // Second delivery timing rationale.
+   {{ address {{ references []; occurrence @{}; }}; send_y 350; }}
+  ];
+ }}; }};
+}}
+"#,
+        f.view,
+        f.project.elements[&f.owner].alias,
+        f.project.elements[&f.lane].alias,
+        f.project.elements[&f.repeated_lane].alias,
+        f.project.elements[&f.first].alias,
+        f.project.elements[&f.second].alias
+    );
+    source.replace_range(location.span.start..location.span.end, &text);
+    compile_bundle(&bundle, ProjectLimits::default()).unwrap()
+}
+
+#[test]
+fn source_rows_follow_identity_order_and_keep_comments_numeric_spelling_and_file_ownership() {
+    let f = fixture();
+    let original = authored(&f);
+    let mut changed = original.decoded.project.clone();
+    let rows = payload(changed.diagrams.get_mut(&f.view).unwrap());
+    rows.lanes.swap(0, 1);
+    rows.messages.swap(0, 1);
+    rows.messages[0].send_y = 390.;
+    changed.elements.get_mut(&f.lane).unwrap().alias = "renamed_controller_lane".into();
+    let updated = update_bundle(&original, &changed, ProjectLimits::default()).unwrap();
+    assert_eq!(updated.decoded.project, changed);
+    let path = &original.index.declarations[&f.view].path;
+    assert_eq!(&updated.index.declarations[&f.view].path, path);
+    let text = &updated.bundle.files[path];
+    assert!(
+        text.find("// Repeated performer").unwrap() < text.find("// Controller spacing").unwrap(),
+        "{text}"
+    );
+    assert!(
+        text.find("// Second delivery").unwrap() < text.find("// First delivery").unwrap(),
+        "{text}"
+    );
+    assert!(
+        text.contains(
+            "lifeline @ // first lane identity\n      renamed_controller_lane; x 4.20e2;"
+        ),
+        "{text}"
+    );
+    assert!(text.contains("send_y 2.00e2"), "{text}");
+    assert!(text.contains("send_y 390"), "{text}");
+    for (other, bytes) in &original.bundle.files {
+        if other != path && !bytes.contains(&f.project.elements[&f.lane].alias) {
+            assert_eq!(&updated.bundle.files[other], bytes);
+        }
+    }
+    assert_eq!(
+        compile_bundle(&updated.bundle, ProjectLimits::default())
+            .unwrap()
+            .decoded
+            .project,
+        changed
+    );
+}
+
+#[test]
+fn source_identity_swap_keeps_each_coordinate_comment_with_its_original_object() {
+    let f = fixture();
+    let original = authored(&f);
+    let temporary = Id::new_v4();
+    let command = Command::Batch(vec![
+        Command::Reidentify(f.first, temporary),
+        Command::Reidentify(f.second, f.first),
+        Command::Reidentify(temporary, f.second),
+    ]);
+    let prepared = prepare_command(&original.decoded.project, &command).unwrap();
+    let mut changed = prepared.project;
+    payload(changed.diagrams.get_mut(&f.view).unwrap())
+        .messages
+        .swap(0, 1);
+    let updated = update_bundle_with_identity_map(
+        &original,
+        &changed,
+        &prepared.identity_map,
+        ProjectLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(updated.decoded.project, changed);
+    let path = &original.index.declarations[&f.view].path;
+    let text = &updated.bundle.files[path];
+    assert!(
+        text.find("// Second delivery").unwrap() < text.find("// First delivery").unwrap(),
+        "{text}"
+    );
+    let first_comment = text.find("// First delivery").unwrap();
+    assert!(text[first_comment..].contains(&format!(
+        "occurrence @{}",
+        changed.elements[&f.second].alias
+    )));
+    assert!(text[first_comment..].contains("send_y 2.00e2"));
+}
+
+#[test]
+fn coordinate_batch_is_one_undo_and_numeric_noop_keeps_source_exact() {
+    let f = fixture();
+    let original = authored(&f);
+    let mut session = Session::new(original.decoded.project.clone());
+    session
+        .execute(Command::Batch(vec![
+            Command::SetScenarioLanePosition {
+                diagram: f.view,
+                position: ScenarioLanePosition {
+                    lifeline: f.lane,
+                    x: 510.,
+                },
+            },
+            Command::SetScenarioMessagePosition {
+                diagram: f.view,
+                position: ScenarioMessagePosition {
+                    address: address(f.second),
+                    send_y: 430.,
+                },
+            },
+        ]))
+        .unwrap();
+    let changed = session.project().clone();
+    assert_eq!(session.revision(), 1);
+    assert_eq!(changed.elements, original.decoded.project.elements);
+    assert_eq!(changed.relations, original.decoded.project.relations);
+    let updated = update_bundle(&original, &changed, ProjectLimits::default()).unwrap();
+    session.undo();
+    assert_eq!(session.project(), &original.decoded.project);
+    assert!(!session.can_undo());
+    session.redo();
+    assert_eq!(session.project(), &changed);
+    session
+        .execute(Command::SetScenarioMessagePosition {
+            diagram: f.view,
+            position: ScenarioMessagePosition {
+                address: address(f.second),
+                send_y: 430.,
+            },
+        })
+        .unwrap();
+    assert_eq!(session.revision(), 3);
+    let noop = update_bundle(&updated, session.project(), ProjectLimits::default()).unwrap();
+    assert_eq!(noop.bundle, updated.bundle);
+}
+
+#[test]
+fn absent_and_empty_payload_round_trip_distinctly_and_remove_does_not_materialize_absence() {
+    let f = fixture();
+    let before = language::format(&f.project);
+    let mut session = Session::new(f.project.clone());
+    session
+        .execute(Command::RemoveScenarioLanePosition {
+            diagram: f.view,
+            lifeline: f.lane,
+        })
+        .unwrap();
+    assert_eq!(session.project(), &f.project);
+    assert!(!session.can_undo());
+    assert_eq!(language::format(session.project()), before);
+    let mut present = f.project.clone();
+    present.diagrams.get_mut(&f.view).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()));
+    let text = language::format(&present);
+    assert_ne!(text, before);
+    assert_eq!(language::parse(&text).unwrap(), present);
+    assert_eq!(language::parse(&before).unwrap(), f.project);
+}
+
+#[test]
+fn invalid_layout_source_rejects_without_changing_last_compiled_workspace() {
+    let f = fixture();
+    let original = authored(&f);
+    let before = original.bundle.clone();
+    let path = original.index.declarations[&f.view].path.clone();
+    for replacement in ["x 1e30", "x not_a_number"] {
+        let mut candidate = before.clone();
+        let source = candidate.files.get_mut(&path).unwrap();
+        *source = source.replace("x 4.20e2", replacement);
+        assert!(compile_bundle(&candidate, ProjectLimits::default()).is_err());
+        assert_eq!(original.bundle, before);
+    }
+    let mut candidate = before.clone();
+    let source = candidate.files.get_mut(&path).unwrap();
+    *source = source.replace(
+        &format!("occurrence @{}", f.project.elements[&f.first].alias),
+        &format!("occurrence @{}", f.project.elements[&f.performer].alias),
+    );
+    assert!(compile_bundle(&candidate, ProjectLimits::default()).is_err());
+    assert_eq!(original.bundle, before);
+}
+
+#[test]
+fn explicit_none_survives_other_edits_while_real_payload_clear_removes_values() {
+    let f = fixture();
+    let mut bundle = format_bundle(&f.project);
+    let compiled = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let location = &compiled.index.declarations[&f.view];
+    let path = location.path.clone();
+    bundle.files.get_mut(&path).unwrap().insert_str(
+        location.span.end - 1,
+        "\n layout // explicitly automatic\n none;\n",
+    );
+    let original = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let mut described = original.decoded.project.clone();
+    described.diagrams.get_mut(&f.view).unwrap().description =
+        "Review spacing independently".into();
+    let updated = update_bundle(&original, &described, ProjectLimits::default()).unwrap();
+    assert!(updated.bundle.files[&path].contains("layout // explicitly automatic\n none;"));
+    assert_eq!(updated.decoded.project, described);
+    let mut empty = described.clone();
+    empty.diagrams.get_mut(&f.view).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()));
+    let present = update_bundle(&updated, &empty, ProjectLimits::default()).unwrap();
+    assert_eq!(present.decoded.project, empty);
+    assert!(present.bundle.files[&path].contains("// explicitly automatic"));
+    let cleared = update_bundle(&present, &described, ProjectLimits::default()).unwrap();
+    assert_eq!(cleared.decoded.project, described);
+    assert!(!cleared.bundle.files[&path].contains("layout"));
+    assert!(cleared.bundle.files[&path].contains("// explicitly automatic"));
+}

crates/oa-core/src/session.rs

@@ -23,6 +23,22 @@ pub enum Command {
     EditRelation(Id, Relation),
     CreateDiagram(Diagram),
     EditDiagram(Id, Diagram),
+    SetScenarioLanePosition {
+        diagram: Id,
+        position: ScenarioLanePosition,
+    },
+    RemoveScenarioLanePosition {
+        diagram: Id,
+        lifeline: Id,
+    },
+    SetScenarioMessagePosition {
+        diagram: Id,
+        position: ScenarioMessagePosition,
+    },
+    RemoveScenarioMessagePosition {
+        diagram: Id,
+        address: OccurrenceEndpoint,
+    },
     CreateArtifact(ArtifactLink),
     EditArtifact(Id, ArtifactLink),
     CreateTrace(Trace),
@@ -488,6 +504,26 @@ fn apply_command(
             reidentify_tracked(p, *old, value.id, provenance)?;
             Some(value.id)
         }
+        Command::SetScenarioLanePosition { diagram, position } => {
+            let replacement = crate::scenario_layout::set_lane(p, *diagram, position.clone())?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
+        Command::RemoveScenarioLanePosition { diagram, lifeline } => {
+            let replacement = crate::scenario_layout::remove_lane(p, *diagram, *lifeline)?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
+        Command::SetScenarioMessagePosition { diagram, position } => {
+            let replacement = crate::scenario_layout::set_message(p, *diagram, position.clone())?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
+        Command::RemoveScenarioMessagePosition { diagram, address } => {
+            let replacement = crate::scenario_layout::remove_message(p, *diagram, address)?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
         Command::CreateArtifact(value) => {
             vacant(p, value.id)?;
             p.artifact_links.insert(value.id, value.clone());
@@ -878,6 +914,7 @@ pub fn reidentify(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
         return Ok(());
     }
     vacant(p, new)?;
+    crate::references::check_remap(p, old, new)?;
     if p.id == old {
         p.id = new;
     } else if let Some(mut v) = p.elements.remove(&old) {
@@ -904,12 +941,17 @@ pub fn reidentify(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
             }
         }
     }
-    crate::references::remap_references(p, old, new);
+    crate::references::remap_references(p, old, new)?;
     Ok(())
 }
 fn layout(p: &mut Project, diagram: Id) -> Result<(), ModelError> {
     use std::collections::{BTreeMap, BTreeSet};
     let d = p.diagrams.get(&diagram).ok_or_else(missing)?;
+    if d.projection.scenario().is_some() {
+        return Err(ModelError(
+            "Scenario layout requires the Scenario geometry operation.".into(),
+        ));
+    }
     let parents = crate::projection::parents(p, d);
     let mut children: BTreeMap<Option<Id>, Vec<Id>> = BTreeMap::new();
     for (id, parent) in &parents {

crates/oa-core/src/source_project.rs

@@ -930,7 +930,18 @@ pub fn update_bundle_with_identity_map(
             };
             let local = edits.entry(path.clone()).or_default();
             update.header(&actual.header, &previous.header, &next.header, local);
-            update.value(&actual.fields, Some(&previous.fields), &next.fields, local);
+            let context = if old.diagrams.contains_key(&id) {
+                EditContext::Diagram
+            } else {
+                EditContext::Other
+            };
+            update.value(
+                &actual.fields,
+                Some(&previous.fields),
+                &next.fields,
+                context,
+                local,
+            );
         }
     }
     if old.id != project.id || old.alias != project.alias || old.name != project.name {
@@ -1119,6 +1130,29 @@ fn inserted_value(text: &str, indent: &str, source: &str) -> String {
     output
 }
 
+// Schema context is explicit: similarly named fields in arbitrary records must
+// never acquire Scenario row identity or move their authored trivia.
+#[derive(Clone, Copy)]
+enum EditContext {
+    Other,
+    Diagram,
+    Layout,
+    Scenario,
+    Lanes,
+    Messages,
+}
+impl EditContext {
+    fn field(self, name: &str) -> Self {
+        match (self, name) {
+            (Self::Diagram, "layout") => Self::Layout,
+            (Self::Layout, "Scenario") => Self::Scenario,
+            (Self::Scenario, "lanes") => Self::Lanes,
+            (Self::Scenario, "messages") => Self::Messages,
+            _ => Self::Other,
+        }
+    }
+}
+
 struct SyntaxUpdate<'a> {
     source: &'a str,
     before: &'a str,
@@ -1185,6 +1219,7 @@ impl SyntaxUpdate<'_> {
         actual: &language::EditValue,
         before: Option<&language::EditValue>,
         after: &language::EditValue,
+        context: EditContext,
         edits: &mut LocalEdits,
     ) {
         use language::EditKind;
@@ -1200,7 +1235,7 @@ impl SyntaxUpdate<'_> {
                         None
                     }
                 });
-                self.record(actual.span, fields, previous, next, edits);
+                self.record(actual.span, fields, previous, next, context, edits);
             }
             (EditKind::List(items), EditKind::List(next)) => {
                 let previous = before.and_then(|old| {
@@ -1210,7 +1245,7 @@ impl SyntaxUpdate<'_> {
                         None
                     }
                 });
-                self.list(actual.span, items, previous, next, edits);
+                self.list(actual.span, items, previous, next, context, edits);
             }
             (EditKind::Reference(_), EditKind::Reference(alias)) => {
                 let token = significant(&self.source[actual.span.start..actual.span.end])
@@ -1263,6 +1298,7 @@ impl SyntaxUpdate<'_> {
         actual: &BTreeMap<String, language::EditField>,
         before: Option<&BTreeMap<String, language::EditField>>,
         after: &BTreeMap<String, language::EditField>,
+        context: EditContext,
         edits: &mut LocalEdits,
     ) {
         // A typed constructor tag change retains shared fields and their trivia.
@@ -1286,7 +1322,13 @@ impl SyntaxUpdate<'_> {
                     },
                     new_key.clone(),
                 ));
-                self.value(&field.value, Some(&old.value), &new.value, edits);
+                self.value(
+                    &field.value,
+                    Some(&old.value),
+                    &new.value,
+                    context.field(new_key),
+                    edits,
+                );
                 return;
             }
         }
@@ -1298,9 +1340,16 @@ impl SyntaxUpdate<'_> {
                         .and_then(|fields| fields.get(key))
                         .map(|field| &field.value),
                     &next.value,
+                    context.field(key),
                     edits,
                 );
-            } else {
+            } else if !(matches!(context, EditContext::Diagram)
+                && key == "layout"
+                && before.is_some_and(|fields| !fields.contains_key(key)))
+            {
+                // Canonical None omits layout. Preserve an authored explicit
+                // none while another field changes; a real Some->None clear
+                // still removes the former payload and retains its trivia.
                 erase_syntax(self.source, field.span, edits);
             }
         }
@@ -1355,6 +1404,7 @@ impl SyntaxUpdate<'_> {
         actual: &[language::EditValue],
         before: Option<&[language::EditValue]>,
         after: &[language::EditValue],
+        context: EditContext,
         edits: &mut LocalEdits,
     ) {
         let previous = before.unwrap_or(&[]);
@@ -1367,6 +1417,7 @@ impl SyntaxUpdate<'_> {
                     self.old_aliases,
                     self.legacy_value_paths,
                     None,
+                    context,
                 )
             })
             .collect();
@@ -1379,6 +1430,7 @@ impl SyntaxUpdate<'_> {
                     self.new_aliases,
                     self.legacy_value_paths,
                     self.identity_origins,
+                    context,
                 )
             })
             .collect();
@@ -1407,7 +1459,7 @@ impl SyntaxUpdate<'_> {
                 .all(|(i, source)| *source == Some(i))
         {
             for (i, (current, next)) in actual.iter().zip(after).enumerate() {
-                self.value(current, previous.get(i), next, edits);
+                self.value(current, previous.get(i), next, EditContext::Other, edits);
             }
             return;
         }
@@ -1440,7 +1492,13 @@ impl SyntaxUpdate<'_> {
                 let chunk = chunks[index];
                 text.push_str(&self.source[chunk.start..current.span.start]);
                 let mut local = Vec::new();
-                self.value(current, previous.get(index), next, &mut local);
+                self.value(
+                    current,
+                    previous.get(index),
+                    next,
+                    EditContext::Other,
+                    &mut local,
+                );
                 text.push_str(&changed_text(self.source, current.span, local));
                 suffix = &self.source[current.span.end..chunk.end];
             } else {
@@ -1483,14 +1541,58 @@ impl SyntaxUpdate<'_> {
     }
 }
 
+fn scenario_item_key(
+    value: &language::EditValue,
+    aliases: &BTreeMap<String, String>,
+    context: EditContext,
+) -> Option<String> {
+    use language::EditKind;
+    let EditKind::Record(fields) = &value.kind else {
+        return None;
+    };
+    let reference = |value: &language::EditValue| {
+        if let EditKind::Reference(alias) = &value.kind {
+            aliases.get(alias).cloned()
+        } else {
+            None
+        }
+    };
+    match context {
+        EditContext::Lanes => {
+            reference(&fields.get("lifeline")?.value).map(|id| format!("scenario-lane:{id}"))
+        }
+        EditContext::Messages => {
+            let EditKind::Record(address) = &fields.get("address")?.value.kind else {
+                return None;
+            };
+            let occurrence = reference(&address.get("occurrence")?.value)?;
+            let path: Vec<_> = match address.get("references") {
+                None => Vec::new(),
+                Some(field) => {
+                    let EditKind::List(path) = &field.value.kind else {
+                        return None;
+                    };
+                    path.iter().map(reference).collect::<Option<Vec<_>>>()?
+                }
+            };
+            Some(format!("scenario-message:{}:{occurrence}", path.join("/")))
+        }
+        _ => None,
+    }
+}
+
 fn item_key(
     value: &language::EditValue,
     source: &str,
     aliases: &BTreeMap<String, String>,
     legacy_value_paths: bool,
     origins: Option<&BTreeMap<Id, Id>>,
+    context: EditContext,
 ) -> Option<String> {
     use language::EditKind;
+    if matches!(context, EditContext::Lanes | EditContext::Messages) {
+        return scenario_item_key(value, aliases, context);
+    }
     if matches!(value.kind, EditKind::Record(_))
         && let Some(key) = language::semantic_row_key(
             &source[value.span.start..value.span.end],

crates/oa-core/src/source_project/source_migration.rs

@@ -68,6 +68,11 @@ pub(super) fn upgrade(
                 &actual.fields,
                 Some(&actual.fields),
                 &next.fields,
+                if project.diagrams.contains_key(&id) {
+                    EditContext::Diagram
+                } else {
+                    EditContext::Other
+                },
                 edits.entry(path.clone()).or_default(),
             );
         }

crates/oa-core/src/validation.rs

@@ -619,6 +619,7 @@ pub fn validate(p: &Project) -> Vec<Issue> {
         }
         text(&mut out, d.id, "name", &d.name);
         text(&mut out, d.id, "description", &d.description);
+        crate::scenario_layout::validate_diagram(p, d, &mut out);
         let option_issues = if d.projection == ProjectionKind::Traceability {
             crate::view_options::validate_options_cross_layer(p, &d.view_options)
         } else {

crates/oa-core/tests/release_routing.rs

@@ -41,6 +41,7 @@ fn fixture() -> Fixture {
             projection: ProjectionKind::Overview,
             view_options: Default::default(),
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-core/tests/source7_contract.rs

@@ -261,7 +261,7 @@ fn source7_context_lifecycle_source_history_and_closed_admission() {
     assert_eq!(session.project(), &after);
     let fresh = Id::new_v4();
     let mut reidentified = after.clone();
-    references::remap_references(&mut reidentified, f.r1, fresh);
+    references::remap_references(&mut reidentified, f.r1, fresh).unwrap();
     let mut e = reidentified.elements.remove(&f.r1).unwrap();
     e.id = fresh;
     reidentified.elements.insert(fresh, e);

crates/oa-core/tests/state_diagrams.rs

@@ -20,6 +20,7 @@ fn view(p: &mut Project, machine: Id, alias: &str) -> Id {
             projection: ProjectionKind::StateMachine { machine },
             view_options: Default::default(),
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-desktop/src/app.rs

@@ -10,12 +10,15 @@ mod hosted;
 mod reference_authoring;
 #[cfg(test)]
 mod review_navigation_tests;
+mod scenario_diagram;
+mod scenario_spacing;
 pub(crate) mod source_rename;
 mod source_symbols;
 #[cfg(test)]
 mod transition_context_tests;
 #[cfg(test)]
 mod view_copy_tests;
+pub(crate) const SAVED_SCENARIO_UNAVAILABLE: &str = "This action uses architecture diagram tools and is unavailable for a saved Scenario. Open the view in Behavior; saved positions are preserved.";
 use crate::forms::Draft;
 use crate::{
     behavior,
@@ -529,6 +532,7 @@ pub struct App {
     pub(crate) diagram_navigation_focus: Option<crate::diagram_usage::Focus>,
     source_diagram_job: Option<Id>,
     diagram_lookup_in_flight: Option<Id>,
+    pending_scenario_reveal_visit: Option<Id>,
     pending_diagram_reveal: Option<(
         crate::diagram_usage::Context,
         crate::diagram_usage::Usage,
@@ -577,7 +581,7 @@ impl App {
         let active_diagram = project
             .diagrams
             .values()
-            .filter(|d| d.layer == layer)
+            .filter(|d| d.layer == layer && d.projection.scenario().is_none())
             .min_by_key(|d| (d.projection != ProjectionKind::Allocation, d.id))
             .map(|d| d.id);
         let draft = Draft::from_project(&project, selected);
@@ -650,6 +654,7 @@ impl App {
             source_diagram_job: None,
             diagram_lookup_in_flight: None,
             pending_diagram_reveal: None,
+            pending_scenario_reveal_visit: None,
             model_issues,
             migration: None,
             source_version: 0,
@@ -664,6 +669,7 @@ impl App {
             workflow: None,
         };
         app.route_state_diagram_workspace();
+        app.reconcile_scenario_workspace();
         app.last_workspace_page = app.page;
         app
     }
@@ -774,6 +780,17 @@ impl App {
         self.sync_with_alias_editor(None);
     }
     fn sync_with_alias_editor(&mut self, hint: Option<source_rename::EditorRefresh<'_>>) {
+        // A saved view may be retargeted across layers by one source transaction.
+        // Follow that explicit identity before generic active-view normalization.
+        if let Some(rep @ behavior::scenario_layout::Representation::Saved { diagram }) =
+            self.behavior.scenario.representation()
+            && self.active_diagram == Some(diagram)
+            && let Some(owner) =
+                behavior::scenario_layout::presentation::checked_owner(self.project(), rep)
+        {
+            self.layer = self.project().elements[&owner].layer();
+            self.behavior.active_owner = Some(owner);
+        }
         self.explorer_index = crate::explorer::Index::new(self.project(), self.layer);
         self.model_issues = validate(self.project());
         self.normalize_creation();
@@ -798,7 +815,7 @@ impl App {
                 .project()
                 .diagrams
                 .values()
-                .filter(|d| d.layer == self.layer)
+                .filter(|d| d.layer == self.layer && d.projection.scenario().is_none())
                 .min_by_key(|d| (d.projection != ProjectionKind::Allocation, d.id))
                 .map(|d| d.id);
         }
@@ -878,6 +895,26 @@ impl App {
                 .map_err(|e| e.to_string())
         }) {
             Ok(id) => {
+                if self.behavior.scenario.representation()
+                    == Some(behavior::scenario_layout::Representation::Saved { diagram: original })
+                    && id != original
+                {
+                    let representation =
+                        behavior::scenario_layout::Representation::Saved { diagram: id };
+                    if let Some(owner) = behavior::scenario_layout::presentation::checked_owner(
+                        self.project(),
+                        representation,
+                    ) {
+                        self.behavior.scenario.enter_representation(
+                            self.canvas_document,
+                            owner,
+                            representation,
+                        );
+                        if self.page != Page::Behavior {
+                            self.behavior.scenario.leave();
+                        }
+                    }
+                }
                 if self.active_diagram == Some(original) {
                     self.active_diagram = Some(id);
                 }
@@ -1050,7 +1087,7 @@ impl App {
                     self.project()
                         .diagrams
                         .get(id)
-                        .is_some_and(|d| d.layer == layer)
+                        .is_some_and(|d| d.layer == layer && d.projection.scenario().is_none())
                 })
                 .or(retained)
                 .or_else(|| self.diagram_for(layer, target));
@@ -1082,6 +1119,17 @@ impl App {
             && let Some(owner) = crate::behavior::selected_behavior(self.project(), id)
         {
             self.behavior.active_owner = Some(owner);
+            if self.behavior.scenario.representation().is_some_and(|rep| {
+                behavior::scenario_layout::presentation::checked_owner(self.project(), rep)
+                    != Some(owner)
+            }) && self.project().elements[&owner].kind() == Kind::Scenario
+            {
+                self.enter_scenario_representation(
+                    behavior::scenario_layout::Representation::Derived { owner },
+                );
+            } else if self.project().elements[&owner].kind() != Kind::Scenario {
+                self.behavior.scenario.forget_view();
+            }
         }
         if self.reset_state_view_after_navigation(previous_state_view)
             && self.page == Page::Behavior
@@ -1224,6 +1272,9 @@ impl App {
         ])
     }
     pub fn update(&mut self, message: Message) -> Task<Message> {
+        if let Message::ScenarioCanvas(behavior::scenario::CanvasEvent::Spacing(event)) = &message {
+            return self.scenario_spacing(*event);
+        }
         // Reject stale rename intents before camera/reveal reconciliation or
         // source interaction can disturb a newer navigation destination.
         if let Message::SourceRename(event) = &message
@@ -1231,6 +1282,38 @@ impl App {
         {
             return Task::none();
         }
+        // Prior view visits are inert before they can retire a newer reveal,
+        // camera lifetime or focus operation. Passive events may relax epoch,
+        // but never the destination identity.
+        if let Message::ScenarioCanvas(event) = &message {
+            let captured = event.context();
+            if self.scenario_context().is_none_or(|current| {
+                current.document != captured.document
+                    || current.scenario != captured.scenario
+                    || current.representation != captured.representation
+                    || current.visit != captured.visit
+                    || (!matches!(event, behavior::scenario::CanvasEvent::Restored(..))
+                        && current.revision != captured.revision)
+            }) {
+                return Task::none();
+            }
+            if let behavior::scenario::CanvasEvent::Camera(_, lifetime, _) = event
+                && *lifetime != self.camera_epoch
+            {
+                return Task::none();
+            }
+        }
+        if let Message::BehaviorControl(intent) = &message
+            && behavior::canvas_workspace::Scope::current(self).is_none_or(|scope| {
+                scope.document != intent.scope.document
+                    || scope.owner != intent.scope.owner
+                    || scope.scenario_view != intent.scope.scenario_view
+                    || scope.revision != intent.scope.revision
+                    || scope.epoch != intent.scope.epoch
+            })
+        {
+            return Task::none();
+        }
         let usage_viewport = self.diagram_reveal_viewport(&message);
         let window_resized = matches!(&message, Message::WindowResized(_));
         // Reject stale measurements before legacy viewport handlers can change
@@ -1251,6 +1334,7 @@ impl App {
                 | Message::TopologyCanvas(crate::behavior::topology::CanvasEvent::Camera(..))
         );
         let before = self.camera_boundary();
+        let spacing_selected = self.selected;
         let task = self.update_inner(message);
         if window_resized && let Some((_, _, epoch)) = &mut self.pending_diagram_reveal {
             *epoch = self.canvas_epoch;
@@ -1265,6 +1349,13 @@ impl App {
         {
             self.diagram_navigation_focus = None;
         }
+        if (self.camera_boundary() != before
+            || self.selected != spacing_selected
+            || !self.spacing_enabled())
+            && self.behavior.scenario.cancel_spacing()
+        {
+            self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+        }
         if !camera && self.camera_boundary() != before {
             self.camera_epoch = self.camera_epoch.wrapping_add(1);
             self.camera_boundary_epoch = self.canvas_epoch;
@@ -1283,6 +1374,7 @@ impl App {
         let valid_scenario = |c: behavior::scenario::Context| {
             c.document == scope.document
                 && c.scenario == scope.owner
+                && scope.scenario_view == Some((c.representation, c.visit))
                 && c.revision == scope.revision
                 && self.camera_toolbar_epoch(c.epoch)
         };
@@ -1298,6 +1390,9 @@ impl App {
             Message::ScenarioCanvas(Scenario::Camera(c, lifetime, Camera::Focus))
                 if valid_scenario(*c) && *lifetime == scope.epoch =>
             {
+                if self.behavior.scenario.cancel_spacing() {
+                    self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                }
                 return canvas_workspace::focus_task(scope, Camera::Focus);
             }
             Message::TopologyCanvas(Process::Camera(c, lifetime, Camera::Focus))
@@ -1323,6 +1418,9 @@ impl App {
             _ => return Task::none(),
         }
         let task = self.update(message);
+        if self.behavior.scenario.cancel_spacing() {
+            self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+        }
         // Reapplying Fit or a tool also ends a held gesture. Focus is stamped
         // after the action, for Iced's final-view ordering.
         if self.camera_epoch == scope.epoch {
@@ -1666,6 +1764,7 @@ impl App {
         self.refresh_source_rename_context();
         self.reconcile_reference_chooser();
         self.route_state_diagram_workspace();
+        self.reconcile_scenario_workspace();
         if self.page != Page::Home {
             self.last_workspace_page = self.page;
         }
@@ -1674,11 +1773,6 @@ impl App {
                 .topology
                 .enter(context.document, context.owner);
         }
-        if let Some(context) = self.scenario_context() {
-            self.behavior
-                .scenario
-                .enter(context.document, context.scenario);
-        }
         if self.connection.as_ref().is_some_and(|session| {
             Some(session.context) != self.route_context()
                 || self.page != Page::Diagram
@@ -1722,15 +1816,23 @@ impl App {
         }
     }
     pub(crate) fn scenario_context(&self) -> Option<crate::behavior::scenario::Context> {
-        let scenario = crate::behavior::selected_owner(self)?;
-        (self.page == Page::Behavior
-            && self.project().elements.get(&scenario)?.kind() == Kind::Scenario)
-            .then_some(crate::behavior::scenario::Context {
-                document: self.canvas_document,
-                scenario,
-                revision: self.document.revision(),
-                epoch: self.canvas_epoch,
-            })
+        if self.page != Page::Behavior {
+            return None;
+        }
+        let scenario = if matches!(
+            self.behavior.scenario.representation(),
+            Some(behavior::scenario_layout::Representation::Saved { .. })
+        ) {
+            self.behavior.scenario.owner()?
+        } else {
+            crate::behavior::selected_owner(self)?
+        };
+        self.behavior.scenario.context(
+            self.canvas_document,
+            scenario,
+            self.document.revision(),
+            self.canvas_epoch,
+        )
     }
     pub(crate) fn scenario_focus_owner(&self) -> Option<crate::behavior::scenario::focus::Stamp> {
         if self.busy
@@ -1746,7 +1848,46 @@ impl App {
         }
         self.behavior.scenario.focus_stamp(self.scenario_context()?)
     }
+    fn saved_scenario_diagram(&self, id: Id) -> bool {
+        self.project()
+            .diagrams
+            .get(&id)
+            .is_some_and(|d| d.projection.scenario().is_some())
+    }
+
+    fn unsupported_saved_scenario_message(&self, message: &Message) -> bool {
+        let active = self
+            .active_diagram
+            .is_some_and(|id| self.saved_scenario_diagram(id));
+        match message {
+            Message::Command(Command::Layout(diagram)) => self.saved_scenario_diagram(*diagram),
+            Message::Projection(projection) => active || projection.scenario().is_some(),
+            Message::SelectNode(_)
+            | Message::PlaceSelected
+            | Message::HideSelected
+            | Message::ToggleCollapse
+            | Message::MoveNode(..)
+            | Message::Route(_)
+            | Message::Connection(_)
+            | Message::PortAnchor(_)
+            | Message::Export
+            | Message::Fit
+            | Message::Zoom(_)
+            | Message::Pan(_) => active,
+            Message::Add(_) | Message::CreateContextElement(..) => {
+                active && self.page == Page::Diagram
+            }
+            _ => false,
+        }
+    }
+
     fn handle(&mut self, message: Message) -> Task<Message> {
+        // Refuse unsupported saved-view actions before they can Apply unrelated drafts.
+        // Generic model/source edits and the semantic Scenario workspace remain available.
+        if self.unsupported_saved_scenario_message(&message) {
+            self.status = SAVED_SCENARIO_UNAVAILABLE.into();
+            return Task::none();
+        }
         match message {
             Message::BehaviorControl(intent) => return self.behavior_control(intent),
             Message::Architecture(event) => return self.architecture_event(event),
@@ -1768,6 +1909,8 @@ impl App {
                     if self.scenario_context().is_some_and(|current| {
                         current.document == context.document
                             && current.scenario == context.scenario
+                            && current.representation == context.representation
+                            && current.visit == context.visit
                             && current.revision == context.revision
                     }) && self.scenario_focus_owner().is_some()
                         && self.behavior.scenario.take_form_focus(mount)
@@ -1780,6 +1923,8 @@ impl App {
                     if self.scenario_context().is_some_and(|current| {
                         current.document == context.document
                             && current.scenario == context.scenario
+                            && current.representation == context.representation
+                            && current.visit == context.visit
                             && current.revision == context.revision
                     }) && self.behavior.scenario.viewport(size)
                     {
@@ -1789,7 +1934,10 @@ impl App {
                 }
                 if let CanvasEvent::Restored(_, token, area, offset) = event {
                     if self.scenario_context().is_some_and(|current| {
-                        current.document == context.document && current.scenario == context.scenario
+                        current.document == context.document
+                            && current.scenario == context.scenario
+                            && current.representation == context.representation
+                            && current.visit == context.visit
                     }) && self
                         .behavior
                         .scenario
@@ -1806,6 +1954,8 @@ impl App {
                     if self.scenario_context().is_some_and(|current| {
                         current.document == context.document
                             && current.scenario == context.scenario
+                            && current.representation == context.representation
+                            && current.visit == context.visit
                             && current.revision == context.revision
                     }) && self.behavior.scenario.scrolled(area, offset)
                     {
@@ -1819,6 +1969,8 @@ impl App {
                         || !self.scenario_context().is_some_and(|c| {
                             c.document == context.document
                                 && c.scenario == context.scenario
+                                && c.representation == context.representation
+                                && c.visit == context.visit
                                 && c.revision == context.revision
                         })
                     {
@@ -1827,6 +1979,7 @@ impl App {
                     let scope = canvas_workspace::Scope {
                         document: context.document,
                         owner: context.scenario,
+                        scenario_view: Some((context.representation, context.visit)),
                         revision: context.revision,
                         epoch: lifetime,
                     };
@@ -1837,6 +1990,9 @@ impl App {
                     {
                         return Task::none();
                     }
+                    if self.behavior.scenario.cancel_spacing() {
+                        self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                    }
                     match input {
                         Event::Focus
                         | Event::Traverse(_)
@@ -1849,7 +2005,10 @@ impl App {
                             self.canvas_epoch = self.canvas_epoch.wrapping_add(1)
                         }
                         input => {
-                            if self.behavior.scenario.camera(input) {
+                            let mut state = std::mem::take(&mut self.behavior.scenario);
+                            let changed = state.camera(self.project(), context.scenario, input);
+                            self.behavior.scenario = state;
+                            if changed {
                                 self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                             }
                         }
@@ -1860,6 +2019,32 @@ impl App {
                     return Task::none();
                 }
                 match event {
+                    CanvasEvent::Representation(_, requested) => {
+                        use behavior::scenario_layout::{
+                            Representation, presentation::checked_owner,
+                        };
+                        if checked_owner(self.project(), requested) != Some(context.scenario) {
+                            return Task::none();
+                        }
+                        if !self.apply() {
+                            return Task::none();
+                        }
+                        let requested = match requested {
+                            Representation::Saved { diagram }
+                                if context.representation
+                                    == (Representation::Saved { diagram }) =>
+                            {
+                                Representation::Saved {
+                                    diagram: self.active_diagram.unwrap_or(diagram),
+                                }
+                            }
+                            Representation::Derived { owner } => Representation::Derived {
+                                owner: self.behavior.active_owner.unwrap_or(owner),
+                            },
+                            other => other,
+                        };
+                        self.enter_scenario_representation(requested);
+                    }
                     CanvasEvent::Focus(_) => {
                         self.behavior.scenario.toggle_focus();
                         self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
@@ -1888,7 +2073,11 @@ impl App {
                             Ok(target) => {
                                 // A command can preselect this target while the
                                 // caller remains visible, bypassing select below.
-                                self.behavior.active_owner = Some(target);
+                                self.enter_scenario_representation(
+                                    behavior::scenario_layout::Representation::Derived {
+                                        owner: target,
+                                    },
+                                );
                                 self.select(target);
                                 self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                             }
@@ -1910,7 +2099,7 @@ impl App {
                             // A command may already have selected this UUID while
                             // leaving the referenced definition open. select's
                             // same-UUID fast path must not keep that old owner.
-                            self.behavior.active_owner = Some(caller.owner);
+                            self.enter_scenario_representation(caller.representation);
                             self.select(caller.occurrence);
                             self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                             if let Some(context) = self.scenario_context() {
@@ -1938,6 +2127,15 @@ impl App {
                         }
                     }
                     CanvasEvent::Choose(_, tool) => {
+                        if tool != scenario::CanvasTool::Select
+                            && !self
+                                .behavior
+                                .scenario
+                                .coordinate_input(self.project(), context)
+                        {
+                            self.status = "Canvas insertion and reordering are unavailable for this presentation.".into();
+                            return Task::none();
+                        }
                         if self.behavior.has_pending() || self.draft_dirty() || self.source_dirty()
                         {
                             self.status =
@@ -1949,6 +2147,17 @@ impl App {
                         self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                     }
                     mutation => {
+                        if !behavior::scenario_layout::presentation::present(
+                            self.project(),
+                            context.representation,
+                            self.selected,
+                        )
+                        .capabilities()
+                        .coordinate_input
+                        {
+                            self.status = "Layout editing is unavailable for this presentation. Saved positions are preserved.".into();
+                            return Task::none();
+                        }
                         if self.behavior.has_pending() || self.draft_dirty() || self.source_dirty()
                         {
                             self.status =
@@ -2049,6 +2258,13 @@ impl App {
                     })
                 {
                     self.behavior.active_owner = Some(choice.id);
+                    if self.project().elements[&choice.id].kind() == Kind::Scenario {
+                        self.enter_scenario_representation(
+                            behavior::scenario_layout::Representation::Derived { owner: choice.id },
+                        );
+                    } else {
+                        self.behavior.scenario.forget_view();
+                    }
                     self.behavior.diagram = Default::default();
                     self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                     self.select(choice.id);
@@ -2394,7 +2610,7 @@ impl App {
                             self.project()
                                 .diagrams
                                 .get(&id)
-                                .is_some_and(|d| d.projection.state_machine().is_some())
+                                .is_some_and(|d| !d.projection.is_architecture())
                         })
                     {
                         // Architecture remains reachable from a state workspace.
@@ -2403,9 +2619,7 @@ impl App {
                             .project()
                             .diagrams
                             .values()
-                            .filter(|d| {
-                                d.layer == self.layer && d.projection.state_machine().is_none()
-                            })
+                            .filter(|d| d.layer == self.layer && d.projection.is_architecture())
                             .min_by_key(|d| (d.projection != ProjectionKind::Allocation, d.id))
                             .map(|d| d.id);
                         self.fit();
@@ -2416,6 +2630,15 @@ impl App {
                             crate::behavior::selected_behavior(self.project(), self.selected)
                         {
                             self.behavior.active_owner = Some(owner);
+                            if self.project().elements[&owner].kind() == Kind::Scenario
+                                && self.behavior.scenario.owner() != Some(owner)
+                            {
+                                self.enter_scenario_representation(
+                                    behavior::scenario_layout::Representation::Derived { owner },
+                                );
+                            } else if self.project().elements[&owner].kind() != Kind::Scenario {
+                                self.behavior.scenario.forget_view();
+                            }
                         }
                         self.behavior.active_owner = crate::behavior::selected_owner(self);
                         self.reset_state_view_after_navigation(previous_state_view);
@@ -2652,6 +2875,7 @@ impl App {
             }
             Message::Layer(layer) => {
                 if self.apply() {
+                    self.behavior.scenario.forget_view();
                     let previous_state_view = self.state_view_identity();
                     self.layer = layer;
                     self.create_kind = if layer == Layer::Oa {
@@ -2663,7 +2887,7 @@ impl App {
                         .project()
                         .diagrams
                         .values()
-                        .filter(|d| d.layer == layer)
+                        .filter(|d| d.layer == layer && d.projection.scenario().is_none())
                         .min_by_key(|d| (d.projection != ProjectionKind::Allocation, d.id))
                         .map(|d| d.id);
                     self.selected = self.project().id;
@@ -2824,6 +3048,9 @@ impl App {
                 }
             }
             Message::RevealInDiagram(diagram, selected) => {
+                if self.saved_scenario_diagram(diagram) {
+                    return self.reveal_saved_scenario(diagram, selected);
+                }
                 let original = self.selected;
                 if !self.apply() {
                     return Task::none();
@@ -2836,6 +3063,10 @@ impl App {
                 let Some(view) = self.project().diagrams.get(&diagram) else {
                     return Task::none();
                 };
+                if view.projection.scenario().is_some() {
+                    self.status = SAVED_SCENARIO_UNAVAILABLE.into();
+                    return Task::none();
+                }
                 let layer = view.layer;
                 let endpoints = self
                     .project()
@@ -2903,6 +3134,7 @@ impl App {
                         description: String::new(),
                         layer: self.layer,
                         projection: ProjectionKind::Allocation,
+                        layout: None,
                         routes: Vec::new(),
                         view_options: Default::default(),
                         nodes: Default::default(),
@@ -3050,6 +3282,16 @@ impl App {
                     self.status = "Diagram no longer exists.".into();
                     return Task::none();
                 }
+                if self.saved_scenario_diagram(choice.id)
+                    && behavior::scenario_layout::presentation::checked_owner(
+                        self.project(),
+                        behavior::scenario_layout::Representation::Saved { diagram: choice.id },
+                    )
+                    .is_none()
+                {
+                    self.status = "This Scenario view has an incompatible or missing owner.".into();
+                    return Task::none();
+                }
                 let previous_diagram = self.active_diagram;
                 let follow_view = previous_diagram == Some(self.selected);
                 if self.apply() {
@@ -3069,7 +3311,14 @@ impl App {
                     }
                     self.selected_node = None;
                     self.refresh_draft();
-                    self.fit();
+                    if self.saved_scenario_diagram(diagram) {
+                        self.enter_scenario_representation(
+                            behavior::scenario_layout::Representation::Saved { diagram },
+                        );
+                    } else {
+                        self.page = Page::Diagram;
+                        self.fit();
+                    }
                 }
             }
             Message::Projection(projection) => {
@@ -3079,6 +3328,10 @@ impl App {
                         .and_then(|id| self.project().diagrams.get(&id))
                         .cloned()
                 {
+                    if d.projection.scenario().is_some() {
+                        self.status = SAVED_SCENARIO_UNAVAILABLE.into();
+                        return Task::none();
+                    }
                     d.projection = projection;
                     self.execute(Command::EditDiagram(d.id, d));
                     self.fit();
@@ -3643,6 +3896,14 @@ impl App {
                 }
             }
             Message::Export => {
+                let Some(diagram) = self.active_diagram else {
+                    self.status = "Create a diagram first.".into();
+                    return Task::none();
+                };
+                if !self.project().diagrams.contains_key(&diagram) {
+                    self.status = crate::diagram::ExportError::MissingDiagram(diagram).to_string();
+                    return Task::none();
+                }
                 if self.apply() {
                     return self.choose_file(FileOperation::Export);
                 }
@@ -3705,7 +3966,9 @@ impl App {
         };
         let id = e.id;
         let mut commands = vec![Command::CreateElement(e)];
-        let mut diagram_target = self.active_diagram;
+        let mut diagram_target = self
+            .active_diagram
+            .filter(|id| !self.saved_scenario_diagram(*id));
         let preferred = if self.create_kind.is_work() || self.create_kind.is_performer() {
             Some(ProjectionKind::Allocation)
         } else if ProjectionKind::Capabilities.includes(self.create_kind) {
@@ -3735,6 +3998,7 @@ impl App {
                     description: String::new(),
                     layer: self.layer,
                     projection: preferred,
+                    layout: None,
                     routes: Vec::new(),
                     view_options: Default::default(),
                     nodes: Default::default(),
@@ -4074,11 +4338,24 @@ impl App {
         )
     }
     fn export_to(&mut self, path: PathBuf) -> Task<Message> {
+        if self
+            .active_diagram
+            .is_some_and(|id| self.saved_scenario_diagram(id))
+        {
+            self.status = SAVED_SCENARIO_UNAVAILABLE.into();
+            return Task::none();
+        }
         let Some(diagram) = self.active_diagram else {
             self.status = "Create a diagram first.".into();
             return Task::none();
         };
-        let svg = crate::diagram::export_svg(self.project(), diagram);
+        let svg = match crate::diagram::export_svg(self.project(), diagram) {
+            Ok(svg) => svg,
+            Err(error) => {
+                self.status = error.to_string();
+                return Task::none();
+            }
+        };
         self.busy = true;
         Task::perform(
             async move {
@@ -4301,6 +4578,9 @@ impl App {
         )
     }
     pub fn route_context(&self) -> Option<crate::route_edit::Context> {
+        if self.saved_scenario_diagram(self.active_diagram?) {
+            return None;
+        }
         Some(crate::route_edit::Context {
             document: self.canvas_document,
             diagram: self.active_diagram?,
@@ -4525,6 +4805,12 @@ impl App {
         }
     }
     pub fn fit(&mut self) {
+        if self
+            .active_diagram
+            .is_some_and(|id| self.saved_scenario_diagram(id))
+        {
+            return;
+        }
         self.fit_to_view = true;
         let view = self
             .active_diagram
@@ -4572,7 +4858,7 @@ fn preferred_diagram(p: &Project, active: Option<Id>, layer: Layer, element: Id)
         return p
             .diagrams
             .values()
-            .filter(|d| d.layer == layer)
+            .filter(|d| d.layer == layer && d.projection.scenario().is_none())
             .min_by_key(|d| {
                 let view = project_view(p, d.id);
                 (
@@ -4586,7 +4872,7 @@ fn preferred_diagram(p: &Project, active: Option<Id>, layer: Layer, element: Id)
     }
     p.diagrams
         .values()
-        .filter(|d| d.layer == layer)
+        .filter(|d| d.layer == layer && d.projection.scenario().is_none())
         .min_by_key(|d| {
             (
                 !p.elements
@@ -5389,6 +5675,7 @@ mod port_view_tests {
                 description: String::new(),
                 layer: Layer::Sa,
                 projection: ProjectionKind::Capabilities,
+                layout: None,
                 routes: Vec::new(),
                 view_options: Default::default(),
                 nodes: Default::default(),
@@ -5555,3 +5842,240 @@ mod data_paging_lifecycle_tests {
         assert_eq!(app.data_state, crate::data_view::State::default());
     }
 }
+
+#[cfg(test)]
+mod saved_scenario_dispatch_tests {
+    use super::*;
+
+    fn fixture() -> (App, Id, Id, Id) {
+        let f = behavior::scenario::direct_tests::fixture();
+        let mut project = f.project;
+        let architecture = project.ensure_diagram(Layer::Oa);
+        let saved = Id::new_v4();
+        project.diagrams.insert(
+            saved,
+            Diagram {
+                id: saved,
+                alias: "saved_scenario_dispatch".into(),
+                name: "Saved Scenario".into(),
+                description: String::new(),
+                layer: Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: f.owner },
+                view_options: Default::default(),
+                nodes: Default::default(),
+                routes: vec![],
+                layout: None,
+            },
+        );
+        let mut app = App::with_project(project);
+        app.page = Page::Diagram;
+        app.active_diagram = Some(architecture);
+        app.select(f.owner);
+        (app, architecture, saved, f.owner)
+    }
+
+    #[test]
+    fn rejected_export_schedules_no_write_and_preserves_draft_history_and_busy_state() {
+        let (mut app, _, saved, _) = fixture();
+        let _ = app.update(Message::Field("/name".into(), "Keep export draft".into()));
+        assert!(app.draft_dirty());
+        let path =
+            std::env::temp_dir().join(format!("arcadia-rejected-export-{}.svg", Id::new_v4()));
+        std::fs::write(&path, b"existing export").unwrap();
+        for target in [Some(saved), Some(Id::new_v4()), None] {
+            for busy in [false, true] {
+                app.active_diagram = target;
+                app.busy = busy;
+                let before = app.document.bundle().clone();
+                let history = (
+                    app.document.revision(),
+                    app.document.can_undo(),
+                    app.document.can_redo(),
+                );
+                let view = (
+                    app.page,
+                    app.selected,
+                    app.active_diagram,
+                    app.zoom,
+                    app.pan,
+                );
+                let task = app.export_to(path.clone());
+                assert_eq!(task.units(), 0, "rejection must not schedule a write");
+                assert_eq!(app.busy, busy);
+                assert_eq!(app.document.bundle(), &before);
+                assert_eq!(
+                    (
+                        app.document.revision(),
+                        app.document.can_undo(),
+                        app.document.can_redo()
+                    ),
+                    history
+                );
+                assert_eq!(
+                    (
+                        app.page,
+                        app.selected,
+                        app.active_diagram,
+                        app.zoom,
+                        app.pan
+                    ),
+                    view
+                );
+                assert!(app.draft_dirty());
+                assert!(app.file_prompt.is_none());
+                assert_eq!(std::fs::read(&path).unwrap(), b"existing export");
+            }
+        }
+        std::fs::remove_file(path).unwrap();
+    }
+
+    #[test]
+    fn missing_export_target_does_not_apply_pending_properties_or_open_dialog() {
+        for target in [None, Some(Id::new_v4())] {
+            let (mut app, _, _, _) = fixture();
+            let _ = app.update(Message::Field(
+                "/name".into(),
+                "Unapplied export draft".into(),
+            ));
+            app.active_diagram = target;
+            let before = app.document.bundle().clone();
+            let revision = app.document.revision();
+            let task = app.handle(Message::Export);
+            assert_eq!(task.units(), 0);
+            assert_eq!(app.document.bundle(), &before);
+            assert_eq!(app.document.revision(), revision);
+            assert!(app.draft_dirty());
+            assert!(app.file_prompt.is_none());
+            assert!(!app.busy);
+        }
+    }
+
+    #[test]
+    fn saved_picker_with_invalid_properties_and_reveal_with_pending_properties_do_not_apply() {
+        for reveal in [false, true] {
+            let (mut app, architecture, saved, owner) = fixture();
+            let _ = app.update(Message::Field(
+                if reveal { "/name" } else { "/id" }.into(),
+                if reveal {
+                    "Unapplied scenario name"
+                } else {
+                    "-"
+                }
+                .into(),
+            ));
+            assert!(app.draft_dirty());
+            let before = app.document.bundle().clone();
+            let revision = app.document.revision();
+            let selected = app.selected;
+            let message = if reveal {
+                Message::RevealInDiagram(saved, owner)
+            } else {
+                Message::Diagram(Choice {
+                    id: saved,
+                    label: "Saved Scenario".into(),
+                })
+            };
+            let _ = app.update(message);
+            assert_eq!(app.document.bundle(), &before);
+            assert_eq!(app.document.revision(), revision);
+            assert_eq!(app.active_diagram, Some(architecture));
+            assert_eq!(app.selected, selected);
+            assert!(app.draft_dirty());
+        }
+    }
+
+    #[test]
+    fn saved_scenario_cannot_use_architecture_controls_or_change_projection_by_toolbar() {
+        let (mut app, _, saved, _) = fixture();
+        app.active_diagram = Some(saved);
+        let _ = app.update(Message::Field("/name".into(), "Keep pending".into()));
+        let before = app.document.bundle().clone();
+        assert!(app.route_context().is_none());
+        assert!(architecture_authoring::kinds(&app).is_empty());
+        for message in [
+            Message::Projection(ProjectionKind::Overview),
+            Message::PlaceSelected,
+            Message::Command(Command::Layout(saved)),
+            Message::Export,
+        ] {
+            let _ = app.update(message);
+            assert_eq!(app.document.bundle(), &before);
+            assert!(app.draft_dirty());
+            assert!(app.file_prompt.is_none());
+            assert!(
+                app.project().diagrams[&saved]
+                    .projection
+                    .scenario()
+                    .is_some()
+            );
+        }
+    }
+
+    #[test]
+    fn saved_scenario_does_not_start_the_existing_architecture_palette() {
+        let (mut app, _, saved, _) = fixture();
+        app.active_diagram = Some(saved);
+        let before = app.document.bundle().clone();
+        let _ = app.update(Message::Architecture(
+            architecture_authoring::Event::Existing(None),
+        ));
+        assert!(app.architecture.is_none());
+        assert_eq!(app.document.bundle(), &before);
+        assert!(app.status.contains("architecture view"));
+    }
+
+    #[test]
+    fn forged_saved_usage_is_refused_without_selection_or_camera_changes() {
+        let (mut app, architecture, saved, _) = fixture();
+        let before = (
+            app.page,
+            app.selected,
+            app.layer,
+            app.zoom,
+            app.pan,
+            app.canvas_epoch,
+        );
+        let source = app.document.bundle().clone();
+        let usage = crate::diagram_usage::Usage {
+            subject: saved,
+            surface: crate::diagram_usage::Surface::Saved(saved),
+            target: crate::diagram_usage::Target::Whole,
+            role: "diagram".into(),
+            bounds: iced::Rectangle::new(iced::Point::new(500., 600.), iced::Size::new(300., 200.)),
+        };
+        assert!(!app.reveal_diagram_usage(&usage));
+        assert_eq!(
+            (
+                app.page,
+                app.selected,
+                app.layer,
+                app.zoom,
+                app.pan,
+                app.canvas_epoch
+            ),
+            before
+        );
+        assert_eq!(app.active_diagram, Some(architecture));
+        assert!(app.pending_diagram_reveal.is_none());
+        assert_eq!(app.document.bundle(), &source);
+    }
+
+    #[test]
+    fn semantic_scenario_preview_remains_available_and_saved_views_are_not_default_architecture() {
+        let (mut app, architecture, saved, owner) = fixture();
+        assert_eq!(
+            preferred_diagram(app.project(), Some(saved), Layer::Oa, owner),
+            Some(architecture)
+        );
+        app.active_diagram = Some(saved);
+        let before = app.document.bundle().clone();
+        let _ = app.update(Message::Select(owner));
+        let _ = app.update(Message::Page(Page::Behavior));
+        assert_eq!(app.scenario_context().unwrap().scenario, owner);
+        assert_eq!(app.document.bundle(), &before);
+        let mut only_saved = app.project().clone();
+        only_saved.diagrams.retain(|id, _| *id == saved);
+        assert!(preferred_diagram(&only_saved, None, Layer::Oa, owner).is_none());
+        assert!(App::with_project(only_saved).active_diagram.is_none());
+    }
+}

crates/oa-desktop/src/app/architecture_authoring.rs

@@ -138,7 +138,7 @@ pub fn validate_saved(p: &Project, s: &Saved) -> Result<(), String> {
         .diagrams
         .get(&s.diagram)
         .ok_or("The creation draft's diagram is missing.")?;
-    if matches!(d.projection, ProjectionKind::StateMachine { .. })
+    if !d.projection.is_architecture()
         || s.query.len() > 16384
         || s.page > 1_000_000
         || s.point
@@ -180,7 +180,7 @@ pub fn validate_saved(p: &Project, s: &Saved) -> Result<(), String> {
 }
 fn context_kinds(p: &Project, d: &Diagram) -> Vec<Kind> {
     let mut values = match (d.layer, d.projection) {
-        (_, ProjectionKind::StateMachine { .. }) => vec![],
+        (_, ProjectionKind::StateMachine { .. } | ProjectionKind::Scenario { .. }) => vec![],
         (Layer::Oa, ProjectionKind::FunctionalDataflow) => vec![Kind::Activity],
         (Layer::Sa, ProjectionKind::FunctionalDataflow) => vec![Kind::Function],
         (Layer::Oa, ProjectionKind::Capabilities) => vec![
@@ -208,11 +208,12 @@ pub fn kinds(app: &App) -> Vec<Kind> {
         .unwrap_or_default()
 }
 fn compatible(p: &Project, d: &Diagram, id: Id) -> bool {
-    p.elements.get(&id).is_some_and(|e| {
-        e.kind() != Kind::Port
-            && d.projection.includes(e.kind())
-            && (e.layer() == d.layer || d.projection == ProjectionKind::Traceability)
-    })
+    d.projection.is_architecture()
+        && p.elements.get(&id).is_some_and(|e| {
+            e.kind() != Kind::Port
+                && d.projection.includes(e.kind())
+                && (e.layer() == d.layer || d.projection == ProjectionKind::Traceability)
+        })
 }
 fn suggested(p: &Project, d: &Diagram, kind: Kind) -> bool {
     // Existing System remains a useful choice even when the singleton exists.
@@ -257,6 +258,17 @@ pub fn candidates(app: &App) -> Vec<(Id, String, bool)> {
 }
 impl App {
     pub(super) fn architecture_event(&mut self, event: Event) -> Task<Message> {
+        if matches!(
+            &event,
+            Event::Start(..) | Event::Allocate(..) | Event::Existing(..)
+        ) && !self
+            .active_diagram
+            .and_then(|id| self.project().diagrams.get(&id))
+            .is_some_and(|d| d.projection.is_architecture())
+        {
+            self.status = "Choose an architecture view before adding architecture content.".into();
+            return Task::none();
+        }
         match event {
             Event::Start(_, point) | Event::Allocate(_, _, point) | Event::Existing(point) => {
                 if self.architecture.is_some() {

crates/oa-desktop/src/app/diagram_reveal.rs

@@ -1,5 +1,6 @@
 //! Complete a navigation camera after the destination reports its real viewport.
 use super::*;
+use crate::behavior::scenario_layout::Representation;
 use crate::diagram_usage::{Context, Surface};
 #[cfg(test)]
 mod tests;
@@ -47,11 +48,23 @@ impl App {
                     && c.epoch == *epoch,
             ),
             Message::ScenarioCanvas(behavior::scenario::CanvasEvent::Viewport(c, size)) => (
-                Surface::Scenario(c.scenario),
+                match c.representation {
+                    Representation::Derived { owner } => Surface::Scenario(owner),
+                    Representation::Saved { diagram } => Surface::Saved(diagram),
+                },
                 *size,
                 c.document == context.document
                     && c.revision == context.revision
-                    && c.epoch == *epoch,
+                    && c.epoch == *epoch
+                    && self.pending_scenario_reveal_visit == Some(c.visit)
+                    && self.page == Page::Behavior
+                    && self.behavior.active_owner == Some(c.scenario)
+                    && self.behavior.scenario.context(
+                        self.canvas_document,
+                        c.scenario,
+                        self.document.revision(),
+                        self.canvas_epoch,
+                    ) == Some(*c),
             ),
             Message::StateDiagram(behavior::state_edit::Event::Viewport(c, size)) => (
                 Surface::Saved(c.diagram),
@@ -91,6 +104,7 @@ impl App {
                 | Message::StateDiagram(behavior::state_edit::Event::Viewport(..))
         ) {
             self.pending_diagram_reveal = None;
+            self.pending_scenario_reveal_visit = None;
             if !Self::is_navigation_camera(message) {
                 self.diagram_navigation_focus = None;
             }
@@ -142,5 +156,6 @@ impl App {
             self.reveal_diagram_usage(&usage);
         }
         self.pending_diagram_reveal = None;
+        self.pending_scenario_reveal_visit = None;
     }
 }

crates/oa-desktop/src/app/diagram_reveal/tests.rs

@@ -98,6 +98,7 @@ fn fixture(canvas: Canvas) -> (App, Usage) {
                     layer: Layer::Oa,
                     projection: ProjectionKind::StateMachine { machine },
                     nodes: BTreeMap::new(),
+                    layout: None,
                     routes: vec![],
                     view_options: Default::default(),
                 },
@@ -143,6 +144,7 @@ fn measurement(
     epoch: u64,
     surface: Surface,
     size: Size,
+    visit: Id,
 ) -> Message {
     match canvas {
         Canvas::Architecture => Message::DiagramRevealViewport(context, epoch, size),
@@ -159,6 +161,10 @@ fn measurement(
             behavior::scenario::Context {
                 document: context.document,
                 scenario: surface.id(),
+                representation: Representation::Derived {
+                    owner: surface.id(),
+                },
+                visit,
                 revision: context.revision,
                 epoch,
             },
@@ -176,12 +182,16 @@ fn measurement(
     }
 }
 
-fn stamp(app: &App) -> (Context, u64) {
+fn stamp(app: &App) -> (Context, u64, Id) {
     let (context, _, epoch) = app
         .pending_diagram_reveal
         .as_ref()
         .expect("reveal awaits measured destination");
-    (*context, *epoch)
+    (
+        *context,
+        *epoch,
+        app.pending_scenario_reveal_visit.unwrap_or(Id::nil()),
+    )
 }
 
 fn assert_centered(app: &App, canvas: Canvas, target: &Usage) {
@@ -219,7 +229,11 @@ fn assert_centered(app: &App, canvas: Canvas, target: &Usage) {
             expected.choose_tool(target.surface.id(), behavior::scenario::CanvasTool::Select);
             expected.viewport(ACTUAL);
             expected.zoom(Some(zoom));
-            expected.camera(behavior::canvas_workspace::Event::Pan(pan));
+            expected.camera(
+                app.project(),
+                target.surface.id(),
+                behavior::canvas_workspace::Event::Pan(pan),
+            );
             assert!(app.behavior.scenario.camera_boundary() == expected.camera_boundary());
         }
     }
@@ -238,10 +252,10 @@ fn all_reveal_surfaces_recenter_once_after_the_real_viewport_and_preserve_author
             app.document.dirty(),
         );
         assert!(app.reveal_diagram_usage(&target));
-        let (context, epoch) = stamp(&app);
+        let (context, epoch, visit) = stamp(&app);
         send(
             &mut app,
-            measurement(canvas, context, epoch, target.surface, ACTUAL),
+            measurement(canvas, context, epoch, target.surface, ACTUAL, visit),
         );
         assert!(app.pending_diagram_reveal.is_none());
         assert_centered(&app, canvas, &target);
@@ -260,7 +274,7 @@ fn all_reveal_surfaces_recenter_once_after_the_real_viewport_and_preserve_author
         let camera = app.camera_boundary();
         send(
             &mut app,
-            measurement(canvas, context, epoch, target.surface, ACTUAL),
+            measurement(canvas, context, epoch, target.surface, ACTUAL, visit),
         );
         assert!(app.pending_diagram_reveal.is_none());
         assert!(app.camera_boundary() == camera);
@@ -274,7 +288,7 @@ fn malformed_or_wrong_stamp_measurements_cannot_poison_a_pending_reveal() {
         for invalid in 0..6 {
             let (mut app, target) = fixture(canvas);
             assert!(app.reveal_diagram_usage(&target));
-            let (context, epoch) = stamp(&app);
+            let (context, epoch, visit) = stamp(&app);
             let camera = app.camera_boundary();
             let mut stale = context;
             let mut wrong_epoch = epoch;
@@ -289,13 +303,13 @@ fn malformed_or_wrong_stamp_measurements_cannot_poison_a_pending_reveal() {
             }
             send(
                 &mut app,
-                measurement(canvas, stale, wrong_epoch, target.surface, size),
+                measurement(canvas, stale, wrong_epoch, target.surface, size, visit),
             );
             assert!(
                 app.pending_diagram_reveal.is_some(),
                 "{canvas:?} invalid case {invalid}"
             );
-            assert_eq!(stamp(&app), (context, epoch));
+            assert_eq!(stamp(&app), (context, epoch, visit));
             assert_eq!(app.canvas_epoch, epoch);
             assert!(
                 app.camera_boundary() == camera,
@@ -303,7 +317,7 @@ fn malformed_or_wrong_stamp_measurements_cannot_poison_a_pending_reveal() {
             );
             send(
                 &mut app,
-                measurement(canvas, context, epoch, target.surface, ACTUAL),
+                measurement(canvas, context, epoch, target.surface, ACTUAL, visit),
             );
             assert!(app.pending_diagram_reveal.is_none());
             assert_centered(&app, canvas, &target);
@@ -317,9 +331,10 @@ fn actual_window_resize_before_first_measurement_retains_focus_for_the_new_conte
         let (mut app, target) = fixture(canvas);
         let accepted = app.document.snapshot();
         assert!(app.reveal_diagram_usage(&target));
-        let (context, old_epoch) = stamp(&app);
+        let (context, old_epoch, visit) = stamp(&app);
         send(&mut app, Message::WindowResized(Size::new(1100., 700.)));
-        let (current, epoch) = stamp(&app);
+        let (current, epoch, current_visit) = stamp(&app);
+        assert_eq!(current_visit, visit);
         assert_eq!(current, context);
         assert_eq!(epoch, app.canvas_epoch);
         if matches!(canvas, Canvas::Process | Canvas::Scenario) {
@@ -327,14 +342,14 @@ fn actual_window_resize_before_first_measurement_retains_focus_for_the_new_conte
             let camera = app.camera_boundary();
             send(
                 &mut app,
-                measurement(canvas, context, old_epoch, target.surface, ACTUAL),
+                measurement(canvas, context, old_epoch, target.surface, ACTUAL, visit),
             );
-            assert_eq!(stamp(&app), (current, epoch));
+            assert_eq!(stamp(&app), (current, epoch, visit));
             assert!(app.camera_boundary() == camera);
         }
         send(
             &mut app,
-            measurement(canvas, current, epoch, target.surface, ACTUAL),
+            measurement(canvas, current, epoch, target.surface, ACTUAL, visit),
         );
         assert!(app.pending_diagram_reveal.is_none());
         assert_centered(&app, canvas, &target);
@@ -349,7 +364,7 @@ fn user_camera_edit_and_navigation_cancel_deferred_focus_without_late_snapping()
             let (mut app, target) = fixture(canvas);
             let accepted = app.document.snapshot();
             assert!(app.reveal_diagram_usage(&target));
-            let (context, epoch) = stamp(&app);
+            let (context, epoch, visit) = stamp(&app);
             let event = match action {
                 0 => match canvas {
                     Canvas::Architecture => Message::Pan(Vector::new(31., -17.)),
@@ -386,7 +401,7 @@ fn user_camera_edit_and_navigation_cancel_deferred_focus_without_late_snapping()
             // restore the old navigation camera after deliberate user input.
             send(
                 &mut app,
-                measurement(canvas, context, epoch, target.surface, WIDE),
+                measurement(canvas, context, epoch, target.surface, WIDE, visit),
             );
             assert!(app.pending_diagram_reveal.is_none());
             assert!(

crates/oa-desktop/src/app/diagram_usages.rs

@@ -1,5 +1,6 @@
 //! Navigation-only adapter: validates destinations before changing presentation.
 use super::*;
+use crate::behavior::scenario_layout::{Representation, presentation};
 use crate::diagram_usage::{self as usage, Context, Event, Panel, Surface, Target, Usage};
 #[cfg(test)]
 mod tests;
@@ -164,6 +165,7 @@ impl App {
             // Only an accepted new chooser supersedes the previous reveal.
             // Rejected/stale panel envelopes leave its first measurement intact.
             self.pending_diagram_reveal = None;
+            self.pending_scenario_reveal_visit = None;
             self.diagram_navigation_focus = None;
             self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
             return Task::batch([
@@ -286,11 +288,78 @@ impl App {
         Task::none()
     }
 
+    /// Explicit saved-Scenario reveal runs before generic Apply. An absent target
+    /// never selects the owner or another saved arrangement as a fallback.
+    pub(super) fn reveal_saved_scenario(&mut self, diagram: Id, selected: Id) -> Task<Message> {
+        if self.diagram_usages.is_some() || !self.usage_navigation_available() {
+            self.status = "Apply or revert pending edits before revealing a saved Scenario. Your inputs are retained.".into();
+            return Task::none();
+        }
+        if presentation::checked_owner(self.project(), Representation::Saved { diagram }).is_none()
+        {
+            return Task::none();
+        }
+        let Some(found) = self
+            .current_surface_usages(selected, Surface::Saved(diagram))
+            .into_iter()
+            .find(|row| matches!(row.target, Target::Whole | Target::ScenarioObject(_)))
+        else {
+            self.status = "This object has no visible target in that saved Scenario.".into();
+            return Task::none();
+        };
+        self.reveal_diagram_usage(&found);
+        Task::none()
+    }
+
     pub(super) fn reveal_diagram_usage(&mut self, usage: &Usage) -> bool {
         if !self.usage_navigation_available() {
             return false;
         }
         let previous_layer = self.layer;
+        let scenario_representation = match usage.surface {
+            Surface::Saved(diagram) if self.saved_scenario_diagram(diagram) => {
+                Some(Representation::Saved { diagram })
+            }
+            Surface::Scenario(owner) => Some(Representation::Derived { owner }),
+            _ => None,
+        };
+        if let Some(representation) = scenario_representation {
+            let Some(owner) = presentation::checked_owner(self.project(), representation) else {
+                return false;
+            };
+            if !self
+                .behavior
+                .scenario
+                .representation_usages(self.project(), representation, usage.subject)
+                .iter()
+                .any(|row| row == usage)
+            {
+                return false;
+            }
+            // Finish target/camera admission before changing the App route. The
+            // checked immutable owner also makes the following entry infallible.
+            let revealed = match representation {
+                Representation::Derived { .. } => self.behavior.scenario.reveal_usage(
+                    self.document.project(),
+                    self.canvas_document,
+                    owner,
+                    &usage.target,
+                ),
+                Representation::Saved { .. } => self.behavior.scenario.reveal_representation_usage(
+                    self.document.project(),
+                    self.canvas_document,
+                    owner,
+                    representation,
+                    &usage.target,
+                ),
+            };
+            if !revealed {
+                return false;
+            }
+            if !self.enter_scenario_representation(representation) {
+                return false;
+            }
+        }
         let p = self.document.project();
         let (selected, placement) = match &usage.target {
             Target::Whole => (usage.surface.id(), None),
@@ -330,7 +399,10 @@ impl App {
                 };
                 self.layer = diagram.layer;
                 self.active_diagram = Some(id);
-                if let Some(machine) = diagram.projection.state_machine() {
+                if let Some(owner) = diagram.projection.scenario() {
+                    self.behavior.active_owner = Some(owner);
+                    self.page = Page::Behavior;
+                } else if let Some(machine) = diagram.projection.state_machine() {
                     let viewport = self.behavior.diagram.viewport.unwrap_or(iced::Size::new(
                         (self.window_size.width - 610.).max(280.),
                         (self.window_size.height - 320.).max(240.),
@@ -372,19 +444,14 @@ impl App {
                 self.page = Page::Behavior;
             }
             Surface::Scenario(owner) => {
-                if !self.behavior.scenario.reveal_usage(
-                    p,
-                    self.canvas_document,
-                    owner,
-                    &usage.target,
-                ) {
-                    return false;
-                }
                 self.layer = p.elements[&owner].layer();
                 self.behavior.active_owner = Some(owner);
                 self.page = Page::Behavior;
             }
         }
+        if scenario_representation.is_none() {
+            self.behavior.scenario.forget_view();
+        }
         self.selected = selected;
         self.selected_node = placement;
         self.model_menu = None;
@@ -411,6 +478,18 @@ impl App {
             usage: usage.clone(),
             selected,
         });
+        self.pending_scenario_reveal_visit = scenario_representation.and_then(|representation| {
+            let owner = presentation::checked_owner(self.project(), representation)?;
+            self.behavior
+                .scenario
+                .context(
+                    self.canvas_document,
+                    owner,
+                    self.document.revision(),
+                    self.canvas_epoch,
+                )
+                .map(|context| context.visit)
+        });
         self.pending_diagram_reveal = Some((
             Context {
                 document: self.canvas_document,
@@ -431,10 +510,20 @@ impl App {
             Surface::Saved(id) => {
                 self.active_diagram == Some(id)
                     && matches!(self.page, Page::Diagram | Page::Behavior)
+                    && (!self.saved_scenario_diagram(id)
+                        || (self.page == Page::Behavior
+                            && self.behavior.scenario.representation()
+                                == Some(Representation::Saved { diagram: id })))
             }
-            Surface::Process(owner) | Surface::Scenario(owner) => {
+            Surface::Process(owner) => {
                 self.page == Page::Behavior && self.behavior.active_owner == Some(owner)
             }
+            Surface::Scenario(owner) => {
+                self.page == Page::Behavior
+                    && self.behavior.active_owner == Some(owner)
+                    && self.behavior.scenario.representation()
+                        == Some(Representation::Derived { owner })
+            }
         };
         (current_surface
             && focus.usage.surface == surface

crates/oa-desktop/src/app/diagram_usages/tests.rs

@@ -1401,3 +1401,5 @@ fn completion_releases_worker_behind_busy_modal_without_navigation() {
     assert_eq!(location(&app), prior);
     assert_eq!(authored(&app), before);
 }
+
+mod saved_scenario;

crates/oa-desktop/src/app/diagram_usages/tests/saved_scenario.arcadia

@@ -0,0 +1,108 @@
+arcadia 7;
+project incident_workspace "Incident report review" id "70200000-0000-4000-8000-000000000001" {
+    // Two operational activities, with one lifeline appearance per Scenario.
+    oa_activity report_incident "Report incident" id "70200000-0000-4000-8000-000000000002" {}
+    oa_activity assess_incident "Assess incident" id "70200000-0000-4000-8000-000000000003" {}
+    interaction incident_report "Incident report" id "70200000-0000-4000-8000-000000000004" {
+        source @report_incident;
+        target @assess_incident;
+    }
+
+    oa_scenario incident_response "Review a reported incident" id "70200000-0000-4000-8000-000000000010" {
+        viewpoint OperationalActivity;
+        steps [@initial_report, @updated_report, @assess_call, @assess_reply, @unfinished_notice, @use_review];
+    }
+    oa_lifeline reporter "Reporting activity" id "70200000-0000-4000-8000-000000000011" {
+        parent @incident_response; represented @report_incident;
+    }
+    oa_lifeline assessor "Assessment activity" id "70200000-0000-4000-8000-000000000012" {
+        parent @incident_response; represented @assess_incident;
+    }
+    // Both appearances reuse one definition. Navigation must retain the occurrence.
+    oa_occurrence initial_report "Initial incident report" id "70200000-0000-4000-8000-000000000020" {
+        parent @incident_response;
+        body { Exchange { exchange @incident_report; sender @reporter; receiver @assessor; message_kind Asynchronous; }; };
+    }
+    oa_occurrence updated_report "Updated incident report" id "70200000-0000-4000-8000-000000000021" {
+        parent @incident_response;
+        body { Exchange { exchange @incident_report; sender @reporter; receiver @assessor; message_kind Asynchronous; }; };
+    }
+    // A correlated self call/reply with deliberately unassigned exchange definitions.
+    oa_occurrence assess_call "Assess report details" id "70200000-0000-4000-8000-000000000022" {
+        parent @incident_response;
+        body { Exchange { exchange none; sender @assessor; receiver @assessor; message_kind Call; }; };
+    }
+    oa_occurrence assess_reply "Assessment ready" id "70200000-0000-4000-8000-000000000023" {
+        parent @incident_response;
+        body { Exchange { exchange none; sender @assessor; receiver @assessor; message_kind Reply; reply_to @assess_call; }; };
+    }
+    // Intentional unfinished work: no receiver and therefore no fabricated arrow.
+    oa_occurrence unfinished_notice "Follow-up recipient undecided" id "70200000-0000-4000-8000-000000000024" {
+        parent @incident_response;
+        body { Exchange { exchange @incident_report; sender @reporter; receiver none; message_kind Asynchronous; }; };
+    }
+    oa_occurrence use_review "Use the reviewed reporting procedure" id "70200000-0000-4000-8000-000000000025" {
+        parent @incident_response;
+        body { ScenarioUse {
+            bindings [{ local @reporter; referenced @review_reporter; }, { local @assessor; referenced @review_assessor; }];
+            scenario @reporting_review;
+        }; };
+    }
+
+    // This definition stays opaque in the caller. Open it, then Back to the saved view.
+    oa_scenario reporting_review "Reporting procedure detail" id "70200000-0000-4000-8000-000000000030" {
+        viewpoint OperationalActivity;
+        steps [@review_delivery];
+    }
+    oa_lifeline review_reporter "Reporting activity in detail" id "70200000-0000-4000-8000-000000000031" {
+        parent @reporting_review; represented @report_incident;
+    }
+    oa_lifeline review_assessor "Assessment activity in detail" id "70200000-0000-4000-8000-000000000032" {
+        parent @reporting_review; represented @assess_incident;
+    }
+    oa_occurrence review_delivery "Check the incident report" id "70200000-0000-4000-8000-000000000033" {
+        parent @reporting_review;
+        body { Exchange { exchange @incident_report; sender @review_reporter; receiver @review_assessor; message_kind Asynchronous; }; };
+    }
+
+    diagram incident_readable "A - Incident review readable" id "70200000-0000-4000-8000-000000000040" {
+        layer Oa;
+        projection { Scenario { scenario @incident_response; }; };
+        layout { Scenario {
+            lanes [{ lifeline @reporter; x 160; }, { lifeline @assessor; x 640; }];
+            messages [
+                { address { references []; occurrence @initial_report; }; send_y 160; },
+                { address { references []; occurrence @updated_report; }; send_y 252; },
+                { address { references []; occurrence @assess_call; }; send_y 344; },
+                { address { references []; occurrence @assess_reply; }; send_y 436; }
+            ];
+        }; };
+    }
+    diagram incident_wide "B - Incident review negative and far" id "70200000-0000-4000-8000-000000000041" {
+        layer Oa;
+        projection { Scenario { scenario @incident_response; }; };
+        layout { Scenario {
+            lanes [{ lifeline @reporter; x -500; }, { lifeline @assessor; x 50000; }];
+            messages [
+                { address { references []; occurrence @initial_report; }; send_y 160; },
+                { address { references []; occurrence @updated_report; }; send_y 252; },
+                { address { references []; occurrence @assess_call; }; send_y 344; },
+                { address { references []; occurrence @assess_reply; }; send_y 436; }
+            ];
+        }; };
+    }
+    diagram incident_repair "C - Incident review needs layout repair" id "70200000-0000-4000-8000-000000000042" {
+        layer Oa;
+        projection { Scenario { scenario @incident_response; }; };
+        layout { Scenario {
+            // These valid authored lanes must remain saved during complete fallback.
+            lanes [{ lifeline @reporter; x 900; }, { lifeline @assessor; x -500; }];
+            messages [
+                // REPAIR: change only this 300 to 424, then Undo and Redo the edit.
+                { address { references []; occurrence @assess_reply; }; send_y 300; },
+                // This authored value stays latent while the receiver is missing.
+                { address { references []; occurrence @unfinished_notice; }; send_y 2000; }
+            ];
+        }; };
+    }
+}

crates/oa-desktop/src/app/diagram_usages/tests/saved_scenario.rs

@@ -0,0 +1,356 @@
+//! Actual App chooser/explicit-reveal checks for saved Scenario identity and source history.
+use super::*;
+use crate::behavior::scenario::{CanvasEvent, State};
+use crate::behavior::scenario_layout::{
+    Representation,
+    presentation::{self, PresentationStatus},
+};
+use iced::{Size, Vector};
+
+fn fixture() -> App {
+    let p = language::parse(include_str!("saved_scenario.arcadia")).unwrap();
+    let errors: Vec<_> = oa_core::validation::validate(&p)
+        .into_iter()
+        .filter(|d| d.severity == oa_core::validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+    App::with_project(p)
+}
+fn id(app: &App, alias: &str) -> Id {
+    app.project()
+        .identities()
+        .into_iter()
+        .find(|(_, a)| *a == alias)
+        .unwrap()
+        .0
+}
+fn representation(view: Id) -> Representation {
+    Representation::Saved { diagram: view }
+}
+fn find(app: &App, subject: Id, view: Id) -> Usage {
+    usage::saved_usages_for(app.project(), subject, Some(view))
+        .into_iter()
+        .find(|row| row.target == Target::ScenarioObject(subject))
+        .expect("exact saved occurrence")
+}
+fn context(app: &App) -> behavior::scenario::Context {
+    let owner = app.behavior.active_owner.unwrap();
+    app.behavior
+        .scenario
+        .context(
+            app.canvas_document,
+            owner,
+            app.document.revision(),
+            app.canvas_epoch,
+        )
+        .unwrap()
+}
+fn navigate(app: &mut App, subject: Id, view: Id) -> Id {
+    let (token, rows) = open(app, subject);
+    let found = rows
+        .into_iter()
+        .find(|u| u.surface == Surface::Saved(view) && u.target == Target::ScenarioObject(subject))
+        .expect("saved chooser destination");
+    choose(app, token, found);
+    assert!(app.diagram_usages.is_none());
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.active_diagram, Some(view));
+    assert_eq!(
+        app.behavior.scenario.representation(),
+        Some(representation(view))
+    );
+    assert_eq!(app.selected, subject);
+    token
+}
+
+#[test]
+fn saved_queries_use_each_actual_presentation_and_keep_repeated_appearances_and_references_opaque()
+{
+    let app = fixture();
+    let owner = id(&app, "incident_response");
+    let first = id(&app, "initial_report");
+    let second = id(&app, "updated_report");
+    let exchange = id(&app, "incident_report");
+    let latent = id(&app, "unfinished_notice");
+    let callee_message = id(&app, "review_delivery");
+    let views = ["incident_readable", "incident_wide", "incident_repair"].map(|a| id(&app, a));
+    let derived = app
+        .behavior
+        .scenario
+        .diagram_usages(app.project(), owner, first)
+        .pop()
+        .unwrap();
+    let rows = views.map(|view| find(&app, first, view));
+    assert_eq!(rows[0].bounds.y - derived.bounds.y, 12.);
+    assert_ne!(rows[0].bounds, rows[1].bounds);
+    assert_eq!(
+        rows[2].bounds, derived.bounds,
+        "complete fallback cannot retain the authored lane override"
+    );
+    for view in views {
+        let represented = usage::saved_usages_for(app.project(), exchange, Some(view));
+        assert_eq!(represented.len(), 2);
+        assert!(
+            represented
+                .iter()
+                .any(|u| u.target == Target::ScenarioObject(first))
+        );
+        assert!(
+            represented
+                .iter()
+                .any(|u| u.target == Target::ScenarioObject(second))
+        );
+        assert!(
+            represented
+                .iter()
+                .all(|u| u.surface == Surface::Saved(view))
+        );
+        assert!(usage::saved_usages_for(app.project(), callee_message, Some(view)).is_empty());
+        assert_eq!(
+            find(&app, latent, view).target,
+            Target::ScenarioObject(latent)
+        );
+        let shown = presentation::present(app.project(), representation(view), owner);
+        let whole = usage::saved_usages_for(app.project(), view, Some(view));
+        assert_eq!(whole.len(), 1);
+        assert_eq!(whole[0].target, Target::Whole);
+        assert_eq!(Some(whole[0].bounds), shown.bounds());
+    }
+    let wide = presentation::present(app.project(), representation(views[1]), owner)
+        .bounds()
+        .unwrap();
+    assert!(wide.x < -500. && wide.x + wide.width > 50000.);
+    let fallback = presentation::present(app.project(), representation(views[2]), owner);
+    assert!(matches!(
+        fallback.status(),
+        PresentationStatus::Fallback { .. }
+    ));
+    assert_eq!(fallback.latent_messages(), &[latent]);
+    assert!(!fallback.capabilities().coordinate_input);
+}
+
+#[test]
+fn saved_chooser_and_explicit_reveal_preserve_complete_source_and_actual_undo_redo() {
+    for alias in ["incident_readable", "incident_wide", "incident_repair"] {
+        let mut app = fixture();
+        let view = id(&app, alias);
+        let first = id(&app, "initial_report");
+        let owner = id(&app, "incident_response");
+        let original = app.document.snapshot();
+        app.document
+            .execute(Command::Rename(first, "Reviewed incident report".into()))
+            .unwrap();
+        let edited = app.document.snapshot();
+        app.sync_source();
+        app.refresh_draft();
+        let before = authored(&app);
+        navigate(&mut app, first, view);
+        assert_eq!(app.behavior.active_owner, Some(owner));
+        assert_eq!(authored(&app), before);
+        send(&mut app, Message::RevealInDiagram(view, first));
+        assert_eq!(app.active_diagram, Some(view));
+        assert_eq!(authored(&app), before);
+        assert!(app.document.undo());
+        assert_eq!(app.project(), &original.decoded.project);
+        assert_eq!(app.document.bundle(), &original.bundle);
+        assert!(app.document.redo());
+        assert_eq!(app.project(), &edited.decoded.project);
+        assert_eq!(app.document.bundle(), &edited.bundle);
+    }
+}
+
+#[test]
+fn saved_reveal_and_chooser_refuse_source_property_and_behavior_drafts() {
+    for chooser in [false, true] {
+        for block in 0..3 {
+            let mut app = fixture();
+            let view = id(&app, "incident_repair");
+            let first = id(&app, "initial_report");
+            let choice = chooser.then(|| {
+                let (token, rows) = open(&mut app, first);
+                (
+                    token,
+                    rows.into_iter()
+                        .find(|u| u.surface == Surface::Saved(view))
+                        .unwrap(),
+                )
+            });
+            match block {
+                0 => {
+                    let cursor = app.source_editor.cursor();
+                    app.source_workspace
+                        .edit("? preserve unfinished source".into(), cursor);
+                }
+                1 => {
+                    app.draft
+                        .as_mut()
+                        .unwrap()
+                        .input("/name", "Unapplied inspector value".into());
+                    assert!(app.draft_dirty());
+                }
+                _ => {
+                    let p = app.project().clone();
+                    app.behavior
+                        .creation
+                        .update(&p, behavior::creation::Event::Open(Layer::Oa))
+                        .unwrap();
+                    assert!(app.behavior.has_pending());
+                }
+            }
+            let before = authored(&app);
+            let prior = location(&app);
+            let draft = app
+                .draft
+                .as_ref()
+                .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap());
+            if let Some((token, row)) = choice {
+                choose(&mut app, token, row);
+            } else {
+                send(&mut app, Message::RevealInDiagram(view, first));
+            }
+            assert_eq!(authored(&app), before);
+            assert_eq!(location(&app), prior);
+            assert_eq!(
+                app.draft
+                    .as_ref()
+                    .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap()),
+                draft
+            );
+        }
+    }
+}
+
+#[test]
+fn saved_a_b_a_rejects_old_visit_and_panel_callbacks_before_deferred_measurement() {
+    let mut app = fixture();
+    let a = id(&app, "incident_readable");
+    let b = id(&app, "incident_wide");
+    let first = id(&app, "initial_report");
+    let before = authored(&app);
+    let old_token = navigate(&mut app, first, a);
+    let old = context(&app);
+    navigate(&mut app, first, b);
+    navigate(&mut app, first, a);
+    let current = context(&app);
+    assert_ne!(old.visit, current.visit);
+    let held = behavior::scenario::Context {
+        epoch: current.epoch,
+        ..old
+    };
+    let camera = app.behavior.scenario.camera_boundary();
+    send(
+        &mut app,
+        Message::ScenarioCanvas(CanvasEvent::Viewport(held, Size::new(900., 900.))),
+    );
+    send(&mut app, Message::ScenarioCanvas(CanvasEvent::Focus(held)));
+    send(
+        &mut app,
+        Message::DiagramUsage(Event::Search(old_token, "obsolete filter".into())),
+    );
+    send(&mut app, Message::DiagramUsage(Event::Close(old_token)));
+    assert_eq!(app.pending_scenario_reveal_visit, Some(current.visit));
+    assert!(app.pending_diagram_reveal.is_some());
+    assert!(app.behavior.scenario.camera_boundary() == camera);
+    let bounds = find(&app, first, a).bounds;
+    send(
+        &mut app,
+        Message::ScenarioCanvas(CanvasEvent::Viewport(current, Size::new(500., 300.))),
+    );
+    assert!(app.pending_diagram_reveal.is_none());
+    assert_eq!(context(&app).visit, current.visit);
+    let mut expected = State::default();
+    expected.enter_representation(app.canvas_document, current.scenario, representation(a));
+    expected.viewport(Size::new(500., 300.));
+    expected.zoom(Some(1.25));
+    expected.camera(
+        app.project(),
+        current.scenario,
+        behavior::canvas_workspace::Event::Pan(Vector::new(
+            250. - bounds.center_x() * 1.25,
+            150. - bounds.center_y() * 1.25,
+        )),
+    );
+    assert!(app.behavior.scenario.camera_boundary() == expected.camera_boundary());
+    assert_eq!(authored(&app), before);
+}
+
+#[test]
+fn retargeted_saved_view_cannot_reveal_a_former_owner_occurrence() {
+    let mut app = fixture();
+    let first = id(&app, "initial_report");
+    let view = id(&app, "incident_readable");
+    let other = id(&app, "reporting_review");
+    let (token, rows) = open(&mut app, first);
+    let old = rows
+        .into_iter()
+        .find(|u| u.surface == Surface::Saved(view))
+        .unwrap();
+    let mut replacement = app.project().diagrams[&view].clone();
+    replacement.projection = ProjectionKind::Scenario { scenario: other };
+    replacement.layout = None;
+    app.document
+        .execute(Command::EditDiagram(view, replacement))
+        .unwrap();
+    app.sync_source();
+    app.refresh_draft();
+    let before = authored(&app);
+    let prior = location(&app);
+    choose(&mut app, token, old);
+    assert_eq!(location(&app), prior);
+    assert_eq!(authored(&app), before);
+    finish_lookup(&mut app);
+    let token = app.diagram_usages.as_ref().unwrap().token;
+    assert!(
+        app.diagram_usages
+            .as_ref()
+            .unwrap()
+            .usages
+            .iter()
+            .all(|u| u.surface != Surface::Saved(view))
+    );
+    send(&mut app, Message::DiagramUsage(Event::Close(token)));
+    send(&mut app, Message::RevealInDiagram(view, first));
+    assert_eq!(location(&app), prior);
+    assert_eq!(authored(&app), before);
+}
+
+#[test]
+fn explicit_saved_layout_repair_undo_redo_requeries_authored_and_fallback_geometry_without_extra_history()
+ {
+    let mut app = fixture();
+    let view = id(&app, "incident_repair");
+    let first = id(&app, "initial_report");
+    let reply = id(&app, "assess_reply");
+    let before = app.document.snapshot();
+    let fallback = find(&app, first, view);
+    app.document
+        .execute(Command::SetScenarioMessagePosition {
+            diagram: view,
+            position: oa_core::ScenarioMessagePosition {
+                address: oa_core::OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: reply,
+                },
+                send_y: 424.,
+            },
+        })
+        .unwrap();
+    app.sync_source();
+    app.refresh_draft();
+    let repaired = app.document.snapshot();
+    let authored_row = find(&app, first, view);
+    assert_ne!(authored_row.bounds, fallback.bounds);
+    navigate(&mut app, first, view);
+    assert!(app.document.undo());
+    app.sync_source();
+    app.refresh_draft();
+    assert_eq!(app.project(), &before.decoded.project);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert_eq!(find(&app, first, view).bounds, fallback.bounds);
+    assert!(app.document.redo());
+    app.sync_source();
+    app.refresh_draft();
+    assert_eq!(app.project(), &repaired.decoded.project);
+    assert_eq!(app.document.bundle(), &repaired.bundle);
+    assert_eq!(find(&app, first, view).bounds, authored_row.bounds);
+}

crates/oa-desktop/src/app/process_canvas.rs

@@ -65,6 +65,7 @@ impl App {
                 owner: context.owner,
                 revision: context.revision,
                 epoch: lifetime,
+                scenario_view: None,
             };
             if self.behavior.has_pending()
                 || self.draft_dirty()

crates/oa-desktop/src/app/scenario_diagram.rs

@@ -0,0 +1,96 @@
+//! Saved Scenario navigation is presentation state, never a document edit.
+use super::*;
+use crate::behavior::scenario_layout::{Representation, presentation::checked_owner};
+
+impl App {
+    pub(super) fn enter_scenario_representation(&mut self, representation: Representation) -> bool {
+        let Some(owner) = checked_owner(self.project(), representation) else {
+            self.status =
+                "This Scenario view is no longer available or has an incompatible owner.".into();
+            return false;
+        };
+        self.layer = self.project().elements[&owner].layer();
+        self.page = Page::Behavior;
+        self.behavior.active_owner = Some(owner);
+        match representation {
+            Representation::Saved { diagram } => self.active_diagram = Some(diagram),
+            Representation::Derived { .. } => {
+                if self
+                    .active_diagram
+                    .is_some_and(|id| self.saved_scenario_diagram(id))
+                {
+                    self.active_diagram = None;
+                }
+            }
+        }
+        self.selected_node = None;
+        if self
+            .behavior
+            .scenario
+            .enter_representation(self.canvas_document, owner, representation)
+        {
+            self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+        }
+        true
+    }
+
+    /// Reconcile after navigation/adoption without selecting or applying a draft.
+    /// A retained invalid Saved identity remains unavailable; it must not silently
+    /// turn into a different automatic Scenario or another saved arrangement.
+    pub(super) fn reconcile_scenario_workspace(&mut self) {
+        if self.page == Page::Diagram
+            && !self.behavior.has_pending()
+            && let Some(diagram) = self
+                .active_diagram
+                .filter(|id| self.saved_scenario_diagram(*id))
+        {
+            self.enter_scenario_representation(Representation::Saved { diagram });
+        }
+        if self.page != Page::Behavior {
+            self.behavior.scenario.leave();
+            return;
+        }
+        if let Some(rep @ Representation::Saved { diagram }) =
+            self.behavior.scenario.representation()
+        {
+            // The requested view is authoritative until explicit navigation
+            // retires it. This also recovers the same view when Undo restores it.
+            if let Some(owner) = checked_owner(self.project(), rep) {
+                self.active_diagram = Some(diagram);
+                self.layer = self.project().elements[&owner].layer();
+                self.behavior.active_owner = Some(owner);
+                self.behavior
+                    .scenario
+                    .enter_representation(self.canvas_document, owner, rep);
+            } else if let Some(owner) = self.behavior.scenario.owner() {
+                self.behavior
+                    .scenario
+                    .enter_representation(self.canvas_document, owner, rep);
+            }
+            return;
+        }
+        let Some(owner) = behavior::selected_owner(self) else {
+            self.behavior.scenario.leave();
+            return;
+        };
+        if self
+            .project()
+            .elements
+            .get(&owner)
+            .is_some_and(|e| e.kind() == Kind::Scenario)
+        {
+            self.behavior.scenario.enter(self.canvas_document, owner);
+        } else {
+            self.behavior.scenario.leave();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(test)]
+mod adoption_tests;
+
+#[cfg(test)]
+mod owner_navigation_tests;

crates/oa-desktop/src/app/scenario_diagram/adoption_tests.rs

@@ -0,0 +1,264 @@
+//! Independent adoption oracles: expected Projects are edited directly in the
+//! fixture, then admitted through the actual source editor/Document transaction.
+//! Navigation is checked separately from the expected authored mutation.
+use super::*;
+use crate::behavior::canvas_workspace::tests::Mounted;
+use iced::advanced::widget;
+use iced::widget::text_editor;
+use oa_core::language;
+use std::sync::Arc;
+
+struct Fixture {
+    app: App,
+    owner: Id,
+    same_layer: Id,
+    other_layer: Id,
+    view: Id,
+    spare_view: Id,
+}
+
+fn fixture() -> Fixture {
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::Scenario, Layer::Oa, "Original owner", None)
+        .unwrap();
+    let same_layer = project
+        .add_element(Kind::Scenario, Layer::Oa, "Other OA owner", None)
+        .unwrap();
+    let other_layer = project
+        .add_element(Kind::Scenario, Layer::Sa, "SA owner", None)
+        .unwrap();
+    // A remaining topology makes silent fallback observably different from the
+    // required unavailable Saved view after its owner is deleted.
+    project
+        .add_element(Kind::Process, Layer::Oa, "Remaining process", None)
+        .unwrap();
+    let mut make_view = |alias: &str, name: &str, owner| {
+        let id = Id::new_v4();
+        project.diagrams.insert(
+            id,
+            Diagram {
+                id,
+                alias: alias.into(),
+                name: name.into(),
+                description: String::new(),
+                layer: Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: owner },
+                layout: None,
+                nodes: Default::default(),
+                routes: vec![],
+                view_options: Default::default(),
+            },
+        );
+        id
+    };
+    let view = make_view("retained_view", "Retained arrangement", owner);
+    let spare_view = make_view("spare_view", "Spare arrangement", same_layer);
+    let mut app = App::with_project(project);
+    let _ = app.update(Message::Select(owner));
+    choose(&mut app, view);
+    assert_saved(&app, view, owner, Layer::Oa);
+    assert!(!app.document.can_undo());
+    Fixture {
+        app,
+        owner,
+        same_layer,
+        other_layer,
+        view,
+        spare_view,
+    }
+}
+
+fn choose(app: &mut App, id: Id) {
+    let _ = app.update(Message::Diagram(Choice {
+        id,
+        label: "Previously captured picker item".into(),
+    }));
+}
+
+fn assert_saved(app: &App, view: Id, owner: Id, layer: Layer) {
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.layer, layer);
+    assert_eq!(app.active_diagram, Some(view));
+    let context = app
+        .scenario_context()
+        .expect("saved owner remains the visible context");
+    assert_eq!(context.scenario, owner);
+    assert_eq!(
+        context.representation,
+        Representation::Saved { diagram: view }
+    );
+    assert!(!context.visit.is_nil());
+}
+
+fn adopt_from_source(app: &mut App, expected: &Project) {
+    let text = language::format(expected);
+    // Parser equality is a fixture precondition, not the navigation oracle.
+    assert_eq!(language::parse(&text).unwrap(), *expected);
+    let _ = app.update(Message::Page(Page::Text));
+    let _ = app.update(Message::SourceEdit(text_editor::Action::SelectAll));
+    let _ = app.update(Message::SourceEdit(text_editor::Action::Edit(
+        text_editor::Edit::Paste(Arc::new(text)),
+    )));
+    assert!(app.source_dirty());
+    let _ = app.update(Message::ApplySource);
+    assert!(!app.source_dirty(), "{}", app.status);
+    assert_eq!(
+        app.project(),
+        expected,
+        "actual source transaction must adopt exactly the fixture change"
+    );
+    let _ = app.update(Message::Page(Page::Behavior));
+}
+
+fn retarget(cross_layer: bool) {
+    let mut f = fixture();
+    let before = f.app.document.snapshot();
+    let old_context = f.app.scenario_context().unwrap();
+    let revision = f.app.document.revision();
+    let target = if cross_layer {
+        f.other_layer
+    } else {
+        f.same_layer
+    };
+    let layer = if cross_layer { Layer::Sa } else { Layer::Oa };
+    let mut expected = before.decoded.project.clone();
+    let view = expected.diagrams.get_mut(&f.view).unwrap();
+    view.projection = ProjectionKind::Scenario { scenario: target };
+    view.layer = layer;
+
+    adopt_from_source(&mut f.app, &expected);
+    assert_saved(&f.app, f.view, target, layer);
+    assert_ne!(f.app.scenario_context().unwrap().visit, old_context.visit);
+    assert_eq!(
+        f.app.document.revision(),
+        revision + 1,
+        "routing must not create a second transaction"
+    );
+    assert_eq!(
+        f.app.project().diagrams[&f.spare_view],
+        before.decoded.project.diagrams[&f.spare_view]
+    );
+    let adopted_bundle = f.app.document.bundle().clone();
+
+    let _ = f.app.update(Message::Undo);
+    assert_saved(&f.app, f.view, f.owner, Layer::Oa);
+    assert_eq!(f.app.project(), &before.decoded.project);
+    assert_eq!(f.app.document.bundle(), &before.bundle);
+    assert!(
+        !f.app.document.can_undo(),
+        "exactly one authored adoption must be undone"
+    );
+    let _ = f.app.update(Message::Redo);
+    assert_saved(&f.app, f.view, target, layer);
+    assert_eq!(f.app.project(), &expected);
+    assert_eq!(f.app.document.bundle(), &adopted_bundle);
+    assert!(!f.app.document.can_redo());
+}
+
+#[test]
+fn source_same_layer_owner_retarget_undo_redo_keeps_requested_saved_uuid() {
+    retarget(false);
+}
+
+#[test]
+fn source_cross_layer_owner_retarget_undo_redo_keeps_requested_saved_uuid() {
+    retarget(true);
+}
+
+#[tokio::test]
+async fn source_deleted_owner_and_saved_view_mount_unavailable_instead_of_another_behavior() {
+    let mut f = fixture();
+    let before = f.app.document.snapshot();
+    let mut expected = before.decoded.project.clone();
+    assert!(expected.elements.remove(&f.owner).is_some());
+    assert!(expected.diagrams.remove(&f.view).is_some());
+    assert!(expected.elements.contains_key(&f.same_layer));
+    assert!(
+        expected
+            .elements
+            .values()
+            .any(|e| e.kind() == Kind::Process)
+    );
+    adopt_from_source(&mut f.app, &expected);
+    assert_eq!(
+        f.app.behavior.scenario.representation(),
+        Some(Representation::Saved { diagram: f.view })
+    );
+    let adopted = f.app.document.snapshot();
+    let revision = f.app.document.revision();
+    let mut mounted = Mounted::new(&mut f.app).await;
+    let geometry = mounted.geometry(&f.app);
+    assert!(
+        geometry
+            .containers
+            .contains_key(&widget::Id::from("scenario-viewport-unavailable"))
+    );
+    assert!(
+        !geometry
+            .containers
+            .contains_key(&widget::Id::from("scenario-viewport"))
+    );
+    assert_eq!(f.app.project(), &expected);
+    assert_eq!(f.app.document.bundle(), &adopted.bundle);
+    assert_eq!(
+        f.app.document.revision(),
+        revision,
+        "mounting unavailable must remain passive"
+    );
+
+    let _ = f.app.update(Message::Undo);
+    assert_saved(&f.app, f.view, f.owner, Layer::Oa);
+    assert_eq!(f.app.document.bundle(), &before.bundle);
+    let _ = f.app.update(Message::Redo);
+    assert_eq!(
+        f.app.behavior.scenario.representation(),
+        Some(Representation::Saved { diagram: f.view })
+    );
+    mounted.settle(&mut f.app).await;
+    assert!(
+        mounted
+            .geometry(&f.app)
+            .containers
+            .contains_key(&widget::Id::from("scenario-viewport-unavailable"))
+    );
+    assert_eq!(f.app.project(), &expected);
+    assert_eq!(f.app.document.bundle(), &adopted.bundle);
+}
+
+#[test]
+fn missing_and_deleted_picker_ids_cannot_apply_an_unrelated_valid_property_draft() {
+    let mut f = fixture();
+    let mut expected = f.app.project().clone();
+    expected.diagrams.remove(&f.spare_view).unwrap();
+    adopt_from_source(&mut f.app, &expected);
+    let _ = f.app.update(Message::Select(f.owner));
+    let _ = f.app.update(Message::Field(
+        "/name".into(),
+        "Pending valid owner rename".into(),
+    ));
+    assert!(f.app.draft_dirty());
+    let before = f.app.document.snapshot();
+    let revision = f.app.document.revision();
+    let selected = f.app.selected;
+    for invalid in [Id::nil(), f.spare_view] {
+        choose(&mut f.app, invalid);
+        assert_saved(&f.app, f.view, f.owner, Layer::Oa);
+        assert_eq!(f.app.selected, selected);
+        assert!(f.app.draft_dirty());
+        assert_eq!(f.app.project(), &before.decoded.project);
+        assert_eq!(f.app.document.bundle(), &before.bundle);
+        assert_eq!(f.app.document.revision(), revision);
+    }
+    // Establish that the retained draft really was valid, not merely refused by
+    // the property validator: explicit Apply commits it in exactly one step.
+    assert!(f.app.apply(), "{}", f.app.status);
+    assert_eq!(
+        f.app.project().elements[&f.owner].name,
+        "Pending valid owner rename"
+    );
+    assert_eq!(f.app.document.revision(), revision + 1);
+    let _ = f.app.update(Message::Undo);
+    assert_eq!(f.app.project(), &before.decoded.project);
+    assert_eq!(f.app.document.bundle(), &before.bundle);
+}

crates/oa-desktop/src/app/scenario_diagram/owner_navigation_tests.rs

@@ -0,0 +1,113 @@
+//! Explicit owner navigation must retire a retained Saved Scenario, including
+//! when selection was made on a different page. These are real App events.
+use super::*;
+use crate::behavior::scenario::CanvasEvent;
+
+fn setup(kind: Kind) -> (App, Id, Id) {
+    let mut project = Project::empty();
+    let scenario = project
+        .add_element(Kind::Scenario, Layer::Oa, "Incident review", None)
+        .unwrap();
+    let target = project
+        .add_element(kind, Layer::Oa, "Explicit destination", None)
+        .unwrap();
+    let view = Id::new_v4();
+    project.diagrams.insert(
+        view,
+        Diagram {
+            id: view,
+            alias: "incident_saved".into(),
+            name: "Incident saved arrangement".into(),
+            description: String::new(),
+            layer: Layer::Oa,
+            projection: ProjectionKind::Scenario { scenario },
+            layout: None,
+            nodes: Default::default(),
+            routes: vec![],
+            view_options: Default::default(),
+        },
+    );
+    let errors: Vec<_> = oa_core::validation::validate(&project)
+        .into_iter()
+        .filter(|issue| issue.severity == oa_core::validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+    let mut app = App::with_project(project);
+    let _ = app.update(Message::Select(scenario));
+    let _ = app.update(Message::Diagram(Choice {
+        id: view,
+        label: "Incident saved arrangement".into(),
+    }));
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved { diagram: view }
+    );
+    assert_eq!(app.selected, scenario);
+    (app, scenario, target)
+}
+
+fn assert_destination(app: &App, target: Id) {
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.selected, target);
+    assert_eq!(app.behavior.active_owner, Some(target));
+    assert_eq!(behavior::selected_owner(app), Some(target));
+    assert_eq!(
+        app.behavior.scenario.representation(),
+        None,
+        "explicit non-Scenario destination must not retain an overriding Saved request"
+    );
+    assert!(app.scenario_context().is_none());
+}
+
+fn exercise(via_guide: bool) {
+    for kind in [Kind::Process, Kind::StateMachine] {
+        let (mut app, scenario, target) = setup(kind);
+        assert_ne!(scenario, target);
+        let held = app.scenario_context().unwrap();
+        let accepted = app.document.snapshot();
+        let drafts = app.source_workspace.bundle();
+        let revision = app.document.revision();
+        let dirty = (app.document.dirty(), app.dirty(), app.source_dirty());
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+        if via_guide {
+            let _ = app.update(Message::Page(Page::Guide));
+            assert_eq!(app.page, Page::Guide);
+            assert!(app.scenario_context().is_none());
+        }
+        let _ = app.update(Message::Select(target));
+        if via_guide {
+            assert_eq!(
+                app.page,
+                Page::Guide,
+                "explorer selection must not itself switch the page"
+            );
+            let _ = app.update(Message::Page(Page::Behavior));
+        }
+        assert_destination(&app, target);
+        let camera = app.camera_boundary();
+        // The prior saved canvas cannot regain focus after either owner route.
+        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Focus(held)));
+        assert_destination(&app, target);
+        assert!(app.camera_boundary() == camera);
+        assert_eq!(app.project(), &accepted.decoded.project);
+        assert_eq!(app.document.bundle(), &accepted.bundle);
+        assert_eq!(app.source_workspace.bundle(), drafts);
+        assert_eq!(app.document.revision(), revision);
+        assert_eq!(
+            (app.document.dirty(), app.dirty(), app.source_dirty()),
+            dirty
+        );
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}
+
+#[test]
+fn saved_scenario_guide_selection_returns_to_explicit_process_or_state_owner() {
+    exercise(true);
+}
+
+#[test]
+fn saved_scenario_direct_behavior_selection_enters_explicit_process_or_state_owner() {
+    exercise(false);
+}

crates/oa-desktop/src/app/scenario_diagram/tests.rs

@@ -0,0 +1,205 @@
+use super::*;
+use crate::behavior::scenario::{CanvasEvent, ScrollArea};
+
+fn saved(p: &mut Project, owner: Id, name: &str) -> Id {
+    let id = Id::new_v4();
+    p.diagrams.insert(
+        id,
+        Diagram {
+            id,
+            alias: format!("view_{}", p.diagrams.len()),
+            name: name.into(),
+            description: String::new(),
+            layer: Layer::Oa,
+            projection: ProjectionKind::Scenario { scenario: owner },
+            layout: None,
+            routes: vec![],
+            nodes: Default::default(),
+            view_options: Default::default(),
+        },
+    );
+    id
+}
+fn setup() -> (App, Id, Id, Id, Id) {
+    let (mut p, [owner, callee, _], [reference, _, _]) =
+        behavior::scenario::direct_tests::navigation_fixture();
+    let a = saved(&mut p, owner, "Review A");
+    let b = saved(&mut p, owner, "Review B");
+    let mut app = App::with_project(p);
+    app.select(owner);
+    (app, a, b, reference, callee)
+}
+fn choose(app: &mut App, diagram: Id) {
+    let _ = app.update(Message::Diagram(Choice {
+        id: diagram,
+        label: "Captured view".into(),
+    }));
+}
+fn event(app: &mut App, f: impl FnOnce(behavior::scenario::Context) -> CanvasEvent) {
+    let context = app.scenario_context().unwrap();
+    let _ = app.update(Message::ScenarioCanvas(f(context)));
+}
+#[test]
+fn saved_view_switches_are_distinct_passive_visits_and_preserve_actual_history() {
+    let (mut app, a, b, _, _) = setup();
+    let original = app.document.snapshot();
+    let owner = app.selected;
+    assert!(app.execute(Command::Rename(owner, "Previously edited caller".into())));
+    let edited = app.document.snapshot();
+    let edited_revision = app.document.revision();
+    choose(&mut app, a);
+    let first = app.scenario_context().unwrap();
+    choose(&mut app, b);
+    let second = app.scenario_context().unwrap();
+    choose(&mut app, a);
+    let third = app.scenario_context().unwrap();
+    assert_eq!(first.scenario, owner);
+    assert_eq!(first.representation, Representation::Saved { diagram: a });
+    assert_eq!(second.representation, Representation::Saved { diagram: b });
+    assert_ne!(first.visit, second.visit);
+    assert_ne!(first.visit, third.visit);
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.selected, owner);
+    assert_eq!(app.document.bundle(), &edited.bundle);
+    assert_eq!(app.project(), &edited.decoded.project);
+    assert_eq!(app.document.revision(), edited_revision);
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert_eq!(app.project(), &original.decoded.project);
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.document.bundle(), &edited.bundle);
+    assert_eq!(app.project(), &edited.decoded.project);
+}
+#[test]
+fn saved_view_return_rejects_old_passive_events_without_an_intermediate_frame() {
+    let (mut app, a, b, _, _) = setup();
+    choose(&mut app, a);
+    let old = app.scenario_context().unwrap();
+    choose(&mut app, b);
+    choose(&mut app, a);
+    let current = app.scenario_context().unwrap();
+    let camera = app.behavior.scenario.camera_boundary();
+    let before = app.document.snapshot();
+    for stale in [
+        CanvasEvent::Viewport(old, iced::Size::new(432., 321.)),
+        CanvasEvent::Scrolled(old, ScrollArea::Page, iced::Vector::new(0., 800.)),
+        CanvasEvent::FormShown(old, Id::new_v4()),
+        CanvasEvent::Restored(
+            old,
+            Id::new_v4(),
+            ScrollArea::Page,
+            iced::Vector::new(0., 800.),
+        ),
+        CanvasEvent::Camera(
+            old,
+            app.camera_epoch,
+            behavior::canvas_workspace::Event::Pan(iced::Vector::new(90., 80.)),
+        ),
+    ] {
+        let _ = app.update(Message::ScenarioCanvas(stale));
+        assert_eq!(app.scenario_context(), Some(current));
+        assert!(app.behavior.scenario.camera_boundary() == camera);
+        assert_eq!(app.document.bundle(), &before.bundle);
+    }
+}
+#[test]
+fn saved_reference_back_restores_exact_view_with_a_fresh_visit() {
+    let (mut app, a, _, reference, callee) = setup();
+    choose(&mut app, a);
+    let caller = app.scenario_context().unwrap();
+    let before = app.document.snapshot();
+    event(&mut app, |ctx| CanvasEvent::OpenUse(ctx, reference));
+    let target = app.scenario_context().unwrap();
+    assert_eq!(target.scenario, callee);
+    assert_eq!(
+        target.representation,
+        Representation::Derived { owner: callee }
+    );
+    assert_eq!(app.active_diagram, None);
+    event(&mut app, CanvasEvent::Back);
+    let returned = app.scenario_context().unwrap();
+    assert_eq!(returned.representation, caller.representation);
+    assert_eq!(app.active_diagram, Some(a));
+    assert_eq!(app.selected, reference);
+    assert_ne!(returned.visit, caller.visit);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert_eq!(app.project(), &before.decoded.project);
+    assert!(!app.document.can_undo());
+}
+#[test]
+fn saved_picker_applies_valid_old_draft_and_uuid_edit_follows_that_same_view() {
+    let (mut app, a, b, _, _) = setup();
+    choose(&mut app, a);
+    let _ = app.update(Message::Select(a));
+    let before = app.document.snapshot();
+    let _ = app.update(Message::Field("/name".into(), "Renamed A".into()));
+    choose(&mut app, b);
+    assert_eq!(app.project().diagrams[&a].name, "Renamed A");
+    assert_eq!(app.selected, b);
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved { diagram: b }
+    );
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    choose(&mut app, a);
+    let replacement = Id::new_v4();
+    let _ = app.update(Message::Field("/id".into(), replacement.to_string()));
+    choose(&mut app, a);
+    assert!(!app.project().diagrams.contains_key(&a));
+    assert_eq!(app.active_diagram, Some(replacement));
+    assert_eq!(app.selected, replacement);
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved {
+            diagram: replacement
+        }
+    );
+}
+#[test]
+fn leaving_and_reentering_saved_view_preserves_source_and_retires_passive_visit() {
+    let (mut app, a, _, _, _) = setup();
+    choose(&mut app, a);
+    let old = app.scenario_context().unwrap();
+    let before = app.document.snapshot();
+    let _ = app.update(Message::Page(Page::Guide));
+    assert!(app.scenario_context().is_none());
+    let _ = app.update(Message::Page(Page::Behavior));
+    let fresh = app.scenario_context().unwrap();
+    assert_eq!(fresh.representation, old.representation);
+    assert_ne!(fresh.visit, old.visit);
+    assert_eq!(app.document.bundle(), &before.bundle);
+}
+
+#[test]
+fn arrangement_picker_rejects_previous_visit_and_switches_automatic_without_model_changes() {
+    let (mut app, a, b, _, _) = setup();
+    choose(&mut app, a);
+    let stale = app.scenario_context().unwrap();
+    choose(&mut app, b);
+    let current = app.scenario_context().unwrap();
+    let before = app.document.snapshot();
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Representation(
+        stale,
+        Representation::Saved { diagram: a },
+    )));
+    assert_eq!(app.scenario_context(), Some(current));
+    event(&mut app, |context| {
+        CanvasEvent::Representation(
+            context,
+            Representation::Derived {
+                owner: context.scenario,
+            },
+        )
+    });
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Derived {
+            owner: current.scenario
+        }
+    );
+    assert_eq!(app.active_diagram, None);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert_eq!(app.project(), &before.decoded.project);
+    assert!(!app.document.can_undo());
+}

crates/oa-desktop/src/app/scenario_spacing.rs

@@ -0,0 +1,88 @@
+//! Admit spacing packets before ordinary navigation can retire a newer reveal.
+use super::*;
+use behavior::scenario::spacing::{Event, controller::Finish};
+
+#[cfg(test)]
+mod tests;
+
+impl App {
+    pub(super) fn spacing_enabled(&self) -> bool {
+        self.pending_diagram_reveal.is_none()
+            && !self.behavior.has_pending()
+            && !self.draft_dirty()
+            && !self.source_dirty()
+            && !self.source_rename.open()
+            && behavior::canvas_workspace::keyboard_enabled(self)
+    }
+
+    pub(super) fn scenario_spacing(&mut self, event: Event) -> Task<Message> {
+        let stamp = event.stamp();
+        if self.scenario_context() != Some(stamp.context) || self.camera_epoch != stamp.camera_epoch
+        {
+            return Task::none();
+        }
+        let state = &self.behavior.scenario;
+        let matches =
+            state.spacing_token() == Some(event.token()) && state.spacing_stamp() == Some(stamp);
+        if match event {
+            Event::Begin { token, .. } => token.is_nil() || state.spacing_token().is_some(),
+            _ => !matches,
+        } {
+            return Task::none();
+        }
+        if matches!(event, Event::Cancel { .. }) || !self.spacing_enabled() {
+            if self.behavior.scenario.cancel_spacing() {
+                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+            }
+            return Task::none();
+        }
+        match event {
+            Event::Begin { .. } => {
+                let mut state = std::mem::take(&mut self.behavior.scenario);
+                let result = state.begin_spacing(self.project(), event);
+                self.behavior.scenario = state;
+                if result.is_err() {
+                    self.status = "The drag could not start in this view. Try again.".into();
+                }
+            }
+            Event::Move { screen, .. } => self.behavior.scenario.move_spacing(screen),
+            Event::Finish { screen, .. } => {
+                let finished = self.behavior.scenario.finish_spacing(screen);
+                // Retire queued packets even for zero motion or a refused finish.
+                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                match finished {
+                    Ok(Finish::Click(target)) => self.select(target),
+                    Ok(Finish::Noop) => {}
+                    Ok(Finish::Commit {
+                        command,
+                        selected,
+                        scale,
+                        pan,
+                    }) => {
+                        // Document prepares and writes the source candidate before
+                        // committing its snapshot. Failure leaves camera/selection
+                        // and source/history at their accepted values.
+                        match self.document.execute(command) {
+                            Ok(_) => {
+                                self.selected = selected;
+                                self.selected_node = None;
+                                self.diagram_navigation_focus = None;
+                                self.behavior.scenario.accept_spacing_camera(scale, pan);
+                                self.sync();
+                                self.status = "Scenario spacing updated.".into();
+                            }
+                            Err(error) => self.status = format!("Spacing was not applied: {error}"),
+                        }
+                    }
+                    Err(_) => {
+                        self.status =
+                            "That position cannot be applied. The saved arrangement is unchanged."
+                                .into()
+                    }
+                }
+            }
+            Event::Cancel { .. } => unreachable!(),
+        }
+        Task::none()
+    }
+}

crates/oa-desktop/src/app/scenario_spacing/tests.rs

@@ -0,0 +1,272 @@
+use super::*;
+use behavior::scenario::{
+    CanvasEvent,
+    spacing::{
+        Target,
+        controller::tests::{fixture, packet},
+    },
+};
+use iced::{Point, Size, Vector};
+
+fn setup() -> (App, Id, Id) {
+    let (document, owner, diagram, lane, message) = fixture();
+    let mut app = App::with_project(document.project().clone());
+    let _ = app.update(Message::Select(owner));
+    let _ = app.update(Message::Diagram(Choice {
+        id: diagram,
+        label: "Saved".into(),
+    }));
+    let c = app.scenario_context().unwrap();
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Viewport(
+        c,
+        Size::new(900., 600.),
+    )));
+    assert!(app.spacing_enabled());
+    (app, lane, message)
+}
+fn begin(app: &mut App, target: Target) -> (Event, Point, f32) {
+    let event = packet(
+        app.project(),
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        app.camera_epoch,
+        target,
+    );
+    let Event::Begin {
+        press_screen,
+        scale,
+        ..
+    } = event
+    else {
+        unreachable!()
+    };
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Spacing(event)));
+    assert_eq!(app.behavior.scenario.spacing_token(), Some(event.token()));
+    (event, press_screen, scale)
+}
+fn send(app: &mut App, event: Event) {
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Spacing(event)));
+}
+fn move_to(app: &mut App, begin: Event, screen: Point) {
+    send(
+        app,
+        Event::Move {
+            stamp: begin.stamp(),
+            token: begin.token(),
+            screen,
+        },
+    );
+}
+fn finish(app: &mut App, begin: Event, screen: Point) {
+    send(
+        app,
+        Event::Finish {
+            stamp: begin.stamp(),
+            token: begin.token(),
+            screen,
+        },
+    );
+}
+
+#[test]
+fn same_batch_preview_is_immutable_and_one_commit_undo_redo_has_exact_source_parity() {
+    let (mut app, lane, _) = setup();
+    let original = app.document.snapshot();
+    let source = app.source_workspace.bundle();
+    let selected = app.selected;
+    let epoch = app.canvas_epoch;
+    let (event, start, scale) = begin(&mut app, Target::Lane(lane));
+    move_to(&mut app, event, start + Vector::new(40., 300.));
+    assert_eq!(app.selected, selected);
+    assert_eq!(app.canvas_epoch, epoch);
+    assert_eq!(app.project(), &original.decoded.project);
+    assert_eq!(app.source_workspace.bundle(), source);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+    finish(&mut app, event, start + Vector::new(40., 300.));
+    assert_eq!(app.selected, lane);
+    assert!(app.document.can_undo() && !app.document.can_redo());
+    let accepted = app.document.snapshot();
+    assert_ne!(accepted.bundle, original.bundle);
+    let expected = behavior::scenario::spacing::controller::tests::expected(
+        &original.decoded.project,
+        match event.stamp().context.representation {
+            behavior::scenario_layout::Representation::Saved { diagram } => diagram,
+            _ => unreachable!(),
+        },
+        Target::Lane(lane),
+        40. / scale,
+    );
+    assert_eq!(app.project(), &expected);
+    let _ = app.update(Message::ShortcutUndo(false));
+    assert_eq!(app.project(), &original.decoded.project);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert!(!app.document.can_undo() && app.document.can_redo());
+    let _ = app.update(Message::ShortcutUndo(true));
+    assert_eq!(app.project(), &accepted.decoded.project);
+    assert_eq!(app.document.bundle(), &accepted.bundle);
+}
+
+#[test]
+fn click_selects_but_crossed_return_and_cancel_preserve_selection_camera_and_history() {
+    let (mut app, lane, message) = setup();
+    let original = app.document.snapshot();
+    let camera = app.behavior.scenario.camera_boundary();
+    let (event, start, _) = begin(&mut app, Target::Message(message));
+    finish(&mut app, event, start + Vector::new(30., 2.));
+    assert_eq!(app.selected, message);
+    assert!(camera == app.behavior.scenario.camera_boundary());
+    for cancel in [false, true] {
+        let (event, start, _) = begin(&mut app, Target::Lane(lane));
+        move_to(&mut app, event, start + Vector::new(30., 0.));
+        if cancel {
+            send(
+                &mut app,
+                Event::Cancel {
+                    stamp: event.stamp(),
+                    token: event.token(),
+                },
+            );
+        } else {
+            finish(&mut app, event, start);
+        }
+        assert_eq!(app.selected, message);
+        assert!(camera == app.behavior.scenario.camera_boundary());
+        assert_eq!(app.document.bundle(), &original.bundle);
+        assert_eq!(app.project(), &original.decoded.project);
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}
+
+#[test]
+fn stale_finish_after_new_view_and_forged_token_are_inert_before_reveal_reconciliation() {
+    let (mut app, lane, _) = setup();
+    let (event, start, _) = begin(&mut app, Target::Lane(lane));
+    let held_epoch = app.canvas_epoch;
+    send(
+        &mut app,
+        Event::Finish {
+            stamp: event.stamp(),
+            token: Id::new_v4(),
+            screen: start + Vector::new(30., 0.),
+        },
+    );
+    assert_eq!(app.canvas_epoch, held_epoch);
+    assert_eq!(app.behavior.scenario.spacing_token(), Some(event.token()));
+    let owner = event.stamp().context.scenario;
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Representation(
+        event.stamp().context,
+        behavior::scenario_layout::Representation::Derived { owner },
+    )));
+    let current = app.scenario_context();
+    let epoch = app.canvas_epoch;
+    let original = app.document.snapshot();
+    finish(&mut app, event, start + Vector::new(50., 0.));
+    assert_eq!(app.scenario_context(), current);
+    assert_eq!(app.canvas_epoch, epoch);
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert_eq!(app.document.bundle(), &original.bundle);
+}
+
+#[test]
+fn source_write_failure_cannot_commit_candidate_or_materialize_camera() {
+    let (mut app, lane, _) = setup();
+    let bundle = app.document.bundle().clone();
+    let mut limits = oa_core::source_project::ProjectLimits::default();
+    limits.model.max_source_bytes = bundle.files.values().map(String::len).sum();
+    app.document = Document::from_bundle(bundle, limits).unwrap();
+    app.sync();
+    let original = app.document.snapshot();
+    let selected = app.selected;
+    let camera = app.behavior.scenario.camera_boundary();
+    let (event, start, _) = begin(&mut app, Target::Lane(lane));
+    move_to(&mut app, event, start + Vector::new(40., 0.));
+    finish(&mut app, event, start + Vector::new(40., 0.));
+    assert!(
+        app.status.starts_with("Spacing was not applied:"),
+        "{}",
+        app.status
+    );
+    assert_eq!(app.selected, selected);
+    assert!(camera == app.behavior.scenario.camera_boundary());
+    assert_eq!(app.project(), &original.decoded.project);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+    assert!(app.behavior.scenario.spacing_token().is_none());
+}
+
+#[test]
+fn pending_semantic_draft_and_source_edit_cancel_and_reject_held_finish() {
+    for source in [false, true] {
+        let (mut app, lane, _) = setup();
+        let original = app.document.snapshot();
+        let selected = app.selected;
+        let (event, start, _) = begin(&mut app, Target::Lane(lane));
+        move_to(&mut app, event, start + Vector::new(30., 0.));
+        if source {
+            let _ = app.update(Message::SourceEdit(text_editor::Action::Edit(
+                text_editor::Edit::Insert(' '),
+            )));
+            assert!(app.source_dirty());
+        } else {
+            let _ = app.update(Message::Behavior(behavior::Event::Scenario(
+                behavior::scenario::Event::Start(
+                    event.stamp().context.scenario,
+                    behavior::scenario::Tool::Lifeline,
+                ),
+            )));
+            assert!(app.behavior.has_pending());
+        }
+        let draft = app.source_workspace.bundle();
+        assert!(app.behavior.scenario.spacing_token().is_none());
+        finish(&mut app, event, start + Vector::new(30., 0.));
+        assert_eq!(app.project(), &original.decoded.project);
+        assert_eq!(app.document.bundle(), &original.bundle);
+        assert_eq!(app.source_workspace.bundle(), draft);
+        assert_eq!(app.selected, selected);
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn stale_finish_cannot_remove_new_same_view_deferred_reveal() {
+    let (mut app, lane, message) = setup();
+    let (event, start, _) = begin(&mut app, Target::Lane(lane));
+    let behavior::scenario_layout::Representation::Saved { diagram } =
+        event.stamp().context.representation
+    else {
+        unreachable!()
+    };
+    let _ = app.update(Message::RevealInDiagram(diagram, message));
+    assert!(app.pending_diagram_reveal.is_some());
+    let epoch = app.canvas_epoch;
+    let selected = app.selected;
+    let visit = app.pending_scenario_reveal_visit;
+    let original = app.document.snapshot();
+    finish(&mut app, event, start + Vector::new(50., 0.));
+    assert_eq!(app.canvas_epoch, epoch);
+    assert_eq!(app.pending_scenario_reveal_visit, visit);
+    assert!(app.pending_diagram_reveal.is_some());
+    assert_eq!(app.selected, selected);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn modal_open_cancels_preview_and_captured_begin_stays_retired_after_close() {
+    let (mut app, lane, _) = setup();
+    let original = app.document.snapshot();
+    let camera = app.behavior.scenario.camera_boundary();
+    let (event, start, _) = begin(&mut app, Target::Lane(lane));
+    move_to(&mut app, event, start + Vector::new(30., 0.));
+    let _ = app.update(Message::Delete);
+    assert!(app.delete_pending);
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    finish(&mut app, event, start + Vector::new(30., 0.));
+    let _ = app.update(Message::CancelDelete);
+    send(&mut app, event);
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert_eq!(app.project(), &original.decoded.project);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert!(camera == app.behavior.scenario.camera_boundary());
+    assert!(!app.document.can_undo());
+}

crates/oa-desktop/src/app/source_rename/navigation_union_tests.rs

@@ -440,7 +440,7 @@ fn rename_then_exact_caret_diagram_navigation_preserves_complete_model_undo_redo
             Arc::ptr_eq(&expected, &app.document.snapshot()),
             "exact history entry restored"
         );
-        assert_eq!(app.project(), &expected.project);
+        assert_eq!(app.project(), &expected.decoded.project);
         assert_eq!(app.document.bundle(), &expected.bundle);
         assert_eq!(app.source_workspace.bundle(), expected.bundle);
         assert!(!app.source_dirty());

crates/oa-desktop/src/app/state_diagram.rs

@@ -24,6 +24,7 @@ impl App {
         if self.behavior.has_pending() {
             return;
         }
+        self.behavior.scenario.forget_view();
         self.layer = layer;
         self.page = Page::Behavior;
         self.behavior.active_owner = Some(machine);

crates/oa-desktop/src/app/transition_context_tests.rs

@@ -49,11 +49,28 @@ fn fixture(layer: Layer, kind: Kind) -> (App, Id, Id, Id) {
     p.diagrams.get_mut(&view).unwrap().name = "Unrelated architecture".into();
     p.place(view, reused, Position { x: 873., y: 421. });
     let mut app = App::with_project(p);
-    app.layer = layer;
-    app.page = Page::Behavior;
-    app.selected = root;
-    app.behavior.active_owner = Some(root);
-    app.refresh_draft();
+    let accepted = app.document.snapshot();
+    // Enter through the actual navigation path: assigning Page/owner alone does
+    // not create the representation and live visit required by canvas events.
+    send(&mut app, Message::Select(root));
+    send(&mut app, Message::Page(Page::Behavior));
+    assert_eq!(app.layer, layer);
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.selected, root);
+    assert_eq!(app.behavior.active_owner, Some(root));
+    if kind == Kind::Scenario {
+        let context = app.scenario_context().unwrap();
+        assert_eq!(context.document, app.canvas_document);
+        assert_eq!(context.scenario, root);
+        assert_eq!(
+            context.representation,
+            crate::behavior::scenario_layout::Representation::Derived { owner: root }
+        );
+        assert!(!context.visit.is_nil());
+    }
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    assert_eq!(app.source_workspace.bundle(), accepted.bundle);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
     (app, root, work, reused)
 }
 

crates/oa-desktop/src/behavior/canvas_workspace.rs

@@ -50,7 +50,7 @@ pub fn controls<'a>(
             tooltip::Position::Bottom),
         control("Fit", "Fit", Some(zoom(None))),
         control("ZoomOut", "−", Some(zoom(Some(scale / 1.25)))),
-        text(format!("{:.0}%", scale * 100.)).size(12),
+        text(zoom_label(scale)).size(12),
         control("ZoomIn", "+", Some(zoom(Some(scale * 1.25)))),
         control("ActualSize", "100%", Some(zoom(Some(1.)))),
     ].spacing(4).align_y(iced::Center).into()
@@ -58,6 +58,7 @@ pub fn controls<'a>(
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct Scope {
+    pub(crate) scenario_view: Option<(super::scenario_layout::Representation, Id)>,
     pub document: Id,
     pub owner: Id,
     pub revision: u64,
@@ -69,6 +70,7 @@ impl Scope {
             Some(Self {
                 document: context.document,
                 owner: context.scenario,
+                scenario_view: Some((context.representation, context.visit)),
                 revision: context.revision,
                 epoch: app.camera_epoch,
             })
@@ -77,6 +79,7 @@ impl Scope {
             Some(Self {
                 document: context.document,
                 owner: context.owner,
+                scenario_view: None,
                 revision: context.revision,
                 epoch: app.camera_epoch,
             })
@@ -96,8 +99,8 @@ impl Scope {
 
     pub fn control_id(self, name: &str) -> iced::advanced::widget::Id {
         iced::advanced::widget::Id::from(format!(
-            "behavior-control:{}:{}:{}:{name}",
-            self.document, self.owner, self.revision
+            "behavior-control:{}:{}:{}:{:?}:{name}",
+            self.document, self.owner, self.revision, self.scenario_view
         ))
     }
 }
@@ -131,6 +134,20 @@ pub enum Event {
 pub use focus::{focus_task, root as focus_root};
 /// Fold relative input in event order. The base scale is used only on leaving Fit.
 pub fn change(pan: &mut Vector, zoom: &mut Option<f32>, fit: &mut bool, event: Event) -> bool {
+    change_with_minimum(pan, zoom, fit, event, 0.05)
+}
+
+/// Scenario extents can require scales below the topology canvas's 5% floor.
+pub(super) fn change_with_minimum(
+    pan: &mut Vector,
+    zoom: &mut Option<f32>,
+    fit: &mut bool,
+    event: Event,
+    minimum: f32,
+) -> bool {
+    if !minimum.is_finite() || minimum <= 0. || minimum > 3. {
+        return false;
+    }
     match event {
         Event::Pan(delta) if delta.x.is_finite() && delta.y.is_finite() => {
             let next = *pan + delta;
@@ -150,7 +167,10 @@ pub fn change(pan: &mut Vector, zoom: &mut Option<f32>, fit: &mut bool, event: E
                 && at.y.is_finite() =>
         {
             let old = if *fit { base } else { zoom.unwrap_or(base) };
-            let next = (old * factor).clamp(0.05, 3.);
+            if !old.is_finite() || old <= 0. {
+                return false;
+            }
+            let next = (old * factor).clamp(minimum, 3.);
             if old == next {
                 return false;
             }
@@ -168,6 +188,51 @@ pub fn change(pan: &mut Vector, zoom: &mut Option<f32>, fit: &mut bool, event: E
     }
 }
 
+fn zoom_label(scale: f32) -> String {
+    let percent = f64::from(scale) * 100.;
+    if !percent.is_finite() || percent <= 0. {
+        return "—".into();
+    }
+    if percent >= 1. {
+        format!("{percent:.0}%")
+    } else if percent >= 0.01 {
+        format!("{percent:.3}%")
+    } else {
+        format!("{percent:.2e}%")
+    }
+}
+
+#[cfg(test)]
+mod camera_policy_tests {
+    use super::*;
+
+    #[test]
+    fn topology_retains_five_percent_floor() {
+        let (mut pan, mut zoom, mut fit) = (Vector::ZERO, Some(0.06), false);
+        assert!(change(
+            &mut pan,
+            &mut zoom,
+            &mut fit,
+            Event::Zoom {
+                factor: 0.1,
+                at: Point::ORIGIN,
+                base: 0.06,
+            }
+        ));
+        assert_eq!(zoom, Some(0.05));
+    }
+
+    #[test]
+    fn tiny_zoom_label_is_nonzero_and_changes_with_zoom() {
+        assert_eq!(zoom_label(1.), "100%");
+        assert_eq!(zoom_label(0.05), "5%");
+        assert_eq!(zoom_label(0.00034193), "0.034%");
+        assert_eq!(zoom_label(0.00034193 * 1.25), "0.043%");
+        assert_eq!(zoom_label(1e-7), "1.00e-5%");
+        assert_ne!(zoom_label(f32::from_bits(1)), "0%");
+    }
+}
+
 /// Constant-width labelled palette. Arming a tool never reallocates the canvas.
 pub fn palette<'a>(
     scope: Scope,

crates/oa-desktop/src/behavior/canvas_workspace/tests.rs

@@ -368,6 +368,7 @@ fn relative_camera_zoom_keeps_the_cursor_world_point_and_rejects_nonfinite_input
 fn viewport_ordered_batch_uses_each_event_position_and_cancels_before_camera_motion() {
     use iced::widget::Space;
     let scope = Scope {
+        scenario_view: None,
         document: Id::new_v4(),
         owner: Id::new_v4(),
         revision: 2,
@@ -427,6 +428,7 @@ pub(crate) fn scope(app: &App) -> Scope {
         Scope {
             document: context.document,
             owner: context.scenario,
+            scenario_view: Some((context.representation, context.visit)),
             revision: context.revision,
             epoch: app.camera_epoch,
         }
@@ -435,6 +437,7 @@ pub(crate) fn scope(app: &App) -> Scope {
         Scope {
             document: context.document,
             owner: context.owner,
+            scenario_view: None,
             revision: context.revision,
             epoch: app.camera_epoch,
         }

crates/oa-desktop/src/behavior/contextual_source_tests.rs

@@ -893,11 +893,14 @@ fn contextual_source_empty_palette_lifeline_cannot_open_a_previous_owner_or_laye
         .add_element(Kind::Scenario, Layer::Oa, "Second scenario", None)
         .unwrap();
     let mut app = App::with_project(p.clone());
-    app.page = Page::Behavior;
-    app.layer = Layer::Oa;
-    app.behavior.active_owner = Some(a);
-    app.selected = a;
+    // Capture the context created by actual navigation, including its visit.
+    // Merely assigning active_owner/selected does not mount a Scenario anymore.
+    let _ = app.update(Message::Select(a));
+    let _ = app.update(Message::Page(Page::Behavior));
     let context = app.scenario_context().unwrap();
+    assert_eq!(context.scenario, a);
+    assert!(!context.visit.is_nil());
+    let snapshot = app.document.snapshot();
     let source = app.document.bundle().clone();
     let begin = |context| scenario::CanvasEvent::BeginOccurrence {
         context,
@@ -908,23 +911,40 @@ fn contextual_source_empty_palette_lifeline_cannot_open_a_previous_owner_or_laye
         },
         lifeline: None,
     };
-    app.behavior.active_owner = Some(b);
-    app.selected = b;
+    let _ = app.update(Message::Select(b));
+    let second = app.scenario_context().unwrap();
+    assert_eq!(second.scenario, b);
+    assert_ne!(second.visit, context.visit);
     let _ = app.update(Message::ScenarioCanvas(begin(context)));
     assert!(!app.behavior.has_pending());
     assert_eq!(app.project(), &p);
-    app.behavior.active_owner = Some(a);
-    app.selected = a;
-    app.layer = Layer::Sa;
-    let _ = app.update(Message::ScenarioCanvas(begin(context)));
+
+    let _ = app.update(Message::Select(a));
+    let before_layer_change = app.scenario_context().unwrap();
+    assert_eq!(before_layer_change.scenario, a);
+    assert_ne!(before_layer_change.visit, context.visit);
+    let _ = app.update(Message::Layer(Layer::Sa));
+    assert_eq!(app.layer, Layer::Sa);
+    assert!(app.scenario_context().is_none());
+    let _ = app.update(Message::ScenarioCanvas(begin(before_layer_change)));
     assert!(!app.behavior.has_pending());
-    app.layer = Layer::Oa;
+
+    let _ = app.update(Message::Layer(Layer::Oa));
+    let _ = app.update(Message::Select(a));
     let current = app.scenario_context().unwrap();
+    assert_eq!(current.scenario, a);
+    assert_ne!(current.visit, before_layer_change.visit);
+    // Returning to the same owner/layer must not revive either retired packet.
+    for retired in [context, before_layer_change] {
+        let _ = app.update(Message::ScenarioCanvas(begin(retired)));
+        assert!(!app.behavior.has_pending());
+    }
+    assert!(std::sync::Arc::ptr_eq(&snapshot, &app.document.snapshot()));
     let _ = app.update(Message::ScenarioCanvas(begin(current)));
     assert_eq!(app.behavior.pending_owner(), Some(a));
     assert_eq!(app.project(), &p);
     assert_eq!(app.document.bundle(), &source);
-    assert!(!app.document.can_undo());
+    assert!(!app.document.can_undo() && !app.document.can_redo());
 }
 
 #[test]

crates/oa-desktop/src/behavior/scenario.rs

@@ -4,7 +4,15 @@ use super::topology::{occurrence, unique_batch};
 use super::*;
 use iced::widget::{Column, column, text_input};
 use std::{cell::RefCell, collections::BTreeSet};
+mod camera;
 pub(crate) mod focus;
+pub(crate) mod spacing;
+use super::scenario_layout::{
+    Representation,
+    presentation::{self, ScenarioPresentation},
+};
+#[cfg(test)]
+mod presentation_tests;
 mod usage;
 mod workspace;
 pub(crate) use workspace::NAME_INPUT;
@@ -71,6 +79,8 @@ impl std::fmt::Display for MessageStyle {
 pub struct Context {
     pub document: Id,
     pub scenario: Id,
+    pub representation: Representation,
+    pub visit: Id,
     pub revision: u64,
     pub epoch: u64,
 }
@@ -97,6 +107,7 @@ impl std::fmt::Display for CanvasTool {
 }
 #[derive(Debug, Clone)]
 pub enum CanvasEvent {
+    Spacing(spacing::Event),
     Scrolled(Context, ScrollArea, iced::Vector),
     Restored(Context, Id, ScrollArea, iced::Vector),
     Viewport(Context, Size),
@@ -108,6 +119,7 @@ pub enum CanvasEvent {
     OpenUse(Context, Id),
     Back(Context),
     Choose(Context, CanvasTool),
+    Representation(Context, Representation),
     Select(Context, Id),
     Begin {
         context: Context,
@@ -136,6 +148,7 @@ pub enum ScrollArea {
 impl CanvasEvent {
     pub fn context(&self) -> Context {
         match self {
+            Self::Spacing(event) => event.stamp().context,
             Self::Scrolled(context, _, _)
             | Self::Restored(context, ..)
             | Self::Viewport(context, _)
@@ -147,6 +160,7 @@ impl CanvasEvent {
             | Self::OpenUse(context, _)
             | Self::Back(context)
             | Self::Choose(context, _)
+            | Self::Representation(context, _)
             | Self::Select(context, _)
             | Self::Begin { context, .. }
             | Self::BeginOccurrence { context, .. }
@@ -203,6 +217,7 @@ pub enum ValueSection {
 const VALUE_PAGE_SIZE: usize = 24;
 #[derive(Default)]
 pub struct State {
+    spacing: Option<spacing::controller::Session>,
     draft: Option<Draft>,
     form_session: Id,
     form_mount: Id,
@@ -218,6 +233,7 @@ const CALLER_LIMIT: usize = 32;
 pub(crate) struct Caller {
     document: Id,
     pub owner: Id,
+    pub representation: Representation,
     pub occurrence: Id,
     target: Id,
     tool: CanvasTool,
@@ -227,6 +243,8 @@ pub(crate) struct Caller {
 struct DetailsRestore {
     document: Id,
     owner: Id,
+    representation: Representation,
+    visit: Id,
     token: Id,
     offset: iced::Vector,
 }
@@ -234,6 +252,8 @@ struct DetailsRestore {
 pub(super) struct ScrollRestore {
     pub document: Id,
     pub owner: Id,
+    pub representation: Representation,
+    pub visit: Id,
     pub token: Id,
     pub offset: iced::Vector,
 }
@@ -327,42 +347,149 @@ impl State {
     }
 
     pub(crate) fn enter(&mut self, document: Id, owner: Id) {
-        if self.presentation.identity != Some((document, owner)) {
+        self.enter_representation(document, owner, Representation::Derived { owner });
+    }
+    /// App validates requested identity with checked_owner before entering.
+    pub(crate) fn enter_representation(
+        &mut self,
+        document: Id,
+        owner: Id,
+        representation: Representation,
+    ) -> bool {
+        if matches!(representation, Representation::Derived { owner: requested } if requested != owner)
+        {
+            return false;
+        }
+        let changed = self.presentation.identity != Some((document, owner))
+            || self.presentation.representation != Some(representation);
+        if changed {
             self.presentation = workspace::Presentation {
                 identity: Some((document, owner)),
+                representation: Some(representation),
                 focused: self.presentation.focused,
+                fit: matches!(representation, Representation::Saved { .. }),
                 ..Default::default()
             };
             self.details_offset = iced::Vector::ZERO;
-            self.restore = None;
+            self.canvas_tool = Some((owner, CanvasTool::Select));
         }
+        if changed || self.presentation.visit.is_nil() {
+            self.spacing = None;
+            self.presentation.visit = Id::new_v4();
+            self.restore = None;
+            return true;
+        }
+        false
+    }
+    /// Suspend captured events while preserving this destination's camera state.
+    pub(crate) fn leave(&mut self) {
+        self.spacing = None;
+        self.presentation.visit = Id::nil();
+        self.restore = None;
+    }
+    pub(crate) fn forget_view(&mut self) {
+        self.spacing = None;
+        self.presentation.identity = None;
+        self.presentation.representation = None;
+        self.presentation.visit = Id::nil();
+        self.restore = None;
+    }
+    pub(crate) fn representation(&self) -> Option<Representation> {
+        self.presentation.representation
+    }
+    pub(crate) fn owner(&self) -> Option<Id> {
+        self.presentation.identity.map(|(_, owner)| owner)
+    }
+    pub(crate) fn context(
+        &self,
+        document: Id,
+        owner: Id,
+        revision: u64,
+        epoch: u64,
+    ) -> Option<Context> {
+        if self.presentation.identity != Some((document, owner)) || self.presentation.visit.is_nil()
+        {
+            return None;
+        }
+        Some(Context {
+            document,
+            scenario: owner,
+            representation: self.representation()?,
+            visit: self.presentation.visit,
+            revision,
+            epoch,
+        })
+    }
+    pub(crate) fn display(
+        &self,
+        p: &Project,
+        owner: Id,
+        selected: Id,
+    ) -> Option<ScenarioPresentation> {
+        let (_, current_owner) = self.presentation.identity?;
+        let representation = self.representation()?;
+        (current_owner == owner).then(|| presentation::present(p, representation, selected))
+    }
+    pub(crate) fn coordinate_input(&self, p: &Project, context: Context) -> bool {
+        self.context(
+            context.document,
+            context.scenario,
+            context.revision,
+            context.epoch,
+        ) == Some(context)
+            && self
+                .display(p, context.scenario, context.scenario)
+                .is_some_and(|shown| shown.capabilities().coordinate_input)
     }
     pub(crate) fn viewport(&mut self, size: Size) -> bool {
         self.presentation.viewport(size)
     }
-    pub(crate) fn camera(&mut self, event: super::canvas_workspace::Event) -> bool {
+    pub(crate) fn camera(
+        &mut self,
+        project: &Project,
+        owner: Id,
+        event: super::canvas_workspace::Event,
+    ) -> bool {
+        let Some(bounds) = self
+            .display(project, owner, owner)
+            .and_then(|shown| shown.bounds())
+        else {
+            return false;
+        };
         let p = &mut self.presentation;
-        super::canvas_workspace::change(&mut p.pan, &mut p.zoom, &mut p.fit, event)
+        camera::change(
+            &mut p.pan,
+            &mut p.zoom,
+            &mut p.fit,
+            p.viewport,
+            bounds,
+            event,
+        )
     }
     pub(crate) fn zoom(&mut self, scale: Option<f32>) -> bool {
         self.presentation.zoom(scale)
     }
     pub(crate) fn camera_zoom(&mut self, p: &Project, owner: Id, zoom: Option<f32>) -> bool {
-        let size = Scene::sequence(p, owner, owner).size;
-        let old = self.presentation.scale(size);
+        let Some(bounds) = self
+            .display(p, owner, owner)
+            .and_then(|shown| shown.bounds())
+        else {
+            return false;
+        };
         if let Some(next) = zoom {
+            let current = self.presentation.camera(bounds);
             let viewport = self.presentation.viewport.unwrap_or(Size::new(500., 300.));
-            self.camera(super::canvas_workspace::Event::Zoom {
-                factor: next / old,
-                at: Point::new(viewport.width / 2., viewport.height / 2.),
-                base: old,
-            })
+            self.camera(
+                p,
+                owner,
+                super::canvas_workspace::Event::Zoom {
+                    factor: next / current.scale,
+                    at: Point::new(viewport.width / 2., viewport.height / 2.),
+                    base: current.scale,
+                },
+            )
         } else {
-            self.zoom(None);
-            let fitted = self.presentation.scale(size);
-            self.zoom(Some(fitted));
-            self.presentation.pan = iced::Vector::ZERO;
-            true
+            self.zoom(None)
         }
     }
     pub(crate) fn focused(&self) -> bool {
@@ -390,6 +517,7 @@ impl State {
         self.return_to.push(Caller {
             document: context.document,
             owner: context.scenario,
+            representation: context.representation,
             occurrence,
             target,
             tool: self.canvas_tool(context.scenario),
@@ -404,6 +532,7 @@ impl State {
     fn valid_caller(p: &Project, context: Context, frame: &Caller) -> bool {
         frame.document == context.document
             && frame.target == context.scenario
+            && presentation::checked_owner(p, frame.representation) == Some(frame.owner)
             && referenced_scenario(p, frame.owner, frame.occurrence) == Some(frame.target)
     }
     pub(super) fn can_back(&self, p: &Project, context: Context) -> bool {
@@ -420,16 +549,23 @@ impl State {
         None
     }
     pub(crate) fn restore_caller(&mut self, context: Context, frame: Caller) {
-        if context.document != frame.document || context.scenario != frame.owner {
+        if context.document != frame.document
+            || context.scenario != frame.owner
+            || context.representation != frame.representation
+        {
             return;
         }
         self.canvas_tool = Some((frame.owner, frame.tool));
         self.details_offset = frame.details_offset;
         self.presentation = frame.presentation;
         self.presentation.identity = Some((context.document, context.scenario));
+        self.presentation.representation = Some(frame.representation);
+        self.presentation.visit = context.visit;
         self.restore = Some(DetailsRestore {
             document: context.document,
             owner: frame.owner,
+            representation: frame.representation,
+            visit: context.visit,
             token: Id::new_v4(),
             offset: frame.details_offset,
         });
@@ -439,13 +575,17 @@ impl State {
         context: Context,
         ScrollArea::Page: ScrollArea,
     ) -> Option<ScrollRestore> {
-        let restore = self
-            .restore
-            .as_ref()
-            .filter(|r| r.document == context.document && r.owner == context.scenario)?;
+        let restore = self.restore.as_ref().filter(|r| {
+            r.document == context.document
+                && r.owner == context.scenario
+                && r.representation == context.representation
+                && r.visit == context.visit
+        })?;
         Some(ScrollRestore {
             document: restore.document,
             owner: restore.owner,
+            representation: restore.representation,
+            visit: restore.visit,
             token: restore.token,
             offset: restore.offset,
         })
@@ -458,7 +598,11 @@ impl State {
         offset: iced::Vector,
     ) -> bool {
         if !self.restore.as_ref().is_some_and(|r| {
-            r.document == context.document && r.owner == context.scenario && r.token == token
+            r.document == context.document
+                && r.owner == context.scenario
+                && r.representation == context.representation
+                && r.visit == context.visit
+                && r.token == token
         }) {
             return false;
         }
@@ -1931,6 +2075,8 @@ pub(crate) mod direct_tests {
         Context {
             document: Id::new_v4(),
             scenario: owner,
+            representation: Representation::Derived { owner },
+            visit: Id::new_v4(),
             revision: 0,
             epoch: 0,
         }
@@ -3234,12 +3380,24 @@ mod tests {
                 .iter()
                 .any(|l| l.id == steps[1] && l.dashed && l.label.contains("reply"))
         );
-        assert!(
-            scene
-                .boxes
-                .iter()
-                .any(|b| b.id == steps[0] && b.rect.width == 8.)
+        assert_eq!(
+            scene.activations,
+            vec![super::super::scenario_activation::Segment {
+                call: steps[0],
+                receiver,
+                scope: owner,
+                rect: Rectangle::new(
+                    Point::new(scene.lanes[&receiver] - 6., 148.),
+                    Size::new(12., 92.),
+                ),
+                column: 0,
+                finish: super::super::scenario_activation::Finish::Reply(steps[1]),
+            }]
         );
+        let call_line = scene.lines.iter().find(|line| line.id == steps[0]).unwrap();
+        let reply_line = scene.lines.iter().find(|line| line.id == steps[1]).unwrap();
+        assert_eq!(call_line.points.last().unwrap().y, 148.);
+        assert_eq!(reply_line.points.first().unwrap().y, 240.);
         let mut reply = State::default();
         reply
             .update(result, Event::Start(owner, Tool::Message))

crates/oa-desktop/src/behavior/scenario/camera.rs

@@ -0,0 +1,282 @@
+//! Scenario camera policy. Bounds are from the exact displayed presentation,
+//! including its origin and automatic fallback; no model geometry is authored.
+use crate::behavior::canvas_workspace::{self, Event};
+use iced::{Rectangle, Size, Vector};
+
+pub(super) const MIN_SCALE: f32 = f32::from_bits(1);
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) struct Camera {
+    pub(super) scale: f32,
+    pub(super) pan: Vector,
+}
+
+/// Fit never enlarges above 100%. Use f64 intermediates so a valid f32 origin
+/// and size cannot overflow while finding the center. Unrepresentable cameras
+/// are refused rather than silently clamped to an unrelated minimum scale.
+pub(super) fn fit(bounds: Rectangle, viewport: Size) -> Option<Camera> {
+    if [
+        bounds.x,
+        bounds.y,
+        bounds.width,
+        bounds.height,
+        viewport.width,
+        viewport.height,
+    ]
+    .iter()
+    .any(|n| !n.is_finite())
+        || bounds.width < 0.
+        || bounds.height < 0.
+        || viewport.width <= 0.
+        || viewport.height <= 0.
+    {
+        return None;
+    }
+    let width = f64::from(viewport.width);
+    let height = f64::from(viewport.height);
+    let scale = ((width - 2. * (width / 4.).min(8.)) / f64::from(bounds.width).max(1.))
+        .min((height - 2. * (height / 4.).min(8.)) / f64::from(bounds.height).max(1.))
+        .min(1.) as f32;
+    if !scale.is_finite() || scale <= 0. {
+        return None;
+    }
+    let x = width / 2. - (f64::from(bounds.x) + f64::from(bounds.width) / 2.) * f64::from(scale);
+    let y = height / 2. - (f64::from(bounds.y) + f64::from(bounds.height) / 2.) * f64::from(scale);
+    let pan = Vector::new(x as f32, y as f32);
+    (pan.x.is_finite() && pan.y.is_finite()).then_some(Camera { scale, pan })
+}
+
+pub(super) fn effective_camera(
+    pan: Vector,
+    zoom: Option<f32>,
+    fitting: bool,
+    viewport: Option<Size>,
+    bounds: Rectangle,
+) -> Camera {
+    if fitting && let Some(camera) = viewport.and_then(|size| fit(bounds, size)) {
+        return camera;
+    }
+    Camera {
+        scale: zoom.unwrap_or(1.),
+        pan,
+    }
+}
+
+/// None preserves Fit as a mode, including before the first viewport arrives.
+pub(super) fn set_zoom(
+    pan: &mut Vector,
+    zoom: &mut Option<f32>,
+    fitting: &mut bool,
+    scale: Option<f32>,
+) -> bool {
+    if scale.is_some_and(|value| !value.is_finite() || value <= 0.) {
+        return false;
+    }
+    let next = scale.map(|value| value.min(3.));
+    let next_pan = if scale.is_none() { Vector::ZERO } else { *pan };
+    let changed = *zoom != next || *fitting != scale.is_none() || *pan != next_pan;
+    *zoom = next;
+    *fitting = scale.is_none();
+    *pan = next_pan;
+    changed
+}
+
+/// Materialize the visible fitted camera only when a camera gesture succeeds.
+/// A zero-motion or rejected event preserves the original mode and fields.
+pub(super) fn change(
+    pan: &mut Vector,
+    zoom: &mut Option<f32>,
+    fitting: &mut bool,
+    viewport: Option<Size>,
+    bounds: Rectangle,
+    event: Event,
+) -> bool {
+    let camera = effective_camera(*pan, *zoom, *fitting, viewport, bounds);
+    let (mut next_pan, mut next_zoom, mut next_fit) = (camera.pan, Some(camera.scale), false);
+    let event = match event {
+        Event::Zoom { base, .. } if !base.is_finite() || base <= 0. => return false,
+        Event::Zoom { factor, at, .. } => Event::Zoom {
+            factor,
+            at,
+            base: camera.scale,
+        },
+        event => event,
+    };
+    if !canvas_workspace::change_with_minimum(
+        &mut next_pan,
+        &mut next_zoom,
+        &mut next_fit,
+        event,
+        MIN_SCALE,
+    ) {
+        return false;
+    }
+    *pan = next_pan;
+    *zoom = next_zoom;
+    *fitting = next_fit;
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use iced::Point;
+
+    fn bounds() -> Rectangle {
+        Rectangle {
+            x: -1_000_160.,
+            y: -200.,
+            width: 2_000_400.,
+            height: 1_000.,
+        }
+    }
+    fn near(actual: f32, expected: f32, tolerance: f32) {
+        assert!(
+            (actual - expected).abs() <= tolerance,
+            "{actual} != {expected}"
+        );
+    }
+    fn projected(camera: Camera, point: Point) -> Point {
+        Point::new(
+            point.x * camera.scale + camera.pan.x,
+            point.y * camera.scale + camera.pan.y,
+        )
+    }
+
+    #[test]
+    fn negative_origin_fit_contains_independently_known_extremes() {
+        let camera = fit(bounds(), Size::new(700., 500.)).unwrap();
+        near(camera.scale, 0.0003419316, 1e-10);
+        near(camera.pan.x, 349.98633, 0.0001);
+        near(
+            projected(camera, Point::new(-1_000_160., -200.)).x,
+            8.,
+            0.0001,
+        );
+        near(
+            projected(camera, Point::new(1_000_240., 800.)).x,
+            692.,
+            0.0001,
+        );
+        near(projected(camera, Point::new(40., 300.)).y, 250., 0.0001);
+    }
+
+    #[test]
+    fn fit_remains_active_across_first_and_changed_viewport() {
+        let (mut pan, mut zoom, mut fitting) = (Vector::new(50., 80.), Some(0.8), false);
+        assert!(set_zoom(&mut pan, &mut zoom, &mut fitting, None));
+        let retained = effective_camera(pan, zoom, fitting, Some(Size::new(1200., 500.)), bounds());
+        let actual = effective_camera(pan, zoom, fitting, Some(Size::new(500., 500.)), bounds());
+        assert!(actual.scale < retained.scale);
+        near(
+            projected(actual, Point::new(-1_000_160., -200.)).x,
+            8.,
+            0.0001,
+        );
+        near(
+            projected(actual, Point::new(1_000_240., 800.)).x,
+            492.,
+            0.0001,
+        );
+        assert_eq!((pan, zoom, fitting), (Vector::ZERO, None, true));
+    }
+
+    #[test]
+    fn tiny_fit_zoom_in_out_preserves_pointer_world_anchor_without_floor_jump() {
+        let viewport = Some(Size::new(700., 500.));
+        let start = fit(bounds(), viewport.unwrap()).unwrap();
+        let (mut pan, mut zoom, mut fitting) = (Vector::ZERO, None, true);
+        let at = Point::new(210., 180.);
+        let world = Point::new(
+            (at.x - start.pan.x) / start.scale,
+            (at.y - start.pan.y) / start.scale,
+        );
+        for factor in [1.25, 0.8] {
+            let prior_scale = zoom.unwrap_or(start.scale);
+            assert!(change(
+                &mut pan,
+                &mut zoom,
+                &mut fitting,
+                viewport,
+                bounds(),
+                Event::Zoom {
+                    factor,
+                    at,
+                    base: start.scale,
+                }
+            ));
+            let camera = effective_camera(pan, zoom, fitting, viewport, bounds());
+            near(camera.scale, prior_scale * factor, 1e-10);
+            assert!(camera.scale < 0.001);
+            near(projected(camera, world).x, at.x, 0.0001);
+            near(projected(camera, world).y, at.y, 0.0001);
+        }
+        near(zoom.unwrap(), start.scale, 1e-10);
+        near(pan.x, start.pan.x, 0.0001);
+        assert!(!fitting);
+    }
+
+    #[test]
+    fn pan_leaves_fit_from_displayed_position_and_zero_motion_preserves_fit() {
+        let viewport = Some(Size::new(700., 500.));
+        let (mut pan, mut zoom, mut fitting) = (Vector::ZERO, None, true);
+        for event in [
+            Event::Pan(Vector::ZERO),
+            Event::Zoom {
+                factor: 1.,
+                at: Point::ORIGIN,
+                base: 1.,
+            },
+        ] {
+            assert!(!change(
+                &mut pan,
+                &mut zoom,
+                &mut fitting,
+                viewport,
+                bounds(),
+                event
+            ));
+            assert_eq!((pan, zoom, fitting), (Vector::ZERO, None, true));
+        }
+        let start = fit(bounds(), viewport.unwrap()).unwrap();
+        assert!(change(
+            &mut pan,
+            &mut zoom,
+            &mut fitting,
+            viewport,
+            bounds(),
+            Event::Pan(Vector::new(20., -30.))
+        ));
+        assert_eq!(pan, start.pan + Vector::new(20., -30.));
+        assert_eq!(zoom, Some(start.scale));
+        assert!(!fitting);
+    }
+
+    #[test]
+    fn invalid_inputs_are_passive_and_large_finite_bounds_do_not_overflow_center() {
+        assert!(fit(bounds(), Size::new(f32::NAN, 500.)).is_none());
+        let extreme = Rectangle {
+            x: f32::MAX,
+            y: 0.,
+            width: f32::MAX,
+            height: 100.,
+        };
+        let camera = fit(extreme, Size::new(700., 500.)).unwrap();
+        assert!(camera.scale > 0. && camera.scale < 1e-30 && camera.pan.x.is_finite());
+        let (mut pan, mut zoom, mut fitting) = (Vector::ZERO, None, true);
+        assert!(!set_zoom(&mut pan, &mut zoom, &mut fitting, Some(f32::NAN)));
+        assert!(!change(
+            &mut pan,
+            &mut zoom,
+            &mut fitting,
+            Some(Size::new(700., 500.)),
+            bounds(),
+            Event::Zoom {
+                factor: 1.25,
+                at: Point::ORIGIN,
+                base: f32::NAN
+            }
+        ));
+        assert_eq!((pan, zoom, fitting), (Vector::ZERO, None, true));
+    }
+}

crates/oa-desktop/src/behavior/scenario/focus.rs

@@ -11,6 +11,8 @@ use std::collections::BTreeMap;
 pub(crate) struct Stamp {
     document: ModelId,
     owner: ModelId,
+    representation: super::Representation,
+    visit: ModelId,
     revision: u64,
     session: ModelId,
     mount: ModelId,
@@ -20,6 +22,8 @@ impl Stamp {
         Self {
             document: context.document,
             owner: context.scenario,
+            representation: context.representation,
+            visit: context.visit,
             revision: context.revision,
             session,
             mount,
@@ -28,10 +32,12 @@ impl Stamp {
 }
 pub(crate) fn name_id(stamp: Stamp) -> Id {
     Id::from(format!(
-        "{}:{}:{}:{}:{}:{}",
+        "{}:{}:{}:{:?}:{}:{}:{}:{}",
         super::NAME_INPUT,
         stamp.document,
         stamp.owner,
+        stamp.representation,
+        stamp.visit,
         stamp.revision,
         stamp.session,
         stamp.mount

crates/oa-desktop/src/behavior/scenario/presentation_tests.rs

@@ -0,0 +1,283 @@
+//! Controller identity and actual presentation input, independent of App routing.
+use super::*;
+use oa_core::{Diagram, DiagramLayout, ProjectionKind, ScenarioLanePosition, ScenarioLayout};
+
+fn saved(p: &mut Project, owner: Id, lanes: &[(Id, f32)]) -> Representation {
+    let id = Id::new_v4();
+    p.diagrams.insert(
+        id,
+        Diagram {
+            id,
+            alias: format!("saved_{}", p.diagrams.len()),
+            name: "Saved scenario".into(),
+            description: String::new(),
+            layer: p.elements[&owner].layer(),
+            projection: ProjectionKind::Scenario { scenario: owner },
+            view_options: Default::default(),
+            nodes: Default::default(),
+            routes: vec![],
+            layout: Some(DiagramLayout::Scenario(ScenarioLayout {
+                lanes: lanes
+                    .iter()
+                    .map(|&(lifeline, x)| ScenarioLanePosition { lifeline, x })
+                    .collect(),
+                messages: vec![],
+            })),
+        },
+    );
+    let errors: Vec<_> = oa_core::validation::validate(p)
+        .into_iter()
+        .filter(|issue| issue.severity == oa_core::validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+    Representation::Saved { diagram: id }
+}
+
+#[test]
+fn saved_visits_distinguish_same_owner_roundtrips_and_suspended_return_without_editing() {
+    let mut f = direct_tests::fixture();
+    let a = saved(&mut f.project, f.owner, &[(f.sender, -500.)]);
+    let b = saved(&mut f.project, f.owner, &[(f.sender, 900.)]);
+    let original = f.project.clone();
+    let document = Id::new_v4();
+    let mut state = State::default();
+    assert!(state.enter_representation(document, f.owner, a));
+    let first = state.context(document, f.owner, 7, 9).unwrap();
+    assert!(!state.enter_representation(document, f.owner, a));
+    assert_eq!(state.context(document, f.owner, 7, 9), Some(first));
+    state.presentation.pan = iced::Vector::new(23., -17.);
+    state.leave();
+    assert_eq!(state.representation(), Some(a));
+    assert_eq!(state.owner(), Some(f.owner));
+    assert!(state.context(document, f.owner, 7, 9).is_none());
+    assert!(state.enter_representation(document, f.owner, a));
+    let returned = state.context(document, f.owner, 7, 9).unwrap();
+    assert_ne!(returned.visit, first.visit);
+    assert_eq!(state.presentation.pan, iced::Vector::new(23., -17.));
+    assert!(state.enter_representation(document, f.owner, b));
+    let middle = state.context(document, f.owner, 7, 9).unwrap();
+    assert!(state.enter_representation(document, f.owner, a));
+    let last = state.context(document, f.owner, 7, 9).unwrap();
+    assert_ne!(last.visit, returned.visit);
+    assert_ne!(last.visit, middle.visit);
+    assert!(!state.coordinate_input(&f.project, first));
+    assert!(state.coordinate_input(&f.project, last));
+    let session = Id::new_v4();
+    let mount = Id::new_v4();
+    assert_ne!(
+        focus::Stamp::new(first, session, mount),
+        focus::Stamp::new(last, session, mount)
+    );
+    assert_eq!(f.project, original);
+    state.forget_view();
+    assert_eq!(state.representation(), None);
+    assert_eq!(state.owner(), None);
+    assert!(state.context(document, f.owner, 7, 9).is_none());
+}
+
+#[test]
+fn saved_caller_restores_exact_representation_with_fresh_visit_and_rejects_deleted_view() {
+    let (mut project, [a, b, _], [reference, _, _]) = direct_tests::navigation_fixture();
+    let view = saved(&mut project, a, &[]);
+    let original = project.clone();
+    let document = Id::new_v4();
+    let mut state = State::default();
+    state.enter_representation(document, a, view);
+    let initial = state.context(document, a, 0, 0).unwrap();
+    state.presentation.pan = iced::Vector::new(11., 29.);
+    state.details_offset = iced::Vector::new(0., 71.);
+    assert_eq!(state.open_use(&project, initial, reference).unwrap(), b);
+    state.enter(document, b);
+    let callee = state.context(document, b, 0, 0).unwrap();
+    let frame = state.back(&project, callee).unwrap();
+    assert_eq!(frame.representation, view);
+    state.enter_representation(document, a, frame.representation);
+    let returned = state.context(document, a, 0, 0).unwrap();
+    state.restore_caller(returned, frame);
+    assert_ne!(returned.visit, initial.visit);
+    assert_eq!(state.representation(), Some(view));
+    assert_eq!(state.presentation.pan, iced::Vector::new(11., 29.));
+    assert!(state.scroll_restore(initial, ScrollArea::Page).is_none());
+    assert_eq!(
+        state
+            .scroll_restore(returned, ScrollArea::Page)
+            .unwrap()
+            .offset,
+        iced::Vector::new(0., 71.)
+    );
+    assert_eq!(project, original);
+    state.open_use(&project, returned, reference).unwrap();
+    state.enter(document, b);
+    let Representation::Saved { diagram } = view else {
+        unreachable!()
+    };
+    project.diagrams.remove(&diagram);
+    let callee = state.context(document, b, 0, 0).unwrap();
+    assert!(state.back(&project, callee).is_none());
+}
+
+#[test]
+fn complete_fallback_scene_selects_but_cannot_capture_or_finish_coordinate_gestures() {
+    let mut f = direct_tests::fixture();
+    // Equal authored lane centers are structurally valid, but cannot render a distinct-endpoint call.
+    let rep = saved(
+        &mut f.project,
+        f.owner,
+        &[(f.sender, 900.), (f.receiver, 900.)],
+    );
+    let original = f.project.clone();
+    let mut state = State::default();
+    state.enter_representation(Id::new_v4(), f.owner, rep);
+    let document = state.presentation.identity.unwrap().0;
+    let context = state.context(document, f.owner, 0, 0).unwrap();
+    let shown = state.display(&f.project, f.owner, f.call).unwrap();
+    assert!(matches!(
+        shown.status(),
+        presentation::PresentationStatus::Fallback { .. }
+    ));
+    assert!(!state.coordinate_input(&f.project, context));
+    let automatic = presentation::present(
+        &f.project,
+        Representation::Derived { owner: f.owner },
+        f.call,
+    );
+    let automatic = automatic.scene().unwrap();
+    assert_eq!(shown.scene().unwrap().render_lanes, automatic.render_lanes);
+    assert_eq!(shown.scene().unwrap().activations, automatic.activations);
+    assert!(!automatic.activations.is_empty());
+    let mut scene = shown.into_scene().unwrap();
+    scene.coordinate_input = false;
+    let line = scene.lines.iter().find(|line| line.id == f.call).unwrap();
+    let point = Point::new(
+        (line.points[0].x + line.points.last().unwrap().x) / 2.,
+        line.points[0].y,
+    );
+    assert_eq!(scene.hit(point), Some(f.call));
+    let bounds = Rectangle::with_size(Size::new(1600., 1000.));
+    for tool in [
+        CanvasTool::Select,
+        CanvasTool::Message(MessageStyle::CallReply),
+        CanvasTool::Add(Tool::Reuse),
+    ] {
+        scene.interaction = Some((context, tool, true));
+        let mut input = SequenceInput::default();
+        let mut messages = vec![];
+        for event in [
+            mouse::Event::CursorMoved { position: point },
+            mouse::Event::ButtonPressed(mouse::Button::Left),
+            mouse::Event::CursorMoved {
+                position: Point::new(point.x, point.y + 100.),
+            },
+            mouse::Event::ButtonReleased(mouse::Button::Left),
+        ] {
+            if let Some(message) = canvas::Program::update(
+                &scene,
+                &mut input,
+                &canvas::Event::Mouse(event),
+                bounds,
+                mouse::Cursor::Available(point),
+            )
+            .and_then(|action| action.into_inner().0)
+            {
+                messages.push(message);
+            }
+        }
+        assert_eq!(messages.len(), 1);
+        assert!(
+            matches!(messages[0], Message::ScenarioCanvas(CanvasEvent::Select(c, id)) if c == context && id == f.call)
+        );
+        assert!(input.press.is_none() && input.source.is_none());
+    }
+    // A gesture already captured in a Ready frame is cancelled when capability is revoked.
+    scene.coordinate_input = true;
+    scene.interaction = Some((context, CanvasTool::Select, true));
+    let mut input = SequenceInput::default();
+    let _ = canvas::Program::update(
+        &scene,
+        &mut input,
+        &canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+        bounds,
+        mouse::Cursor::Available(point),
+    );
+    assert!(input.press.is_some());
+    scene.coordinate_input = false;
+    let result = canvas::Program::update(
+        &scene,
+        &mut input,
+        &canvas::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+        bounds,
+        mouse::Cursor::Available(point),
+    );
+    assert!(result.and_then(|action| action.into_inner().0).is_none());
+    assert!(input.press.is_none());
+    assert_eq!(f.project, original);
+}
+
+#[test]
+fn saved_camera_fits_actual_negative_origin_and_tiny_scale_without_authored_mutation() {
+    let mut f = direct_tests::fixture();
+    let rep = saved(
+        &mut f.project,
+        f.owner,
+        &[(f.sender, -1_000_000.), (f.receiver, 1_000_000.)],
+    );
+    let original = f.project.clone();
+    let mut state = State::default();
+    state.enter_representation(Id::new_v4(), f.owner, rep);
+    state.viewport(Size::new(700., 500.));
+    assert!(
+        state.presentation.fit,
+        "new saved views await their real viewport in Fit mode"
+    );
+    assert!(
+        !state.camera_zoom(&f.project, f.owner, None),
+        "already-active Fit is idempotent"
+    );
+    let shown = state.display(&f.project, f.owner, f.owner).unwrap();
+    assert!(matches!(
+        shown.status(),
+        presentation::PresentationStatus::Ready
+    ));
+    let bounds = shown.bounds().unwrap();
+    assert!(bounds.x < -1_000_000. && bounds.x + bounds.width > 1_000_000.);
+    let fitted = state.presentation.camera(bounds);
+    assert!(fitted.scale > 0. && fitted.scale < 0.001);
+    let left = bounds.x * fitted.scale + fitted.pan.x;
+    let right = (bounds.x + bounds.width) * fitted.scale + fitted.pan.x;
+    assert!((left - 8.).abs() < 0.001 && (right - 692.).abs() < 0.001);
+    assert!(state.camera(
+        &f.project,
+        f.owner,
+        super::super::canvas_workspace::Event::Pan(iced::Vector::new(13., -7.))
+    ));
+    let moved = state.presentation.camera(bounds);
+    assert_eq!(moved.scale, fitted.scale);
+    assert_eq!(moved.pan, fitted.pan + iced::Vector::new(13., -7.));
+    assert!(!state.presentation.fit);
+    assert_eq!(f.project, original);
+}
+
+#[test]
+fn deleted_saved_identity_remains_unavailable_and_never_falls_into_derived_geometry() {
+    let mut f = direct_tests::fixture();
+    let rep = saved(&mut f.project, f.owner, &[]);
+    let mut state = State::default();
+    let document = Id::new_v4();
+    state.enter_representation(document, f.owner, rep);
+    let Representation::Saved { diagram } = rep else {
+        unreachable!()
+    };
+    f.project.diagrams.remove(&diagram);
+    let original = f.project.clone();
+    let shown = state.display(&f.project, f.owner, f.owner).unwrap();
+    assert_eq!(shown.requested(), rep);
+    assert!(matches!(
+        shown.status(),
+        presentation::PresentationStatus::Unavailable { .. }
+    ));
+    assert!(shown.scene().is_none() && shown.bounds().is_none());
+    assert_eq!(state.owner(), Some(f.owner));
+    assert!(state.context(document, f.owner, 0, 0).is_some());
+    assert!(!state.camera_zoom(&f.project, f.owner, None));
+    assert_eq!(f.project, original);
+}

crates/oa-desktop/src/behavior/scenario/spacing.rs

@@ -0,0 +1,160 @@
+//! Pure Saved-only spacing preparation. Delta is measured from the original
+//! pointer in the captured camera's world coordinates, never from the last
+//! preview. The controller must own document/revision/visit, camera and hit-role
+//! admission; this module neither dispatches commands nor changes selection.
+use crate::behavior::scenario_layout::{
+    GeometryIssue, Representation, ResolvedScenarioPlan, presentation::checked_owner, resolve,
+};
+use oa_core::{
+    Command, Id, Kind, OccurrenceBody, OccurrenceEndpoint, Project, ScenarioLanePosition,
+    ScenarioMessagePosition, SharedBody, execute_batch,
+};
+
+pub(crate) mod controller;
+#[cfg(test)]
+mod tests;
+pub(crate) use controller::{Event, Stamp};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Target {
+    Lane(Id),
+    Message(Id),
+}
+impl Target {
+    pub(crate) fn id(self) -> Id {
+        match self {
+            Self::Lane(id) | Self::Message(id) => id,
+        }
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum Refusal {
+    InvalidSavedView(Id),
+    TargetNotRendered(Target),
+    InvalidDelta,
+    InvalidGesture,
+    CameraChanged,
+    TargetNotHit(Target),
+    Command(String),
+    Geometry(Vec<GeometryIssue>),
+}
+
+pub(super) struct Drag {
+    original: Project,
+    diagram: Id,
+    target: Target,
+    origin: f32,
+    original_geometry: ResolvedScenarioPlan,
+}
+
+pub(super) struct Preview {
+    pub(super) command: Command,
+    #[cfg(test)]
+    pub(super) project: Project,
+    pub(super) geometry: ResolvedScenarioPlan,
+}
+
+/// Capture an accepted, actually drawn target. A Saved view displaying automatic
+/// fallback is not an editable original, even if the target appears in fallback.
+pub(super) fn capture(project: &Project, diagram: Id, target: Target) -> Result<Drag, Refusal> {
+    let representation = Representation::Saved { diagram };
+    let owner = checked_owner(project, representation).ok_or(Refusal::InvalidSavedView(diagram))?;
+    let geometry = resolve(project, representation, target.id()).map_err(Refusal::Geometry)?;
+    let element = project.elements.get(&target.id());
+    let origin = match target {
+        Target::Lane(id)
+            if element.is_some_and(|e| e.kind() == Kind::Lifeline && e.parent == Some(owner)) =>
+        {
+            // Unassigned lifelines still have drawn headers. `scene.lanes`
+            // excludes them only from semantic message-endpoint hit testing.
+            geometry.scene.render_lanes.get(&id).copied()
+        }
+        Target::Message(id)
+            if element.is_some_and(|e| {
+                matches!(
+                    e.shared(),
+                    Some(SharedBody::Occurrence {
+                        body: OccurrenceBody::Exchange { .. },
+                        ..
+                    })
+                )
+            }) =>
+        {
+            // A lifecycle row can denote receive y; the public position means
+            // send y. Read the actual outgoing endpoint, including self calls.
+            geometry
+                .scene
+                .lines
+                .iter()
+                .find(|line| line.id == id)
+                .and_then(|line| line.points.first())
+                .map(|point| point.y)
+        }
+        _ => None,
+    }
+    .ok_or(Refusal::TargetNotRendered(target))?;
+    if !origin.is_finite() {
+        return Err(Refusal::TargetNotRendered(target));
+    }
+    Ok(Drag {
+        original: project.clone(),
+        diagram,
+        target,
+        origin,
+        original_geometry: geometry,
+    })
+}
+
+impl Drag {
+    /// None means there is no command to commit. In particular +0/-0, return to
+    /// start, and sub-precision motion never materialize a missing override or
+    /// normalize an existing explicit value. Document/redo are never touched.
+    pub(super) fn prepare(&self, original_delta: f32) -> Result<Option<Preview>, Refusal> {
+        if !original_delta.is_finite() {
+            return Err(Refusal::InvalidDelta);
+        }
+        if original_delta == 0. {
+            return Ok(None);
+        }
+        let position = (f64::from(self.origin) + f64::from(original_delta)) as f32;
+        if position == self.origin {
+            return Ok(None);
+        }
+        let command = match self.target {
+            Target::Lane(lifeline) => Command::SetScenarioLanePosition {
+                diagram: self.diagram,
+                position: ScenarioLanePosition {
+                    lifeline,
+                    x: position,
+                },
+            },
+            Target::Message(occurrence) => Command::SetScenarioMessagePosition {
+                diagram: self.diagram,
+                position: ScenarioMessagePosition {
+                    address: OccurrenceEndpoint {
+                        references: vec![],
+                        occurrence,
+                    },
+                    send_y: position,
+                },
+            },
+        };
+        let project = execute_batch(&self.original, std::slice::from_ref(&command))
+            .map_err(|error| Refusal::Command(error.to_string()))?;
+        let geometry = resolve(
+            &project,
+            Representation::Saved {
+                diagram: self.diagram,
+            },
+            self.target.id(),
+        )
+        .map_err(Refusal::Geometry)?;
+        Ok(Some(Preview {
+            command,
+            #[cfg(test)]
+            project,
+            geometry,
+        }))
+    }
+}

crates/oa-desktop/src/behavior/scenario/spacing/controller.rs

@@ -0,0 +1,300 @@
+//! One press owns one immutable accepted Project and one frozen display camera.
+use super::*;
+use crate::behavior::{
+    Scene, SceneHitRole,
+    scenario::{CanvasTool, Context, State},
+    scenario_layout::Diagnostic,
+};
+use iced::{Point, Rectangle, Vector};
+
+#[cfg(test)]
+pub(crate) mod tests;
+#[cfg(test)]
+mod timing_tests;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Stamp {
+    pub(crate) context: Context,
+    pub(crate) camera_epoch: u64,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub enum Event {
+    Begin {
+        stamp: Stamp,
+        token: Id,
+        target: Target,
+        press_screen: Point,
+        canvas_bounds: Rectangle,
+        scale: f32,
+        pan: Vector,
+    },
+    Move {
+        stamp: Stamp,
+        token: Id,
+        screen: Point,
+    },
+    Finish {
+        stamp: Stamp,
+        token: Id,
+        screen: Point,
+    },
+    Cancel {
+        stamp: Stamp,
+        token: Id,
+    },
+}
+impl Event {
+    pub(crate) fn stamp(self) -> Stamp {
+        match self {
+            Self::Begin { stamp, .. }
+            | Self::Move { stamp, .. }
+            | Self::Finish { stamp, .. }
+            | Self::Cancel { stamp, .. } => stamp,
+        }
+    }
+    pub(crate) fn token(self) -> Id {
+        match self {
+            Self::Begin { token, .. }
+            | Self::Move { token, .. }
+            | Self::Finish { token, .. }
+            | Self::Cancel { token, .. } => token,
+        }
+    }
+}
+
+pub(crate) struct Session {
+    stamp: Stamp,
+    token: Id,
+    press_screen: Point,
+    scale: f32,
+    pan: Vector,
+    drag: Drag,
+    preview: Option<Preview>,
+    refusal: Option<Refusal>,
+    ever_crossed: bool,
+}
+
+pub(in crate::behavior) struct Paint<'a> {
+    pub(in crate::behavior) scene: &'a Scene,
+    #[cfg(test)]
+    pub(in crate::behavior) bounds: Rectangle,
+    pub(in crate::behavior) refusal: Option<&'a Refusal>,
+    pub(in crate::behavior) original_diagnostics: &'a [Diagnostic],
+    pub(in crate::behavior) original_latent: &'a [Id],
+    pub(in crate::behavior) diagnostics: &'a [Diagnostic],
+}
+
+pub(crate) enum Finish {
+    Click(Id),
+    Noop,
+    Commit {
+        command: Command,
+        selected: Id,
+        scale: f32,
+        pan: Vector,
+    },
+}
+
+impl Session {
+    fn configure(&self, scene: &mut Scene) {
+        scene.selected = self.drag.target.id();
+        scene.scale = self.scale;
+        scene.camera_pan = self.pan;
+        scene.interaction = Some((self.stamp.context, CanvasTool::Select, true));
+        scene.spacing_stamp = Some(self.stamp);
+        scene.coordinate_input = true;
+        scene.pending_placement = None;
+    }
+    fn update(&mut self, screen: Point) {
+        self.preview = None;
+        self.refusal = None;
+        if !screen.x.is_finite() || !screen.y.is_finite() {
+            self.refusal = Some(Refusal::InvalidDelta);
+            return;
+        }
+        let distance = match self.drag.target {
+            Target::Lane(_) => screen.x - self.press_screen.x,
+            Target::Message(_) => screen.y - self.press_screen.y,
+        };
+        self.ever_crossed |= distance.abs() >= 3.;
+        if !self.ever_crossed {
+            return;
+        }
+        match self.drag.prepare(distance / self.scale) {
+            Ok(Some(mut preview)) => {
+                self.configure(&mut preview.geometry.scene);
+                self.preview = Some(preview);
+            }
+            Ok(None) => {}
+            Err(error) => self.refusal = Some(error),
+        }
+    }
+}
+
+impl State {
+    pub(crate) fn spacing_token(&self) -> Option<Id> {
+        self.spacing.as_ref().map(|s| s.token)
+    }
+    pub(crate) fn spacing_stamp(&self) -> Option<Stamp> {
+        self.spacing.as_ref().map(|s| s.stamp)
+    }
+    pub(crate) fn cancel_spacing(&mut self) -> bool {
+        self.spacing.take().is_some()
+    }
+
+    pub(in crate::behavior) fn spacing_paint(
+        &self,
+        context: Context,
+        camera_epoch: u64,
+    ) -> Option<Paint<'_>> {
+        let session = self.spacing.as_ref()?;
+        if session.stamp
+            != (Stamp {
+                context,
+                camera_epoch,
+            })
+        {
+            return None;
+        }
+        let original = &session.drag.original_geometry;
+        let shown = session.preview.as_ref().map_or(original, |p| &p.geometry);
+        Some(Paint {
+            scene: &shown.scene,
+            #[cfg(test)]
+            bounds: shown.bounds,
+            refusal: session.refusal.as_ref(),
+            original_diagnostics: &original.plan.diagnostics,
+            original_latent: &original.latent_messages,
+            diagnostics: &shown.plan.diagnostics,
+        })
+    }
+
+    pub(crate) fn begin_spacing(&mut self, project: &Project, event: Event) -> Result<(), Refusal> {
+        let Event::Begin {
+            stamp,
+            token,
+            target,
+            press_screen,
+            canvas_bounds,
+            scale,
+            pan,
+        } = event
+        else {
+            return Err(Refusal::InvalidGesture);
+        };
+        let context = stamp.context;
+        if self.spacing.is_some()
+            || token.is_nil()
+            || self.context(
+                context.document,
+                context.scenario,
+                context.revision,
+                context.epoch,
+            ) != Some(context)
+            || self.canvas_tool(context.scenario) != CanvasTool::Select
+            || ![
+                press_screen.x,
+                press_screen.y,
+                canvas_bounds.x,
+                canvas_bounds.y,
+                canvas_bounds.width,
+                canvas_bounds.height,
+                scale,
+                pan.x,
+                pan.y,
+            ]
+            .into_iter()
+            .all(f32::is_finite)
+            || scale <= 0.
+            || canvas_bounds.width <= 0.
+            || canvas_bounds.height <= 0.
+            || !canvas_bounds.contains(press_screen)
+        {
+            return Err(Refusal::InvalidGesture);
+        }
+        let Representation::Saved { diagram } = context.representation else {
+            return Err(Refusal::InvalidGesture);
+        };
+        let mut drag = capture(project, diagram, target)?;
+        let camera = self.presentation.camera(drag.original_geometry.bounds);
+        if self.presentation.viewport != Some(canvas_bounds.size())
+            || camera.scale != scale
+            || camera.pan != pan
+        {
+            return Err(Refusal::CameraChanged);
+        }
+        let world = Point::new(
+            (press_screen.x - canvas_bounds.x - pan.x) / scale,
+            (press_screen.y - canvas_bounds.y - pan.y) / scale,
+        );
+        // Hit tolerance is measured in displayed pixels, just like the widget.
+        drag.original_geometry.scene.scale = scale;
+        drag.original_geometry.scene.camera_pan = pan;
+        let hit = drag.original_geometry.scene.hit_item(world);
+        if !hit.is_some_and(|hit| {
+            hit.id == target.id()
+                && match target {
+                    Target::Lane(_) => hit.role == SceneHitRole::LifelineHeader,
+                    Target::Message(_) => matches!(
+                        hit.role,
+                        SceneHitRole::MessageBody | SceneHitRole::MessageLabel
+                    ),
+                }
+        }) {
+            return Err(Refusal::TargetNotHit(target));
+        }
+        // Configure baseline without changing the persistent camera or selection.
+        let scene = &mut drag.original_geometry.scene;
+        scene.selected = target.id();
+        scene.scale = scale;
+        scene.camera_pan = pan;
+        scene.interaction = Some((context, CanvasTool::Select, true));
+        scene.spacing_stamp = Some(stamp);
+        scene.coordinate_input = true;
+        scene.pending_placement = None;
+        self.spacing = Some(Session {
+            stamp,
+            token,
+            press_screen,
+            scale,
+            pan,
+            drag,
+            preview: None,
+            refusal: None,
+            ever_crossed: false,
+        });
+        Ok(())
+    }
+    pub(crate) fn move_spacing(&mut self, screen: Point) {
+        if let Some(session) = &mut self.spacing {
+            session.update(screen);
+        }
+    }
+    pub(crate) fn finish_spacing(&mut self, screen: Point) -> Result<Finish, Refusal> {
+        let Some(mut session) = self.spacing.take() else {
+            return Err(Refusal::InvalidGesture);
+        };
+        session.update(screen);
+        if let Some(error) = session.refusal {
+            return Err(error);
+        }
+        if !session.ever_crossed {
+            return Ok(Finish::Click(session.drag.target.id()));
+        }
+        Ok(match session.preview {
+            None => Finish::Noop,
+            Some(preview) => Finish::Commit {
+                command: preview.command,
+                selected: session.drag.target.id(),
+                scale: session.scale,
+                pan: session.pan,
+            },
+        })
+    }
+    pub(crate) fn accept_spacing_camera(&mut self, scale: f32, pan: Vector) {
+        self.presentation.zoom = Some(scale);
+        self.presentation.pan = pan;
+        self.presentation.fit = false;
+    }
+}

crates/oa-desktop/src/behavior/scenario/spacing/controller/tests.rs

@@ -0,0 +1,330 @@
+use super::*;
+use crate::document::Document;
+use iced::Size;
+use oa_core::{Diagram, Layer, ProjectionKind, language, source_project::ProjectLimits};
+
+pub(crate) fn fixture() -> (Document, Id, Id, Id, Id) {
+    let mut p = language::parse(r#"arcadia 7;
+project spacing "Spacing" {
+ oa_activity work "Work" {}
+ oa_activity response "Response" {}
+ oa_scenario incident "Incident" { viewpoint OperationalActivity; steps [@first, @second]; }
+ oa_lifeline reporter "Reporter" { parent @incident; represented @work; }
+ oa_lifeline operator "Operator" { parent @incident; represented @response; }
+ oa_occurrence first "First" { parent @incident; body { Exchange { exchange none; sender @reporter; receiver @operator; message_kind Asynchronous; }; }; }
+ oa_occurrence second "Second" { parent @incident; body { Exchange { exchange none; sender @operator; receiver @reporter; message_kind Asynchronous; }; }; }
+}"#).unwrap();
+    let id = |name: &str| {
+        p.identities()
+            .into_iter()
+            .find(|(_, alias)| *alias == name)
+            .unwrap()
+            .0
+    };
+    let (owner, lane, message) = (id("incident"), id("reporter"), id("first"));
+    let diagram = Id::new_v4();
+    p.diagrams.insert(
+        diagram,
+        Diagram {
+            id: diagram,
+            alias: "saved".into(),
+            name: "Saved".into(),
+            description: String::new(),
+            layer: Layer::Oa,
+            projection: ProjectionKind::Scenario { scenario: owner },
+            nodes: Default::default(),
+            routes: vec![],
+            view_options: Default::default(),
+            layout: None,
+        },
+    );
+    (
+        Document::from_project(p, ProjectLimits::default()).unwrap(),
+        owner,
+        diagram,
+        lane,
+        message,
+    )
+}
+
+pub(crate) fn expected(p: &Project, diagram: Id, target: Target, delta: f32) -> Project {
+    capture(p, diagram, target)
+        .unwrap()
+        .prepare(delta)
+        .unwrap()
+        .unwrap()
+        .project
+}
+
+pub(crate) fn packet(
+    p: &Project,
+    state: &State,
+    context: Context,
+    camera_epoch: u64,
+    target: Target,
+) -> Event {
+    let geometry = resolve(p, context.representation, target.id()).unwrap();
+    let world = match target {
+        Target::Lane(id) => geometry
+            .scene
+            .boxes
+            .iter()
+            .find(|item| item.id == id && item.role == SceneHitRole::LifelineHeader)
+            .unwrap()
+            .rect
+            .center(),
+        Target::Message(id) => {
+            let line = geometry
+                .scene
+                .lines
+                .iter()
+                .find(|line| line.id == id)
+                .unwrap();
+            Point::new((line.points[0].x + line.points[1].x) / 2., line.points[0].y)
+        }
+    };
+    assert!(
+        geometry
+            .scene
+            .hit_item(world)
+            .is_some_and(|hit| hit.id == target.id())
+    );
+    let camera = state.presentation.camera(geometry.bounds);
+    let canvas_bounds = Rectangle::new(Point::new(17., 23.), state.presentation.viewport.unwrap());
+    Event::Begin {
+        stamp: Stamp {
+            context,
+            camera_epoch,
+        },
+        token: Id::new_v4(),
+        target,
+        press_screen: Point::new(
+            canvas_bounds.x + world.x * camera.scale + camera.pan.x,
+            canvas_bounds.y + world.y * camera.scale + camera.pan.y,
+        ),
+        canvas_bounds,
+        scale: camera.scale,
+        pan: camera.pan,
+    }
+}
+fn setup(target_message: bool) -> (Document, State, Event) {
+    let (doc, owner, diagram, lane, message) = fixture();
+    let mut state = State::default();
+    state.enter_representation(Id::new_v4(), owner, Representation::Saved { diagram });
+    state.presentation.viewport = Some(Size::new(900., 600.));
+    let context = state
+        .context(
+            state.presentation.identity.unwrap().0,
+            owner,
+            doc.revision(),
+            4,
+        )
+        .unwrap();
+    let target = if target_message {
+        Target::Message(message)
+    } else {
+        Target::Lane(lane)
+    };
+    let event = packet(doc.project(), &state, context, 9, target);
+    (doc, state, event)
+}
+fn press(event: Event) -> Point {
+    let Event::Begin { press_screen, .. } = event else {
+        unreachable!()
+    };
+    press_screen
+}
+
+#[test]
+fn real_preview_moves_only_active_axis_from_original_and_never_changes_document() {
+    for message in [false, true] {
+        let (doc, mut state, begin) = setup(message);
+        let original = doc.snapshot();
+        let camera = state.camera_boundary();
+        let start = press(begin);
+        state.begin_spacing(doc.project(), begin).unwrap();
+        let first = if message {
+            Vector::new(500., 30.)
+        } else {
+            Vector::new(30., 500.)
+        };
+        state.move_spacing(start + first);
+        let session = state.spacing.as_ref().unwrap();
+        let candidate = session.preview.as_ref().unwrap();
+        let delta = 30. / session.scale;
+        let actual_anchor = match session.drag.target {
+            Target::Lane(id) => candidate.geometry.scene.render_lanes[&id],
+            Target::Message(id) => {
+                candidate
+                    .geometry
+                    .scene
+                    .lines
+                    .iter()
+                    .find(|line| line.id == id)
+                    .unwrap()
+                    .points[0]
+                    .y
+            }
+        };
+        let wanted = (f64::from(session.drag.origin) + f64::from(delta)) as f32;
+        assert_eq!(actual_anchor.to_bits(), wanted.to_bits());
+        let expected = session.drag.prepare(delta).unwrap().unwrap();
+        assert_eq!(candidate.project, expected.project);
+        assert_eq!(candidate.geometry.scene.rows, expected.geometry.scene.rows);
+        assert_eq!(
+            candidate.geometry.scene.render_lanes,
+            expected.geometry.scene.render_lanes
+        );
+        state.move_spacing(start + first * 2.);
+        let session = state.spacing.as_ref().unwrap();
+        assert_eq!(
+            session.preview.as_ref().unwrap().project,
+            session.drag.prepare(delta * 2.).unwrap().unwrap().project
+        );
+        assert_eq!(doc.project(), &original.decoded.project);
+        assert_eq!(doc.compiled().bundle, original.bundle);
+        assert!(!doc.dirty() && !doc.can_undo() && !doc.can_redo());
+        assert!(camera == state.camera_boundary());
+    }
+}
+
+#[test]
+fn click_threshold_is_active_axis_and_return_to_zero_is_not_a_click() {
+    let (doc, mut state, begin) = setup(false);
+    let start = press(begin);
+    state.begin_spacing(doc.project(), begin).unwrap();
+    state.move_spacing(start + Vector::new(2., 100.));
+    assert!(matches!(
+        state.finish_spacing(start).unwrap(),
+        Finish::Click(_)
+    ));
+    state.begin_spacing(doc.project(), begin).unwrap();
+    state.move_spacing(start + Vector::new(4., 0.));
+    assert!(matches!(state.finish_spacing(start).unwrap(), Finish::Noop));
+    assert!(!doc.can_undo());
+}
+
+#[test]
+fn invalid_move_discards_prior_candidate_and_finish_rechecks_final_pointer() {
+    let (doc, mut state, begin) = setup(false);
+    let start = press(begin);
+    state.begin_spacing(doc.project(), begin).unwrap();
+    state.move_spacing(start + Vector::new(20., 0.));
+    state.move_spacing(Point::new(f32::NAN, start.y));
+    let paint = state.spacing_paint(begin.stamp().context, 9).unwrap();
+    assert!(matches!(paint.refusal, Some(Refusal::InvalidDelta)));
+    assert_eq!(
+        paint.scene.render_lanes,
+        state
+            .spacing
+            .as_ref()
+            .unwrap()
+            .drag
+            .original_geometry
+            .scene
+            .render_lanes
+    );
+    assert!(matches!(
+        state.finish_spacing(Point::new(f32::NAN, start.y)),
+        Err(Refusal::InvalidDelta)
+    ));
+    assert!(state.spacing_token().is_none());
+}
+
+#[test]
+fn forged_camera_hit_role_and_retired_visit_cannot_capture() {
+    let (doc, mut state, begin) = setup(false);
+    let Event::Begin {
+        stamp,
+        token,
+        target,
+        press_screen,
+        canvas_bounds,
+        scale,
+        pan,
+    } = begin
+    else {
+        unreachable!()
+    };
+    assert!(matches!(
+        state.begin_spacing(
+            doc.project(),
+            Event::Begin {
+                stamp,
+                token,
+                target,
+                press_screen,
+                canvas_bounds,
+                scale: scale * 2.,
+                pan
+            }
+        ),
+        Err(Refusal::CameraChanged)
+    ));
+    assert!(matches!(
+        state.begin_spacing(
+            doc.project(),
+            Event::Begin {
+                stamp,
+                token,
+                target,
+                press_screen: canvas_bounds.center(),
+                canvas_bounds,
+                scale,
+                pan
+            }
+        ),
+        Err(Refusal::TargetNotHit(_))
+    ));
+    state.leave();
+    assert!(matches!(
+        state.begin_spacing(doc.project(), begin),
+        Err(Refusal::InvalidGesture)
+    ));
+}
+
+#[test]
+fn zoomed_out_message_tolerance_matches_actual_canvas_hit() {
+    let (doc, mut state, _) = setup(true);
+    state.presentation.fit = false;
+    state.presentation.zoom = Some(0.25);
+    state.presentation.pan = Vector::ZERO;
+    let context = state
+        .context(
+            state.presentation.identity.unwrap().0,
+            state.owner().unwrap(),
+            doc.revision(),
+            4,
+        )
+        .unwrap();
+    let message = doc
+        .project()
+        .identities()
+        .into_iter()
+        .find(|(_, alias)| *alias == "first")
+        .map(|(id, _)| id)
+        .unwrap();
+    let Event::Begin {
+        stamp,
+        token,
+        target,
+        press_screen,
+        canvas_bounds,
+        scale,
+        pan,
+    } = packet(doc.project(), &state, context, 9, Target::Message(message))
+    else {
+        unreachable!()
+    };
+    let event = Event::Begin {
+        stamp,
+        token,
+        target,
+        press_screen: press_screen + Vector::new(0., 3.),
+        canvas_bounds,
+        scale,
+        pan,
+    };
+    state.begin_spacing(doc.project(), event).unwrap();
+    assert_eq!(state.spacing_token(), Some(token));
+}

crates/oa-desktop/src/behavior/scenario/spacing/controller/timing_tests.rs

@@ -0,0 +1,304 @@
+//! Diagnostic only: production capture/prepare, excluding fixture construction,
+//! oracle work, App source writes, widget rebuilds, text shaping and GPU paint.
+use super::*;
+use crate::document::Document;
+use oa_core::{
+    DiagramLayout, Layer, MessageKind, RelationKind, ScenarioLayout, source_project::ProjectLimits,
+};
+use serde_json::{Value, json};
+use std::{collections::BTreeSet, sync::Arc, time::Instant};
+
+const MESSAGE_COUNT: usize = 1000;
+const TARGET_INDEX: usize = 500;
+
+fn large_fixture() -> (Document, Id, [Id; 3], Vec<Id>, Vec<Id>) {
+    let (seed, owner, a, reporter, first) = super::tests::fixture();
+    let mut p = seed.project().clone();
+    let old_steps = p.elements[&owner].steps().unwrap().clone();
+    let template = p.elements[&first].clone();
+    let work = |alias: &str| {
+        p.identities()
+            .into_iter()
+            .find(|(_, name)| *name == alias)
+            .unwrap()
+            .0
+    };
+    let (source, target) = (work("work"), work("response"));
+    let operator = work("operator");
+    let relation = p.relate(
+        RelationKind::Interaction,
+        "Repeated incident report",
+        source,
+        target,
+    );
+    let mut lanes = vec![];
+    for index in 0..20 {
+        let original = if index < 10 { reporter } else { operator };
+        let mut lane = p.elements[&original].clone();
+        lane.id = Id::new_v4();
+        lane.alias = format!("timing_lane_{index:02}");
+        lane.name = format!("Review participant {index:02}");
+        lanes.push(lane.id);
+        p.elements.insert(lane.id, lane);
+    }
+    p.elements.remove(&reporter);
+    p.elements.remove(&operator);
+    for id in old_steps {
+        p.elements.remove(&id);
+    }
+    let mut messages = vec![];
+    for index in 0..MESSAGE_COUNT {
+        let mut occurrence = template.clone();
+        occurrence.id = Id::new_v4();
+        occurrence.alias = format!("timing_message_{index:04}");
+        occurrence.name = format!("Validate incident report {index:04}");
+        *occurrence.shared_mut().unwrap() = SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange {
+                exchange: Some(relation),
+                sender: Some(lanes[index % 10]),
+                receiver: Some(lanes[10 + index % 10]),
+                message_kind: MessageKind::Asynchronous,
+                operation: None,
+                reply_to: None,
+                values: vec![],
+            },
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+        messages.push(occurrence.id);
+        p.elements.insert(occurrence.id, occurrence);
+    }
+    *p.elements.get_mut(&owner).unwrap().steps_mut().unwrap() = messages.clone();
+    p.diagrams.get_mut(&a).unwrap().layout = Some(DiagramLayout::Scenario(ScenarioLayout {
+        lanes: lanes
+            .iter()
+            .enumerate()
+            .map(|(i, &lifeline)| ScenarioLanePosition {
+                lifeline,
+                x: 160. + i as f32 * 240.,
+            })
+            .collect(),
+        messages: vec![],
+    }));
+    let mut views = [a, Id::nil(), Id::nil()];
+    for (index, x, offset) in [(1, -500., 12.), (2, 6500., -12.)] {
+        let mut view = p.diagrams[&a].clone();
+        view.id = Id::new_v4();
+        view.alias = format!("timing_saved_{index}");
+        view.name = format!("Review arrangement {index}");
+        view.layout = Some(DiagramLayout::Scenario(ScenarioLayout {
+            lanes: vec![ScenarioLanePosition {
+                lifeline: lanes[0],
+                x,
+            }],
+            messages: vec![ScenarioMessagePosition {
+                address: OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: messages[TARGET_INDEX],
+                },
+                send_y: 148. + TARGET_INDEX as f32 * 92. + offset,
+            }],
+        }));
+        views[index] = view.id;
+        p.diagrams.insert(view.id, view);
+    }
+    let document = Document::from_project(p, ProjectLimits::default()).unwrap();
+    assert_eq!(
+        document
+            .project()
+            .children(owner)
+            .filter(|e| e.kind() == Kind::Lifeline)
+            .count(),
+        20
+    );
+    assert_eq!(document.project().elements[&owner].layer(), Layer::Oa);
+    assert_eq!(document.project().diagrams.len(), 3);
+    (document, owner, views, lanes, messages)
+}
+
+fn assert_scene(
+    scene: &Scene,
+    lanes: &[Id],
+    messages: &[Id],
+    moved_message: Option<(Id, f32)>,
+    moved_lane: Option<(Id, f32)>,
+) {
+    assert_eq!(scene.render_lanes.len(), 20);
+    assert_eq!(
+        scene
+            .boxes
+            .iter()
+            .filter(|b| b.role == SceneHitRole::LifelineHeader)
+            .count(),
+        20
+    );
+    assert_eq!(scene.lines.len(), MESSAGE_COUNT);
+    assert_eq!(
+        scene
+            .lines
+            .iter()
+            .map(|line| line.id)
+            .collect::<BTreeSet<_>>(),
+        messages.iter().copied().collect::<BTreeSet<_>>()
+    );
+    assert!(scene.activations.is_empty() && scene.open_calls.is_empty());
+    let x = |index: usize| {
+        160. + index as f32 * 240.
+            + moved_lane
+                .filter(|(id, _)| *id == lanes[index])
+                .map_or(0., |(_, delta)| delta)
+    };
+    for (index, &lane) in lanes.iter().enumerate() {
+        assert_eq!(scene.render_lanes[&lane], x(index));
+    }
+    for (index, (line, &id)) in scene.lines.iter().zip(messages).enumerate() {
+        let y = 148.
+            + index as f32 * 92.
+            + moved_message
+                .filter(|(target, _)| *target == id)
+                .map_or(0., |(_, delta)| delta);
+        assert_eq!(line.id, id);
+        assert_eq!(
+            line.points,
+            vec![
+                Point::new(x(index % 10), y),
+                Point::new(x(10 + index % 10), y)
+            ]
+        );
+    }
+}
+
+fn summary(samples: &[Value], phase: &str) -> Value {
+    let mut times: Vec<u64> = samples
+        .iter()
+        .filter(|sample| sample["phase"] == phase)
+        .map(|sample| sample["elapsed_ns"].as_u64().unwrap())
+        .collect();
+    times.sort_unstable();
+    let n = times.len();
+    let median = if n.is_multiple_of(2) {
+        ((u128::from(times[n / 2 - 1]) + u128::from(times[n / 2])) / 2) as u64
+    } else {
+        times[n / 2]
+    };
+    json!({"samples": n, "min_ns": times[0], "median_ns": median, "max_ns": times[n-1]})
+}
+
+#[test]
+#[ignore = "Diagnostic timing only; run alone with --exact --ignored --nocapture after correctness gates; no latency acceptance threshold"]
+fn saved_spacing_capture_prepare_20_lanes_1000_messages_3_views() {
+    let (document, owner, views, lanes, messages) = large_fixture();
+    let original = document.snapshot();
+    let target = messages[TARGET_INDEX];
+    let mut samples = vec![];
+    let mut retained = None;
+    for iteration in 0..4 {
+        let start = Instant::now();
+        let result = capture(document.project(), views[0], Target::Message(target));
+        let elapsed_ns = u64::try_from(start.elapsed().as_nanos()).unwrap();
+        let drag = result.expect("complete asynchronous fixture must resolve");
+        samples.push(json!({"phase":"capture_message", "iteration":iteration,
+            "first_in_probe":iteration==0, "elapsed_ns":elapsed_ns, "outcome":"captured"}));
+        assert_scene(&drag.original_geometry.scene, &lanes, &messages, None, None);
+        if iteration == 0 {
+            retained = Some(drag);
+        }
+    }
+    let drag = retained.unwrap();
+    // Every sample is relative to the original press, including duplicate,
+    // reverse and return-to-start samples. Oracle work is outside each timer.
+    let deltas = [
+        4., 8., 12., 16., 20., 24., 28., 32., 32., 28., 24., 20., 16., 12., 8., 4., -4., -8., -4.,
+        0.,
+    ];
+    for (iteration, delta) in deltas.into_iter().enumerate() {
+        let start = Instant::now();
+        let result = drag.prepare(delta);
+        let elapsed_ns = u64::try_from(start.elapsed().as_nanos()).unwrap();
+        let candidate = result.expect("these isolated asynchronous offsets are feasible");
+        samples.push(json!({"phase":"prepare_message", "iteration":iteration,
+            "delta_world":delta, "elapsed_ns":elapsed_ns, "outcome":if candidate.is_some(){"preview"}else{"noop"}}));
+        if delta == 0. {
+            assert!(candidate.is_none());
+        } else {
+            let candidate = candidate.unwrap();
+            let mut expected = original.decoded.project.clone();
+            let Some(DiagramLayout::Scenario(layout)) =
+                &mut expected.diagrams.get_mut(&views[0]).unwrap().layout
+            else {
+                panic!()
+            };
+            layout.messages.push(ScenarioMessagePosition {
+                address: OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: target,
+                },
+                send_y: 148. + TARGET_INDEX as f32 * 92. + delta,
+            });
+            assert_eq!(candidate.project, expected);
+            assert_scene(
+                &candidate.geometry.scene,
+                &lanes,
+                &messages,
+                Some((target, delta)),
+                None,
+            );
+        }
+        assert_eq!(
+            document.project().elements[&owner].steps().unwrap(),
+            &messages
+        );
+        assert_eq!(document.project(), &original.decoded.project);
+        assert!(Arc::ptr_eq(&original, &document.snapshot()));
+    }
+    let lane = lanes[10];
+    let start = Instant::now();
+    let result = capture(document.project(), views[0], Target::Lane(lane));
+    let elapsed_ns = u64::try_from(start.elapsed().as_nanos()).unwrap();
+    let drag = result.unwrap();
+    samples.push(json!({"phase":"capture_lane", "iteration":0, "elapsed_ns":elapsed_ns, "outcome":"captured"}));
+    for (iteration, delta) in [20., 40., -20.].into_iter().enumerate() {
+        let start = Instant::now();
+        let result = drag.prepare(delta);
+        let elapsed_ns = u64::try_from(start.elapsed().as_nanos()).unwrap();
+        let candidate = result.unwrap().unwrap();
+        samples.push(json!({"phase":"prepare_lane", "iteration":iteration,
+            "delta_world":delta, "elapsed_ns":elapsed_ns, "outcome":"preview"}));
+        let mut expected = original.decoded.project.clone();
+        let Some(DiagramLayout::Scenario(layout)) =
+            &mut expected.diagrams.get_mut(&views[0]).unwrap().layout
+        else {
+            panic!()
+        };
+        layout.lanes[10].x = 2560. + delta;
+        assert_eq!(candidate.project, expected);
+        assert_scene(
+            &candidate.geometry.scene,
+            &lanes,
+            &messages,
+            None,
+            Some((lane, delta)),
+        );
+    }
+    assert_eq!(document.project(), &original.decoded.project);
+    assert_eq!(document.bundle(), &original.bundle);
+    for view in views {
+        assert_eq!(
+            document.project().diagrams[&view],
+            original.decoded.project.diagrams[&view]
+        );
+    }
+    assert_eq!(document.revision(), 0);
+    assert!(!document.dirty() && !document.can_undo() && !document.can_redo());
+    let report = json!({
+        "schema":"scenario_spacing_timing_v1",
+        "fixture":{"lanes":20,"messages":MESSAGE_COUNT,"saved_views":3,"target_index":TARGET_INDEX,"distinct_message_ids":messages.iter().copied().collect::<BTreeSet<_>>().len()},
+        "profile_context":{"debug_assertions":cfg!(debug_assertions),"os":std::env::consts::OS,"arch":std::env::consts::ARCH,
+            "source_pin_from_runner":std::env::var("SCENARIO_SPACING_SOURCE_PIN").ok(),"source_binary_toolchain_binding":"external gate receipt required"},
+        "summaries":{"capture_message":summary(&samples,"capture_message"),"prepare_message":summary(&samples,"prepare_message"),"capture_lane":summary(&samples,"capture_lane"),"prepare_lane":summary(&samples,"prepare_lane")},
+        "samples":samples,
+        "invariant_status":"passed",
+        "limits":"First capture is first in this probe, not cold OS caches. Timers exclude construction/oracles, prior-preview disposal, source write/history, widget rebuild, label shaping, GPU paint and queued input; no responsiveness acceptance or latency threshold. All messages asynchronous; no nested frame/lifecycle stress."
+    });
+    println!("SPACING_TIMING_JSON={report}");
+}

crates/oa-desktop/src/behavior/scenario/spacing/tests.rs

@@ -0,0 +1,522 @@
+use super::*;
+use crate::behavior::scenario_layout::Diagnostic;
+use crate::document::Document;
+use oa_core::{
+    Diagram, DiagramLayout, ProjectionKind, ScenarioLayout, language, source_project::ProjectLimits,
+};
+
+fn id(project: &Project, alias: &str) -> Id {
+    project
+        .identities()
+        .into_iter()
+        .find(|(_, name)| *name == alias)
+        .unwrap()
+        .0
+}
+
+fn fixture(layout: Option<ScenarioLayout>) -> (Document, Id, Id) {
+    let mut project = language::parse(FIXTURE).unwrap();
+    let owner = id(&project, "conversation");
+    let mut add = |alias: &str, layout: Option<ScenarioLayout>| {
+        let diagram = Id::new_v4();
+        project.diagrams.insert(
+            diagram,
+            Diagram {
+                id: diagram,
+                alias: alias.into(),
+                name: alias.into(),
+                description: String::new(),
+                layer: oa_core::Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: owner },
+                nodes: Default::default(),
+                routes: vec![],
+                view_options: Default::default(),
+                layout: layout.map(DiagramLayout::Scenario),
+            },
+        );
+        diagram
+    };
+    let a = add("saved_a", layout);
+    let b = add("saved_b", Some(ScenarioLayout::default()));
+    let document = Document::from_project(project, ProjectLimits::default()).unwrap();
+    (document, a, b)
+}
+
+fn resolved(project: &Project, diagram: Id, selected: Id) -> ResolvedScenarioPlan {
+    resolve(project, Representation::Saved { diagram }, selected).unwrap()
+}
+
+fn same_geometry(a: &ResolvedScenarioPlan, b: &ResolvedScenarioPlan) {
+    assert_eq!(a.bounds, b.bounds);
+    assert_eq!(a.lanes, b.lanes);
+    assert_eq!(a.plan.frames, b.plan.frames);
+    assert_eq!(a.plan.scopes, b.plan.scopes);
+    let (a, b) = (&a.scene, &b.scene);
+    assert_eq!(a.rows, b.rows);
+    assert_eq!(a.sequence_bounds, b.sequence_bounds);
+    assert_eq!(a.size, b.size);
+    assert_eq!(a.layout_origin, b.layout_origin);
+    assert_eq!(a.lanes, b.lanes);
+    assert_eq!(a.render_lanes, b.render_lanes);
+    assert_eq!(a.activations, b.activations);
+    assert_eq!(a.lifecycle, b.lifecycle);
+    assert_eq!(a.open_calls, b.open_calls);
+    let slots = |scene: &crate::behavior::Scene| {
+        scene
+            .slots
+            .iter()
+            .map(|item| {
+                (
+                    item.slot.parent,
+                    item.slot.before,
+                    item.y,
+                    item.label.clone(),
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(slots(a), slots(b));
+    let lines = |scene: &crate::behavior::Scene| {
+        scene
+            .lines
+            .iter()
+            .map(|line| {
+                (
+                    line.id,
+                    line.points.clone(),
+                    line.label_at,
+                    line.label.clone(),
+                    line.dashed,
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+    let boxes = |scene: &crate::behavior::Scene| {
+        scene
+            .boxes
+            .iter()
+            .map(|item| {
+                (
+                    item.id,
+                    item.rect,
+                    item.title.clone(),
+                    item.detail.clone(),
+                    item.marker,
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(lines(a), lines(b));
+    assert_eq!(boxes(a), boxes(b));
+}
+
+fn expected_message(project: &Project, diagram: Id, occurrence: Id, y: f32) -> Project {
+    // Independent expected mutation: tests begin with no message overrides.
+    let mut expected = project.clone();
+    expected.diagrams.get_mut(&diagram).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout {
+            lanes: vec![],
+            messages: vec![ScenarioMessagePosition {
+                address: OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence,
+                },
+                send_y: y,
+            }],
+        }));
+    expected
+}
+
+#[test]
+fn one_repeated_message_moves_in_one_view_with_exact_document_undo_redo_and_reopen() {
+    let (mut document, a, b) = fixture(None);
+    let original = document.snapshot();
+    let before = document.project().clone();
+    let first = id(&before, "first");
+    let second = id(&before, "second");
+    let baseline = resolved(&before, a, second);
+    assert_eq!(baseline.scene.rows[&first].1, 148.);
+    assert_eq!(baseline.scene.rows[&second].1, 240.);
+    let untouched = resolved(&before, b, second);
+    let drag = capture(&before, a, Target::Message(second)).unwrap();
+    let preview = drag.prepare(-40.).unwrap().unwrap();
+    let expected = expected_message(&before, a, second, 200.);
+    assert_eq!(preview.project, expected);
+    assert_eq!(preview.geometry.scene.rows[&first].1, 148.);
+    assert_eq!(preview.geometry.scene.rows[&second].1, 200.);
+    let line = preview
+        .geometry
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == second)
+        .unwrap();
+    assert_eq!(line.points.first().unwrap().y, 200.);
+    assert_eq!(line.points.last().unwrap().y, 200.);
+    assert_eq!(
+        preview.geometry.scene.activations,
+        baseline.scene.activations
+    );
+    assert_eq!(preview.geometry.scene.lifecycle, baseline.scene.lifecycle);
+    same_geometry(&resolved(&preview.project, b, second), &untouched);
+    assert_eq!(drag.original, before);
+    assert!(std::sync::Arc::ptr_eq(&original, &document.snapshot()));
+    assert!(!document.can_undo());
+
+    let returned_selection = document.execute(preview.command).unwrap();
+    assert_eq!(
+        returned_selection,
+        Some(a),
+        "controller must preserve the dragged semantic selection separately"
+    );
+    assert_eq!(document.project(), &expected);
+    assert_eq!(document.revision(), 1);
+    let accepted = document.bundle().clone();
+    same_geometry(&resolved(document.project(), a, second), &preview.geometry);
+    assert!(document.undo());
+    assert_eq!(document.project(), &before);
+    assert_eq!(document.bundle(), &original.bundle);
+    assert!(!document.can_undo());
+    assert!(document.redo());
+    assert_eq!(document.project(), &expected);
+    assert_eq!(document.bundle(), &accepted);
+    let reopened = Document::from_bundle(accepted, ProjectLimits::default()).unwrap();
+    assert_eq!(reopened.project(), &expected);
+    same_geometry(&resolved(reopened.project(), a, second), &preview.geometry);
+    assert!(!reopened.dirty() && !reopened.can_undo());
+}
+
+#[test]
+fn horizontal_lane_move_changes_actual_header_and_attached_endpoints_only_in_selected_view() {
+    let (document, a, b) = fixture(None);
+    let before = document.project();
+    let right = id(before, "right");
+    let first = id(before, "first");
+    let other = resolved(before, b, right);
+    let preview = capture(before, a, Target::Lane(right))
+        .unwrap()
+        .prepare(100.)
+        .unwrap()
+        .unwrap();
+    let mut expected = before.clone();
+    expected.diagrams.get_mut(&a).unwrap().layout = Some(DiagramLayout::Scenario(ScenarioLayout {
+        lanes: vec![ScenarioLanePosition {
+            lifeline: right,
+            x: 500.,
+        }],
+        messages: vec![],
+    }));
+    assert_eq!(preview.project, expected);
+    assert_eq!(preview.geometry.scene.lanes[&right], 500.);
+    let header = preview
+        .geometry
+        .scene
+        .boxes
+        .iter()
+        .find(|item| item.id == right)
+        .unwrap();
+    assert_eq!(header.rect.center_x(), 500.);
+    let line = preview
+        .geometry
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == first)
+        .unwrap();
+    assert_eq!(line.points.first().unwrap().x, 160.);
+    assert_eq!(line.points.last().unwrap().x, 500.);
+    assert!(line.points.iter().all(|point| point.y == 148.));
+    same_geometry(&resolved(&preview.project, b, right), &other);
+    assert_eq!(document.project(), before);
+    assert!(!document.dirty() && !document.can_undo());
+}
+
+#[test]
+fn drawn_unassigned_lifeline_can_move_without_assigning_a_semantic_participant() {
+    let (document, a, _) = fixture(None);
+    let mut project = document.project().clone();
+    let owner = id(&project, "conversation");
+    let lane = project
+        .add_element(
+            Kind::Lifeline,
+            oa_core::Layer::Oa,
+            "Unassigned header",
+            Some(owner),
+        )
+        .unwrap();
+    let document = Document::from_project(project, ProjectLimits::default()).unwrap();
+    let baseline = resolved(document.project(), a, lane);
+    assert!(!baseline.scene.lanes.contains_key(&lane));
+    let before_header = baseline
+        .scene
+        .boxes
+        .iter()
+        .find(|item| item.id == lane)
+        .unwrap()
+        .rect;
+    let preview = capture(document.project(), a, Target::Lane(lane))
+        .unwrap()
+        .prepare(70.)
+        .unwrap()
+        .unwrap();
+    let after_header = preview
+        .geometry
+        .scene
+        .boxes
+        .iter()
+        .find(|item| item.id == lane)
+        .unwrap()
+        .rect;
+    assert_eq!(after_header.x, before_header.x + 70.);
+    assert_eq!(after_header.y, before_header.y);
+    assert_eq!(after_header.size(), before_header.size());
+    assert_eq!(preview.project.elements, document.project().elements);
+    assert_eq!(preview.project.relations, document.project().relations);
+    assert!(!document.can_undo());
+}
+
+#[test]
+fn self_call_spacing_uses_send_y_and_preserves_reply_and_actual_activation_finish() {
+    let (document, a, _) = fixture(None);
+    let before = document.project();
+    let call = id(before, "call");
+    let reply = id(before, "reply");
+    let baseline = resolved(before, a, call);
+    let preview = capture(before, a, Target::Message(call))
+        .unwrap()
+        .prepare(-22.)
+        .unwrap()
+        .unwrap();
+    assert_eq!(preview.project, expected_message(before, a, call, 310.));
+    let line = preview
+        .geometry
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == call)
+        .unwrap();
+    assert_eq!(line.points.first().unwrap().y, 310.);
+    assert_eq!(line.points.last().unwrap().y, 334.);
+    assert_eq!(preview.geometry.scene.rows[&reply].1, 424.);
+    assert_eq!(preview.geometry.scene.activations.len(), 1);
+    let mut expected_activation = baseline.scene.activations.clone();
+    expected_activation[0].rect.y = 334.;
+    expected_activation[0].rect.height = 90.;
+    assert_eq!(preview.geometry.scene.activations, expected_activation);
+    assert_eq!(preview.geometry.scene.lifecycle, baseline.scene.lifecycle);
+}
+
+#[test]
+fn feasible_spacing_crossing_remains_authored_with_diagnostic_and_unchanged_steps() {
+    let (document, a, _) = fixture(None);
+    let before = document.project();
+    let first = id(before, "first");
+    let second = id(before, "second");
+    let owner = id(before, "conversation");
+    let preview = capture(before, a, Target::Message(second))
+        .unwrap()
+        .prepare(-120.)
+        .unwrap()
+        .unwrap();
+    assert_eq!(preview.project, expected_message(before, a, second, 120.));
+    assert_eq!(preview.geometry.scene.rows[&second].1, 120.);
+    assert_eq!(preview.geometry.scene.rows[&first].1, 148.);
+    assert_eq!(
+        preview.project.elements[&owner].steps(),
+        before.elements[&owner].steps()
+    );
+    let shown = crate::behavior::scenario_layout::presentation::present(
+        &preview.project,
+        Representation::Saved { diagram: a },
+        second,
+    );
+    assert!(shown.capabilities().coordinate_input);
+    assert!(
+        shown
+            .diagnostics()
+            .contains(&Diagnostic::SourceOrderCrossing {
+                scope: owner,
+                before: first,
+                after: second
+            })
+    );
+}
+
+#[test]
+fn unsupported_self_call_move_is_refused_and_automatic_fallback_is_not_editable_capture() {
+    let (document, a, _) = fixture(None);
+    let before = document.project();
+    let call = id(before, "call");
+    let drag = capture(before, a, Target::Message(call)).unwrap();
+    let Err(Refusal::Geometry(issues)) = drag.prepare(118.) else {
+        panic!("send450 / receive474 after reply424 must be refused")
+    };
+    assert!(issues.iter().any(|issue| matches!(issue, GeometryIssue::TypedActivationCrossingNotSupported { call: id, .. } if *id == call)));
+    assert_eq!(&drag.original, before);
+    let invalid_geometry = expected_message(before, a, call, 450.);
+    let shown = crate::behavior::scenario_layout::presentation::present(
+        &invalid_geometry,
+        Representation::Saved { diagram: a },
+        call,
+    );
+    assert!(shown.capabilities().geometry_navigation && !shown.capabilities().coordinate_input);
+    assert!(matches!(
+        capture(&invalid_geometry, a, Target::Message(call)),
+        Err(Refusal::Geometry(_))
+    ));
+    assert!(!document.dirty() && !document.can_undo());
+}
+
+#[test]
+fn invalid_view_foreign_identity_and_latent_message_are_not_spacing_targets() {
+    let (document, a, b) = fixture(None);
+    let p = document.project();
+    let unfinished = id(p, "unfinished");
+    let source = id(p, "source");
+    assert!(matches!(
+        capture(p, Id::nil(), Target::Lane(source)),
+        Err(Refusal::InvalidSavedView(_))
+    ));
+    for target in [
+        Target::Lane(source),
+        Target::Lane(b),
+        Target::Message(source),
+        Target::Message(unfinished),
+    ] {
+        assert!(
+            matches!(capture(p, a, target), Err(Refusal::TargetNotRendered(found)) if found == target)
+        );
+    }
+    // A stored latent coordinate is not permission to fabricate a painted arrow.
+    let mut latent = expected_message(p, a, unfinished, 2000.);
+    let foreign_owner = latent
+        .add_element(Kind::Scenario, oa_core::Layer::Oa, "Foreign", None)
+        .unwrap();
+    let foreign_lane = latent
+        .add_element(
+            Kind::Lifeline,
+            oa_core::Layer::Oa,
+            "Foreign lane",
+            Some(foreign_owner),
+        )
+        .unwrap();
+    *latent
+        .elements
+        .get_mut(&foreign_lane)
+        .unwrap()
+        .shared_mut()
+        .unwrap() = SharedBody::Lifeline {
+        represented: Some(source),
+    };
+    let latent_document = Document::from_project(latent, ProjectLimits::default()).unwrap();
+    assert!(matches!(
+        capture(latent_document.project(), a, Target::Message(unfinished)),
+        Err(Refusal::TargetNotRendered(_))
+    ));
+    assert!(matches!(
+        capture(latent_document.project(), a, Target::Lane(foreign_lane)),
+        Err(Refusal::TargetNotRendered(_))
+    ));
+}
+
+#[test]
+fn zero_motion_return_to_start_and_subprecision_preserve_sparse_intent_and_real_redo() {
+    let parsed = language::parse(FIXTURE).unwrap();
+    let left = id(&parsed, "left");
+    let second = id(&parsed, "second");
+    let layouts = [
+        None,
+        Some(ScenarioLayout::default()),
+        Some(ScenarioLayout {
+            lanes: vec![],
+            messages: vec![ScenarioMessagePosition {
+                address: OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: second,
+                },
+                send_y: 240.,
+            }],
+        }),
+        Some(ScenarioLayout {
+            lanes: vec![ScenarioLanePosition {
+                lifeline: left,
+                x: -0.,
+            }],
+            messages: vec![],
+        }),
+    ];
+    for (index, layout) in layouts.into_iter().enumerate() {
+        let (mut document, a, _) = fixture(layout);
+        let owner = id(document.project(), "conversation");
+        document
+            .execute(Command::Rename(owner, "A real redo entry".into()))
+            .unwrap();
+        let redo = document.snapshot();
+        assert!(document.undo());
+        let before = document.snapshot();
+        let revision = document.revision();
+        let target = if index == 3 {
+            Target::Lane(left)
+        } else {
+            Target::Message(second)
+        };
+        let drag = capture(document.project(), a, target).unwrap();
+        if index == 3 {
+            let Some(DiagramLayout::Scenario(layout)) = &drag.original.diagrams[&a].layout else {
+                panic!()
+            };
+            assert_eq!(layout.lanes[0].x.to_bits(), (-0_f32).to_bits());
+        }
+        assert!(drag.prepare(10.).unwrap().is_some());
+        for delta in [0., -0.] {
+            assert!(drag.prepare(delta).unwrap().is_none());
+        }
+        if index != 3 {
+            assert!(drag.prepare(f32::from_bits(1)).unwrap().is_none());
+        }
+        assert_eq!(
+            serde_json::to_vec(&drag.original).unwrap(),
+            serde_json::to_vec(document.project()).unwrap()
+        );
+        assert!(std::sync::Arc::ptr_eq(&before, &document.snapshot()));
+        assert_eq!(document.bundle(), &before.bundle);
+        assert_eq!(document.revision(), revision);
+        assert!(document.can_redo());
+        assert!(document.redo());
+        assert_eq!(document.project(), &redo.decoded.project);
+        assert_eq!(document.bundle(), &redo.bundle);
+    }
+}
+
+#[test]
+fn malformed_or_out_of_range_motion_cannot_mutate_original() {
+    let (document, a, _) = fixture(None);
+    let drag = capture(
+        document.project(),
+        a,
+        Target::Message(id(document.project(), "second")),
+    )
+    .unwrap();
+    for delta in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+        assert!(matches!(drag.prepare(delta), Err(Refusal::InvalidDelta)));
+    }
+    assert!(matches!(drag.prepare(f32::MAX), Err(Refusal::Command(_))));
+    assert_eq!(&drag.original, document.project());
+    assert!(!document.dirty() && !document.can_undo());
+}
+
+const FIXTURE: &str = r#"arcadia 7;
+project spacing_probe "Saved spacing probe" id "71000000-0000-4000-8000-000000000001" {
+ oa_activity source "Source" id "71000000-0000-4000-8000-000000000002" {}
+ oa_activity target "Target" id "71000000-0000-4000-8000-000000000003" {}
+ interaction exchange "Repeated exchange" id "71000000-0000-4000-8000-000000000004" { source @source; target @target; }
+ oa_scenario conversation "Conversation" id "71000000-0000-4000-8000-000000000005" { viewpoint OperationalActivity; steps [@first, @second, @call, @reply, @unfinished]; }
+ oa_lifeline left "Left" id "71000000-0000-4000-8000-000000000006" { parent @conversation; represented @source; }
+ oa_lifeline right "Right" id "71000000-0000-4000-8000-000000000007" { parent @conversation; represented @target; }
+ oa_occurrence first "First" id "71000000-0000-4000-8000-000000000008" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver @right; message_kind Asynchronous; }; }; }
+ oa_occurrence second "Second" id "71000000-0000-4000-8000-000000000009" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver @right; message_kind Asynchronous; }; }; }
+ oa_occurrence call "Call" id "71000000-0000-4000-8000-00000000000a" { parent @conversation; body { Exchange { exchange none; sender @right; receiver @right; message_kind Call; }; }; }
+ oa_occurrence reply "Reply" id "71000000-0000-4000-8000-00000000000b" { parent @conversation; body { Exchange { exchange none; sender @right; receiver @right; message_kind Reply; reply_to @call; }; }; }
+ oa_occurrence unfinished "Unfinished" id "71000000-0000-4000-8000-00000000000c" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver none; message_kind Asynchronous; }; }; }
+}
+"#;

crates/oa-desktop/src/behavior/scenario/usage.rs

@@ -1,5 +1,6 @@
 //! Navigation is derived from the same opaque-reference scene that is painted.
 use super::*;
+use crate::behavior::scenario_layout::{Representation, presentation};
 use crate::diagram_usage::{Surface, Target, Usage};
 
 /// The renderer collapses whitespace before shortening. Require at least one
@@ -22,7 +23,14 @@ fn label_field_visible(full: &str, prefix: &str, value: &str) -> bool {
     start < retained
 }
 
-fn usages(p: &Project, owner: Id, subject: Id, scene: &Scene) -> Vec<Usage> {
+fn usages(
+    p: &Project,
+    owner: Id,
+    subject: Id,
+    surface: Surface,
+    bounds: Rectangle,
+    scene: &Scene,
+) -> Vec<Usage> {
     let mut result = Vec::new();
     let mut add = |id, bounds, role: &str| {
         // Activation bars share the occurrence identity with a labelled message;
@@ -33,7 +41,7 @@ fn usages(p: &Project, owner: Id, subject: Id, scene: &Scene) -> Vec<Usage> {
         {
             result.push(Usage {
                 subject,
-                surface: Surface::Scenario(owner),
+                surface,
                 target: Target::ScenarioObject(id),
                 role: role.into(),
                 bounds,
@@ -137,15 +145,15 @@ fn usages(p: &Project, owner: Id, subject: Id, scene: &Scene) -> Vec<Usage> {
             }
         }
     }
-    if subject == owner {
+    if subject == owner || subject == surface.id() {
         result.insert(
             0,
             Usage {
                 subject,
-                surface: Surface::Scenario(owner),
+                surface,
                 target: Target::Whole,
                 role: "scenario".into(),
-                bounds: Rectangle::new(Point::ORIGIN, scene.size),
+                bounds,
             },
         );
     }
@@ -153,15 +161,29 @@ fn usages(p: &Project, owner: Id, subject: Id, scene: &Scene) -> Vec<Usage> {
 }
 
 impl State {
-    pub(crate) fn diagram_usages(&self, p: &Project, owner: Id, subject: Id) -> Vec<Usage> {
-        if !p
-            .elements
-            .get(&owner)
-            .is_some_and(|e| e.kind() == Kind::Scenario)
-        {
+    /// Membership comes from the complete presentation chosen for this exact view,
+    /// including automatic fallback geometry while retaining its Saved identity.
+    pub(crate) fn representation_usages(
+        &self,
+        p: &Project,
+        representation: Representation,
+        subject: Id,
+    ) -> Vec<Usage> {
+        let shown = presentation::present(p, representation, subject);
+        let (Some(owner), Some(bounds), Some(scene)) =
+            (shown.owner(), shown.bounds(), shown.scene())
+        else {
             return vec![];
-        }
-        usages(p, owner, subject, &Scene::sequence(p, owner, subject))
+        };
+        let surface = match representation {
+            Representation::Derived { owner } => Surface::Scenario(owner),
+            Representation::Saved { diagram } => Surface::Saved(diagram),
+        };
+        usages(p, owner, subject, surface, bounds, scene)
+    }
+
+    pub(crate) fn diagram_usages(&self, p: &Project, owner: Id, subject: Id) -> Vec<Usage> {
+        self.representation_usages(p, Representation::Derived { owner }, subject)
     }
 
     pub(crate) fn reveal_usage(
@@ -171,12 +193,24 @@ impl State {
         owner: Id,
         target: &Target,
     ) -> bool {
-        if self.draft.is_some()
-            || !p
-                .elements
-                .get(&owner)
-                .is_some_and(|e| e.kind() == Kind::Scenario)
-        {
+        self.reveal_representation_usage(
+            p,
+            document,
+            owner,
+            Representation::Derived { owner },
+            target,
+        )
+    }
+
+    pub(crate) fn reveal_representation_usage(
+        &mut self,
+        p: &Project,
+        document: Id,
+        owner: Id,
+        representation: Representation,
+        target: &Target,
+    ) -> bool {
+        if self.draft.is_some() || presentation::checked_owner(p, representation) != Some(owner) {
             return false;
         }
         let id = match target {
@@ -185,7 +219,7 @@ impl State {
             _ => return false,
         };
         let Some(usage) = self
-            .diagram_usages(p, owner, id)
+            .representation_usages(p, representation, id)
             .into_iter()
             .find(|u| &u.target == target)
         else {
@@ -193,11 +227,29 @@ impl State {
         };
         // Preserve an existing mounted viewport across enter's owner reset.
         let viewport = self.presentation.viewport.unwrap_or(Size::new(500., 300.));
-        self.enter(document, owner);
+        if !viewport.width.is_finite()
+            || !viewport.height.is_finite()
+            || viewport.width <= 0.
+            || viewport.height <= 0.
+        {
+            return false;
+        }
+        let (zoom, pan) = if matches!(target, Target::Whole) {
+            let Some(camera) = super::camera::fit(usage.bounds, viewport) else {
+                return false;
+            };
+            (None, camera.pan)
+        } else {
+            let (zoom, pan) = crate::diagram_usage::camera_for(target, usage.bounds, viewport);
+            if !zoom.is_finite() || !pan.x.is_finite() || !pan.y.is_finite() {
+                return false;
+            }
+            (Some(zoom), pan)
+        };
+        self.enter_representation(document, owner, representation);
         self.presentation.viewport = Some(viewport);
         self.canvas_tool = Some((owner, CanvasTool::Select));
-        let (zoom, pan) = crate::diagram_usage::camera_for(target, usage.bounds, viewport);
-        self.presentation.zoom(Some(zoom));
+        self.presentation.zoom(zoom);
         self.presentation.pan = pan;
         true
     }

crates/oa-desktop/src/behavior/scenario/workspace.rs

@@ -13,6 +13,8 @@ pub enum Shelf {
 #[derive(Clone, Default)]
 pub(super) struct Presentation {
     pub(super) identity: Option<(Id, Id)>,
+    pub(super) representation: Option<Representation>,
+    pub(super) visit: Id,
     pub(super) viewport: Option<Size>,
     pub(super) focused: bool,
     pub(super) shelf: Option<Shelf>,
@@ -20,7 +22,6 @@ pub(super) struct Presentation {
     pub(super) zoom: Option<f32>,
     pub(super) fit: bool,
 }
-const MIN_SCALE: f32 = 0.05;
 impl Presentation {
     pub(super) fn viewport(&mut self, size: Size) -> bool {
         if !size.width.is_finite()
@@ -35,29 +36,26 @@ impl Presentation {
         true
     }
     pub(super) fn zoom(&mut self, scale: Option<f32>) -> bool {
-        if scale.is_some_and(|value| !value.is_finite() || value <= 0.) {
-            return false;
-        }
-        let next = scale.map(|value| value.clamp(MIN_SCALE, 3.));
-        let changed = self.zoom != next || self.fit != scale.is_none();
-        self.zoom = next;
-        self.fit = scale.is_none();
-        changed
+        camera::set_zoom(&mut self.pan, &mut self.zoom, &mut self.fit, scale)
     }
-    fn fit_scale(&self, scene: Size) -> Option<f32> {
-        let viewport = self.viewport?;
-        // Fit uses the actual mounted viewport with a small visual gutter.
-        Some(
-            ((viewport.width - 16.).max(1.) / scene.width.max(1.))
-                .min((viewport.height - 16.).max(1.) / scene.height.max(1.)),
-        )
+    pub(super) fn camera(&self, bounds: Rectangle) -> camera::Camera {
+        camera::effective_camera(self.pan, self.zoom, self.fit, self.viewport, bounds)
     }
-    pub(super) fn scale(&self, scene: Size) -> f32 {
-        if self.fit {
-            self.fit_scale(scene).unwrap_or(1.).clamp(MIN_SCALE, 1.)
-        } else {
-            self.zoom.unwrap_or(1.)
-        }
+    // Legacy tests call size-only scale; actual display always passes full bounds.
+    #[cfg(test)]
+    pub(super) fn scale(&self, size: Size) -> f32 {
+        self.camera(Rectangle::new(Point::ORIGIN, size)).scale
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct ArrangementChoice {
+    representation: Representation,
+    label: String,
+}
+impl std::fmt::Display for ArrangementChoice {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.label)
     }
 }
 
@@ -69,43 +67,136 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
         .draft
         .as_ref()
         .is_some_and(|draft| draft.owner == owner);
-    let context = app.scenario_context().expect("visible scenario context");
+    let Some(context) = app.scenario_context() else {
+        return column![
+            out,
+            text("Scenario view is unavailable."),
+            button("Open selected source").on_press(Message::SourceForSelection)
+        ]
+        .spacing(8)
+        .into();
+    };
     let tool = state.canvas_tool(owner);
     let clean = !app.behavior.has_pending() && !app.draft_dirty() && !app.source_dirty();
-    let mut scene = Scene::sequence(p, owner, app.selected);
-    let scale = presentation.scale(scene.size);
-    scene.scale = scale;
-    scene.camera_pan = presentation.pan;
-    scene.interaction = Some((context, tool, clean));
-    scene.pending_placement = state.pending_placement(owner);
+    // Resolve once per accepted view. An active spacing session owns its exact
+    // prepared geometry; borrowing it also retains the canvas input state.
+    let preview = state.spacing_paint(context, app.camera_epoch);
+    let shown = preview
+        .is_none()
+        .then(|| presentation::present(p, context.representation, app.selected));
+    let capabilities = shown.as_ref().map_or(
+        presentation::PresentationCapabilities {
+            geometry_navigation: true,
+            coordinate_input: true,
+        },
+        ScenarioPresentation::capabilities,
+    );
+    let coordinate_input = clean && capabilities.coordinate_input;
+    let notice = if let Some(paint) = &preview {
+        display_notice_parts(
+            p,
+            context.representation,
+            &presentation::PresentationStatus::Ready,
+            paint.original_diagnostics,
+            paint.original_latent,
+        )
+    } else {
+        display_notice(p, shown.as_ref().expect("normal presentation"))
+    };
+    let camera_state = preview
+        .as_ref()
+        .map(|paint| camera::Camera {
+            scale: paint.scene.scale,
+            pan: paint.scene.camera_pan,
+        })
+        .or_else(|| {
+            shown
+                .as_ref()
+                .and_then(ScenarioPresentation::bounds)
+                .map(|bounds| presentation.camera(bounds))
+        });
+    let scale = camera_state.map_or(1., |camera| camera.scale);
     let scope = super::super::canvas_workspace::Scope {
         document: context.document,
         owner,
         revision: context.revision,
         epoch: app.camera_epoch,
+        scenario_view: Some((context.representation, context.visit)),
     };
-    let keyboard = clean && super::super::canvas_workspace::keyboard_enabled(app);
+    let keyboard = clean
+        && capabilities.geometry_navigation
+        && super::super::canvas_workspace::keyboard_enabled(app);
     let camera = move |e| Message::ScenarioCanvas(CanvasEvent::Camera(context, scope.epoch, e));
-    let canvas = container(
-        sensor(
-            super::super::canvas_workspace::Viewport::new(
-                canvas::Canvas::new(scene).width(Fill).height(Fill),
-                scope,
-                scale,
-                keyboard,
-                camera,
-            )
-            .pan_background(tool == CanvasTool::Select),
+    let raw_canvas: Option<Element<'a, Message>> = if let Some(paint) = &preview {
+        Some(
+            canvas::Canvas::new(paint.scene)
+                .width(Fill)
+                .height(Fill)
+                .into(),
         )
-        .key((context.document, owner))
-        .on_show(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size)))
-        .on_resize(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size))),
-    )
-    .id("scenario-viewport")
-    .width(Fill)
-    .height(Fill)
-    .style(style::card)
-    .into();
+    } else if let Some(mut scene) = shown.and_then(ScenarioPresentation::into_scene) {
+        let camera_state = camera_state.expect("displayed Scene has complete bounds");
+        scene.scale = camera_state.scale;
+        scene.camera_pan = camera_state.pan;
+        scene.interaction = Some((context, tool, clean));
+        scene.spacing_stamp = (coordinate_input
+            && !app.source_rename.open()
+            && keyboard
+            && matches!(context.representation, Representation::Saved { .. }))
+        .then_some(spacing::Stamp {
+            context,
+            camera_epoch: app.camera_epoch,
+        });
+        scene.coordinate_input = capabilities.coordinate_input;
+        scene.pending_placement = coordinate_input
+            .then(|| state.pending_placement(owner))
+            .flatten();
+        Some(canvas::Canvas::new(scene).width(Fill).height(Fill).into())
+    } else {
+        None
+    };
+    let canvas: Element<'a, Message> = if let Some(raw_canvas) = raw_canvas {
+        // Keep this Stack in both branches: replacing the Canvas with a wrapper
+        // on Begin would discard its pointer capture before Move/Finish.
+        let mut layers = iced::widget::stack![raw_canvas];
+        if let Some(paint) = &preview {
+            let feedback = spacing_feedback(p, paint.refusal, paint.diagnostics);
+            layers = layers.push(
+                container(
+                    container(text(feedback).size(12))
+                        .padding(6)
+                        .width(Fill)
+                        .style(style::card),
+                )
+                .width(Fill)
+                .align_bottom(Fill)
+                .padding(8),
+            );
+        }
+        container(
+            sensor(
+                super::super::canvas_workspace::Viewport::new(
+                    layers, scope, scale, keyboard, camera,
+                )
+                .pan_background(tool == CanvasTool::Select || !capabilities.coordinate_input),
+            )
+            .key((
+                context.document,
+                format!("{:?}", context.representation),
+                context.visit,
+            ))
+            .on_show(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size)))
+            .on_resize(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size))),
+        )
+        .id("scenario-viewport")
+        .width(Fill)
+        .height(Fill)
+        .style(style::card)
+        .into()
+    } else {
+        container(text("No supported canvas geometry is available. Inspect the model or open its source to repair this view."))
+            .id("scenario-viewport-unavailable").padding(16).width(Fill).height(Fill).style(style::card).into()
+    };
     let mut navigation = row![
         out.width(Fill),
         super::super::canvas_workspace::Control::new(
@@ -141,9 +232,47 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
                 clean.then_some(Message::ScenarioCanvas(CanvasEvent::Back(context))),
             ));
     }
-    let header = column![
-        navigation,
-        super::super::canvas_workspace::controls(
+    let mut header = column![navigation, notice].spacing(4);
+    let saved_views = p
+        .diagrams
+        .values()
+        .filter(|diagram| {
+            presentation::checked_owner(
+                p,
+                Representation::Saved {
+                    diagram: diagram.id,
+                },
+            ) == Some(owner)
+        })
+        .map(|diagram| ArrangementChoice {
+            representation: Representation::Saved {
+                diagram: diagram.id,
+            },
+            label: short(&diagram.name, 64),
+        })
+        .collect::<Vec<_>>();
+    if !saved_views.is_empty() {
+        let mut choices = vec![ArrangementChoice {
+            representation: Representation::Derived { owner },
+            label: "Automatic arrangement".into(),
+        }];
+        choices.extend(saved_views);
+        let selected = choices
+            .iter()
+            .find(|choice| choice.representation == context.representation)
+            .cloned();
+        header = header.push(
+            pick_list(choices, selected, move |choice: ArrangementChoice| {
+                Message::ScenarioCanvas(CanvasEvent::Representation(context, choice.representation))
+            })
+            .placeholder("Choose arrangement")
+            .text_size(12)
+            .padding(5)
+            .width(Fill),
+        );
+    }
+    if capabilities.geometry_navigation {
+        header = header.push(super::super::canvas_workspace::controls(
             scope,
             keyboard,
             scale,
@@ -151,15 +280,22 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
             clean.then_some(Message::ScenarioCanvas(CanvasEvent::Camera(
                 context,
                 scope.epoch,
-                super::super::canvas_workspace::Event::Focus
+                super::super::canvas_workspace::Event::Focus,
             ))),
             move |zoom| Message::ScenarioCanvas(CanvasEvent::Zoom(context, zoom)),
-            camera
-        )
-    ]
-    .spacing(4);
+            camera,
+        ));
+    }
     let entries = [
-        ("S", "Select / reorder occurrences", CanvasTool::Select),
+        (
+            "S",
+            if matches!(context.representation, Representation::Saved { .. }) {
+                "Select / move messages and lifelines"
+            } else {
+                "Select / reorder occurrences"
+            },
+            CanvasTool::Select,
+        ),
         (
             "L",
             "Lifeline: click to choose represented work or participant",
@@ -226,9 +362,10 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
                 glyph,
                 label,
                 choice == tool,
-                clean.then_some(Message::ScenarioCanvas(CanvasEvent::Choose(
-                    context, choice,
-                ))),
+                (clean && (choice == CanvasTool::Select || capabilities.coordinate_input))
+                    .then_some(Message::ScenarioCanvas(CanvasEvent::Choose(
+                        context, choice,
+                    ))),
             )
         }),
     );
@@ -246,6 +383,10 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
             ))),
         ));
     }
+    details = details.push(text("Scenario order").size(13));
+    if matches!(context.representation, Representation::Saved { .. }) {
+        details = details.push(text("↑ and ↓ change the shared Scenario order. Saved message positions are retained; automatically placed items may move.").size(11));
+    }
     let details = details_pane(
         context,
         state.scroll_restore(context, ScrollArea::Page),
@@ -575,6 +716,153 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
     super::super::canvas_workspace::host(header.into(), palette, canvas, editor)
 }
 
+fn display_notice<'a>(p: &Project, shown: &ScenarioPresentation) -> Element<'a, Message> {
+    display_notice_parts(
+        p,
+        shown.requested(),
+        shown.status(),
+        shown.diagnostics(),
+        shown.latent_messages(),
+    )
+}
+
+fn display_notice_parts<'a>(
+    p: &Project,
+    requested: Representation,
+    status: &presentation::PresentationStatus,
+    diagnostics: &[super::super::scenario_layout::Diagnostic],
+    latent_messages: &[Id],
+) -> Element<'a, Message> {
+    use super::super::scenario_layout::{Diagnostic, presentation::PresentationStatus};
+    let title = match requested {
+        Representation::Saved { diagram } => p.diagrams.get(&diagram).map_or_else(
+            || "Unavailable saved Scenario view".into(),
+            |view| format!("Saved view · {}", view.name),
+        ),
+        Representation::Derived { owner } => format!("Automatic view · {}", p.named(owner)),
+    };
+    let mut notice = column![text(title).size(14)].spacing(4);
+    match status {
+        PresentationStatus::Ready => {
+            for diagnostic in diagnostics.iter().take(3) {
+                let explanation = match diagnostic {
+                    Diagnostic::SourceOrderCrossing { before, after, .. } => format!(
+                        "Saved spacing places '{}' below '{}'. The Scenario order is unchanged.",
+                        p.named(*before),
+                        p.named(*after)
+                    ),
+                    Diagnostic::FrameExtendsPastFollowingAnchor { frame, following } => format!(
+                        "Saved spacing makes '{}' overlap '{}'. Both keep their saved positions.",
+                        p.named(*frame),
+                        p.named(*following)
+                    ),
+                };
+                notice = notice.push(text(explanation).size(12));
+            }
+            if diagnostics.len() > 3 {
+                notice = notice.push(
+                    text(format!(
+                        "{} additional spacing notices are retained.",
+                        diagnostics.len() - 3
+                    ))
+                    .size(12),
+                );
+            }
+        }
+        PresentationStatus::Fallback { requested_issues } => {
+            notice = notice.push(text("Showing the complete automatic arrangement because the saved positions cannot currently be displayed. Saved positions are preserved.").size(12));
+            if let Some(issue) = requested_issues.first() {
+                notice = notice.push(text(geometry_problem(p, issue)).size(12));
+            }
+            notice = notice.push(text("Selection, navigation and Fit remain available. Canvas insertion and reordering are unavailable until the saved positions are repaired.").size(12));
+        }
+        PresentationStatus::Unavailable { .. } => {
+            notice = notice.push(text("This view is unavailable. Its identity or automatic geometry cannot be resolved; the model and source remain available for inspection and repair.").size(12));
+        }
+    }
+    if !latent_messages.is_empty() {
+        notice = notice.push(text(format!("{} unfinished message position(s) are retained until their endpoints are complete.", latent_messages.len())).size(12));
+    }
+    notice = notice.push(button("Open selected source").on_press(Message::SourceForSelection));
+    container(notice)
+        .id("scenario-display-notice")
+        .padding(6)
+        .width(Fill)
+        .into()
+}
+
+fn spacing_feedback(
+    p: &Project,
+    refusal: Option<&spacing::Refusal>,
+    diagnostics: &[super::super::scenario_layout::Diagnostic],
+) -> String {
+    if let Some(refusal) = refusal {
+        let reason = match refusal {
+            spacing::Refusal::Geometry(issues) => issues
+                .first()
+                .map(|issue| geometry_problem(p, issue))
+                .unwrap_or_else(|| "This position cannot be displayed.".into()),
+            spacing::Refusal::Command(error) => error.clone(),
+            _ => "This position is unavailable in the current view.".into(),
+        };
+        return format!(
+            "Position unavailable · {reason} Move back to a supported position, or release to cancel."
+        );
+    }
+    let explanation = match diagnostics.first() {
+        Some(super::super::scenario_layout::Diagnostic::SourceOrderCrossing {
+            before,
+            after,
+            ..
+        }) => format!(
+            " '{}' is below '{}'; Scenario order stays unchanged.",
+            p.named(*before),
+            p.named(*after)
+        ),
+        Some(super::super::scenario_layout::Diagnostic::FrameExtendsPastFollowingAnchor {
+            frame,
+            following,
+        }) => format!(" '{}' overlaps '{}'.", p.named(*frame), p.named(*following)),
+        None => " Scenario order stays unchanged.".into(),
+    };
+    format!("Spacing preview · Release to finish; Escape cancels.{explanation}")
+}
+
+fn geometry_problem(p: &Project, issue: &super::super::scenario_layout::GeometryIssue) -> String {
+    use super::super::scenario_layout::GeometryIssue;
+    match issue {
+        GeometryIssue::TypedActivationCrossingNotSupported { call, event } => format!(
+            "The position of '{}' conflicts with the execution of '{}'.",
+            p.named(*event),
+            p.named(*call)
+        ),
+        GeometryIssue::CoincidentDistinctEndpoints(message) => format!(
+            "The distinct endpoints of '{}' have the same horizontal position.",
+            p.named(*message)
+        ),
+        GeometryIssue::TypedActivationOutsideLifetime { call, .. }
+        | GeometryIssue::TypedActivationOutsideScope { call, .. } => format!(
+            "The position of '{}' falls outside its supported execution interval.",
+            p.named(*call)
+        ),
+        GeometryIssue::FixedFrameHeaderWouldMove { frame } => format!(
+            "The saved spacing would move the fixed header of '{}'.",
+            p.named(*frame)
+        ),
+        GeometryIssue::OperandScopeOutsideEnclosingInterval { operand, .. } => format!(
+            "The spacing of '{}' extends outside its enclosing frame.",
+            p.named(*operand)
+        ),
+        GeometryIssue::LifecycleGeometryNotSupported { .. }
+        | GeometryIssue::LifecycleAnchorOutsideRenderScope { .. }
+        | GeometryIssue::LifetimeInversionNotSupported { .. } => {
+            "The saved spacing cannot preserve the participant lifetime geometry.".into()
+        }
+        _ => "These saved positions are outside the geometry currently supported by the canvas."
+            .into(),
+    }
+}
+
 fn sequence_action<'a>(
     title: &str,
     message: Message,
@@ -631,6 +919,9 @@ fn editor_panel<'a, R: iced::advanced::text::Renderer + 'a>(
 #[cfg(all(test, debug_assertions))]
 mod tests;
 
+#[cfg(all(test, debug_assertions))]
+mod spacing_tests;
+
 fn sequence_rows<'a>(
     p: &'a Project,
     context: Context,

crates/oa-desktop/src/behavior/scenario/workspace/spacing_tests.rs

@@ -0,0 +1,420 @@
+//! Real mounted widgets dispatch the gesture; expectations name authored fields
+//! and actual displayed anchors independently of controller command results.
+use super::*;
+use crate::behavior::canvas_workspace::tests::{Mounted, key};
+use crate::behavior::scenario_layout::{ResolvedScenarioPlan, resolve};
+use crate::document::Document;
+use iced::Vector;
+use std::sync::Arc;
+
+const FIXTURE: &str = include_str!("../../../app/diagram_usages/tests/saved_scenario.arcadia");
+
+fn id(app: &App, alias: &str) -> Id {
+    app.project()
+        .identities()
+        .into_iter()
+        .find(|(_, name)| *name == alias)
+        .unwrap()
+        .0
+}
+
+async fn setup(fit: bool) -> (App, Mounted, Id) {
+    let mut app = App::with_project(oa_core::language::parse(FIXTURE).unwrap());
+    let owner = id(&app, "incident_response");
+    let diagram = id(&app, "incident_readable");
+    let _ = app.update(Message::Select(owner));
+    let _ = app.update(Message::Diagram(crate::app::Choice {
+        id: diagram,
+        label: "A - Incident review readable".into(),
+    }));
+    app.window_size = Size::new(1440., 900.);
+    let mut mounted = Mounted::new(&mut app).await;
+    if !fit {
+        let context = app.scenario_context().unwrap();
+        let task = app.update(Message::ScenarioCanvas(CanvasEvent::Zoom(
+            context,
+            Some(0.5),
+        )));
+        mounted.perform(&mut app, task).await;
+        mounted.settle(&mut app).await;
+    }
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved { diagram }
+    );
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+    (app, mounted, diagram)
+}
+
+fn resolved(app: &App) -> ResolvedScenarioPlan {
+    resolve(
+        app.project(),
+        app.scenario_context().unwrap().representation,
+        app.selected,
+    )
+    .unwrap()
+}
+
+fn stored_camera(app: &App) -> (Vector, Option<f32>, bool) {
+    let p = &app.behavior.scenario.presentation;
+    (p.pan, p.zoom, p.fit)
+}
+
+fn screen(mounted: &mut Mounted, app: &App, world: Point) -> Point {
+    let bounds = mounted.geometry(app).bounds("scenario-viewport");
+    let geometry = resolved(app);
+    let camera = app.behavior.scenario.presentation.camera(geometry.bounds);
+    let point = bounds.position() + camera.pan + Vector::new(world.x, world.y) * camera.scale;
+    assert!(
+        bounds.contains(point),
+        "actual visible world {world:?}: {point:?} in {bounds:?}"
+    );
+    point
+}
+
+fn mouse_event(event: mouse::Event) -> iced::Event {
+    iced::Event::Mouse(event)
+}
+
+async fn press(mounted: &mut Mounted, app: &mut App, point: Point) -> Vec<Message> {
+    mounted
+        .batch(
+            app,
+            &[
+                mouse_event(mouse::Event::CursorMoved { position: point }),
+                mouse_event(mouse::Event::ButtonPressed(mouse::Button::Left)),
+            ],
+            mouse::Cursor::Available(point),
+        )
+        .await
+}
+
+async fn move_to(mounted: &mut Mounted, app: &mut App, point: Point) -> Vec<Message> {
+    mounted
+        .batch(
+            app,
+            &[mouse_event(mouse::Event::CursorMoved { position: point })],
+            mouse::Cursor::Available(point),
+        )
+        .await
+}
+
+async fn release(mounted: &mut Mounted, app: &mut App, point: Point) -> Vec<Message> {
+    mounted
+        .batch(
+            app,
+            &[mouse_event(mouse::Event::ButtonReleased(
+                mouse::Button::Left,
+            ))],
+            mouse::Cursor::Available(point),
+        )
+        .await
+}
+
+fn set_expected_message(project: &mut oa_core::Project, diagram: Id, occurrence: Id, y: f32) {
+    let Some(oa_core::DiagramLayout::Scenario(layout)) =
+        &mut project.diagrams.get_mut(&diagram).unwrap().layout
+    else {
+        panic!()
+    };
+    layout
+        .messages
+        .iter_mut()
+        .find(|m| m.address.occurrence == occurrence)
+        .unwrap()
+        .send_y = y;
+}
+
+fn set_expected_lane(project: &mut oa_core::Project, diagram: Id, lifeline: Id, x: f32) {
+    let Some(oa_core::DiagramLayout::Scenario(layout)) =
+        &mut project.diagrams.get_mut(&diagram).unwrap().layout
+    else {
+        panic!()
+    };
+    layout
+        .lanes
+        .iter_mut()
+        .find(|lane| lane.lifeline == lifeline)
+        .unwrap()
+        .x = x;
+}
+
+fn assert_reopens_exactly(app: &App) {
+    let reopened = Document::from_bundle(
+        app.document.bundle().clone(),
+        oa_core::source_project::ProjectLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(reopened.project(), app.project());
+    assert_eq!(reopened.bundle(), app.document.bundle());
+}
+
+#[tokio::test]
+async fn saved_message_same_batch_pointer_events_commit_once_and_one_undo_redo_restores_exact_source()
+ {
+    let (mut app, mut mounted, diagram) = setup(false).await;
+    let target = id(&app, "updated_report");
+    let before = app.document.snapshot();
+    let revision = app.document.revision();
+    let start = screen(&mut mounted, &app, Point::new(400., 252.));
+    let end = start + Vector::new(0., 10.); // .5 display scale: +20 authored y.
+    let messages = mounted
+        .batch(
+            &mut app,
+            &[
+                mouse_event(mouse::Event::CursorMoved { position: start }),
+                mouse_event(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                mouse_event(mouse::Event::CursorMoved { position: end }),
+                mouse_event(mouse::Event::ButtonReleased(mouse::Button::Left)),
+            ],
+            mouse::Cursor::Available(end),
+        )
+        .await;
+    assert_eq!(
+        messages
+            .iter()
+            .filter(|m| matches!(
+                m,
+                Message::ScenarioCanvas(CanvasEvent::Spacing(spacing::Event::Begin { .. }))
+            ))
+            .count(),
+        1
+    );
+    assert_eq!(
+        messages
+            .iter()
+            .filter(|m| matches!(
+                m,
+                Message::ScenarioCanvas(CanvasEvent::Spacing(spacing::Event::Finish { .. }))
+            ))
+            .count(),
+        1
+    );
+    let mut expected = before.decoded.project.clone();
+    set_expected_message(&mut expected, diagram, target, 272.);
+    assert_eq!(
+        app.project(),
+        &expected,
+        "Only Saved A's addressed y changes; steps, other occurrences and B/C are exact"
+    );
+    assert_eq!(app.document.revision(), revision + 1);
+    assert_eq!(app.selected, target);
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert_reopens_exactly(&app);
+    let after = app.document.snapshot();
+    let task = app.update(Message::Undo);
+    mounted.perform(&mut app, task).await;
+    assert_eq!(app.project(), &before.decoded.project);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert!(!app.document.can_undo() && app.document.can_redo());
+    let task = app.update(Message::Redo);
+    mounted.perform(&mut app, task).await;
+    assert_eq!(app.project(), &after.decoded.project);
+    assert_eq!(app.document.bundle(), &after.bundle);
+}
+
+#[tokio::test]
+async fn saved_header_preview_survives_frames_and_freezes_fit_while_actual_bounds_expand() {
+    let (mut app, mut mounted, diagram) = setup(true).await;
+    let assessor = id(&app, "assessor");
+    let before = app.document.snapshot();
+    let original = resolved(&app);
+    let original_camera = app.behavior.scenario.presentation.camera(original.bounds);
+    let stored = stored_camera(&app);
+    assert!(stored.2, "test must exercise original Fit");
+    let start = screen(&mut mounted, &app, Point::new(640., 45.));
+    press(&mut mounted, &mut app, start).await;
+    let token = app
+        .behavior
+        .scenario
+        .spacing_token()
+        .expect("actual header press begins");
+    for x in [670., 700.] {
+        let end = start + Vector::new((x - 640.) * original_camera.scale, 0.);
+        move_to(&mut mounted, &mut app, end).await;
+        mounted.settle(&mut app).await; // Actual borrowed Scene/Stack tree is rebuilt.
+        assert_eq!(app.behavior.scenario.spacing_token(), Some(token));
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert_eq!(stored_camera(&app), stored);
+        let paint = app
+            .behavior
+            .scenario
+            .spacing_paint(app.scenario_context().unwrap(), app.camera_epoch)
+            .unwrap();
+        assert!(paint.refusal.is_none());
+        assert!((paint.scene.render_lanes[&assessor] - x).abs() < 0.001);
+        assert!(paint.bounds.width > original.bounds.width);
+        assert_eq!(paint.scene.scale, original_camera.scale);
+        assert_eq!(paint.scene.camera_pan, original_camera.pan);
+        let header = paint.scene.boxes.iter().find(|b| b.id == assessor).unwrap();
+        let displayed = Vector::new(header.rect.center().x, header.rect.center().y)
+            * paint.scene.scale
+            + paint.scene.camera_pan;
+        let baseline = Vector::new(640., 50.) * original_camera.scale + original_camera.pan;
+        assert!((displayed.x - baseline.x - (x - 640.) * original_camera.scale).abs() < 0.001);
+        assert_eq!(displayed.y, baseline.y);
+    }
+    let end = start + Vector::new(60. * original_camera.scale, 0.);
+    release(&mut mounted, &mut app, end).await;
+    let final_geometry = resolved(&app);
+    let actual_x = final_geometry.scene.render_lanes[&assessor];
+    assert!((actual_x - 700.).abs() < 0.001);
+    let mut expected = before.decoded.project.clone();
+    set_expected_lane(&mut expected, diagram, assessor, actual_x);
+    assert_eq!(app.project(), &expected);
+    let final_camera = app
+        .behavior
+        .scenario
+        .presentation
+        .camera(final_geometry.bounds);
+    assert_eq!(
+        final_camera, original_camera,
+        "commit must not refit underneath pointer"
+    );
+    assert!(!app.behavior.scenario.presentation.fit);
+    assert_eq!(app.selected, assessor);
+    assert_reopens_exactly(&app);
+}
+
+#[tokio::test]
+async fn saved_body_and_header_clicks_select_without_materializing_spacing() {
+    let (mut app, mut mounted, _) = setup(false).await;
+    let before = app.document.snapshot();
+    let original_camera = stored_camera(&app);
+    for (alias, world) in [
+        ("updated_report", Point::new(400., 252.)),
+        ("assessor", Point::new(640., 45.)),
+    ] {
+        let target = id(&app, alias);
+        let point = screen(&mut mounted, &app, world);
+        mounted.click(&mut app, point).await;
+        assert_eq!(app.selected, target);
+        assert!(app.behavior.scenario.spacing_token().is_none());
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert_eq!(stored_camera(&app), original_camera);
+    }
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[tokio::test]
+async fn saved_valid_preview_then_refused_self_call_never_commits_last_valid_candidate() {
+    let (mut app, mut mounted, _) = setup(false).await;
+    let target = id(&app, "assess_call");
+    let before = app.document.snapshot();
+    let camera = stored_camera(&app);
+    let start = screen(&mut mounted, &app, Point::new(680., 344.));
+    press(&mut mounted, &mut app, start).await;
+    let valid = start + Vector::new(0., -10.); // send324, receive348, reply436 unchanged.
+    move_to(&mut mounted, &mut app, valid).await;
+    mounted.settle(&mut app).await;
+    let paint = app
+        .behavior
+        .scenario
+        .spacing_paint(app.scenario_context().unwrap(), app.camera_epoch)
+        .unwrap();
+    assert!(paint.refusal.is_none());
+    let line = paint.scene.lines.iter().find(|l| l.id == target).unwrap();
+    assert_eq!(line.points[0].y, 324.);
+    assert_eq!(line.points.last().unwrap().y, 348.);
+    let refused = start + Vector::new(0., 53.); // send450, receive474 would follow reply436.
+    move_to(&mut mounted, &mut app, refused).await;
+    mounted.settle(&mut app).await;
+    let paint = app
+        .behavior
+        .scenario
+        .spacing_paint(app.scenario_context().unwrap(), app.camera_epoch)
+        .unwrap();
+    assert!(paint.refusal.is_some());
+    assert_eq!(
+        paint
+            .scene
+            .lines
+            .iter()
+            .find(|l| l.id == target)
+            .unwrap()
+            .points[0]
+            .y,
+        344.
+    );
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    release(&mut mounted, &mut app, refused).await;
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    assert_eq!(stored_camera(&app), camera);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[tokio::test]
+async fn saved_escape_and_outside_pointer_cancel_actual_held_preview() {
+    for escape in [true, false] {
+        let (mut app, mut mounted, _) = setup(false).await;
+        let before = app.document.snapshot();
+        let camera = stored_camera(&app);
+        let start = screen(&mut mounted, &app, Point::new(400., 252.));
+        let end = start + Vector::new(0., 10.);
+        press(&mut mounted, &mut app, start).await;
+        move_to(&mut mounted, &mut app, end).await;
+        mounted.settle(&mut app).await;
+        assert!(app.behavior.scenario.spacing_token().is_some());
+        let release_at = if escape {
+            mounted
+                .batch(
+                    &mut app,
+                    &[key(iced::keyboard::key::Named::Escape)],
+                    mouse::Cursor::Available(end),
+                )
+                .await;
+            end
+        } else {
+            let bounds = mounted.geometry(&app).bounds("scenario-viewport");
+            let outside = Point::new(bounds.x - 5., bounds.y + 100.);
+            move_to(&mut mounted, &mut app, outside).await;
+            outside
+        };
+        assert!(app.behavior.scenario.spacing_token().is_none());
+        release(&mut mounted, &mut app, release_at).await;
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert_eq!(stored_camera(&app), camera);
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}
+
+#[tokio::test]
+async fn saved_drag_return_to_origin_preserves_redo_selection_and_original_fit_camera() {
+    let (mut app, mut mounted, _) = setup(true).await;
+    let owner = id(&app, "incident_response");
+    app.document
+        .execute(oa_core::Command::Rename(
+            owner,
+            "Previously edited owner".into(),
+        ))
+        .unwrap();
+    let redo = app.document.snapshot();
+    let task = app.update(Message::Undo);
+    mounted.perform(&mut app, task).await;
+    mounted.settle(&mut app).await;
+    assert!(app.document.can_redo());
+    let before = app.document.snapshot();
+    let camera = stored_camera(&app);
+    let selected = app.selected;
+    let revision = app.document.revision();
+    let start = screen(&mut mounted, &app, Point::new(400., 252.));
+    press(&mut mounted, &mut app, start).await;
+    move_to(&mut mounted, &mut app, start + Vector::new(0., 12.)).await;
+    mounted.settle(&mut app).await;
+    assert!(app.behavior.scenario.spacing_token().is_some());
+    move_to(&mut mounted, &mut app, start).await;
+    mounted.settle(&mut app).await;
+    release(&mut mounted, &mut app, start).await;
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert_eq!(app.document.revision(), revision);
+    assert_eq!(stored_camera(&app), camera);
+    assert_eq!(app.selected, selected);
+    assert!(app.document.can_redo());
+    let task = app.update(Message::Redo);
+    mounted.perform(&mut app, task).await;
+    assert_eq!(app.project(), &redo.decoded.project);
+    assert_eq!(app.document.bundle(), &redo.bundle);
+}

crates/oa-desktop/src/behavior/scenario/workspace/tests.rs

@@ -48,8 +48,28 @@ async fn production_scenario_canvas_keeps_bounds_draft_identity_and_camera_throu
             mounted.pan(&mut app, start, start + delta).await;
             let diff = app.behavior.scenario.presentation.pan - next_pan;
             assert!(diff.x.hypot(diff.y) < 0.01);
-            let tool = mounted.geometry(&app).bounds("behavior-tool:A").center();
-            mounted.click(&mut app, tool).await;
+            // Iced operations report palette children in content coordinates.
+            // The preceding Action focus may have scrolled this retained palette.
+            let geometry = mounted.geometry(&app);
+            let scope = canvas_workspace::Scope::current(&app).unwrap();
+            let (palette, offset) = geometry.scrolls[&scope.control_id("palette-scroll")];
+            let tool = geometry.bounds("behavior-tool:A").center() - offset;
+            assert!(
+                palette.contains(tool),
+                "visible Action at {tool:?}: {palette:?}"
+            );
+            let chosen = mounted.click(&mut app, tool).await;
+            assert!(
+                chosen.iter().any(|message| matches!(
+                    canvas_workspace::tests::intent_action(message),
+                    Message::ScenarioCanvas(CanvasEvent::Choose(_, CanvasTool::Add(Tool::Action)))
+                )),
+                "Action palette click at scale {scale}, offset {offset:?}: {chosen:?}"
+            );
+            assert_eq!(
+                app.behavior.scenario.canvas_tool(f.owner),
+                CanvasTool::Add(Tool::Action)
+            );
             let messages = mounted.click(&mut app, bounds.position() + desired).await;
             assert!(
                 messages.iter().any(
@@ -57,7 +77,7 @@ async fn production_scenario_canvas_keeps_bounds_draft_identity_and_camera_throu
                 tool: Tool::Action, slot, lifeline: Some(line), ..
             }) if *slot == expected && *line == f.sender)
                 ),
-                "scale {scale}: {messages:?}"
+                "scale {scale}, expected slot {expected:?}: {messages:?}"
             );
             let session = app.behavior.scenario.form_session().unwrap();
             let invocation = app.behavior.scenario.draft.as_ref().unwrap().invocation;
@@ -1337,7 +1357,18 @@ async fn production_scenario_camera_external_controls_bounds_and_retained_deltas
         let bounds = mounted.geometry(&app).bounds("scenario-viewport");
         let point = bounds.position() + iced::Vector::new(95., 90.);
         let lifetime = app.camera_epoch;
-        let pan = app.behavior.scenario.presentation.pan;
+        // Fit stores no pan offset. A real drag starts from the displayed fitted
+        // camera, then materializes it before applying its ordered screen deltas.
+        let shown = app
+            .behavior
+            .scenario
+            .display(app.project(), f.owner, app.selected)
+            .unwrap();
+        let before_camera = app
+            .behavior
+            .scenario
+            .presentation
+            .camera(shown.bounds().unwrap());
         let first = point + iced::Vector::new(13., 9.);
         let last = first + iced::Vector::new(17., -3.);
         let emitted = mounted
@@ -1352,7 +1383,21 @@ async fn production_scenario_camera_external_controls_bounds_and_retained_deltas
                 mouse::Cursor::Available(last),
             )
             .await;
-        assert_eq!(app.behavior.scenario.presentation.pan, pan + (last - point));
+        let expected_pan = before_camera.pan + (last - point);
+        let actual_pan = app.behavior.scenario.presentation.pan;
+        let difference = actual_pan - expected_pan;
+        assert!(
+            difference.x.hypot(difference.y) < 0.001,
+            "{boundary}: displayed pan {actual_pan:?} must follow {expected_pan:?}"
+        );
+        assert_eq!(
+            app.behavior.scenario.presentation.zoom,
+            Some(before_camera.scale)
+        );
+        assert!(
+            !app.behavior.scenario.presentation.fit,
+            "drag materializes the visible Fit camera"
+        );
         assert_eq!(
             app.camera_epoch, lifetime,
             "own ordered deltas retain their lifetime"
@@ -1760,14 +1805,19 @@ fn scenario_workspace_fit_uses_measured_inner_viewport_and_rejects_nonfinite_inp
     assert!(!presentation.viewport(Size::new(484., 204.)));
     let scale = presentation.scale(graph);
     assert!(graph.width * scale <= 468. && graph.height * scale <= 188.);
-    assert!(scale > MIN_SCALE);
+    assert!(scale > camera::MIN_SCALE);
     for bad in [f32::NAN, f32::INFINITY, 0., -1.] {
         assert!(!presentation.zoom(Some(bad)));
         assert!(!presentation.viewport(Size::new(bad, 100.)));
         assert!(!presentation.viewport(Size::new(100., bad)));
         assert_eq!(presentation.scale(graph), scale);
     }
-    assert_eq!(presentation.scale(Size::new(900., 10000.)), MIN_SCALE);
+    let tall = Rectangle::with_size(Size::new(900., 10000.));
+    let camera = presentation.camera(tall);
+    assert!(camera.scale < 0.05 && camera.scale > 0.);
+    assert!((camera.scale - 188. / 10000.).abs() < 1e-8);
+    assert!((tall.height * camera.scale + camera.pan.y - 196.).abs() < 1e-4);
+    assert!((camera.pan.y - 8.).abs() < 1e-4);
     assert!(presentation.zoom(Some(1.25)));
     presentation.viewport(Size::new(200., 100.));
     assert_eq!(

crates/oa-desktop/src/behavior/scenario_activation.rs

@@ -0,0 +1,492 @@
+//! Derived call geometry. Correlation and branch ownership come from the model;
+//! columns separate overlapping drawings and do not assert an execution thread.
+use super::*;
+
+const WIDTH: f32 = 12.;
+const OFFSET: f32 = 6.;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum Finish {
+    Reply(Id),
+    Boundary,
+    /// Still open at this scope boundary; the visible span is not an isolated stub.
+    Continuation,
+    Open,
+    /// The receiver was deleted without answering this call.
+    Terminated(Id),
+    /// Lifetime clipping ended this visible piece before its logical terminal.
+    Clipped,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Segment {
+    pub call: Id,
+    pub receiver: Id,
+    pub scope: Id,
+    pub rect: Rectangle,
+    pub column: usize,
+    pub finish: Finish,
+}
+impl Segment {
+    fn bottom(&self) -> f32 {
+        self.rect.y + self.rect.height
+    }
+    fn overlaps(&self, other: &Self) -> bool {
+        self.receiver == other.receiver
+            && self.scope == other.scope
+            && self.rect.y < other.bottom()
+            && other.rect.y < self.bottom()
+    }
+    fn edge(&self, right: bool) -> f32 {
+        self.rect.x + if right { self.rect.width } else { 0. }
+    }
+}
+
+impl Scene {
+    pub(super) fn layout_activations(&mut self, p: &Project, lanes: &BTreeMap<Id, f32>) {
+        // Logical endpoints precede clipping and remain available even when a
+        // lifetime hides a whole execution or terminates it before its Reply.
+        let correlations = logical_correlations(p, &self.rows, &self.lines);
+        let mut calls: Vec<_> = self
+            .rows
+            .iter()
+            .filter_map(|(&call, &(scope, y))| {
+                let Some(SharedBody::Occurrence {
+                    body:
+                        OccurrenceBody::Exchange {
+                            message_kind: MessageKind::Call,
+                            receiver: Some(receiver),
+                            ..
+                        },
+                    ..
+                }) = p.elements.get(&call).and_then(|e| e.shared())
+                else {
+                    return None;
+                };
+                Some((call, *receiver, scope, y, *lanes.get(receiver)?))
+            })
+            .collect();
+        // Rows are laid out in semantic order. UUID order must not choose which
+        // rectangle obscures another (especially after source reidentification).
+        calls.sort_by(|a, b| a.3.total_cmp(&b.3).then_with(|| a.0.cmp(&b.0)));
+        for &(call, receiver, scope, _, x) in &calls {
+            let first = self.activations.len();
+            let first_cue = self.open_calls.len();
+            self.activation_sequence(p, scope, call, receiver, x, None);
+            let column = self.activations[first..]
+                .iter()
+                .flat_map(|segment| {
+                    self.activations[..first]
+                        .iter()
+                        .filter(move |other| segment.overlaps(other))
+                })
+                .map(|other| other.column + 1)
+                .max()
+                .unwrap_or(0);
+            for segment in &mut self.activations[first..] {
+                segment.column = column;
+                segment.rect.x += column as f32 * OFFSET;
+            }
+            for cue in &mut self.open_calls[first_cue..] {
+                cue.x += column as f32 * OFFSET;
+            }
+        }
+        // Shallow executions paint first; columns cannot collide within a scope.
+        self.activations.sort_by(|a, b| {
+            a.column
+                .cmp(&b.column)
+                .then_with(|| a.rect.y.total_cmp(&b.rect.y))
+                .then_with(|| a.call.cmp(&b.call))
+        });
+        self.anchor_activation_messages(p, lanes, &correlations);
+    }
+
+    fn activation_segment(
+        &mut self,
+        call: Id,
+        receiver: Id,
+        scope: Id,
+        x: f32,
+        span: std::ops::Range<f32>,
+        finish: Finish,
+    ) {
+        // Cues describe unanswered logical paths, including wholly invisible
+        // ones. Never derive them only from the surviving paint rectangles.
+        if matches!(
+            finish,
+            Finish::Open | Finish::Continuation | Finish::Terminated(_)
+        ) {
+            self.open_calls
+                .push(Point::new(x + WIDTH / 2. + 4., span.end - 7.));
+        }
+        for alive in self
+            .lifecycle
+            .alive_spans(receiver, scope, span.start, span.end)
+        {
+            self.activations.push(Segment {
+                call,
+                receiver,
+                scope,
+                rect: Rectangle::new(
+                    Point::new(x - WIDTH / 2., alive.start),
+                    Size::new(WIDTH, alive.end - alive.start),
+                ),
+                column: 0,
+                finish: if alive.end == span.end {
+                    finish
+                } else {
+                    Finish::Clipped
+                },
+            });
+        }
+    }
+
+    /// Follow one exact correlation. A segment belongs to one ordered scope;
+    /// vertically stacked operands must not become a single chronological span.
+    fn activation_sequence(
+        &mut self,
+        p: &Project,
+        owner: Id,
+        call: Id,
+        receiver: Id,
+        x: f32,
+        mut start: Option<f32>,
+    ) -> Outcome {
+        let entered_open = start.is_some();
+        let mut split = false;
+        let mut may_be_terminated = false;
+        for id in p.elements[&owner].steps().into_iter().flatten() {
+            let Some(&(_, y)) = self.rows.get(id) else {
+                continue;
+            };
+            if *id == call {
+                // A reflective call is received at the lower end of its loop.
+                start = Some(
+                    self.lines
+                        .iter()
+                        .find(|line| line.id == call)
+                        .and_then(|line| line.points.last())
+                        .map_or(y, |point| point.y),
+                );
+            }
+            let Some(top) = start else {
+                continue;
+            };
+            match p.elements[id].shared() {
+                Some(SharedBody::Occurrence {
+                    body:
+                        OccurrenceBody::Exchange {
+                            message_kind: MessageKind::Delete,
+                            receiver: Some(deleted),
+                            ..
+                        },
+                    ..
+                }) if *deleted == receiver => {
+                    self.activation_segment(
+                        call,
+                        receiver,
+                        owner,
+                        x,
+                        top..y,
+                        Finish::Terminated(*id),
+                    );
+                    start = None;
+                    may_be_terminated = true;
+                }
+                Some(SharedBody::Occurrence {
+                    body:
+                        OccurrenceBody::Exchange {
+                            message_kind: MessageKind::Reply,
+                            reply_to: Some(correlation),
+                            ..
+                        },
+                    ..
+                }) if *correlation == call => {
+                    // Execution ends when its reply is sent, including a self reply.
+                    self.activation_segment(call, receiver, owner, x, top..y, Finish::Reply(*id));
+                    start = None;
+                }
+                Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Fragment { operator, branches },
+                    ..
+                }) => {
+                    split = true;
+                    self.activation_segment(call, receiver, owner, x, top..y, Finish::Boundary);
+                    let bottom = self
+                        .boxes
+                        .iter()
+                        .find(|b| b.id == *id && !b.title.is_empty())
+                        .map(|b| b.rect.y + b.rect.height)
+                        .unwrap_or(y);
+                    let outcomes: Vec<_> = branches
+                        .iter()
+                        .filter_map(|branch| {
+                            let &(top, _) = self.sequence_bounds.get(branch)?;
+                            Some(self.activation_sequence(p, *branch, call, receiver, x, Some(top)))
+                        })
+                        .collect();
+                    let open = match operator {
+                        FragmentOperator::Alternative => {
+                            outcomes.is_empty() || outcomes.iter().any(|outcome| outcome.open)
+                        }
+                        FragmentOperator::Parallel => outcomes.iter().all(|outcome| outcome.open),
+                        FragmentOperator::Optional | FragmentOperator::Loop => true,
+                    };
+                    if outcomes.iter().any(|outcome| outcome.may_be_terminated) {
+                        // Sibling bars retain their own entry paths, but a
+                        // conditional death cannot become a definite parent
+                        // execution again after a later Create.
+                        self.open_calls
+                            .push(Point::new(x + WIDTH / 2. + 4., bottom - 7.));
+                        may_be_terminated = true;
+                        start = None;
+                    } else {
+                        start = open.then_some(bottom);
+                    }
+                }
+                _ => {}
+            }
+        }
+        if let Some(top) = start {
+            let bottom = if entered_open || split {
+                self.sequence_bounds
+                    .get(&owner)
+                    .map_or(top + 26., |(_, bottom)| (*bottom).max(top + 26.))
+            } else {
+                top + 26.
+            };
+            let finish = if entered_open || split {
+                Finish::Continuation
+            } else {
+                Finish::Open
+            };
+            self.activation_segment(call, receiver, owner, x, top..bottom, finish);
+        }
+        Outcome {
+            open: start.is_some(),
+            may_be_terminated,
+        }
+    }
+
+    fn anchor_activation_messages(
+        &mut self,
+        p: &Project,
+        lanes: &BTreeMap<Id, f32>,
+        correlations: &BTreeMap<Id, Correlation>,
+    ) {
+        let segments = &self.activations;
+        for line in &mut self.lines {
+            let Some(SharedBody::Occurrence {
+                body:
+                    OccurrenceBody::Exchange {
+                        sender: Some(sender),
+                        receiver: Some(receiver),
+                        message_kind,
+                        reply_to,
+                        ..
+                    },
+                ..
+            }) = p.elements.get(&line.id).and_then(|e| e.shared())
+            else {
+                continue;
+            };
+            if !matches!(
+                message_kind,
+                MessageKind::Call | MessageKind::Reply | MessageKind::Asynchronous
+            ) {
+                continue;
+            }
+            let (Some(&from), Some(&to), Some(&(scope, _))) = (
+                lanes.get(sender),
+                lanes.get(receiver),
+                self.rows.get(&line.id),
+            ) else {
+                continue;
+            };
+            let send_y = line.points[0].y;
+            let receive_y = line.points.last().unwrap().y;
+            let reflective = sender == receiver;
+            let source = if *message_kind == MessageKind::Reply {
+                reply_to.and_then(|call| {
+                    segments.iter().find(|a| {
+                        a.call == call
+                            && a.scope == scope
+                            && a.finish == Finish::Reply(line.id)
+                            && a.bottom() == send_y
+                    })
+                })
+            } else {
+                active_segment(
+                    p,
+                    segments,
+                    correlations,
+                    *sender,
+                    scope,
+                    send_y,
+                    Some(line.id),
+                )
+            };
+            let target = if *message_kind == MessageKind::Call {
+                segments
+                    .iter()
+                    .find(|a| a.call == line.id && a.scope == scope && a.rect.y == receive_y)
+            } else {
+                active_segment(
+                    p,
+                    segments,
+                    correlations,
+                    *receiver,
+                    scope,
+                    receive_y,
+                    *reply_to,
+                )
+            };
+            let start = source.map_or(from, |a| a.edge(reflective || to > from));
+            let end = target.map_or(to, |a| a.edge(reflective || from > to));
+            if reflective {
+                let outside = start.max(end) + 60.;
+                line.points = vec![
+                    Point::new(start, send_y),
+                    Point::new(outside, send_y),
+                    Point::new(outside, receive_y),
+                    Point::new(end, receive_y),
+                ];
+            } else {
+                line.points = vec![Point::new(start, send_y), Point::new(end, receive_y)];
+            }
+            line.label_at.x = start.min(end) + 12.;
+        }
+    }
+}
+
+struct Outcome {
+    open: bool,
+    may_be_terminated: bool,
+}
+
+fn logical_correlations(
+    p: &Project,
+    rows: &BTreeMap<Id, (Id, f32)>,
+    lines: &[Line],
+) -> BTreeMap<Id, Correlation> {
+    let mut result = BTreeMap::new();
+    let points: BTreeMap<_, _> = lines.iter().map(|line| (line.id, &line.points)).collect();
+    for (&id, &(_, y)) in rows {
+        if matches!(
+            p.elements.get(&id).and_then(|e| e.shared()),
+            Some(SharedBody::Occurrence {
+                body: OccurrenceBody::Exchange {
+                    message_kind: MessageKind::Call,
+                    ..
+                },
+                ..
+            })
+        ) {
+            result.insert(
+                id,
+                Correlation {
+                    start: points.get(&id).and_then(|p| p.last()).map_or(y, |p| p.y),
+                    replies: vec![],
+                },
+            );
+        }
+    }
+    for (&id, &(scope, y)) in rows {
+        if let Some(SharedBody::Occurrence {
+            body:
+                OccurrenceBody::Exchange {
+                    message_kind: MessageKind::Reply,
+                    reply_to: Some(call),
+                    ..
+                },
+            ..
+        }) = p.elements.get(&id).and_then(|e| e.shared())
+            && let Some(correlation) = result.get_mut(call)
+        {
+            let sent = points.get(&id).and_then(|p| p.first()).map_or(y, |p| p.y);
+            correlation.replies.push((scope, sent));
+        }
+    }
+    result
+}
+
+/// A caller has no implicit execution just because it sent a message. Only an
+/// actually drawn, known-duration execution can supply its anchor. Crossed
+/// intervals provide no unambiguous innermost execution, so fall back to the lane.
+fn active_segment<'a>(
+    p: &Project,
+    segments: &'a [Segment],
+    correlations: &BTreeMap<Id, Correlation>,
+    receiver: Id,
+    scope: Id,
+    y: f32,
+    exclude: Option<Id>,
+) -> Option<&'a Segment> {
+    let candidates: Vec<_> = segments
+        .iter()
+        .filter(|a| {
+            a.receiver == receiver
+                && a.scope == scope
+                && Some(a.call) != exclude
+                && a.rect.y <= y
+                && y < a.bottom()
+                && a.finish != Finish::Open
+        })
+        .collect();
+    let inner = candidates.iter().max_by_key(|a| a.column).copied()?;
+    candidates
+        .iter()
+        .all(|a| {
+            a.call == inner.call
+                || correlations[&a.call].contains(p, scope, &correlations[&inner.call])
+        })
+        .then_some(inner)
+}
+
+struct Correlation {
+    start: f32,
+    replies: Vec<(Id, f32)>,
+}
+impl Correlation {
+    fn contains(&self, p: &Project, scope: Id, inner: &Self) -> bool {
+        // Segment clipping at a fragment can make crossed calls appear nested.
+        // Compare actual correlated replies on compatible scope paths instead.
+        let relevant = |&(reply_scope, _): &(Id, f32)| {
+            ancestor(p, scope, reply_scope) || ancestor(p, reply_scope, scope)
+        };
+        let mut compared = false;
+        for &(inner_scope, inner_end) in inner.replies.iter().filter(|reply| relevant(reply)) {
+            let mut matched = false;
+            for &(outer_scope, outer_end) in self.replies.iter().filter(|reply| relevant(reply)) {
+                if ancestor(p, inner_scope, outer_scope) || ancestor(p, outer_scope, inner_scope) {
+                    // Alternative operands are not chronological. Compare only
+                    // returns that can belong to the same enclosing branch path.
+                    if outer_end < inner_end {
+                        return false;
+                    }
+                    matched = true;
+                }
+            }
+            if !matched {
+                return false;
+            }
+            compared = true;
+        }
+        self.start <= inner.start && compared
+    }
+}
+fn ancestor(p: &Project, expected: Id, mut scope: Id) -> bool {
+    for _ in 0..=p.elements.len() {
+        if scope == expected {
+            return true;
+        }
+        let Some(parent) = p.elements.get(&scope).and_then(|e| e.parent) else {
+            return false;
+        };
+        scope = parent;
+    }
+    false
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-desktop/src/behavior/scenario_activation/tests.rs

@@ -0,0 +1,842 @@
+use super::*;
+
+fn id(n: u128) -> Id {
+    Id::from_u128(0x21ca1100000040008000000000000000 + n)
+}
+struct Fixture {
+    project: Project,
+    owner: Id,
+    caller: Id,
+    callee: Id,
+    call: Id,
+    inner: Id,
+    reply: Id,
+    inner_reply: Id,
+}
+fn seed(p: &mut Project, layer: Layer, n: u128, kind: Kind, parent: Option<Id>) -> Id {
+    let mut e = p
+        .make_element(kind, layer, &format!("Element {n}"), parent)
+        .unwrap();
+    e.id = id(n);
+    e.alias = format!("element_{n}");
+    p.elements.insert(e.id, e);
+    id(n)
+}
+fn message(
+    p: &mut Project,
+    layer: Layer,
+    n: u128,
+    parent: Id,
+    endpoints: (Id, Id),
+    reply: Option<Id>,
+) -> Id {
+    let e = seed(p, layer, n, Kind::Occurrence, Some(parent));
+    *p.elements.get_mut(&e).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange {
+            operation: None,
+            exchange: None,
+            sender: Some(endpoints.0),
+            receiver: Some(endpoints.1),
+            message_kind: if reply.is_some() {
+                MessageKind::Reply
+            } else {
+                MessageKind::Call
+            },
+            reply_to: reply,
+            values: vec![],
+        },
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+    e
+}
+fn fixture(layer: Layer, reverse_uuid_order: bool) -> Fixture {
+    let mut p = Project::empty();
+    let work = if layer == Layer::Oa {
+        Kind::Activity
+    } else {
+        Kind::Function
+    };
+    let a = seed(&mut p, layer, 1, work, None);
+    let b = seed(&mut p, layer, 2, work, None);
+    let owner = seed(&mut p, layer, 3, Kind::Scenario, None);
+    if let SharedBody::Scenario { viewpoint, .. } =
+        p.elements.get_mut(&owner).unwrap().shared_mut().unwrap()
+    {
+        *viewpoint = if layer == Layer::Oa {
+            ScenarioViewpoint::OperationalActivity
+        } else {
+            ScenarioViewpoint::Functional
+        };
+    }
+    let caller = seed(&mut p, layer, 4, Kind::Lifeline, Some(owner));
+    let callee = seed(&mut p, layer, 5, Kind::Lifeline, Some(owner));
+    for (line, represented) in [(caller, a), (callee, b)] {
+        *p.elements.get_mut(&line).unwrap().shared_mut().unwrap() = SharedBody::Lifeline {
+            represented: Some(represented),
+        };
+    }
+    let (first, second) = if reverse_uuid_order {
+        (40, 30)
+    } else {
+        (30, 40)
+    };
+    let call = message(&mut p, layer, first, owner, (caller, callee), None);
+    let inner = message(&mut p, layer, second, owner, (caller, callee), None);
+    let reply = message(&mut p, layer, 50, owner, (callee, caller), Some(call));
+    let inner_reply = message(&mut p, layer, 60, owner, (callee, caller), Some(inner));
+    *p.elements.get_mut(&owner).unwrap().steps_mut().unwrap() =
+        vec![call, inner, inner_reply, reply];
+    Fixture {
+        project: p,
+        owner,
+        caller,
+        callee,
+        call,
+        inner,
+        reply,
+        inner_reply,
+    }
+}
+fn scene(f: &Fixture) -> Scene {
+    let errors: Vec<_> = validation::validate(&f.project)
+        .into_iter()
+        .filter(|i| i.severity == validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "Actual core fixture: {errors:#?}");
+    let source = language::format(&f.project);
+    let reparsed = language::parse(&source).unwrap();
+    assert_eq!(language::format(&reparsed), source);
+    let result = Scene::sequence(&reparsed, f.owner, f.owner);
+    assert_eq!(
+        language::format(&reparsed),
+        source,
+        "Projection must not write geometry into the model"
+    );
+    result
+}
+fn bar(scene: &Scene, call: Id) -> &Segment {
+    scene.activations.iter().find(|a| a.call == call).unwrap()
+}
+
+fn long_labels(f: &mut Fixture) {
+    for occurrence in [f.call, f.inner, f.inner_reply, f.reply] {
+        f.project.elements.get_mut(&occurrence).unwrap().name =
+            "Pressure verification with a descriptive operation label".into();
+    }
+}
+
+#[test]
+fn activation_shoulders_under_label_backplates_select_their_call() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer, true);
+        long_labels(&mut f);
+        let scene = scene(&f);
+        let outer = bar(&scene, f.call);
+        for occurrence in [f.inner, f.inner_reply, f.reply] {
+            let message = line(&scene, occurrence);
+            let shoulder = Point::new(outer.rect.x + 1., message.label_at.y + 11.);
+            assert!(outer.rect.contains(shoulder));
+            assert!(Rectangle::new(message.label_at, Size::new(225., 22.)).contains(shoulder));
+            assert!(message.label.chars().count() > 32);
+            assert!(message.points.windows(2).all(|p| {
+                crate::diagram::distance_to_segment(shoulder, p[0], p[1]) > 8. / scene.scale
+            }));
+            assert_eq!(scene.hit(shoulder), Some(f.call));
+            assert_eq!(
+                scene.hit(message.label_at + iced::Vector::new(4., 4.)),
+                Some(occurrence),
+                "Label text outside activations remains selectable"
+            );
+        }
+        for occurrence in [f.call, f.inner, f.inner_reply, f.reply] {
+            let message = line(&scene, occurrence);
+            for endpoint in [message.points[0], *message.points.last().unwrap()] {
+                assert_eq!(scene.hit(endpoint), Some(occurrence));
+            }
+        }
+    }
+}
+
+#[tokio::test]
+async fn long_message_backplates_do_not_erase_selected_activation_border_pixels() {
+    use iced::advanced::renderer::Headless;
+    use iced_runtime::user_interface::{Cache, UserInterface};
+
+    let mut mounted = crate::behavior::canvas_workspace::tests::Mounted::unshown().await;
+    let mut f = fixture(Layer::Oa, true);
+    long_labels(&mut f);
+    let mut scene = scene(&f);
+    scene.selected = f.call;
+    let border_x = bar(&scene, f.call).rect.x;
+    let label_spans: Vec<_> = [f.inner, f.inner_reply, f.reply]
+        .into_iter()
+        .map(|id| {
+            let message = line(&scene, id);
+            assert!(
+                Rectangle::new(message.label_at, Size::new(225., 22.))
+                    .contains(Point::new(border_x, message.label_at.y + 11.))
+            );
+            (message.label_at.y + 3.) as usize..(message.label_at.y + 20.) as usize
+        })
+        .collect();
+    let dimensions = Size::new(800., 700.);
+    let content: Element<'_, Message> = canvas::Canvas::new(scene)
+        .width(dimensions.width)
+        .height(dimensions.height)
+        .into();
+    let mut ui = UserInterface::build(content, dimensions, Cache::new(), &mut mounted.renderer);
+    ui.draw(
+        &mut mounted.renderer,
+        &style::theme(),
+        &iced::advanced::renderer::Style {
+            text_color: style::INK,
+        },
+        mouse::Cursor::Unavailable,
+    );
+    let pixels = Headless::screenshot(&mut mounted.renderer, Size::new(800, 700), 1., Color::WHITE);
+    let expected = [style::TEAL.r, style::TEAL.g, style::TEAL.b].map(|v| v * 255.);
+    for span in label_spans {
+        for y in span {
+            assert!(
+                ((border_x as usize - 2)..=(border_x as usize + 2)).any(|x| {
+                    let offset = (y * 800 + x) * 4;
+                    pixels[offset..offset + 3]
+                        .iter()
+                        .zip(expected)
+                        .all(|(actual, target)| (*actual as f32 - target).abs() < 30.)
+                }),
+                "Selected activation border was erased at y={y}"
+            );
+        }
+    }
+}
+fn line(scene: &Scene, occurrence: Id) -> &super::super::Line {
+    scene.lines.iter().find(|a| a.id == occurrence).unwrap()
+}
+fn endpoints(p: &mut Project, occurrence: Id, from: Id, to: Id) {
+    if let SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange {
+            sender, receiver, ..
+        },
+        ..
+    } = p
+        .elements
+        .get_mut(&occurrence)
+        .unwrap()
+        .shared_mut()
+        .unwrap()
+    {
+        *sender = Some(from);
+        *receiver = Some(to);
+    }
+}
+
+#[test]
+fn nested_calls_expose_both_bars_and_end_at_their_exact_replies_in_both_directions() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for reverse in [false, true] {
+            let mut f = fixture(layer, true);
+            if reverse {
+                for occurrence in [f.call, f.inner] {
+                    endpoints(&mut f.project, occurrence, f.callee, f.caller);
+                }
+                for occurrence in [f.reply, f.inner_reply] {
+                    endpoints(&mut f.project, occurrence, f.caller, f.callee);
+                }
+            }
+            let scene = scene(&f);
+            let outer = bar(&scene, f.call);
+            let inner = bar(&scene, f.inner);
+            assert!(outer.rect.y < inner.rect.y && outer.bottom() > inner.bottom());
+            assert_eq!(outer.column, 0);
+            assert_eq!(inner.column, 1);
+            assert!(outer.rect.x < inner.rect.x && outer.edge(true) < inner.edge(true));
+            for (call, reply) in [(f.call, f.reply), (f.inner, f.inner_reply)] {
+                let execution = bar(&scene, call);
+                let received = *line(&scene, call).points.last().unwrap();
+                let returned = line(&scene, reply).points[0];
+                assert_eq!(execution.rect.y, received.y);
+                assert_eq!(execution.bottom(), returned.y);
+                assert_eq!(received.x, execution.edge(reverse));
+                assert_eq!(returned.x, execution.edge(reverse));
+                assert_eq!(execution.finish, Finish::Reply(reply));
+            }
+            assert!(scene.open_calls.is_empty());
+        }
+    }
+}
+
+#[test]
+fn call_uuid_order_does_not_choose_activation_columns_or_message_anchors() {
+    let f = fixture(Layer::Oa, false);
+    let g = fixture(Layer::Oa, true);
+    let a = scene(&f);
+    let b = scene(&g);
+    for (x, y) in [
+        (f.call, g.call),
+        (f.inner, g.inner),
+        (f.reply, g.reply),
+        (f.inner_reply, g.inner_reply),
+    ] {
+        assert_eq!(line(&a, x).points, line(&b, y).points);
+    }
+    for (x, y) in [(f.call, g.call), (f.inner, g.inner)] {
+        assert_eq!(bar(&a, x).rect, bar(&b, y).rect);
+    }
+}
+
+#[test]
+fn sequential_calls_reuse_column_and_crossed_replies_keep_their_correlations() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer, true);
+        *f.project
+            .elements
+            .get_mut(&f.owner)
+            .unwrap()
+            .steps_mut()
+            .unwrap() = vec![f.call, f.reply, f.inner, f.inner_reply];
+        let sequential = scene(&f);
+        assert_eq!(
+            bar(&sequential, f.call).rect.x,
+            bar(&sequential, f.inner).rect.x
+        );
+        *f.project
+            .elements
+            .get_mut(&f.owner)
+            .unwrap()
+            .steps_mut()
+            .unwrap() = vec![f.call, f.inner, f.reply, f.inner_reply];
+        let crossed = scene(&f);
+        assert!(bar(&crossed, f.call).bottom() < bar(&crossed, f.inner).bottom());
+        assert!(bar(&crossed, f.call).rect.x < bar(&crossed, f.inner).rect.x);
+        assert_eq!(
+            line(&crossed, f.reply).points[0].x,
+            bar(&crossed, f.call).edge(false)
+        );
+        assert_eq!(
+            line(&crossed, f.inner_reply).points[0].x,
+            bar(&crossed, f.inner).edge(false)
+        );
+    }
+}
+
+#[test]
+fn self_call_receives_at_lower_loop_end_and_self_reply_returns_to_the_parent() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer, true);
+        endpoints(&mut f.project, f.inner, f.callee, f.callee);
+        endpoints(&mut f.project, f.inner_reply, f.callee, f.callee);
+        let scene = scene(&f);
+        let parent = bar(&scene, f.call);
+        let child = bar(&scene, f.inner);
+        let call = line(&scene, f.inner);
+        let reply = line(&scene, f.inner_reply);
+        assert_eq!(call.points[0].x, parent.edge(true));
+        assert_eq!(call.points[3], Point::new(child.edge(true), child.rect.y));
+        assert_eq!(child.rect.y, scene.rows[&f.inner].1 + 24.);
+        assert_eq!(
+            reply.points[0],
+            Point::new(child.edge(true), child.bottom())
+        );
+        assert_eq!(reply.points[3].x, parent.edge(true));
+        assert!(call.points[1].x > child.edge(true));
+        assert!(reply.points[1].x > child.edge(true));
+    }
+}
+
+#[test]
+fn an_inactive_self_call_has_no_fabricated_parent_and_three_nested_calls_expose_three_columns() {
+    let mut f = fixture(Layer::Oa, true);
+    endpoints(&mut f.project, f.inner, f.callee, f.callee);
+    endpoints(&mut f.project, f.inner_reply, f.callee, f.callee);
+    f.project.elements.remove(&f.call);
+    f.project.elements.remove(&f.reply);
+    *f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![f.inner, f.inner_reply];
+    let isolated = scene(&f);
+    assert_eq!(isolated.activations.len(), 1);
+    assert_eq!(bar(&isolated, f.inner).column, 0);
+    assert_eq!(
+        line(&isolated, f.inner).points[0].x,
+        isolated.lanes[&f.callee]
+    );
+    assert_eq!(
+        line(&isolated, f.inner_reply).points[3].x,
+        isolated.lanes[&f.callee]
+    );
+    assert_eq!(
+        bar(&isolated, f.inner).rect.y,
+        line(&isolated, f.inner).points[3].y
+    );
+
+    let mut f = fixture(Layer::Oa, true);
+    let third = message(
+        &mut f.project,
+        Layer::Oa,
+        20,
+        f.owner,
+        (f.caller, f.callee),
+        None,
+    );
+    let third_reply = message(
+        &mut f.project,
+        Layer::Oa,
+        21,
+        f.owner,
+        (f.callee, f.caller),
+        Some(third),
+    );
+    *f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![f.call, f.inner, third, third_reply, f.inner_reply, f.reply];
+    let scene = scene(&f);
+    let calls: Vec<_> = scene.activations.iter().map(|a| a.call).collect();
+    assert_eq!(
+        calls,
+        vec![f.call, f.inner, third],
+        "Paint order is shallow to deep"
+    );
+    for (column, call) in [f.call, f.inner, third].into_iter().enumerate() {
+        let execution = bar(&scene, call);
+        assert_eq!(execution.column, column);
+        let y = (bar(&scene, third).rect.y + bar(&scene, third).bottom()) / 2.;
+        assert_eq!(
+            scene.hit(Point::new(execution.rect.x + OFFSET / 2., y)),
+            Some(call)
+        );
+    }
+}
+
+#[test]
+fn reentrant_call_uses_the_other_receiver_without_inventing_a_caller_execution() {
+    let mut f = fixture(Layer::Oa, true);
+    endpoints(&mut f.project, f.inner, f.callee, f.caller);
+    endpoints(&mut f.project, f.inner_reply, f.caller, f.callee);
+    let scene = scene(&f);
+    assert_eq!(bar(&scene, f.call).column, 0);
+    assert_eq!(bar(&scene, f.inner).column, 0);
+    assert_eq!(bar(&scene, f.inner).receiver, f.caller);
+    assert_eq!(line(&scene, f.call).points[0].x, scene.lanes[&f.caller]);
+    assert_eq!(
+        line(&scene, f.inner).points[0].x,
+        bar(&scene, f.call).edge(false)
+    );
+}
+
+#[test]
+fn actual_canvas_pointer_selects_each_exposed_shoulder_under_zoom_and_pan() {
+    let f = fixture(Layer::Oa, true);
+    let mut scene = scene(&f);
+    let context = scenario::direct_tests::context(f.owner);
+    scene.interaction = Some((context, scenario::CanvasTool::Select, true));
+    let y = (bar(&scene, f.inner).rect.y + bar(&scene, f.inner).bottom()) / 2.;
+    let outer = Point::new(bar(&scene, f.call).rect.x + OFFSET / 2., y);
+    let inner = Point::new(bar(&scene, f.inner).edge(true) - OFFSET / 2., y);
+    for scale in [1., 0.25, 0.05] {
+        scene.scale = scale;
+        scene.camera_pan = iced::Vector::new(50., 25.);
+        let bounds = Rectangle::new(Point::new(30., 40.), Size::new(1000., 700.));
+        for (point, call) in [(outer, f.call), (inner, f.inner)] {
+            assert_eq!(scene.hit(point), Some(call));
+            let cursor = bounds.position()
+                + scene.camera_pan
+                + iced::Vector::new(point.x * scale, point.y * scale);
+            let mut state = SequenceInput::default();
+            let _ = canvas::Program::update(
+                &scene,
+                &mut state,
+                &canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                bounds,
+                mouse::Cursor::Available(cursor),
+            );
+            let action = canvas::Program::update(
+                &scene,
+                &mut state,
+                &canvas::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+                bounds,
+                mouse::Cursor::Available(cursor),
+            )
+            .unwrap();
+            assert!(matches!(action.into_inner().0,
+                Some(Message::ScenarioCanvas(scenario::CanvasEvent::Select(_, selected))) if selected == call));
+        }
+    }
+}
+
+#[test]
+fn missing_reply_is_a_short_explicit_open_span_and_an_uncorrelated_reply_closes_nothing() {
+    let mut f = fixture(Layer::Oa, true);
+    if let SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange { reply_to, .. },
+        ..
+    } = f
+        .project
+        .elements
+        .get_mut(&f.reply)
+        .unwrap()
+        .shared_mut()
+        .unwrap()
+    {
+        *reply_to = None;
+    }
+    let scene = scene(&f);
+    assert_eq!(bar(&scene, f.call).finish, Finish::Open);
+    assert_eq!(bar(&scene, f.call).rect.height, 26.);
+    assert_eq!(scene.open_calls.len(), 1);
+    assert_eq!(
+        bar(&scene, f.inner).column,
+        0,
+        "Unknown duration does not prove later nesting"
+    );
+    assert_eq!(bar(&scene, f.inner).finish, Finish::Reply(f.inner_reply));
+}
+
+#[test]
+fn alternative_and_parallel_operand_local_calls_do_not_nest_from_screen_order() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for operator in [FragmentOperator::Alternative, FragmentOperator::Parallel] {
+            let mut f = fixture(layer, true);
+            let fragment = seed(&mut f.project, layer, 70, Kind::Occurrence, Some(f.owner));
+            let branches = [id(71), id(72)];
+            *f.project
+                .elements
+                .get_mut(&fragment)
+                .unwrap()
+                .shared_mut()
+                .unwrap() = SharedBody::Occurrence {
+                body: OccurrenceBody::Fragment {
+                    operator,
+                    branches: branches.to_vec(),
+                },
+                precondition: String::new(),
+                postcondition: String::new(),
+            };
+            for (index, occurrences) in [vec![f.call, f.reply], vec![f.inner, f.inner_reply]]
+                .into_iter()
+                .enumerate()
+            {
+                let branch = seed(
+                    &mut f.project,
+                    layer,
+                    71 + index as u128,
+                    Kind::Occurrence,
+                    Some(fragment),
+                );
+                for occurrence in &occurrences {
+                    f.project.elements.get_mut(occurrence).unwrap().parent = Some(branch);
+                }
+                *f.project
+                    .elements
+                    .get_mut(&branch)
+                    .unwrap()
+                    .shared_mut()
+                    .unwrap() = SharedBody::Occurrence {
+                    body: OccurrenceBody::Branch {
+                        guard: format!("condition_{index}"),
+                        occurrences,
+                    },
+                    precondition: String::new(),
+                    postcondition: String::new(),
+                };
+            }
+            *f.project
+                .elements
+                .get_mut(&f.owner)
+                .unwrap()
+                .steps_mut()
+                .unwrap() = vec![fragment];
+            let scene = scene(&f);
+            assert_eq!(bar(&scene, f.call).column, 0);
+            assert_eq!(bar(&scene, f.inner).column, 0);
+            assert_ne!(bar(&scene, f.call).scope, bar(&scene, f.inner).scope);
+            assert!(scene.open_calls.is_empty());
+        }
+    }
+}
+
+#[test]
+fn inherited_execution_anchors_a_self_call_inside_an_operand_before_returning_after_the_fragment() {
+    let mut f = fixture(Layer::Oa, true);
+    endpoints(&mut f.project, f.inner, f.callee, f.callee);
+    endpoints(&mut f.project, f.inner_reply, f.callee, f.callee);
+    let fragment = seed(
+        &mut f.project,
+        Layer::Oa,
+        70,
+        Kind::Occurrence,
+        Some(f.owner),
+    );
+    *f.project
+        .elements
+        .get_mut(&fragment)
+        .unwrap()
+        .shared_mut()
+        .unwrap() = SharedBody::Occurrence {
+        body: OccurrenceBody::Fragment {
+            operator: FragmentOperator::Alternative,
+            branches: vec![id(71), id(72)],
+        },
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+    for (index, occurrences) in [vec![f.inner, f.inner_reply], vec![]]
+        .into_iter()
+        .enumerate()
+    {
+        let branch = seed(
+            &mut f.project,
+            Layer::Oa,
+            71 + index as u128,
+            Kind::Occurrence,
+            Some(fragment),
+        );
+        for occurrence in &occurrences {
+            f.project.elements.get_mut(occurrence).unwrap().parent = Some(branch);
+        }
+        *f.project
+            .elements
+            .get_mut(&branch)
+            .unwrap()
+            .shared_mut()
+            .unwrap() = SharedBody::Occurrence {
+            body: OccurrenceBody::Branch {
+                guard: format!("condition_{index}"),
+                occurrences,
+            },
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+    }
+    *f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![f.call, fragment, f.reply];
+    let scene = scene(&f);
+    let parent = scene
+        .activations
+        .iter()
+        .find(|a| a.call == f.call && a.scope == id(71))
+        .unwrap();
+    assert_eq!(parent.finish, Finish::Continuation);
+    assert_eq!(bar(&scene, f.inner).column, parent.column + 1);
+    assert_eq!(line(&scene, f.inner).points[0].x, parent.edge(true));
+    assert_eq!(line(&scene, f.inner_reply).points[3].x, parent.edge(true));
+    assert!(
+        scene
+            .activations
+            .iter()
+            .any(|a| a.call == f.call && a.finish == Finish::Reply(f.reply))
+    );
+}
+
+#[test]
+fn a_fragment_cannot_make_crossed_calls_an_unambiguous_caller_execution() {
+    for placement in ["plain", "before_fragment", "in_operand"] {
+        let mut f = fixture(Layer::Oa, true);
+        let outgoing = message(
+            &mut f.project,
+            Layer::Oa,
+            80,
+            f.owner,
+            (f.callee, f.caller),
+            None,
+        );
+        if let SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange { message_kind, .. },
+            ..
+        } = f
+            .project
+            .elements
+            .get_mut(&outgoing)
+            .unwrap()
+            .shared_mut()
+            .unwrap()
+        {
+            *message_kind = MessageKind::Asynchronous;
+        }
+        let mut ordered = vec![f.call, f.inner];
+        if placement != "in_operand" {
+            ordered.push(outgoing);
+        }
+        if placement != "plain" {
+            let fragment = seed(
+                &mut f.project,
+                Layer::Oa,
+                70,
+                Kind::Occurrence,
+                Some(f.owner),
+            );
+            *f.project
+                .elements
+                .get_mut(&fragment)
+                .unwrap()
+                .shared_mut()
+                .unwrap() = SharedBody::Occurrence {
+                body: OccurrenceBody::Fragment {
+                    operator: FragmentOperator::Alternative,
+                    branches: vec![id(71), id(72)],
+                },
+                precondition: String::new(),
+                postcondition: String::new(),
+            };
+            for index in 0..2u128 {
+                let branch = seed(
+                    &mut f.project,
+                    Layer::Oa,
+                    71 + index,
+                    Kind::Occurrence,
+                    Some(fragment),
+                );
+                let occurrences = if index == 0 && placement == "in_operand" {
+                    f.project.elements.get_mut(&outgoing).unwrap().parent = Some(branch);
+                    vec![outgoing]
+                } else {
+                    vec![]
+                };
+                *f.project
+                    .elements
+                    .get_mut(&branch)
+                    .unwrap()
+                    .shared_mut()
+                    .unwrap() = SharedBody::Occurrence {
+                    body: OccurrenceBody::Branch {
+                        guard: format!("condition_{index}"),
+                        occurrences,
+                    },
+                    precondition: String::new(),
+                    postcondition: String::new(),
+                };
+            }
+            ordered.push(fragment);
+        }
+        ordered.extend([f.reply, f.inner_reply]);
+        *f.project
+            .elements
+            .get_mut(&f.owner)
+            .unwrap()
+            .steps_mut()
+            .unwrap() = ordered;
+        let scene = scene(&f);
+        assert_eq!(
+            line(&scene, outgoing).points[0].x,
+            scene.lanes[&f.callee],
+            "{placement}"
+        );
+    }
+}
+
+#[test]
+fn nested_correlations_returning_in_alternative_operands_remain_nested_before_the_fragment() {
+    let mut f = fixture(Layer::Oa, true);
+    let outgoing = message(
+        &mut f.project,
+        Layer::Oa,
+        80,
+        f.owner,
+        (f.callee, f.caller),
+        None,
+    );
+    if let SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange { message_kind, .. },
+        ..
+    } = f
+        .project
+        .elements
+        .get_mut(&outgoing)
+        .unwrap()
+        .shared_mut()
+        .unwrap()
+    {
+        *message_kind = MessageKind::Asynchronous;
+    }
+    let fragment = seed(
+        &mut f.project,
+        Layer::Oa,
+        70,
+        Kind::Occurrence,
+        Some(f.owner),
+    );
+    *f.project
+        .elements
+        .get_mut(&fragment)
+        .unwrap()
+        .shared_mut()
+        .unwrap() = SharedBody::Occurrence {
+        body: OccurrenceBody::Fragment {
+            operator: FragmentOperator::Alternative,
+            branches: vec![id(71), id(72)],
+        },
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+    for index in 0..2u128 {
+        let branch = seed(
+            &mut f.project,
+            Layer::Oa,
+            71 + index,
+            Kind::Occurrence,
+            Some(fragment),
+        );
+        let occurrences = if index == 0 {
+            for reply in [f.inner_reply, f.reply] {
+                f.project.elements.get_mut(&reply).unwrap().parent = Some(branch);
+            }
+            vec![f.inner_reply, f.reply]
+        } else {
+            vec![
+                message(
+                    &mut f.project,
+                    Layer::Oa,
+                    90,
+                    branch,
+                    (f.callee, f.caller),
+                    Some(f.inner),
+                ),
+                message(
+                    &mut f.project,
+                    Layer::Oa,
+                    91,
+                    branch,
+                    (f.callee, f.caller),
+                    Some(f.call),
+                ),
+            ]
+        };
+        *f.project
+            .elements
+            .get_mut(&branch)
+            .unwrap()
+            .shared_mut()
+            .unwrap() = SharedBody::Occurrence {
+            body: OccurrenceBody::Branch {
+                guard: format!("condition_{index}"),
+                occurrences,
+            },
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+    }
+    *f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![f.call, f.inner, outgoing, fragment];
+    let scene = scene(&f);
+    let inner = scene
+        .activations
+        .iter()
+        .find(|a| a.call == f.inner && a.scope == f.owner)
+        .unwrap();
+    assert_eq!(line(&scene, outgoing).points[0].x, inner.edge(false));
+}

crates/oa-desktop/src/behavior/scenario_hit_tests.rs

@@ -0,0 +1,386 @@
+//! Actual Scene primitives, with independently chosen points and semantic IDs.
+//! These preserve the existing label hit band; they do not establish ink bounds
+//! or authoring eligibility, and do not dispatch a spacing gesture.
+use super::*;
+use crate::document::Document;
+
+struct Fixture {
+    project: Project,
+    owner: Id,
+    sender: Id,
+    receiver: Id,
+    call: Id,
+    reply: Id,
+    exchange: Id,
+}
+
+fn fixture() -> Fixture {
+    let project = language::parse(r#"arcadia 7;
+project hits "Hit roles" {
+ oa_activity source "Source" {}
+ oa_activity target "Target" {}
+ interaction exchange "Contract" { source @source; target @target; }
+ oa_scenario conversation "Conversation" { viewpoint OperationalActivity; steps [@call, @reply]; }
+ oa_lifeline left "Left" { parent @conversation; represented @source; }
+ oa_lifeline right "Right" { parent @conversation; represented @target; }
+ oa_occurrence call "Call" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver @right; message_kind Call; }; }; }
+ oa_occurrence reply "Reply" { parent @conversation; body { Exchange { exchange @exchange; sender @right; receiver @left; message_kind Reply; reply_to @call; }; }; }
+}
+"#).unwrap();
+    let id = |alias: &str| {
+        project
+            .identities()
+            .into_iter()
+            .find(|(_, name)| *name == alias)
+            .unwrap()
+            .0
+    };
+    Fixture {
+        owner: id("conversation"),
+        sender: id("left"),
+        receiver: id("right"),
+        call: id("call"),
+        reply: id("reply"),
+        exchange: id("exchange"),
+        project,
+    }
+}
+
+fn scene(f: &Fixture) -> Scene {
+    let document =
+        Document::from_project(f.project.clone(), source_project::ProjectLimits::default())
+            .unwrap();
+    let before = document.snapshot();
+    let result = Scene::sequence_geometry(
+        document.project(),
+        f.owner,
+        f.call,
+        Some(&BTreeMap::from([(f.sender, 160.), (f.receiver, 400.)])),
+        None,
+    );
+    assert_eq!(document.project(), &before.decoded.project);
+    assert_eq!(document.bundle(), &before.bundle);
+    assert_eq!(document.revision(), 0);
+    assert!(!document.can_undo() && !document.can_redo() && !document.dirty());
+    result
+}
+
+fn hit(scene: &Scene, point: Point, id: Id, role: SceneHitRole) {
+    assert_eq!(scene.hit_item(point), Some(SceneHit { id, role }));
+    assert_eq!(scene.hit(point), Some(id));
+}
+
+fn occurrence(p: &mut Project, parent: Id, body: OccurrenceBody) -> Id {
+    let mut element = p
+        .make_element(Kind::Occurrence, Layer::Oa, "Hit target", Some(parent))
+        .unwrap();
+    let id = element.id;
+    *element.shared_mut().unwrap() = SharedBody::Occurrence {
+        body,
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+    p.elements.insert(id, element);
+    p.elements
+        .get_mut(&parent)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(id);
+    id
+}
+
+fn exchange_mut(p: &mut Project, id: Id) -> &mut OccurrenceBody {
+    let SharedBody::Occurrence { body, .. } =
+        p.elements.get_mut(&id).unwrap().shared_mut().unwrap()
+    else {
+        panic!("expected occurrence")
+    };
+    body
+}
+
+#[test]
+fn exact_headers_include_unassigned_lifelines_but_guides_are_not_headers() {
+    let mut f = fixture();
+    *f.project
+        .elements
+        .get_mut(&f.receiver)
+        .unwrap()
+        .shared_mut()
+        .unwrap() = SharedBody::Lifeline { represented: None };
+    let s = scene(&f);
+    assert!(!s.lanes.contains_key(&f.receiver));
+    assert_eq!(s.render_lanes[&f.receiver], 400.);
+    for (id, x) in [(f.sender, 160.), (f.receiver, 400.)] {
+        // The actual header is x-102..x+102, y15..85, including its padding.
+        for point in [Point::new(x - 101., 16.), Point::new(x + 101., 84.)] {
+            hit(&s, point, id, SceneHitRole::LifelineHeader);
+        }
+        hit(&s, Point::new(x, 95.), id, SceneHitRole::LifelineGuide);
+    }
+}
+
+#[test]
+fn repeated_exchange_occurrences_keep_distinct_message_body_and_label_hits() {
+    let f = fixture();
+    let s = scene(&f);
+    assert_eq!(s.rows[&f.call].1, 148.);
+    assert_eq!(s.rows[&f.reply].1, 240.);
+    for (id, y) in [(f.call, 148.), (f.reply, 240.)] {
+        hit(&s, Point::new(280., y), id, SceneHitRole::MessageBody);
+        hit(
+            &s,
+            Point::new(180., y - 16.),
+            id,
+            SceneHitRole::MessageLabel,
+        );
+        assert_ne!(id, f.exchange);
+    }
+}
+
+#[test]
+fn self_call_elbow_and_receive_endpoint_are_messages_not_execution_hits() {
+    let mut f = fixture();
+    for id in [f.call, f.reply] {
+        let OccurrenceBody::Exchange {
+            sender,
+            receiver,
+            exchange,
+            ..
+        } = exchange_mut(&mut f.project, id)
+        else {
+            unreachable!()
+        };
+        *sender = Some(f.sender);
+        *receiver = Some(f.sender);
+        *exchange = None;
+    }
+    let s = scene(&f);
+    let call = s.lines.iter().find(|l| l.id == f.call).unwrap();
+    assert_eq!(call.points.len(), 4);
+    assert_eq!(call.points[0].y, 148.);
+    assert_eq!(call.points[3].y, 172.);
+    hit(
+        &s,
+        Point::new(call.points[1].x, 160.),
+        f.call,
+        SceneHitRole::MessageBody,
+    );
+    hit(&s, call.points[3], f.call, SceneHitRole::MessageBody);
+    hit(
+        &s,
+        Point::new(180., 132.),
+        f.call,
+        SceneHitRole::MessageLabel,
+    );
+    let bar = s.activations.iter().find(|a| a.call == f.call).unwrap();
+    hit(
+        &s,
+        Point::new(bar.rect.x + 2., 190.),
+        f.call,
+        SceneHitRole::Activation,
+    );
+}
+
+#[test]
+fn activation_shoulder_beats_another_calls_label_and_broad_message_tolerance() {
+    let mut f = fixture();
+    let mut inner = f.project.elements[&f.call].clone();
+    inner.id = Id::new_v4();
+    inner.alias = "inner_call_hit".into();
+    inner.name = "Pressure verification with a descriptive operation label".into();
+    let inner_id = inner.id;
+    f.project.elements.insert(inner_id, inner);
+    let mut inner_reply = f.project.elements[&f.reply].clone();
+    inner_reply.id = Id::new_v4();
+    inner_reply.alias = "inner_reply_hit".into();
+    let reply_id = inner_reply.id;
+    f.project.elements.insert(reply_id, inner_reply);
+    let OccurrenceBody::Exchange { reply_to, .. } = exchange_mut(&mut f.project, reply_id) else {
+        unreachable!()
+    };
+    *reply_to = Some(inner_id);
+    *f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![f.call, inner_id, reply_id, f.reply];
+    let mut s = scene(&f);
+    let inner = s.lines.iter().find(|l| l.id == inner_id).unwrap();
+    let outer = s.activations.iter().find(|a| a.call == f.call).unwrap();
+    let shoulder = Point::new(outer.rect.x + 1., 225.);
+    assert!(outer.rect.contains(shoulder));
+    assert!(inner.label_bounds().contains(shoulder));
+    let endpoint = *inner.points.last().unwrap();
+    for scale in [1., 0.05, 0.0003] {
+        s.scale = scale;
+        hit(&s, shoulder, f.call, SceneHitRole::Activation);
+        hit(&s, endpoint, inner_id, SceneHitRole::MessageBody);
+        hit(
+            &s,
+            Point::new(180., 225.),
+            inner_id,
+            SceneHitRole::MessageLabel,
+        );
+    }
+}
+
+#[test]
+fn create_delete_markers_are_distinct_from_their_own_message_body_and_label() {
+    let mut f = fixture();
+    for (id, kind) in [
+        (f.call, MessageKind::Create),
+        (f.reply, MessageKind::Delete),
+    ] {
+        let OccurrenceBody::Exchange {
+            sender,
+            receiver,
+            message_kind,
+            reply_to,
+            ..
+        } = exchange_mut(&mut f.project, id)
+        else {
+            unreachable!()
+        };
+        *sender = Some(f.sender);
+        *receiver = Some(f.receiver);
+        *message_kind = kind;
+        *reply_to = None;
+    }
+    let s = scene(&f);
+    for (id, y, label_y) in [(f.call, 148., 118.), (f.reply, 240., 224.)] {
+        hit(&s, Point::new(400., y), id, SceneHitRole::LifecycleMarker);
+        hit(&s, Point::new(280., y), id, SceneHitRole::MessageBody);
+        hit(
+            &s,
+            Point::new(180., label_y),
+            id,
+            SceneHitRole::MessageLabel,
+        );
+    }
+    // Capsule boundary owns its contact with the incoming Create arrow.
+    hit(
+        &s,
+        Point::new(330., 148.),
+        f.call,
+        SceneHitRole::LifecycleMarker,
+    );
+}
+
+#[test]
+fn tiny_scale_nearest_hit_retains_the_winning_marker_or_message_role() {
+    let mut f = fixture();
+    let OccurrenceBody::Exchange {
+        sender,
+        receiver,
+        message_kind,
+        reply_to,
+        ..
+    } = exchange_mut(&mut f.project, f.reply)
+    else {
+        unreachable!()
+    };
+    *sender = Some(f.sender);
+    *receiver = Some(f.receiver);
+    *message_kind = MessageKind::Delete;
+    *reply_to = None;
+    let mut s = scene(&f);
+    s.scale = 0.0003;
+    // Both are outside exact strokes/labels. Comparing all broad candidates
+    // chooses the actual nearer shape, even when their UUID is identical.
+    hit(
+        &s,
+        Point::new(280., 246.),
+        f.reply,
+        SceneHitRole::MessageBody,
+    );
+    hit(
+        &s,
+        Point::new(400., 265.),
+        f.reply,
+        SceneHitRole::LifecycleMarker,
+    );
+    hit(
+        &s,
+        Point::new(280., 154.),
+        f.call,
+        SceneHitRole::MessageBody,
+    );
+}
+
+#[test]
+fn action_frame_and_use_boxes_do_not_advertise_message_or_header_roles() {
+    for body in [
+        OccurrenceBody::Action {
+            action: None,
+            lifeline: None,
+        },
+        OccurrenceBody::Fragment {
+            operator: FragmentOperator::Alternative,
+            branches: vec![],
+        },
+        OccurrenceBody::ScenarioUse {
+            scenario: None,
+            bindings: vec![],
+        },
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: None,
+            receiver: None,
+            message_kind: MessageKind::Asynchronous,
+            operation: None,
+            reply_to: None,
+            values: vec![],
+        },
+    ] {
+        let mut f = fixture();
+        let id = occurrence(&mut f.project, f.owner, body);
+        let s = scene(&f);
+        let item = s.boxes.iter().find(|b| b.id == id).unwrap();
+        hit(
+            &s,
+            item.rect.position() + iced::Vector::new(15., 15.),
+            id,
+            SceneHitRole::Box,
+        );
+    }
+}
+
+#[test]
+fn winning_primitive_role_does_not_come_from_its_shared_uuid() {
+    let f = fixture();
+    let mut s = scene(&f);
+    // A controlled overlapping primitive verifies reverse box order without
+    // inventing a core alias. Its ID intentionally equals a real header's ID.
+    s.boxes.push(BoxItem {
+        id: f.sender,
+        role: SceneHitRole::Box,
+        rect: Rectangle::new(Point::new(150., 20.), Size::new(20., 20.)),
+        title: "Overlay control".into(),
+        detail: String::new(),
+        marker: None,
+    });
+    hit(&s, Point::new(160., 30.), f.sender, SceneHitRole::Box);
+    hit(
+        &s,
+        Point::new(180., 30.),
+        f.sender,
+        SceneHitRole::LifelineHeader,
+    );
+}
+
+#[test]
+fn invalid_points_never_produce_a_semantic_or_spacing_hit() {
+    let f = fixture();
+    let s = scene(&f);
+    for point in [
+        Point::new(f32::NAN, 148.),
+        Point::new(280., f32::NAN),
+        Point::new(f32::INFINITY, 148.),
+        Point::new(280., f32::NEG_INFINITY),
+    ] {
+        assert_eq!(s.hit_item(point), None);
+        assert_eq!(s.hit(point), None);
+    }
+}

crates/oa-desktop/src/behavior/scenario_label.rs

@@ -18,12 +18,19 @@
 //! It measures layout advances, not raster ink; overhang/clip/activation-border
 //! acceptance still requires the real WGPU evaluator. The old 32-grapheme/225px
 //! renderer is deliberately untouched for a later baseline comparison.
+//! Field geometry is a second unwired experiment: exact retained source spans
+//! and winning-buffer cluster boxes, with unresolved glyph coverage distinct
+//! from truncation. It does not adopt a production navigation policy.
 use iced::advanced::{
     graphics::text as graphics_text,
     text::{Alignment, LineHeight, Shaping},
 };
 use iced::{Color, Font, Pixels, Point, Rectangle, Size, widget::canvas::Text};
-use std::{collections::VecDeque, ops::Range, sync::Arc};
+use std::{
+    collections::{HashSet, VecDeque},
+    ops::Range,
+    sync::Arc,
+};
 use unicode_segmentation::UnicodeSegmentation;
 
 const MAX_SOURCE_BYTES: usize = 64 * 1024;
@@ -94,9 +101,207 @@ pub(super) struct Label {
     style: Style,
     measured_session: RenderSession,
     measured_zoom: f32,
+    // Snapshot of the final displayed Cache entry, after alignment. These are
+    // cluster advance boxes, never glyph ink or inferred character cells.
+    clusters: Vec<FieldCluster>,
+    source_spans: Vec<SourceSpan>,
+    retained_normalized: usize,
+    field_index: FieldIndex,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct FieldLayout {
+    pub rectangles: Vec<Rectangle>,
+    pub covered: Vec<Range<usize>>,
+    pub truncated: Vec<Range<usize>>,
+    pub unresolved: Vec<UnresolvedField>,
+    pub partially_retained: bool,
+    pub shared_cluster: bool,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum FieldIssue {
+    MissingGlyph,
+    NoAdvanceGeometry,
+    NonPaintingScalar,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct UnresolvedField {
+    pub source: Range<usize>,
+    pub reason: FieldIssue,
+}
+
+#[derive(Clone, Debug)]
+struct SourceSpan {
+    source: Range<usize>,
+    normalized: Range<usize>,
+    whitespace: bool,
+    non_painting: bool,
+}
+
+#[derive(Clone, Debug)]
+struct FieldCluster {
+    normalized: Range<usize>,
+    rectangles: Vec<Rectangle>,
+    missing: bool,
+}
+
+/// Immutable overlap membership, built from Normalized's ordered, disjoint
+/// scalar/separator spans. Clusters may overlap and need not be in visual order.
+/// Construction costs O(C log S + I), storage O(S + C + I), where I is the
+/// number of actual span/cluster overlaps, rather than the full S*C product.
+#[derive(Clone, Debug)]
+struct FieldIndex {
+    clusters_by_span: Vec<Vec<usize>>,
+    source_extents: Vec<Option<SourceExtents>>,
+}
+
+#[derive(Clone, Copy, Debug)]
+struct SourceExtents {
+    minimum_end: usize,
+    maximum_start: usize,
+}
+
+impl FieldIndex {
+    fn new(spans: &[SourceSpan], clusters: &[FieldCluster]) -> Self {
+        debug_assert!(
+            spans
+                .iter()
+                .all(|span| span.normalized.start < span.normalized.end)
+        );
+        debug_assert!(
+            spans
+                .windows(2)
+                .all(|pair| pair[0].normalized.end <= pair[1].normalized.start)
+        );
+        let mut result = Self {
+            clusters_by_span: vec![vec![]; spans.len()],
+            source_extents: vec![None; clusters.len()],
+        };
+        for (index, cluster) in clusters.iter().enumerate() {
+            if cluster.normalized.start >= cluster.normalized.end {
+                continue;
+            }
+            let first =
+                spans.partition_point(|span| span.normalized.end <= cluster.normalized.start);
+            for (offset, span) in spans[first..].iter().enumerate() {
+                if span.normalized.start >= cluster.normalized.end {
+                    break;
+                }
+                result.clusters_by_span[first + offset].push(index);
+                let extents = result.source_extents[index].get_or_insert(SourceExtents {
+                    minimum_end: span.source.end,
+                    maximum_start: span.source.start,
+                });
+                extents.minimum_end = extents.minimum_end.min(span.source.end);
+                extents.maximum_start = extents.maximum_start.max(span.source.start);
+            }
+        }
+        result
+    }
+}
+
+// Translation rejects nonfinite rectangle components before deduplication.
+// For finite f32 values, bit equality differs from `==` only at signed zero.
+// Normalize only the key: preserve the first rectangle and its original bits.
+fn rectangle_key(bounds: Rectangle) -> [u32; 4] {
+    [bounds.x, bounds.y, bounds.width, bounds.height]
+        .map(|value| if value == 0. { 0 } else { value.to_bits() })
 }
 
 impl Label {
+    /// Geometry and coverage are separate: truncation is not missing-font
+    /// coverage, and a positive .notdef advance is not represented field text.
+    /// Shared ligatures use whole cluster boxes; no sub-cluster fraction is
+    /// invented. Returned ranges refer only to the requested original source.
+    pub fn field_layout(
+        &self,
+        session: &RenderSession,
+        zoom: f32,
+        position: Point,
+        field: Range<usize>,
+    ) -> Result<FieldLayout, Error> {
+        self.check(session, zoom)?;
+        translated_bounds(position, Size::ZERO)?;
+        if field.start > field.end || self.source.get(field.clone()).is_none() {
+            return Err(Error::InvalidFieldRange);
+        }
+        let mut result = FieldLayout {
+            rectangles: vec![],
+            covered: vec![],
+            truncated: vec![],
+            unresolved: vec![],
+            partially_retained: false,
+            shared_cluster: false,
+        };
+        let mut selected = vec![false; self.clusters.len()];
+        for (span_index, span) in self.source_spans.iter().enumerate() {
+            if span.whitespace || !overlaps(&span.source, &field) {
+                continue;
+            }
+            // Source spans for text are exact UTF-8 scalars, not intervals
+            // between ends (which could assign trimmed whitespace to text).
+            if span.normalized.end > self.retained_normalized {
+                append_range(&mut result.truncated, span.source.clone());
+                continue;
+            }
+            let matching = &self.field_index.clusters_by_span[span_index];
+            result.shared_cluster |= matching.iter().any(|&index| {
+                let cluster = &self.clusters[index];
+                cluster.normalized.end > self.retained_normalized
+                    || self.field_index.source_extents[index].is_some_and(|extents| {
+                        // Any overlapping source span outside the requested
+                        // field is exactly either a too-small end or too-large
+                        // start. Include whitespace/nonpainting spans, as before.
+                        extents.minimum_end <= field.start || extents.maximum_start >= field.end
+                    })
+            });
+            let issue = if span.non_painting {
+                Some(FieldIssue::NonPaintingScalar)
+            } else if matching.iter().any(|&index| self.clusters[index].missing) {
+                Some(FieldIssue::MissingGlyph)
+            } else if matching.is_empty()
+                || matching
+                    .iter()
+                    .all(|&index| self.clusters[index].rectangles.is_empty())
+            {
+                Some(FieldIssue::NoAdvanceGeometry)
+            } else {
+                None
+            };
+            if let Some(reason) = issue {
+                result.unresolved.push(UnresolvedField {
+                    source: span.source.clone(),
+                    reason,
+                });
+                continue;
+            }
+            append_range(&mut result.covered, span.source.clone());
+            for &index in matching {
+                selected[index] = true;
+            }
+        }
+        let mut seen = HashSet::new();
+        for (cluster, selected) in self.clusters.iter().zip(selected) {
+            if !selected {
+                continue;
+            }
+            for bounds in &cluster.rectangles {
+                let translated = translated_bounds(
+                    Point::new(position.x + bounds.x, position.y + bounds.y),
+                    bounds.size(),
+                )?;
+                if seen.insert(rectangle_key(translated)) {
+                    result.rectangles.push(translated);
+                }
+            }
+        }
+        result.partially_retained = !result.truncated.is_empty()
+            && (!result.covered.is_empty() || !result.unresolved.is_empty());
+        Ok(result)
+    }
+
     fn check(&self, session: &RenderSession, zoom: f32) -> Result<(), Error> {
         if !Arc::ptr_eq(&self.measured_session.identity, &session.identity) {
             return Err(Error::StaleRenderSession);
@@ -194,6 +399,7 @@ pub(super) enum Error {
     StaleZoom,
     StaleRenderSession,
     FontSetChanged,
+    InvalidFieldRange,
 }
 
 struct Entry {
@@ -286,8 +492,8 @@ impl Cache {
         if cuts.len().saturating_sub(1) > MAX_GRAPHEMES {
             return Err(Error::GraphemeBudget);
         }
-        // Candidate buffers are temporary. Only the resolved strings/metrics
-        // survive, bounded by MAX_ENTRIES; renderer caching remains independent.
+        // Candidate buffers are temporary. The winning strings, metrics, source
+        // spans and cluster boxes survive; renderer caching remains independent.
         let mut shapes = graphics_text::Cache::new();
         let mut measure = |content: &str| -> Result<Size, Error> {
             if content.is_empty() {
@@ -345,6 +551,25 @@ impl Cache {
                 best
             }
         };
+        let clusters = if displayed.is_empty() {
+            // measure("") deliberately creates no cache entry.
+            vec![]
+        } else {
+            let (_, entry) = shapes.allocate(
+                fonts.raw(),
+                graphics_text::cache::Key {
+                    content: &displayed,
+                    size,
+                    line_height,
+                    font: style.font,
+                    bounds: Size::INFINITE,
+                    shaping: style.shaping,
+                    align_x: Alignment::Default,
+                },
+            );
+            field_clusters(entry, zoom)?
+        };
+        let field_index = FieldIndex::new(&normalized.spans, &clusters);
         let label = Arc::new(Label {
             source: source.into(),
             displayed,
@@ -353,6 +578,10 @@ impl Cache {
             style,
             measured_session: session.clone(),
             measured_zoom: zoom,
+            clusters,
+            source_spans: normalized.spans,
+            retained_normalized: retained,
+            field_index,
         });
         if self.entries.len() == MAX_ENTRIES {
             self.entries.pop_front();
@@ -394,12 +623,14 @@ fn translated_bounds(position: Point, size: Size) -> Result<Rectangle, Error> {
 struct Normalized {
     text: String,
     ends: Vec<(usize, usize)>,
+    spans: Vec<SourceSpan>,
 }
 impl Normalized {
     fn new(source: &str) -> Self {
         let mut result = Self {
             text: String::new(),
             ends: vec![(0, 0)],
+            spans: vec![],
         };
         let mut separator = false;
         for (start, c) in source.char_indices() {
@@ -408,11 +639,25 @@ impl Normalized {
                 continue;
             }
             if separator {
+                let normalized_start = result.text.len();
                 result.text.push(' ');
+                result.spans.push(SourceSpan {
+                    source: result.ends.last().expect("initial boundary").1..start,
+                    normalized: normalized_start..result.text.len(),
+                    whitespace: true,
+                    non_painting: false,
+                });
                 result.ends.push((result.text.len(), start));
                 separator = false;
             }
+            let normalized_start = result.text.len();
             result.text.push(c);
+            result.spans.push(SourceSpan {
+                source: start..start + c.len_utf8(),
+                normalized: normalized_start..result.text.len(),
+                whitespace: false,
+                non_painting: non_painting_scalar(c),
+            });
             result.ends.push((result.text.len(), start + c.len_utf8()));
         }
         result
@@ -425,6 +670,90 @@ impl Normalized {
     }
 }
 
+fn overlaps(a: &Range<usize>, b: &Range<usize>) -> bool {
+    a.start < a.end && b.start < b.end && a.start < b.end && b.start < a.end
+}
+
+fn append_range(ranges: &mut Vec<Range<usize>>, next: Range<usize>) {
+    if let Some(last) = ranges.last_mut()
+        && last.end == next.start
+    {
+        last.end = next.end;
+        return;
+    }
+    ranges.push(next);
+}
+
+// Conservative non-membership for controls/default-ignorables, even when a
+// shaper assigns them a neighbor's positive-width cluster. Unicode 14 ranges
+// documented in pinned harfrust 0.3.2 src/hb/unicode.rs:615–650. Include its
+// spacing-filler exceptions conservatively; this is not an ink classifier.
+fn non_painting_scalar(c: char) -> bool {
+    c.is_control()
+        || matches!(c as u32,
+        0x00ad | 0x034f | 0x061c | 0x115f..=0x1160 | 0x17b4..=0x17b5 |
+        0x180b..=0x180f | 0x200b..=0x200f | 0x202a..=0x202e | 0x2060..=0x206f |
+        0x3164 | 0xfe00..=0xfe0f | 0xfeff | 0xffa0 | 0xfff0..=0xfff8 |
+        0x1bca0..=0x1bca3 | 0x1d173..=0x1d17a | 0xe0000..=0xe0fff)
+}
+
+fn field_clusters(
+    entry: &graphics_text::cache::Entry,
+    zoom: f32,
+) -> Result<Vec<FieldCluster>, Error> {
+    let mut clusters: std::collections::BTreeMap<(usize, usize), FieldCluster> = Default::default();
+    for run in entry.buffer.layout_runs() {
+        for glyph in run.glyphs {
+            if glyph.start >= glyph.end || run.text.get(glyph.start..glyph.end).is_none() {
+                return Err(Error::InvalidMeasurement);
+            }
+            let cluster =
+                clusters
+                    .entry((glyph.start, glyph.end))
+                    .or_insert_with(|| FieldCluster {
+                        normalized: glyph.start..glyph.end,
+                        rectangles: vec![],
+                        missing: false,
+                    });
+            cluster.missing |= glyph.glyph_id == 0;
+            let x1 = glyph.x / zoom;
+            let x2 = (glyph.x + glyph.w) / zoom;
+            let y = (run.line_top + glyph.y) / zoom;
+            let height = glyph.line_height_opt.unwrap_or(run.line_height) / zoom;
+            if !x1.is_finite()
+                || !x2.is_finite()
+                || !y.is_finite()
+                || !height.is_finite()
+                || height < 0.
+                || !(y + height).is_finite()
+            {
+                return Err(Error::InvalidMeasurement);
+            }
+            if x1 != x2 && height > 0. {
+                let bounds = Rectangle::new(
+                    Point::new(x1.min(x2), y),
+                    Size::new((x2 - x1).abs(), height),
+                );
+                if !bounds.width.is_finite() {
+                    return Err(Error::InvalidMeasurement);
+                }
+                if !cluster.rectangles.contains(&bounds) {
+                    cluster.rectangles.push(bounds);
+                }
+            }
+        }
+    }
+    Ok(clusters.into_values().collect())
+}
+
 #[cfg(test)]
 #[path = "scenario_label/tests.rs"]
 mod tests;
+
+#[cfg(test)]
+#[path = "scenario_label/field_tests.rs"]
+mod field_tests;
+
+#[cfg(test)]
+#[path = "scenario_label/lookup_tests.rs"]
+mod lookup_tests;

crates/oa-desktop/src/behavior/scenario_label/field_tests.rs

@@ -0,0 +1,732 @@
+//! Unwired field-layout falsifiers. Execution evidence is recorded in the harness.
+//! Paragraph is an independent
+//! shaping oracle; it never invokes the candidate normalization/extraction.
+use super::*;
+use iced::advanced::{
+    graphics::text::Paragraph,
+    text::{Paragraph as _, Text as ParagraphText, Wrapping},
+};
+
+// The two ligature tests run alone in fresh processes. Clearing host faces is
+// deliberate: a system-installed Noto Sans with another version must not win.
+const LIGATURE_FONT: &[u8] = include_bytes!("fixtures/NotoSans-Regular.ttf");
+
+fn isolated_ligature_style(shaping: Shaping) -> Style {
+    let mut fonts = graphics_text::font_system().write().unwrap();
+    let ids: Vec<_> = fonts.raw().db().faces().map(|face| face.id).collect();
+    for id in ids {
+        fonts.raw().db_mut().remove_face(id);
+    }
+    fonts.load_font(std::borrow::Cow::Borrowed(LIGATURE_FONT));
+    assert_eq!(fonts.raw().db().len(), 1);
+    Style {
+        font: Font::with_name("Noto Sans"),
+        shaping,
+        ..Style::default()
+    }
+}
+
+fn assert_ligature_fixture_face(oracle: &Paragraph) {
+    let mut fonts = graphics_text::font_system().write().unwrap();
+    let mut count = 0;
+    for glyph in oracle.buffer().layout_runs().flat_map(|run| run.glyphs) {
+        assert_eq!(
+            fonts
+                .raw()
+                .db()
+                .with_face_data(glyph.font_id, |bytes, index| {
+                    index == 0 && bytes == LIGATURE_FONT
+                }),
+            Some(true),
+            "the actual shaped face must be the byte-pinned fixture"
+        );
+        count += 1;
+    }
+    assert!(count > 0, "font identity cannot pass on an empty paragraph");
+}
+
+fn paragraph(text: &str, zoom: f32, style: Style) -> Paragraph {
+    Paragraph::with_text(ParagraphText {
+        content: text,
+        bounds: Size::INFINITE,
+        size: Pixels(style.size.0 * zoom),
+        line_height: match style.line_height {
+            LineHeight::Relative(value) => LineHeight::Relative(value),
+            LineHeight::Absolute(value) => LineHeight::Absolute(Pixels(value.0 * zoom)),
+        },
+        font: style.font,
+        align_x: Alignment::Default,
+        align_y: iced::alignment::Vertical::Top,
+        shaping: style.shaping,
+        wrapping: Wrapping::default(),
+    })
+}
+
+fn resolve(text: &str, width: f32, zoom: f32, style: Style) -> (RenderSession, Arc<Label>) {
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let label = Cache::default()
+        .resolve(&session, text, width, zoom, style)
+        .unwrap();
+    (session, label)
+}
+
+// The oracle walks an independently built Paragraph, never Label's retained
+// spans, cluster snapshot, or field_layout. Test callers supply explicit ranges
+// in the already displayed string; synthetic ellipsis is deliberately excluded.
+fn paragraph_boxes(oracle: &Paragraph, ranges: &[Range<usize>], zoom: f32) -> Vec<Rectangle> {
+    let mut boxes = vec![];
+    for run in oracle.buffer().layout_runs() {
+        for glyph in run.glyphs {
+            if !ranges
+                .iter()
+                .any(|range| range.start < glyph.end && glyph.start < range.end)
+            {
+                continue;
+            }
+            assert_ne!(glyph.glyph_id, 0, "oracle requires actual font coverage");
+            if glyph.w == 0. {
+                continue;
+            }
+            assert!(
+                glyph.w > 0.,
+                "these fixtures require positive glyph advances"
+            );
+            let left = glyph.x / zoom;
+            let right = (glyph.x + glyph.w) / zoom;
+            boxes.push(Rectangle::new(
+                Point::new(left, (run.line_top + glyph.y) / zoom),
+                Size::new(
+                    right - left,
+                    glyph.line_height_opt.unwrap_or(run.line_height) / zoom,
+                ),
+            ));
+        }
+    }
+    canonical_boxes(boxes)
+}
+
+fn canonical_boxes(mut boxes: Vec<Rectangle>) -> Vec<Rectangle> {
+    boxes.sort_by(|a, b| {
+        a.x.total_cmp(&b.x)
+            .then(a.y.total_cmp(&b.y))
+            .then(a.width.total_cmp(&b.width))
+            .then(a.height.total_cmp(&b.height))
+    });
+    boxes.dedup();
+    boxes
+}
+
+fn assert_complete_boxes(actual: &[Rectangle], expected: Vec<Rectangle>) {
+    let canonical = canonical_boxes(actual.to_vec());
+    assert_eq!(
+        actual.len(),
+        canonical.len(),
+        "duplicate returned boxes are extraneous"
+    );
+    assert!(
+        !expected.is_empty(),
+        "the geometric oracle must be nonempty"
+    );
+    assert_eq!(
+        canonical, expected,
+        "every selected rectangle and only selected rectangles"
+    );
+}
+
+fn resolved_fonts(oracle: &Paragraph) -> Vec<String> {
+    let mut identities = vec![];
+    let mut fonts = graphics_text::font_system().write().unwrap();
+    for glyph in oracle.buffer().layout_runs().flat_map(|run| run.glyphs) {
+        let face = fonts.raw().db().face(glyph.font_id).unwrap();
+        let identity = format!(
+            "{:?}: {} {:?}",
+            glyph.font_id, face.post_script_name, face.families
+        );
+        if !identities.contains(&identity) {
+            identities.push(identity);
+        }
+    }
+    identities
+}
+
+#[test]
+fn empty_and_ellipsis_only_have_no_field_coverage() {
+    for text in ["", " \t\n", "Operation: assess"] {
+        let (session, label) = resolve(text, 0., 1., Style::default());
+        assert!(label.displayed.is_empty());
+        let field = label
+            .field_layout(&session, 1., Point::ORIGIN, 0..text.len())
+            .unwrap();
+        assert!(field.rectangles.is_empty());
+        assert!(field.covered.is_empty());
+        assert!(field.unresolved.is_empty());
+    }
+    let style = Style::default();
+    let width = paragraph("…", 1., style).min_width();
+    let text = "Operation: assess";
+    let (session, label) = resolve(text, width, 1., style);
+    assert_eq!(
+        label.displayed, "…",
+        "must exercise synthetic-only displayed content"
+    );
+    let field = label
+        .field_layout(&session, 1., Point::ORIGIN, 0..text.len())
+        .unwrap();
+    assert!(field.covered.is_empty());
+    assert!(field.rectangles.is_empty());
+    assert!(!field.truncated.is_empty());
+}
+
+#[test]
+fn exact_scalar_mapping_does_not_assign_trimmed_or_collapsed_whitespace_to_text() {
+    let source = "  send\t\n  assess  ";
+    let (session, label) = resolve(source, 900., 1., Style::default());
+    assert_eq!(label.displayed, "send assess");
+    for range in [0..2, 6..10, 16..18] {
+        let result = label
+            .field_layout(&session, 1., Point::ORIGIN, range)
+            .unwrap();
+        assert!(result.covered.is_empty());
+        assert!(result.rectangles.is_empty());
+        assert!(result.unresolved.is_empty());
+    }
+    let result = label
+        .field_layout(&session, 1., Point::ORIGIN, 10..16)
+        .unwrap();
+    assert_eq!(result.covered, vec![10..16]);
+    assert!(!result.rectangles.is_empty());
+    assert!(result.truncated.is_empty());
+    assert!(result.unresolved.is_empty());
+}
+
+#[test]
+fn late_operation_reports_hidden_partial_and_complete_without_ellipsis_membership() {
+    let source = "1. call - Incident report - assess_pressure";
+    let start = source.find("assess_pressure").unwrap();
+    let style = Style {
+        shaping: Shaping::Advanced,
+        ..Style::default()
+    };
+    let (session, full) = resolve(source, 900., 1., style);
+    let complete = full
+        .field_layout(&session, 1., Point::ORIGIN, start..source.len())
+        .unwrap();
+    assert_eq!(complete.covered, vec![start..source.len()]);
+    assert!(!complete.partially_retained);
+    let (_, hidden) = resolve(
+        source,
+        paragraph("1. call…", 1., style).min_width(),
+        1.,
+        style,
+    );
+    let hidden_result = hidden
+        .field_layout(
+            &hidden.measured_session,
+            1.,
+            Point::ORIGIN,
+            start..source.len(),
+        )
+        .unwrap();
+    assert!(hidden.retained_source.end <= start);
+    assert!(hidden_result.covered.is_empty());
+    assert_eq!(hidden_result.truncated, vec![start..source.len()]);
+    assert!(!hidden_result.partially_retained);
+    let desired = format!("{}assess…", &source[..start]);
+    let (_, partial) = resolve(
+        source,
+        paragraph(&desired, 1., style).min_width(),
+        1.,
+        style,
+    );
+    assert!(
+        partial.retained_source.end > start && partial.retained_source.end < source.len(),
+        "actual fitting result must retain a strict operation prefix"
+    );
+    let result = partial
+        .field_layout(
+            &partial.measured_session,
+            1.,
+            Point::ORIGIN,
+            start..source.len(),
+        )
+        .unwrap();
+    assert_eq!(result.covered, vec![start..partial.retained_source.end]);
+    assert_eq!(
+        result.truncated,
+        vec![partial.retained_source.end..source.len()]
+    );
+    assert!(result.partially_retained);
+    assert!(result.unresolved.is_empty());
+}
+
+#[test]
+fn positive_notdef_advance_is_unresolved_not_covered_or_truncated() {
+    let source = "A\u{10ffff}B";
+    let style = Style {
+        shaping: Shaping::Advanced,
+        ..Style::default()
+    };
+    let oracle = paragraph(source, 1., style);
+    assert!(
+        oracle
+            .buffer()
+            .layout_runs()
+            .flat_map(|run| run.glyphs)
+            .any(|glyph| glyph.start == 1 && glyph.end == 5 && glyph.glyph_id == 0 && glyph.w > 0.),
+        "font precondition: actual positive-width .notdef for the noncharacter"
+    );
+    let (session, label) = resolve(source, 900., 1., style);
+    let missing = label
+        .field_layout(&session, 1., Point::ORIGIN, 1..5)
+        .unwrap();
+    assert!(missing.covered.is_empty());
+    assert!(missing.rectangles.is_empty());
+    assert!(missing.truncated.is_empty());
+    assert_eq!(
+        missing.unresolved,
+        vec![UnresolvedField {
+            source: 1..5,
+            reason: FieldIssue::MissingGlyph
+        }]
+    );
+    let mixed = label
+        .field_layout(&session, 1., Point::ORIGIN, 0..source.len())
+        .unwrap();
+    assert_eq!(mixed.covered, vec![0..1, 5..6]);
+    assert_eq!(mixed.unresolved, missing.unresolved);
+    assert!(!mixed.rectangles.is_empty());
+}
+
+#[test]
+#[ignore = "replaces global fonts; run only this exact test in a fresh process"]
+fn advanced_ligature_partial_field_uses_whole_shared_cluster_not_fraction() {
+    let source = "ffi";
+    let style = isolated_ligature_style(Shaping::Advanced);
+    let oracle = paragraph(source, 1., style);
+    assert_ligature_fixture_face(&oracle);
+    let run = oracle.buffer().layout_runs().next().unwrap();
+    let glyph = run
+        .glyphs
+        .iter()
+        .find(|glyph| glyph.start == 0 && glyph.end == 3 && glyph.w > 0. && glyph.glyph_id != 0)
+        .expect("font precondition: Advanced must produce the ffi ligature cluster");
+    let expected = Rectangle::new(
+        Point::new(glyph.x, run.line_top + glyph.y),
+        Size::new(glyph.w, glyph.line_height_opt.unwrap_or(run.line_height)),
+    );
+    let (session, label) = resolve(source, 900., 1., style);
+    let field = label
+        .field_layout(&session, 1., Point::ORIGIN, 1..2)
+        .unwrap();
+    assert_eq!(field.covered, vec![1..2]);
+    assert!(field.shared_cluster);
+    assert!(field.rectangles.contains(&expected));
+    assert_eq!(
+        field.rectangles.iter().map(|rect| rect.width).sum::<f32>(),
+        expected.width
+    );
+    assert_complete_boxes(&field.rectangles, vec![expected]);
+    assert!(field.unresolved.is_empty());
+}
+
+#[test]
+fn shared_default_ignorable_does_not_inherit_neighbor_coverage() {
+    let source = "a\u{fe0f}";
+    let style = Style {
+        shaping: Shaping::Advanced,
+        ..Style::default()
+    };
+    let oracle = paragraph(source, 1., style);
+    assert!(
+        oracle
+            .buffer()
+            .layout_runs()
+            .flat_map(|run| run.glyphs)
+            .any(|glyph| glyph.start == 0
+                && glyph.end == source.len()
+                && glyph.w > 0.
+                && glyph.glyph_id != 0),
+        "precondition: variation selector shares a real positive-width base cluster"
+    );
+    let (session, label) = resolve(source, 900., 1., style);
+    let field = label
+        .field_layout(&session, 1., Point::ORIGIN, 1..source.len())
+        .unwrap();
+    assert!(field.covered.is_empty());
+    assert!(field.rectangles.is_empty());
+    assert!(field.truncated.is_empty());
+    assert!(field.shared_cluster);
+    assert_eq!(
+        field.unresolved,
+        vec![UnresolvedField {
+            source: 1..source.len(),
+            reason: FieldIssue::NonPaintingScalar
+        }]
+    );
+}
+
+#[test]
+fn combining_mark_field_retains_cluster_geometry_without_splitting_the_grapheme() {
+    let source = "e\u{301} next";
+    let style = Style {
+        shaping: Shaping::Advanced,
+        ..Style::default()
+    };
+    let oracle = paragraph(source, 1., style);
+    let run = oracle.buffer().layout_runs().next().unwrap();
+    let cluster = run
+        .glyphs
+        .iter()
+        .find(|glyph| glyph.start == 0 && glyph.end == 3 && glyph.w > 0. && glyph.glyph_id != 0)
+        .expect("precondition: composed accent and base share the grapheme cluster");
+    let (session, label) = resolve(source, 900., 1., style);
+    let field = label
+        .field_layout(&session, 1., Point::ORIGIN, 1..3)
+        .unwrap();
+    assert_eq!(field.covered, vec![1..3]);
+    assert!(field.shared_cluster);
+    assert!(
+        field
+            .rectangles
+            .iter()
+            .any(|rect| rect.x == cluster.x && rect.width == cluster.w)
+    );
+    assert!(field.unresolved.is_empty());
+    assert_eq!(
+        label.field_layout(&session, 1., Point::ORIGIN, 2..3),
+        Err(Error::InvalidFieldRange)
+    );
+    let (_, short) = resolve(
+        source,
+        paragraph("e\u{301}…", 1., style).min_width(),
+        1.,
+        style,
+    );
+    assert_ne!(
+        short.retained_source.end, 1,
+        "the chosen prefix must never split the combining grapheme"
+    );
+}
+
+#[test]
+fn bidi_logical_field_keeps_visual_pieces_without_enclosing_unselected_glyph() {
+    let source = "abc אבג xyz";
+    let style = Style {
+        shaping: Shaping::Advanced,
+        ..Style::default()
+    };
+    let oracle = paragraph(source, 1., style);
+    let run = oracle.buffer().layout_runs().next().unwrap();
+    assert!(
+        !run.rtl,
+        "this existing fixture specifically has an LTR paragraph base"
+    );
+    assert!(run.glyphs.iter().any(|glyph| glyph.level.is_rtl()));
+    assert!(run.glyphs.iter().any(|glyph| !glyph.level.is_rtl()));
+    let excluded = run
+        .glyphs
+        .iter()
+        .find(|glyph| glyph.start == 8 && glyph.end == 10 && glyph.w > 0. && glyph.glyph_id != 0)
+        .unwrap();
+    let (session, label) = resolve(source, 900., 1., style);
+    let field = label
+        .field_layout(&session, 1., Point::ORIGIN, 1..8)
+        .unwrap();
+    assert_eq!(field.covered, vec![1..3, 4..8]);
+    assert!(field.unresolved.is_empty());
+    assert_complete_boxes(
+        &field.rectangles,
+        paragraph_boxes(&oracle, &[1..3, 4..8], 1.),
+    );
+    assert!(
+        field
+            .rectangles
+            .iter()
+            .any(|rect| rect.x + rect.width <= excluded.x)
+    );
+    assert!(
+        field
+            .rectangles
+            .iter()
+            .any(|rect| rect.x >= excluded.x + excluded.w)
+    );
+    assert!(
+        field
+            .rectangles
+            .iter()
+            .all(|rect| rect.x + rect.width <= excluded.x || rect.x >= excluded.x + excluded.w),
+        "logical selection must not become one envelope over the intervening visual glyph"
+    );
+}
+
+#[test]
+fn rtl_leading_full_field_has_complete_post_alignment_rectangle_set() {
+    let source = "אבג abc דהו xyz operation";
+    assert_eq!(source.len(), 31);
+    let style = Style {
+        shaping: Shaping::Advanced,
+        ..Style::default()
+    };
+    let oracle = paragraph(source, 1., style);
+    let run = oracle.buffer().layout_runs().next().unwrap();
+    assert!(
+        run.rtl,
+        "must exercise Iced's RTL paragraph alignment branch"
+    );
+    assert!(run.glyphs.iter().any(|glyph| glyph.level.is_rtl()));
+    assert!(run.glyphs.iter().any(|glyph| !glyph.level.is_rtl()));
+    eprintln!("RTL_FIELD_FONTS={:?}", resolved_fonts(&oracle));
+    let (session, label) = resolve(source, 900., 1., style);
+    assert_eq!(label.displayed, source);
+    let ranges = vec![2..6, 7..10, 11..17, 18..21, 22..31];
+    let field = label
+        .field_layout(&session, 1., Point::ORIGIN, 2..source.len())
+        .unwrap();
+    assert_eq!(field.covered, ranges);
+    assert!(field.truncated.is_empty() && field.unresolved.is_empty());
+    assert!(!field.partially_retained);
+    assert_complete_boxes(&field.rectangles, paragraph_boxes(&oracle, &ranges, 1.));
+}
+
+#[test]
+fn rtl_leading_ellipsis_field_has_complete_final_buffer_rectangle_set() {
+    let source = "אבג abc דהו xyz operation";
+    let style = Style {
+        shaping: Shaping::Advanced,
+        ..Style::default()
+    };
+    let width = paragraph("אבג abc דהו…", 1., style).min_width();
+    let (session, label) = resolve(source, width, 1., style);
+    let prefix = label
+        .displayed
+        .strip_suffix('…')
+        .expect("must use an ellipsized displayed buffer");
+    assert!(prefix.len() >= 10 && prefix.len() < source.len());
+    assert!(source.starts_with(prefix));
+    let oracle = paragraph(&label.displayed, 1., style);
+    let run = oracle.buffer().layout_runs().next().unwrap();
+    assert!(
+        run.rtl,
+        "the ellipsized winning text must still exercise RTL alignment"
+    );
+    eprintln!("RTL_ELLIPSIS_FIELD_FONTS={:?}", resolved_fonts(&oracle));
+    // Fixed semantic word spans from the source, clipped only by the literal
+    // displayed prefix. No candidate source map or retained_source is consulted.
+    let words = [2..6, 7..10, 11..17, 18..21, 22..31];
+    let retained: Vec<_> = words
+        .iter()
+        .filter_map(|word| {
+            let end = word.end.min(prefix.len());
+            (word.start < end).then_some(word.start..end)
+        })
+        .collect();
+    let hidden: Vec<_> = words
+        .iter()
+        .filter_map(|word| {
+            let start = word.start.max(prefix.len());
+            (start < word.end).then_some(start..word.end)
+        })
+        .collect();
+    let field = label
+        .field_layout(&session, 1., Point::ORIGIN, 2..source.len())
+        .unwrap();
+    assert_eq!(field.covered, retained);
+    assert_eq!(field.truncated, hidden);
+    assert!(field.partially_retained && field.unresolved.is_empty());
+    assert_complete_boxes(&field.rectangles, paragraph_boxes(&oracle, &retained, 1.));
+}
+
+/// Diagnostic only: warm font/Paragraph preparation precedes the timed resolver
+/// and three lookups. No latency budget or production responsiveness claim.
+#[test]
+#[ignore = "bounded high-end field lookup diagnostic; run this exact test alone with --nocapture"]
+fn field_lookup_4096_scalars_and_combining_heavy_full_coverage() {
+    let style = Style {
+        shaping: Shaping::Advanced,
+        ..Style::default()
+    };
+    let cases = [
+        ("4096_plain_scalars", "A".repeat(4096), 4096),
+        (
+            "4096_combining_heavy_scalars",
+            "a\u{301}\u{323}\u{327}".repeat(1024),
+            1024,
+        ),
+    ];
+    let mut records = vec![];
+    for (name, source, expected_graphemes) in cases {
+        assert_eq!(source.chars().count(), 4096);
+        assert_eq!(source.graphemes(true).count(), expected_graphemes);
+        assert!(source.len() <= MAX_SOURCE_BYTES);
+        assert!(expected_graphemes <= MAX_GRAPHEMES);
+        let oracle = paragraph(&source, 1., style);
+        assert_eq!(oracle.buffer().layout_runs().count(), 1);
+        let expected = paragraph_boxes(&oracle, &[0..source.len()], 1.);
+        let identities = resolved_fonts(&oracle);
+        let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+        let mut cache = Cache::default();
+        let start = std::time::Instant::now();
+        let label = cache
+            .resolve(&session, &source, 1_000_000., 1., style)
+            .unwrap();
+        let resolve_ns = start.elapsed().as_nanos();
+        assert_eq!(label.displayed, source);
+        // The preserved 4c9 lookup runs on the exact same immutable shaped
+        // label. Its timing is separate from the optimized samples below.
+        let start = std::time::Instant::now();
+        let original = label
+            .original_field_layout(&session, 1., Point::ORIGIN, 0..source.len())
+            .unwrap();
+        let original_lookup_ns = start.elapsed().as_nanos();
+        let mut lookup_ns = vec![];
+        for _ in 0..3 {
+            let start = std::time::Instant::now();
+            let field = label
+                .field_layout(&session, 1., Point::ORIGIN, 0..source.len())
+                .unwrap();
+            lookup_ns.push(start.elapsed().as_nanos());
+            assert_eq!(field.covered, vec![0..source.len()]);
+            assert!(field.truncated.is_empty() && field.unresolved.is_empty());
+            assert!(!field.partially_retained && !field.shared_cluster);
+            assert_complete_boxes(&field.rectangles, expected.clone());
+            super::lookup_tests::assert_exact(&field, &original);
+        }
+        // Fresh label construction plus lookup, not just a retained-index
+        // measurement: moving the old quadratic work into resolve cannot hide.
+        let mut fresh_resolve_lookup_ns = vec![];
+        for _ in 0..3 {
+            let mut fresh_cache = Cache::default();
+            let start = std::time::Instant::now();
+            let fresh = fresh_cache
+                .resolve(&session, &source, 1_000_000., 1., style)
+                .unwrap();
+            let field = fresh
+                .field_layout(&session, 1., Point::ORIGIN, 0..source.len())
+                .unwrap();
+            fresh_resolve_lookup_ns.push(start.elapsed().as_nanos());
+            super::lookup_tests::assert_exact(&field, &original);
+            assert_complete_boxes(&field.rectangles, expected.clone());
+        }
+        records.push(serde_json::json!({
+            "case": name, "scalars": 4096, "graphemes": expected_graphemes,
+            "source_bytes": source.len(), "expected_rectangles": expected.len(),
+            "resolved_fonts": identities, "resolve_ns": resolve_ns, "lookup_ns": lookup_ns,
+            "original_lookup_ns": original_lookup_ns,
+            "fresh_resolve_lookup_ns": fresh_resolve_lookup_ns,
+            "source_spans": label.source_spans.len(), "clusters": label.clusters.len(),
+            "overlap_memberships": label.field_index.clusters_by_span.iter().map(Vec::len).sum::<usize>(),
+            "exact_original_result_including_rectangle_bits": "passed",
+            "full_coverage_and_exact_geometry": "passed",
+        }));
+    }
+    println!(
+        "FIELD_LOOKUP_TIMING_JSON={}",
+        serde_json::json!({
+            "schema": "scenario_label_field_lookup_v1",
+            "source_pin_from_runner": std::env::var("SCENARIO_LABEL_FIELDS_SOURCE_PIN").ok(),
+            "debug_assertions": cfg!(debug_assertions), "os": std::env::consts::OS,
+            "arch": std::env::consts::ARCH, "cases": records,
+            "invariant_status": "passed",
+            "scope": "warm-font source-only layout experiment; no native responsiveness threshold",
+        })
+    );
+}
+
+#[test]
+#[ignore = "replaces global fonts; run only this exact test in a fresh process"]
+fn auto_ascii_to_ellipsis_advanced_transition_uses_final_buffer() {
+    let style = isolated_ligature_style(Shaping::Auto);
+    let source = "ffi office assessment";
+    assert_eq!(
+        graphics_text::to_shaping(style.shaping, source),
+        graphics_text::cosmic_text::Shaping::Basic
+    );
+    let basic = paragraph(source, 1., style);
+    assert_ligature_fixture_face(&basic);
+    let initial_clusters: Vec<_> = basic
+        .buffer()
+        .layout_runs()
+        .flat_map(|run| run.glyphs)
+        .filter(|glyph| glyph.start < 3)
+        .map(|glyph| (glyph.start, glyph.end))
+        .collect();
+    assert_eq!(initial_clusters, vec![(0, 1), (1, 2), (2, 3)]);
+    let (session, label) = resolve(
+        source,
+        paragraph("ffi office…", 1., style).min_width(),
+        1.,
+        style,
+    );
+    assert!(label.displayed.ends_with('…'));
+    assert_eq!(
+        graphics_text::to_shaping(style.shaping, &label.displayed),
+        graphics_text::cosmic_text::Shaping::Advanced
+    );
+    let oracle = paragraph(&label.displayed, 1., style);
+    assert_ligature_fixture_face(&oracle);
+    let run = oracle.buffer().layout_runs().next().unwrap();
+    let first = run
+        .glyphs
+        .iter()
+        .find(|glyph| glyph.start == 0 && glyph.end >= 3 && glyph.w > 0. && glyph.glyph_id != 0)
+        .expect("final Advanced shape must expose the ligature precondition");
+    let field = label
+        .field_layout(&session, 1., Point::ORIGIN, 0..3)
+        .unwrap();
+    assert_eq!(field.covered, vec![0..3]);
+    assert!(
+        field
+            .rectangles
+            .iter()
+            .any(|rect| rect.x == first.x && rect.width == first.w)
+    );
+    assert_complete_boxes(&field.rectangles, paragraph_boxes(&oracle, &[0..3], 1.));
+}
+
+#[test]
+fn field_geometry_reuses_zoom_session_guards_and_translates_actual_cluster_boxes() {
+    let source = "Z";
+    for zoom in [0.5, 1.75] {
+        let style = Style::default();
+        let oracle = paragraph(source, zoom, style);
+        let run = oracle.buffer().layout_runs().next().unwrap();
+        assert_eq!(run.glyphs.len(), 1);
+        let glyph = &run.glyphs[0];
+        assert!(glyph.glyph_id != 0 && glyph.w > 0.);
+        let (session, label) = resolve(source, 900., zoom, style);
+        let position = Point::new(-300., 90.);
+        let field = label.field_layout(&session, zoom, position, 0..1).unwrap();
+        assert_eq!(
+            field.rectangles,
+            vec![Rectangle::new(
+                Point::new(
+                    position.x + glyph.x / zoom,
+                    position.y + (run.line_top + glyph.y) / zoom
+                ),
+                Size::new(
+                    ((glyph.x + glyph.w) / zoom - glyph.x / zoom).abs(),
+                    glyph.line_height_opt.unwrap_or(run.line_height) / zoom
+                ),
+            )]
+        );
+        assert_eq!(
+            label.field_layout(&session, zoom + 0.1, position, 0..1),
+            Err(Error::StaleZoom)
+        );
+        let fresh = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+        assert_eq!(
+            label.field_layout(&fresh, zoom, position, 0..1),
+            Err(Error::StaleRenderSession)
+        );
+        assert_eq!(
+            label.field_layout(&session, zoom, Point::new(f32::NAN, 0.), 0..1),
+            Err(Error::InvalidPosition)
+        );
+        assert_eq!(
+            label.field_layout(&session, zoom, position, 0..2),
+            Err(Error::InvalidFieldRange)
+        );
+        let empty = label.field_layout(&session, zoom, position, 0..0).unwrap();
+        assert!(empty.covered.is_empty() && empty.rectangles.is_empty());
+    }
+}

crates/oa-desktop/src/behavior/scenario_label/fixtures/.gitattributes

@@ -0,0 +1 @@
+* -text -whitespace

crates/oa-desktop/src/behavior/scenario_label/fixtures/NotoSans-LICENSE

@@ -0,0 +1,93 @@
+Copyright 2012 Google Inc. All Rights Reserved.
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

crates/oa-desktop/src/behavior/scenario_label/fixtures/README.md

@@ -0,0 +1,15 @@
+# Isolated ligature font fixture
+
+NotoSans-Regular.ttf and NotoSans-LICENSE are copied byte for byte from the fonts/ directory of the pinned cosmic-text 0.15.0 package. The font is unmodified and licensed under SIL Open Font License 1.1; retain the adjacent complete copyright/license file when redistributing it.
+
+- Package VCS commit: c82ee1c5b5b8032e91eaff1cb34294b538727a7d (from .cargo_vcs_info.json).
+- Package checksum in this workspace Cargo.lock: 173852283a9a57a3cbe365d86e74dc428a09c50421477d5ad6fe9d9509e37737.
+- Upstream font: https://github.com/pop-os/cosmic-text/blob/c82ee1c5b5b8032e91eaff1cb34294b538727a7d/fonts/NotoSans-Regular.ttf
+- Upstream license: https://github.com/pop-os/cosmic-text/blob/c82ee1c5b5b8032e91eaff1cb34294b538727a7d/fonts/NotoSans-LICENSE
+- The pinned upstream Git LFS pointer independently reports the identical SHA-256 and 556216-byte size; the fixture contains the actual font, not the pointer.
+- Font bytes: 556216; SHA-256: 2ec33f84606cbaa0a1a944488e14f97faf2f6a25ecdd8354f5358f06da13c7d9.
+- License bytes: 4351; SHA-256: 5ec4347054089def6904da61d04f0360968f9ef36634b1fe007a5b6ec2f7aa96.
+
+Static cmap/GSUB inspection found f glyph 73 and i glyph 76, with ffi [73,73,76] substituted by glyph 1654 in lookup 39 under the standard liga feature. This is a fixture-selection check, not runtime shaping evidence. Iced's bundled Fira Sans was rejected for these unchanged ffi assertions because its corresponding lookup is under discretionary dlig, which these tests do not enable.
+
+Both consumers are ignored by default and must each run as the sole exact test in a fresh process. Their test-only setup removes host font faces before loading this fixture, then verifies every actual oracle glyph resolves to these exact bytes and face index zero. The fixture therefore does not depend on an installed font with the same family name. The original positive nonzero ffi-cluster preconditions remain mandatory. Nothing selects this font for the product or changes the production label algorithm.

crates/oa-desktop/src/behavior/scenario_label/lookup_tests.rs

@@ -0,0 +1,381 @@
+//! Exact differential oracle from 4c9bc87e4e66bba573dd63b23df5ea039f85d0ca.
+//! The old method body is retained verbatim; only its name/visibility changes.
+//! Its unchanged validation/translation helpers remain in the parent module.
+use super::*;
+
+pub(super) fn assert_exact(actual: &FieldLayout, expected: &FieldLayout) {
+    assert_eq!(actual, expected);
+    // PartialEq deliberately equates signed zero; the observable first box
+    // must nevertheless retain exactly the old representation and order.
+    for (actual, expected) in actual.rectangles.iter().zip(&expected.rectangles) {
+        let bits = |r: &Rectangle| [r.x, r.y, r.width, r.height].map(f32::to_bits);
+        assert_eq!(bits(actual), bits(expected));
+    }
+}
+
+fn compare(
+    label: &Label,
+    session: &RenderSession,
+    zoom: f32,
+    position: Point,
+    field: Range<usize>,
+) {
+    let old = label.original_field_layout(session, zoom, position, field.clone());
+    let new = label.field_layout(session, zoom, position, field);
+    match (new, old) {
+        (Ok(new), Ok(old)) => assert_exact(&new, &old),
+        (new, old) => assert_eq!(new, old),
+    }
+}
+
+fn all_fields(label: &Label, session: &RenderSession, position: Point) {
+    let boundaries: Vec<_> = label
+        .source
+        .char_indices()
+        .map(|(i, _)| i)
+        .chain(std::iter::once(label.source.len()))
+        .collect();
+    for &start in &boundaries {
+        for &end in &boundaries {
+            compare(label, session, label.measured_zoom, position, start..end);
+        }
+    }
+}
+
+fn synthetic(source: &str, retained: usize, clusters: Vec<FieldCluster>) -> (RenderSession, Label) {
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let normalized = Normalized::new(source);
+    let field_index = FieldIndex::new(&normalized.spans, &clusters);
+    let label = Label {
+        source: source.into(),
+        displayed: normalized.text,
+        retained_source: 0..source.len(),
+        bounds: Rectangle::with_size(Size::ZERO),
+        style: Style::default(),
+        measured_session: session.clone(),
+        measured_zoom: 1.,
+        clusters,
+        source_spans: normalized.spans,
+        retained_normalized: retained,
+        field_index,
+    };
+    (session, label)
+}
+
+fn cluster(range: Range<usize>, rectangles: Vec<Rectangle>, missing: bool) -> FieldCluster {
+    FieldCluster {
+        normalized: range,
+        rectangles,
+        missing,
+    }
+}
+
+#[test]
+fn indexed_lookup_matches_original_for_real_shaping_and_every_field_boundary() {
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let sources = [
+        "",
+        " \t\n ",
+        "ffi office",
+        " \talpha \r\n beta  ",
+        "a\u{301}\u{fe0f} b\u{2060}c",
+        "אבג abc דהו",
+        "A😀Z",
+    ];
+    let mut nonempty = 0;
+    for source in sources {
+        for shaping in [Shaping::Auto, Shaping::Advanced] {
+            for zoom in [0.5, 1.75] {
+                let mut cache = Cache::default();
+                for width in [0., 25., 500.] {
+                    let label = cache
+                        .resolve(
+                            &session,
+                            source,
+                            width,
+                            zoom,
+                            Style {
+                                shaping,
+                                ..Style::default()
+                            },
+                        )
+                        .unwrap();
+                    nonempty += usize::from(!label.clusters.is_empty());
+                    all_fields(&label, &session, Point::ORIGIN);
+                    all_fields(&label, &session, Point::new(-37.25, 16.125));
+                }
+            }
+        }
+    }
+    assert!(
+        nonempty >= sources.len(),
+        "must compare actual shaped geometry as well as empty labels"
+    );
+}
+
+#[test]
+fn indexed_lookup_matches_original_for_overlapping_and_reordered_clusters() {
+    // Normalization is "a + acute + VS16 + space + b + space + c".
+    // Cluster intervals overlap, nest, span separators, and occur in a
+    // deliberately non-source/non-visual order. This tests the join rather
+    // than assuming the simpler cluster partition of most actual fonts.
+    let source = "  a\u{301}\u{fe0f} b c  ";
+    assert_eq!(Normalized::new(source).text.len(), 10);
+    let a = Rectangle::new(Point::new(30., 3.), Size::new(4., 12.));
+    let b = Rectangle::new(Point::new(-20., -1.), Size::new(7., 11.));
+    let c = Rectangle::new(Point::new(9., 4.), Size::new(2., 10.));
+    let cases = vec![
+        cluster(7..10, vec![b, a], false),
+        cluster(0..6, vec![a, c, a], false),
+        cluster(1..3, vec![], false),
+        cluster(3..8, vec![c], true),
+        cluster(0..10, vec![b], false),
+        cluster(6..7, vec![c], false),
+        cluster(9..13, vec![a], false), // can extend into a synthetic ellipsis
+        cluster(3..3, vec![c], true),   // empty interval cannot match anything
+        cluster(8..7, vec![b], true),   // nor can a reversed interval
+    ];
+    for reverse in [false, true] {
+        let mut clusters = cases.clone();
+        if reverse {
+            clusters.reverse();
+        }
+        for retained in [0, 1, 3, 6, 7, 8, 10] {
+            let (session, label) = synthetic(source, retained, clusters.clone());
+            all_fields(&label, &session, Point::new(-0., -0.));
+            all_fields(&label, &session, Point::new(0.125, -64.));
+        }
+    }
+    let (session, priority) = synthetic(
+        "a\u{2060}b",
+        5,
+        vec![
+            cluster(0..1, vec![], false),
+            cluster(1..4, vec![a], true),
+            cluster(4..5, vec![b], true),
+        ],
+    );
+    all_fields(&priority, &session, Point::ORIGIN);
+    let result = priority
+        .field_layout(&session, 1., Point::ORIGIN, 0..5)
+        .unwrap();
+    assert_eq!(
+        result.unresolved,
+        vec![
+            UnresolvedField {
+                source: 0..1,
+                reason: FieldIssue::NoAdvanceGeometry
+            },
+            UnresolvedField {
+                source: 1..4,
+                reason: FieldIssue::NonPaintingScalar
+            },
+            UnresolvedField {
+                source: 4..5,
+                reason: FieldIssue::MissingGlyph
+            },
+        ]
+    );
+    assert!(result.covered.is_empty() && result.rectangles.is_empty());
+}
+
+#[test]
+fn indexed_lookup_preserves_first_rectangle_bits_and_shared_status() {
+    let negative = Rectangle::new(Point::new(-0., -0.), Size::new(6., 12.));
+    let positive = Rectangle::new(Point::ORIGIN, Size::new(6., 12.));
+    assert_eq!(negative, positive, "Rectangle equality merges signed zero");
+    let other = Rectangle::new(Point::new(-20., 4.), Size::new(3., 12.));
+    let (session, label) = synthetic(
+        "a b",
+        3,
+        vec![
+            cluster(2..3, vec![negative, other], false),
+            cluster(0..1, vec![positive, negative], false),
+        ],
+    );
+    let result = label
+        .field_layout(&session, 1., Point::new(-0., -0.), 0..3)
+        .unwrap();
+    assert_eq!(result.covered, vec![0..1, 2..3]);
+    assert!(!result.shared_cluster);
+    assert_eq!(result.rectangles.len(), 2);
+    assert_eq!(result.rectangles[0].x.to_bits(), (-0f32).to_bits());
+    assert_eq!(result.rectangles[0].y.to_bits(), (-0f32).to_bits());
+    assert_eq!(result.rectangles[1], other);
+    assert_exact(
+        &result,
+        &label
+            .original_field_layout(&session, 1., Point::new(-0., -0.), 0..3)
+            .unwrap(),
+    );
+
+    let (session, shared) = synthetic("a b", 3, vec![cluster(0..3, vec![other], false)]);
+    let partial = shared
+        .field_layout(&session, 1., Point::ORIGIN, 0..1)
+        .unwrap();
+    assert_eq!(partial.covered, vec![0..1]);
+    assert!(partial.shared_cluster);
+    let complete = shared
+        .field_layout(&session, 1., Point::ORIGIN, 0..3)
+        .unwrap();
+    assert!(!complete.shared_cluster);
+    all_fields(&shared, &session, Point::ORIGIN);
+
+    // The same logical cluster crosses the retained prefix: its box remains
+    // shared while the source scalar after that prefix remains truncated.
+    let (session, clipped) = synthetic("abc", 2, vec![cluster(0..3, vec![other], false)]);
+    let clipped = clipped
+        .field_layout(&session, 1., Point::ORIGIN, 0..3)
+        .unwrap();
+    assert_eq!(clipped.covered, vec![0..2]);
+    assert_eq!(clipped.truncated, vec![2..3]);
+    assert!(clipped.shared_cluster && clipped.partially_retained);
+}
+
+#[test]
+fn indexed_lookup_preserves_error_precedence_and_overflow_rejection() {
+    let (session, label) = synthetic(
+        "éa",
+        3,
+        vec![cluster(
+            0..3,
+            vec![Rectangle::new(
+                Point::new(f32::MAX, 0.),
+                Size::new(f32::MAX, 1.),
+            )],
+            false,
+        )],
+    );
+    let stale = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    assert_eq!(
+        label.field_layout(&stale, f32::NAN, Point::new(f32::NAN, 0.), 7..8),
+        Err(Error::StaleRenderSession)
+    );
+    assert_eq!(
+        label.field_layout(&session, 2., Point::new(f32::NAN, 0.), 7..8),
+        Err(Error::StaleZoom)
+    );
+    assert_eq!(
+        label.field_layout(&session, 1., Point::new(f32::NAN, 0.), 7..8),
+        Err(Error::InvalidPosition)
+    );
+    assert_eq!(
+        label.field_layout(&session, 1., Point::ORIGIN, 1..2),
+        Err(Error::InvalidFieldRange)
+    );
+    assert_eq!(
+        label.field_layout(&session, 1., Point::ORIGIN, 0..3),
+        Err(Error::InvalidPosition)
+    );
+    // An unselected overflowing box must not turn a valid empty query into an error.
+    assert!(
+        label
+            .field_layout(&session, 1., Point::ORIGIN, 0..0)
+            .unwrap()
+            .rectangles
+            .is_empty()
+    );
+    for guard in [&session, &stale] {
+        for zoom in [1., 2., f32::NAN] {
+            for position in [
+                Point::ORIGIN,
+                Point::new(f32::NAN, 0.),
+                Point::new(f32::MAX, 0.),
+            ] {
+                for range in [0..0, 0..3, 1..2, 3..2, 0..4] {
+                    compare(&label, guard, zoom, position, range);
+                }
+            }
+        }
+    }
+}
+
+impl Label {
+    pub(super) fn original_field_layout(
+        &self,
+        session: &RenderSession,
+        zoom: f32,
+        position: Point,
+        field: Range<usize>,
+    ) -> Result<FieldLayout, Error> {
+        self.check(session, zoom)?;
+        translated_bounds(position, Size::ZERO)?;
+        if field.start > field.end || self.source.get(field.clone()).is_none() {
+            return Err(Error::InvalidFieldRange);
+        }
+        let mut result = FieldLayout {
+            rectangles: vec![],
+            covered: vec![],
+            truncated: vec![],
+            unresolved: vec![],
+            partially_retained: false,
+            shared_cluster: false,
+        };
+        let mut selected = vec![false; self.clusters.len()];
+        for span in &self.source_spans {
+            if span.whitespace || !overlaps(&span.source, &field) {
+                continue;
+            }
+            // Source spans for text are exact UTF-8 scalars, not intervals
+            // between ends (which could assign trimmed whitespace to text).
+            if span.normalized.end > self.retained_normalized {
+                append_range(&mut result.truncated, span.source.clone());
+                continue;
+            }
+            let matching: Vec<_> = self
+                .clusters
+                .iter()
+                .enumerate()
+                .filter(|(_, cluster)| overlaps(&cluster.normalized, &span.normalized))
+                .collect();
+            result.shared_cluster |= matching.iter().any(|(_, cluster)| {
+                cluster.normalized.end > self.retained_normalized
+                    || self.source_spans.iter().any(|other| {
+                        overlaps(&other.normalized, &cluster.normalized)
+                            && !overlaps(&other.source, &field)
+                    })
+            });
+            let issue = if span.non_painting {
+                Some(FieldIssue::NonPaintingScalar)
+            } else if matching.iter().any(|(_, cluster)| cluster.missing) {
+                Some(FieldIssue::MissingGlyph)
+            } else if matching.is_empty()
+                || matching
+                    .iter()
+                    .all(|(_, cluster)| cluster.rectangles.is_empty())
+            {
+                Some(FieldIssue::NoAdvanceGeometry)
+            } else {
+                None
+            };
+            if let Some(reason) = issue {
+                result.unresolved.push(UnresolvedField {
+                    source: span.source.clone(),
+                    reason,
+                });
+                continue;
+            }
+            append_range(&mut result.covered, span.source.clone());
+            for (index, _) in matching {
+                selected[index] = true;
+            }
+        }
+        for (cluster, selected) in self.clusters.iter().zip(selected) {
+            if !selected {
+                continue;
+            }
+            for bounds in &cluster.rectangles {
+                let translated = translated_bounds(
+                    Point::new(position.x + bounds.x, position.y + bounds.y),
+                    bounds.size(),
+                )?;
+                if !result.rectangles.contains(&translated) {
+                    result.rectangles.push(translated);
+                }
+            }
+        }
+        result.partially_retained = !result.truncated.is_empty()
+            && (!result.covered.is_empty() || !result.unresolved.is_empty());
+        Ok(result)
+    }
+}

crates/oa-desktop/src/behavior/scenario_layout.rs

@@ -0,0 +1,816 @@
+//! Pure complete Scenario geometry. No persistence, gesture or fallback policy.
+//! The only renderer is Scene::sequence_geometry; this module resolves its inputs.
+use super::*;
+use oa_core::{DiagramLayout, ScenarioLayout};
+
+#[cfg(test)]
+mod tests;
+
+pub(crate) mod presentation;
+
+type Candidate = BTreeMap<Id, f32>;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum AnchorRole {
+    MessageSend,
+    MessageReceive,
+    Observation,
+    FrameStart,
+    OperandStart,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) struct Anchor {
+    pub(super) y: f32,
+    role: AnchorRole,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct MessageAnchors {
+    send_y: f32,
+    receive_y: f32,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum Diagnostic {
+    SourceOrderCrossing { scope: Id, before: Id, after: Id },
+    FrameExtendsPastFollowingAnchor { frame: Id, following: Id },
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum GeometryIssue {
+    UnknownAnchor(Id),
+    LifecycleGeometryNotSupported { lifeline: Id, scope: Id },
+    InvalidRepresentation(Id),
+    InvalidCoordinate(Id),
+    DuplicateCoordinate(Id),
+    ExpandedAddressNotSupported(Id),
+    CoincidentDistinctEndpoints(Id),
+    TypedActivationOutsideScope { call: Id, scope: Id },
+    TypedActivationOutsideLifetime { call: Id, receiver: Id },
+    TypedActivationCrossingNotSupported { call: Id, event: Id },
+    NonFinite(Id),
+    CompoundMoveNotImplemented(Id),
+    FixedFrameHeaderWouldMove { frame: Id },
+    OperandScopeOutsideEnclosingInterval { operand: Id, fragment: Id },
+    LifecycleAnchorOutsideRenderScope { occurrence: Id, scope: Id },
+    LifetimeInversionNotSupported { create: Id, delete: Id },
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct Plan {
+    pub(super) anchors: BTreeMap<Id, Anchor>,
+    messages: BTreeMap<Id, MessageAnchors>,
+    pub(super) frames: BTreeMap<Id, Rectangle>,
+    pub(super) scopes: BTreeMap<Id, (f32, f32)>,
+    pub(super) height: f32,
+    pub(super) diagnostics: Vec<Diagnostic>,
+}
+
+pub(super) fn occurrence(p: &Project, id: Id) -> Option<&OccurrenceBody> {
+    match p.elements.get(&id)?.shared()? {
+        SharedBody::Occurrence { body, .. } => Some(body),
+        _ => None,
+    }
+}
+
+fn role(body: &OccurrenceBody) -> AnchorRole {
+    match body {
+        OccurrenceBody::Exchange {
+            message_kind: MessageKind::Create | MessageKind::Delete,
+            ..
+        } => AnchorRole::MessageReceive,
+        OccurrenceBody::Exchange { .. } => AnchorRole::MessageSend,
+        OccurrenceBody::Fragment { .. } => AnchorRole::FrameStart,
+        OccurrenceBody::Branch { .. } => AnchorRole::OperandStart,
+        _ => AnchorRole::Observation,
+    }
+}
+
+fn inside(p: &Project, id: Id, owner: Id) -> bool {
+    let mut current = p.elements.get(&id).and_then(|e| e.parent);
+    for _ in 0..p.elements.len() {
+        match current {
+            Some(parent) if parent == owner => return true,
+            Some(parent) => current = p.elements.get(&parent).and_then(|e| e.parent),
+            None => return false,
+        }
+    }
+    false
+}
+
+fn depth(p: &Project, id: Id) -> usize {
+    let mut current = p.elements.get(&id).and_then(|e| e.parent);
+    let mut result = 0;
+    while let Some(parent) = current {
+        result += 1;
+        if result > p.elements.len() {
+            break;
+        }
+        current = p.elements.get(&parent).and_then(|e| e.parent);
+    }
+    result
+}
+
+pub(in crate::behavior) fn union(a: Rectangle, b: Rectangle) -> Rectangle {
+    let x = a.x.min(b.x);
+    let y = a.y.min(b.y);
+    Rectangle::new(
+        Point::new(x, y),
+        Size::new(
+            (a.x + a.width).max(b.x + b.width) - x,
+            (a.y + a.height).max(b.y + b.height) - y,
+        ),
+    )
+}
+
+/// Actual named shapes/message paths supply footprint measurements; activation
+/// bars are intentionally excluded because current Scene derives them later.
+fn footprints(
+    scene: &Scene,
+    anchors: &BTreeMap<Id, Anchor>,
+    seed: &BTreeMap<Id, Anchor>,
+) -> BTreeMap<Id, Rectangle> {
+    let mut out = BTreeMap::new();
+    for item in scene.boxes.iter().filter(|item| !item.title.is_empty()) {
+        let Some(anchor) = anchors.get(&item.id) else {
+            continue;
+        };
+        let mut rect = item.rect;
+        rect.y += anchor.y - seed[&item.id].y;
+        out.insert(item.id, rect);
+    }
+    for line in &scene.lines {
+        let Some(anchor) = anchors.get(&line.id) else {
+            continue;
+        };
+        let delta = anchor.y - seed[&line.id].y;
+        let mut rect = line.label_bounds();
+        rect.y += delta;
+        for point in &line.points {
+            rect = union(
+                rect,
+                Rectangle::new(Point::new(point.x, point.y + delta), Size::ZERO),
+            );
+        }
+        out.entry(line.id)
+            .and_modify(|old| *old = union(*old, rect))
+            .or_insert(rect);
+    }
+    out
+}
+
+fn include_ancestors(p: &Project, id: Id, rect: Rectangle, covered: &mut BTreeMap<Id, Rectangle>) {
+    let mut current = p.elements.get(&id).and_then(|e| e.parent);
+    for _ in 0..p.elements.len() {
+        let Some(parent) = current else {
+            break;
+        };
+        covered
+            .entry(parent)
+            .and_modify(|old| *old = union(*old, rect))
+            .or_insert(rect);
+        current = p.elements.get(&parent).and_then(|e| e.parent);
+    }
+}
+
+fn coverage(p: &Project, footprints: &BTreeMap<Id, Rectangle>) -> BTreeMap<Id, Rectangle> {
+    let mut covered = BTreeMap::new();
+    for (&id, &rect) in footprints {
+        include_ancestors(p, id, rect, &mut covered);
+    }
+    covered
+}
+
+impl Plan {
+    /// Authored endpoint values are primary inputs, not deltas reconstructed from
+    /// rounded rows. Lifecycle alignment owns x and marker attachment; this final
+    /// y alignment precedes typed activation derivation and preserves send bits.
+    pub(super) fn align_message_anchors(&self, lines: &mut [Line]) {
+        for line in lines {
+            let Some(message) = self.messages.get(&line.id) else {
+                continue;
+            };
+            let previous_send = line.points.first().map_or(message.send_y, |point| point.y);
+            line.label_at.y += message.send_y - previous_send;
+            let last = line.points.len().saturating_sub(1);
+            for (index, point) in line.points.iter_mut().enumerate() {
+                point.y = if index == last || (last == 3 && index == 2) {
+                    message.receive_y
+                } else {
+                    message.send_y
+                };
+            }
+        }
+    }
+
+    fn build(
+        p: &Project,
+        owner: Id,
+        baseline: &Scene,
+        desired: &Candidate,
+    ) -> Result<Self, GeometryIssue> {
+        let mut seed: BTreeMap<_, _> = baseline
+            .rows
+            .iter()
+            .map(|(id, (_, y))| {
+                (
+                    *id,
+                    Anchor {
+                        y: *y,
+                        role: role(occurrence(p, *id).expect("Scene occurrence")),
+                    },
+                )
+            })
+            .collect();
+        // Operand headers are real Scene boxes, but are not entries in rows.
+        for item in &baseline.boxes {
+            if matches!(occurrence(p, item.id), Some(OccurrenceBody::Branch { .. })) {
+                seed.insert(
+                    item.id,
+                    Anchor {
+                        y: item.rect.y,
+                        role: AnchorRole::OperandStart,
+                    },
+                );
+            }
+        }
+        let mut anchors = seed.clone();
+        for (&id, &y) in desired {
+            let anchor = anchors
+                .get_mut(&id)
+                .ok_or(GeometryIssue::UnknownAnchor(id))?;
+            if !y.is_finite() {
+                return Err(GeometryIssue::NonFinite(id));
+            }
+            if matches!(
+                anchor.role,
+                AnchorRole::FrameStart | AnchorRole::OperandStart
+            ) && y != anchor.y
+            {
+                return Err(GeometryIssue::CompoundMoveNotImplemented(id));
+            }
+            anchor.y = y;
+        }
+        let mut messages = BTreeMap::new();
+        for line in &baseline.lines {
+            if let (Some(anchor), Some(first), Some(last)) = (
+                anchors.get(&line.id),
+                line.points.first(),
+                line.points.last(),
+            ) {
+                let message = if desired.contains_key(&line.id) {
+                    let self_message = matches!(occurrence(p, line.id), Some(OccurrenceBody::Exchange {
+                        sender: Some(sender), receiver, message_kind, ..
+                    }) if matches!(message_kind, MessageKind::Timer { .. }) || *receiver == Some(*sender));
+                    let lifecycle = matches!(
+                        occurrence(p, line.id),
+                        Some(OccurrenceBody::Exchange {
+                            message_kind: MessageKind::Create | MessageKind::Delete,
+                            ..
+                        })
+                    );
+                    if self_message && lifecycle {
+                        MessageAnchors {
+                            send_y: anchor.y - 24.,
+                            receive_y: anchor.y,
+                        }
+                    } else {
+                        MessageAnchors {
+                            send_y: anchor.y,
+                            receive_y: if self_message {
+                                anchor.y + 24.
+                            } else {
+                                anchor.y
+                            },
+                        }
+                    }
+                } else {
+                    MessageAnchors {
+                        send_y: first.y,
+                        receive_y: last.y,
+                    }
+                };
+                messages.insert(line.id, message);
+            }
+        }
+        // Track actual semantic lifecycle order per receiver and scope. In particular,
+        // a later recreation must not be compared with an earlier deletion.
+        for element in p
+            .elements
+            .values()
+            .filter(|e| e.id == owner || inside(p, e.id, owner))
+        {
+            let Some(steps) = element.steps() else {
+                continue;
+            };
+            let mut last = BTreeMap::new();
+            for id in steps {
+                if let (
+                    Some(message),
+                    Some(OccurrenceBody::Exchange {
+                        receiver: Some(lane),
+                        message_kind: MessageKind::Create | MessageKind::Delete,
+                        ..
+                    }),
+                ) = (messages.get(id), occurrence(p, *id))
+                    && let Some((previous, previous_y)) =
+                        last.insert(*lane, (*id, message.receive_y))
+                    && previous_y > message.receive_y
+                {
+                    return Err(GeometryIssue::LifetimeInversionNotSupported {
+                        create: previous,
+                        delete: *id,
+                    });
+                }
+            }
+        }
+        let old_footprints = footprints(baseline, &seed, &seed);
+        let mut drawn = footprints(baseline, &anchors, &seed);
+        let old_coverage = coverage(p, &old_footprints);
+        let mut new_coverage = coverage(p, &drawn);
+        let mut frames = BTreeMap::new();
+        let mut containers: Vec<_> = seed
+            .keys()
+            .copied()
+            .filter(|id| matches!(occurrence(p, *id), Some(OccurrenceBody::Fragment { .. })))
+            .collect();
+        containers.sort_by_key(|id| std::cmp::Reverse(depth(p, *id)));
+        for id in containers {
+            let original = old_footprints[&id];
+            let mut rect = original;
+            if let Some(covered) = new_coverage.get(&id).copied() {
+                // Preserve automatic extents and their existing descendant padding.
+                // Upward envelope growth would move the painted frame header
+                // while its fixed FrameStart/row/slot remained at the seed.
+                // Reject that unsupported compound change, not mere overlap.
+                if covered.y < rect.y {
+                    return Err(GeometryIssue::FixedFrameHeaderWouldMove { frame: id });
+                }
+                let old_covered = old_coverage[&id];
+                let padding =
+                    (original.y + original.height - old_covered.y - old_covered.height).max(0.);
+                // Preserve padding before the footprint itself reaches the old
+                // frame edge: operand scopes already retain their own padding.
+                rect.height = rect
+                    .height
+                    .max(covered.y + covered.height + padding - rect.y);
+            }
+            frames.insert(id, rect);
+            drawn.insert(id, rect);
+            include_ancestors(p, id, rect, &mut new_coverage);
+        }
+        let mut scopes = baseline.sequence_bounds.clone();
+        for (&scope, bounds) in &mut scopes {
+            if let (Some(old), Some(new)) = (
+                old_coverage.get(&scope).copied(),
+                new_coverage.get(&scope).copied(),
+            ) {
+                let top_padding = (old.y - bounds.0).max(0.);
+                let bottom_padding = (bounds.1 - old.y - old.height).max(0.);
+                if new.y < bounds.0 {
+                    bounds.0 = new.y - top_padding;
+                }
+                bounds.1 = bounds.1.max(new.y + new.height + bottom_padding);
+            }
+        }
+        let tail = baseline.size.height - baseline.sequence_bounds[&owner].1;
+        let height = baseline.size.height.max(scopes[&owner].1 + tail);
+        for (&operand, &(start, end)) in &scopes {
+            if !matches!(occurrence(p, operand), Some(OccurrenceBody::Branch { .. })) {
+                continue;
+            }
+            let fragment = p.elements[&operand].parent.expect("operand fragment");
+            let caller = p.elements[&fragment]
+                .parent
+                .expect("fragment caller sequence");
+            let enclosing_frame = frames[&fragment];
+            let (caller_start, caller_end) = if caller == owner {
+                (85., height - 20.)
+            } else {
+                let (a, b) = scopes[&caller];
+                (a, if a == b { a + 26. } else { b })
+            };
+            let enclosing_start = anchors[&fragment].y.max(caller_start);
+            let enclosing_end = (enclosing_frame.y + enclosing_frame.height).min(caller_end);
+            let effective_end = if start == end { start + 26. } else { end };
+            // Actual lifecycle traversal cannot enter an operand that escapes
+            // this enclosing interval. This guards bridge feasibility only;
+            // it is not a generic event-spacing or sibling-ordering policy.
+            if start < enclosing_start || effective_end > enclosing_end {
+                return Err(GeometryIssue::OperandScopeOutsideEnclosingInterval {
+                    operand,
+                    fragment,
+                });
+            }
+        }
+        for (&id, message) in &messages {
+            if matches!(
+                occurrence(p, id),
+                Some(OccurrenceBody::Exchange {
+                    message_kind: MessageKind::Create | MessageKind::Delete,
+                    ..
+                })
+            ) {
+                let scope = p.elements[&id].parent.expect("lifecycle sequence owner");
+                // Match Rendering::new's effective scope, not the insertion
+                // scope: it overrides the root span to 85..height-20 and gives
+                // empty non-root scopes the existing 26px lifetime allowance.
+                let (start, end) = if scope == owner {
+                    (85., height - 20.)
+                } else if let Some(&(start, end)) = scopes.get(&scope) {
+                    (start, if start == end { start + 26. } else { end })
+                } else {
+                    return Err(GeometryIssue::LifecycleAnchorOutsideRenderScope {
+                        occurrence: id,
+                        scope,
+                    });
+                };
+                if message.receive_y < start || message.receive_y > end {
+                    return Err(GeometryIssue::LifecycleAnchorOutsideRenderScope {
+                        occurrence: id,
+                        scope,
+                    });
+                }
+            }
+        }
+        let mut diagnostics = Vec::new();
+        for element in p
+            .elements
+            .values()
+            .filter(|e| e.id == owner || inside(p, e.id, owner))
+        {
+            if let Some(steps) = element.steps() {
+                for pair in steps.windows(2) {
+                    if let (Some(a), Some(b)) = (anchors.get(&pair[0]), anchors.get(&pair[1])) {
+                        if a.y > b.y {
+                            diagnostics.push(Diagnostic::SourceOrderCrossing {
+                                scope: element.id,
+                                before: pair[0],
+                                after: pair[1],
+                            });
+                        }
+                        if let Some(frame) = frames.get(&pair[0])
+                            && frame.y + frame.height > b.y
+                        {
+                            diagnostics.push(Diagnostic::FrameExtendsPastFollowingAnchor {
+                                frame: pair[0],
+                                following: pair[1],
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        Ok(Self {
+            anchors,
+            messages,
+            frames,
+            scopes,
+            height,
+            diagnostics,
+        })
+    }
+}
+
+/// An appearance identity, never inferred from selection or from the owner alone.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Representation {
+    Derived { owner: Id },
+    Saved { diagram: Id },
+}
+
+/// Complete immutable geometry produced from one Project borrow. Scene is retained
+/// with its plan so a caller cannot accidentally render this plan against another
+/// Project or representation. Document/revision freshness belongs to that caller.
+pub(super) struct ResolvedScenarioPlan {
+    pub(super) representation: Representation,
+    pub(super) owner: Id,
+    pub(super) lanes: BTreeMap<Id, f32>,
+    pub(super) plan: Plan,
+    pub(super) latent_messages: Vec<Id>,
+    pub(super) bounds: Rectangle,
+    pub(super) scene: Scene,
+}
+
+pub(super) fn resolve(
+    p: &Project,
+    representation: Representation,
+    selected: Id,
+) -> Result<ResolvedScenarioPlan, Vec<GeometryIssue>> {
+    let (owner, layout) = match representation {
+        Representation::Derived { owner } => (owner, None),
+        Representation::Saved { diagram } => {
+            let view = p
+                .diagrams
+                .get(&diagram)
+                .ok_or_else(|| vec![GeometryIssue::InvalidRepresentation(diagram)])?;
+            let owner = view
+                .projection
+                .scenario()
+                .ok_or_else(|| vec![GeometryIssue::InvalidRepresentation(diagram)])?;
+            if p.elements
+                .get(&owner)
+                .is_none_or(|e| e.layer() != view.layer)
+            {
+                return Err(vec![GeometryIssue::InvalidRepresentation(diagram)]);
+            }
+            let layout = view
+                .layout
+                .as_ref()
+                .map(|DiagramLayout::Scenario(layout)| layout);
+            (owner, layout)
+        }
+    };
+    if p.elements
+        .get(&owner)
+        .is_none_or(|e| e.kind() != Kind::Scenario)
+    {
+        return Err(vec![GeometryIssue::InvalidRepresentation(owner)]);
+    }
+    let empty = ScenarioLayout::default();
+    let layout = layout.unwrap_or(&empty);
+    let mut lanes = BTreeMap::new();
+    let mut issues = Vec::new();
+    for lane in &layout.lanes {
+        if p.elements
+            .get(&lane.lifeline)
+            .is_none_or(|e| e.kind() != Kind::Lifeline || e.parent != Some(owner))
+        {
+            issues.push(GeometryIssue::UnknownAnchor(lane.lifeline));
+        }
+        if !lane.x.is_finite() || lane.x.abs() > oa_core::MAX_COORDINATE {
+            issues.push(GeometryIssue::InvalidCoordinate(lane.lifeline));
+        }
+        if lanes.insert(lane.lifeline, lane.x).is_some() {
+            issues.push(GeometryIssue::DuplicateCoordinate(lane.lifeline));
+        }
+    }
+    if !issues.is_empty() {
+        return Err(issues);
+    }
+    // The actual automatic traversal runs first, with authored lane centers already
+    // applied. It supplies every untouched anchor, shape, insertion scope and label.
+    let baseline = Scene::sequence_geometry(
+        p,
+        owner,
+        selected,
+        (!lanes.is_empty()).then_some(&lanes),
+        None,
+    );
+    let mut desired = BTreeMap::new();
+    let mut seen = std::collections::BTreeSet::new();
+    let mut latent_messages = Vec::new();
+    let line_ids: std::collections::BTreeSet<_> =
+        baseline.lines.iter().map(|line| line.id).collect();
+    for message in &layout.messages {
+        let id = message.address.occurrence;
+        if !seen.insert(id) {
+            issues.push(GeometryIssue::DuplicateCoordinate(id));
+        }
+        if !message.address.references.is_empty() {
+            issues.push(GeometryIssue::ExpandedAddressNotSupported(id));
+        }
+        if !message.send_y.is_finite() || message.send_y.abs() > oa_core::MAX_COORDINATE {
+            issues.push(GeometryIssue::InvalidCoordinate(id));
+        }
+        let Some(OccurrenceBody::Exchange {
+            sender,
+            receiver,
+            message_kind,
+            ..
+        }) = occurrence(p, id)
+        else {
+            issues.push(GeometryIssue::UnknownAnchor(id));
+            continue;
+        };
+        if !baseline.rows.contains_key(&id) {
+            issues.push(GeometryIssue::UnknownAnchor(id));
+            continue;
+        }
+        if !line_ids.contains(&id) {
+            latent_messages.push(id);
+            continue;
+        }
+        // Legacy lifecycle rows denote receipt, whereas the saved field denotes send.
+        let row = if sender.is_some()
+            && sender == receiver
+            && matches!(message_kind, MessageKind::Create | MessageKind::Delete)
+        {
+            message.send_y + 24.
+        } else {
+            message.send_y
+        };
+        desired.insert(id, row);
+    }
+    let actual_lanes = &baseline.render_lanes;
+    // A coincident pair is not a self message. Do not invent an arrow or lane order.
+    for line in &baseline.lines {
+        if let Some(OccurrenceBody::Exchange {
+            sender: Some(sender),
+            receiver,
+            message_kind,
+            ..
+        }) = occurrence(p, line.id)
+        {
+            let target = if matches!(message_kind, MessageKind::Timer { .. }) {
+                Some(*sender)
+            } else {
+                *receiver
+            };
+            if target.is_some_and(|target| target != *sender)
+                && target
+                    .is_some_and(|target| actual_lanes.get(sender) == actual_lanes.get(&target))
+            {
+                issues.push(GeometryIssue::CoincidentDistinctEndpoints(line.id));
+            }
+        }
+    }
+    if !issues.is_empty() {
+        return Err(issues);
+    }
+    let mut plan = Plan::build(p, owner, &baseline, &desired).map_err(|issue| vec![issue])?;
+    // Keep the schema's exact send value; send+24 is performed once. In particular,
+    // a self Create/Delete receive row must never round-trip back into saved send.
+    for message in &layout.messages {
+        let id = message.address.occurrence;
+        if let Some(anchors) = plan.messages.get_mut(&id) {
+            let self_message = matches!(occurrence(p, id), Some(OccurrenceBody::Exchange {
+                sender: Some(sender), receiver, message_kind, ..
+            }) if matches!(message_kind, MessageKind::Timer { .. }) || *receiver == Some(*sender));
+            *anchors = MessageAnchors {
+                send_y: message.send_y,
+                receive_y: if self_message {
+                    message.send_y + 24.
+                } else {
+                    message.send_y
+                },
+            };
+        }
+    }
+    // Typed bars require a positive receiver interval. This is a narrow renderer
+    // limitation, not a global ban on reordered/negative asynchronous anchors.
+    for (&id, message) in &plan.messages {
+        match occurrence(p, id) {
+            Some(OccurrenceBody::Exchange {
+                message_kind: MessageKind::Call,
+                ..
+            }) => {
+                let scope = baseline.rows[&id].0;
+                let (start, end) = if scope == owner {
+                    (85., plan.height - 20.)
+                } else {
+                    plan.scopes[&scope]
+                };
+                if desired.contains_key(&id) && (message.send_y < start || message.receive_y >= end)
+                {
+                    issues.push(GeometryIssue::TypedActivationOutsideScope { call: id, scope });
+                }
+            }
+            Some(OccurrenceBody::Exchange {
+                message_kind: MessageKind::Reply,
+                reply_to: Some(call),
+                ..
+            }) => {
+                if let Some(start) = plan.messages.get(call)
+                    && (desired.contains_key(&id) || desired.contains_key(call))
+                    && message.send_y <= start.receive_y
+                {
+                    issues.push(GeometryIssue::TypedActivationCrossingNotSupported {
+                        call: *call,
+                        event: id,
+                    });
+                }
+            }
+            _ => {}
+        }
+    }
+    if !issues.is_empty() {
+        return Err(issues);
+    }
+    for segment in &baseline.activations {
+        if baseline
+            .rows
+            .get(&segment.call)
+            .is_none_or(|(scope, _)| *scope != segment.scope)
+        {
+            continue;
+        }
+        let Some(start) = plan.messages.get(&segment.call) else {
+            continue;
+        };
+        let event = match segment.finish {
+            scenario_activation::Finish::Reply(event)
+            | scenario_activation::Finish::Terminated(event) => Some(event),
+            _ => None,
+        };
+        if let Some(event) = event
+            && (desired.contains_key(&event) || desired.contains_key(&segment.call))
+            && plan.anchors[&event].y <= start.receive_y
+        {
+            issues.push(GeometryIssue::TypedActivationCrossingNotSupported {
+                call: segment.call,
+                event,
+            });
+        }
+    }
+    if !issues.is_empty() {
+        return Err(issues);
+    }
+    let scene = Scene::sequence_geometry(
+        p,
+        owner,
+        selected,
+        (!lanes.is_empty()).then_some(&lanes),
+        Some(&plan),
+    );
+    // Compare the actual projector, whose cursor rules include sibling scopes and
+    // lifecycle/fragment events. Retain existing incomplete-model uncertainty;
+    // reject only newly missing geometry introduced by this presentation.
+    let previous_missing = baseline.lifecycle.missing_geometry();
+    for (lifeline, scope) in scene
+        .lifecycle
+        .missing_geometry()
+        .difference(&previous_missing)
+    {
+        issues.push(GeometryIssue::LifecycleGeometryNotSupported {
+            lifeline: *lifeline,
+            scope: *scope,
+        });
+    }
+    if !issues.is_empty() {
+        return Err(issues);
+    }
+    for segment in &baseline.activations {
+        let Some(seed) = baseline
+            .lines
+            .iter()
+            .find(|line| line.id == segment.call)
+            .and_then(|line| line.points.last())
+        else {
+            continue;
+        };
+        if segment.rect.y != seed.y || baseline.rows[&segment.call].0 != segment.scope {
+            continue;
+        }
+        let receive = plan.messages[&segment.call].receive_y;
+        if !desired.is_empty()
+            && !scene.activations.iter().any(|current| {
+                current.call == segment.call
+                    && current.scope == segment.scope
+                    && current.rect.y == receive
+            })
+        {
+            issues.push(GeometryIssue::TypedActivationOutsideLifetime {
+                call: segment.call,
+                receiver: segment.receiver,
+            });
+        }
+    }
+    if !issues.is_empty() {
+        return Err(issues);
+    }
+    let bounds = structural_bounds(&scene);
+    let all_lanes = scene.render_lanes.clone();
+    Ok(ResolvedScenarioPlan {
+        representation,
+        owner,
+        lanes: all_lanes,
+        plan,
+        latent_messages,
+        bounds,
+        scene,
+    })
+}
+
+fn structural_bounds(scene: &Scene) -> Rectangle {
+    let mut bounds = Rectangle::new(scene.layout_origin, scene.size);
+    for item in &scene.boxes {
+        bounds = union(bounds, item.rect);
+    }
+    for line in &scene.lines {
+        if !line.label.is_empty() {
+            bounds = union(bounds, line.label_bounds());
+        }
+        for point in &line.points {
+            // Arrow wings extend beyond the centerline in either direction.
+            bounds = union(
+                bounds,
+                Rectangle::new(Point::new(point.x - 8., point.y - 8.), Size::new(16., 16.)),
+            );
+        }
+    }
+    for segment in &scene.activations {
+        bounds = union(bounds, segment.rect);
+    }
+    for point in &scene.open_calls {
+        bounds = union(
+            bounds,
+            Rectangle::new(Point::new(point.x - 8., point.y - 8.), Size::new(16., 16.)),
+        );
+    }
+    if let Some(lifetime) = scene.lifecycle.bounds() {
+        bounds = union(bounds, lifetime);
+    }
+    bounds
+}

crates/oa-desktop/src/behavior/scenario_layout/presentation.rs

@@ -0,0 +1,234 @@
+//! Display policy for one requested Scenario representation, without authoring.
+//! The resolver remains the sole renderer. Freshness and editor admission belong
+//! to the caller; a capability here never bypasses those guards.
+use super::{Diagnostic, GeometryIssue, Representation, ResolvedScenarioPlan, resolve};
+use crate::behavior::Scene;
+use iced::Rectangle;
+use oa_core::{DiagramLayout, Id, Kind, OccurrenceBody, Project, SharedBody};
+use std::collections::BTreeSet;
+
+#[cfg(test)]
+mod tests;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum PresentationStatus {
+    Ready,
+    Fallback {
+        requested_issues: Vec<GeometryIssue>,
+    },
+    Unavailable {
+        requested_issues: Vec<GeometryIssue>,
+        automatic_issues: Vec<GeometryIssue>,
+    },
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct PresentationCapabilities {
+    /// Actual geometry exists for inspection, Fit and geometry-based navigation.
+    pub(crate) geometry_navigation: bool,
+    /// Still subject to document, gesture, editor and view-visit admission.
+    pub(crate) coordinate_input: bool,
+}
+
+pub(crate) struct ScenarioPresentation {
+    requested: Representation,
+    owner: Option<Id>,
+    status: PresentationStatus,
+    geometry: Option<ResolvedScenarioPlan>,
+    // Saved metadata must survive a complete automatic fallback.
+    latent_messages: Vec<Id>,
+}
+
+impl ScenarioPresentation {
+    pub(crate) fn requested(&self) -> Representation {
+        self.requested
+    }
+    pub(crate) fn owner(&self) -> Option<Id> {
+        self.owner
+    }
+    pub(crate) fn status(&self) -> &PresentationStatus {
+        &self.status
+    }
+    pub(crate) fn geometry_representation(&self) -> Option<Representation> {
+        self.geometry
+            .as_ref()
+            .map(|geometry| geometry.representation)
+    }
+    pub(crate) fn bounds(&self) -> Option<Rectangle> {
+        self.geometry.as_ref().map(|geometry| geometry.bounds)
+    }
+    /// Diagnostics describe the actual displayed geometry. Requested hard failures
+    /// are retained separately in status(), never presented as automatic warnings.
+    pub(crate) fn diagnostics(&self) -> &[Diagnostic] {
+        self.geometry
+            .as_ref()
+            .map_or(&[], |geometry| &geometry.plan.diagnostics)
+    }
+    pub(crate) fn latent_messages(&self) -> &[Id] {
+        &self.latent_messages
+    }
+    pub(crate) fn capabilities(&self) -> PresentationCapabilities {
+        PresentationCapabilities {
+            geometry_navigation: self.geometry.is_some(),
+            coordinate_input: matches!(self.status, PresentationStatus::Ready),
+        }
+    }
+    pub(in crate::behavior) fn scene(&self) -> Option<&Scene> {
+        self.geometry.as_ref().map(|geometry| &geometry.scene)
+    }
+    pub(in crate::behavior) fn into_scene(self) -> Option<Scene> {
+        self.geometry.map(|geometry| geometry.scene)
+    }
+}
+
+/// Resolve a structurally accepted Project for passive display. This is not a
+/// second model validator: identity and resolver-reported structural failures
+/// cannot be converted into a more permissive automatic representation.
+pub(crate) fn present(
+    project: &Project,
+    requested: Representation,
+    selected: Id,
+) -> ScenarioPresentation {
+    let owner = checked_owner(project, requested);
+    let Some(owner_id) = owner else {
+        let id = match requested {
+            Representation::Derived { owner } => owner,
+            Representation::Saved { diagram } => diagram,
+        };
+        return ScenarioPresentation {
+            requested,
+            owner: None,
+            geometry: None,
+            latent_messages: vec![],
+            status: PresentationStatus::Unavailable {
+                requested_issues: vec![GeometryIssue::InvalidRepresentation(id)],
+                automatic_issues: vec![],
+            },
+        };
+    };
+    match resolve(project, requested, selected) {
+        Ok(geometry) => ScenarioPresentation {
+            requested,
+            owner,
+            status: PresentationStatus::Ready,
+            latent_messages: geometry.latent_messages.clone(),
+            geometry: Some(geometry),
+        },
+        Err(requested_issues) => {
+            if matches!(requested, Representation::Derived { .. })
+                || requested_issues.iter().any(structural_failure)
+            {
+                return ScenarioPresentation {
+                    requested,
+                    owner,
+                    geometry: None,
+                    latent_messages: vec![],
+                    status: PresentationStatus::Unavailable {
+                        requested_issues,
+                        automatic_issues: vec![],
+                    },
+                };
+            }
+            match resolve(
+                project,
+                Representation::Derived { owner: owner_id },
+                selected,
+            ) {
+                Ok(geometry) => {
+                    let latent_messages =
+                        saved_latent_messages(project, requested, &geometry.scene);
+                    ScenarioPresentation {
+                        requested,
+                        owner,
+                        status: PresentationStatus::Fallback { requested_issues },
+                        geometry: Some(geometry),
+                        latent_messages,
+                    }
+                }
+                Err(automatic_issues) => ScenarioPresentation {
+                    requested,
+                    owner,
+                    geometry: None,
+                    latent_messages: vec![],
+                    status: PresentationStatus::Unavailable {
+                        requested_issues,
+                        automatic_issues,
+                    },
+                },
+            }
+        }
+    }
+}
+
+pub(crate) fn checked_owner(project: &Project, requested: Representation) -> Option<Id> {
+    let owner = match requested {
+        Representation::Derived { owner } => owner,
+        Representation::Saved { diagram } => {
+            let view = project.diagrams.get(&diagram)?;
+            let owner = view.projection.scenario()?;
+            if view.id != diagram || project.elements.get(&owner)?.layer() != view.layer {
+                return None;
+            }
+            owner
+        }
+    };
+    project
+        .elements
+        .get(&owner)
+        .is_some_and(|element| element.kind() == Kind::Scenario)
+        .then_some(owner)
+}
+
+fn structural_failure(issue: &GeometryIssue) -> bool {
+    // These violate the existing identity/address/finite-coordinate admission
+    // contract. Geometry support failures below do not invalidate stored intent.
+    match issue {
+        GeometryIssue::InvalidRepresentation(_)
+        | GeometryIssue::UnknownAnchor(_)
+        | GeometryIssue::InvalidCoordinate(_)
+        | GeometryIssue::DuplicateCoordinate(_)
+        | GeometryIssue::ExpandedAddressNotSupported(_)
+        | GeometryIssue::NonFinite(_) => true,
+        GeometryIssue::LifecycleGeometryNotSupported { .. }
+        | GeometryIssue::CoincidentDistinctEndpoints(_)
+        | GeometryIssue::TypedActivationOutsideScope { .. }
+        | GeometryIssue::TypedActivationOutsideLifetime { .. }
+        | GeometryIssue::TypedActivationCrossingNotSupported { .. }
+        | GeometryIssue::CompoundMoveNotImplemented(_)
+        | GeometryIssue::FixedFrameHeaderWouldMove { .. }
+        | GeometryIssue::OperandScopeOutsideEnclosingInterval { .. }
+        | GeometryIssue::LifecycleAnchorOutsideRenderScope { .. }
+        | GeometryIssue::LifetimeInversionNotSupported { .. } => false,
+    }
+}
+
+fn saved_latent_messages(project: &Project, requested: Representation, scene: &Scene) -> Vec<Id> {
+    let Representation::Saved { diagram } = requested else {
+        return vec![];
+    };
+    let Some(DiagramLayout::Scenario(layout)) = project.diagrams[&diagram].layout.as_ref() else {
+        return vec![];
+    };
+    let lines: BTreeSet<_> = scene.lines.iter().map(|line| line.id).collect();
+    layout
+        .messages
+        .iter()
+        .filter_map(|message| {
+            let id = message.address.occurrence;
+            (message.address.references.is_empty()
+                && scene.rows.contains_key(&id)
+                && !lines.contains(&id)
+                && matches!(
+                    project
+                        .elements
+                        .get(&id)
+                        .and_then(|element| element.shared()),
+                    Some(SharedBody::Occurrence {
+                        body: OccurrenceBody::Exchange { .. },
+                        ..
+                    })
+                ))
+            .then_some(id)
+        })
+        .collect()
+}

crates/oa-desktop/src/behavior/scenario_layout/presentation/tests.rs

@@ -0,0 +1,351 @@
+use super::*;
+use crate::document::Document;
+use oa_core::{
+    Command, Diagram, OccurrenceEndpoint, ProjectionKind, ScenarioLanePosition, ScenarioLayout,
+    ScenarioMessagePosition, language, validation,
+};
+
+fn fixture() -> (Project, Id) {
+    let project = language::parse(FIXTURE).unwrap();
+    assert_admitted(&project);
+    let owner = named(&project, "conversation");
+    (project, owner)
+}
+fn named(project: &Project, alias: &str) -> Id {
+    project
+        .identities()
+        .into_iter()
+        .find(|(_, name)| *name == alias)
+        .unwrap()
+        .0
+}
+fn assert_admitted(project: &Project) {
+    let errors: Vec<_> = validation::validate(project)
+        .into_iter()
+        .filter(|issue| issue.severity == validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+}
+fn save(project: &mut Project, owner: Id, layout: Option<ScenarioLayout>) -> Id {
+    let id = Id::new_v4();
+    project.diagrams.insert(
+        id,
+        Diagram {
+            id,
+            alias: format!("view_{}", project.diagrams.len()),
+            name: "Saved conversation".into(),
+            description: String::new(),
+            layer: project.elements[&owner].layer(),
+            projection: ProjectionKind::Scenario { scenario: owner },
+            view_options: Default::default(),
+            nodes: Default::default(),
+            routes: vec![],
+            layout: layout.map(DiagramLayout::Scenario),
+        },
+    );
+    id
+}
+fn layout(messages: &[(Id, f32)], lanes: &[(Id, f32)]) -> ScenarioLayout {
+    ScenarioLayout {
+        lanes: lanes
+            .iter()
+            .map(|&(lifeline, x)| ScenarioLanePosition { lifeline, x })
+            .collect(),
+        messages: messages
+            .iter()
+            .map(|&(occurrence, send_y)| ScenarioMessagePosition {
+                address: OccurrenceEndpoint {
+                    occurrence,
+                    references: vec![],
+                },
+                send_y,
+            })
+            .collect(),
+    }
+}
+fn same_geometry(a: &Scene, b: &Scene) {
+    assert!(
+        !a.activations.is_empty(),
+        "fallback must include real typed executions"
+    );
+    assert_eq!(a.activations, b.activations);
+    assert_eq!(a.lifecycle, b.lifecycle);
+    assert_eq!(a.rows, b.rows);
+    assert_eq!(a.sequence_bounds, b.sequence_bounds);
+    assert_eq!(a.render_lanes, b.render_lanes);
+    assert_eq!(a.lanes, b.lanes);
+    assert_eq!(a.open_calls, b.open_calls);
+    assert_eq!((a.size, a.layout_origin), (b.size, b.layout_origin));
+    let boxes = |scene: &Scene| {
+        scene
+            .boxes
+            .iter()
+            .map(|item| {
+                (
+                    item.id,
+                    item.rect,
+                    item.title.clone(),
+                    item.detail.clone(),
+                    item.marker,
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+    let lines = |scene: &Scene| {
+        scene
+            .lines
+            .iter()
+            .map(|line| {
+                (
+                    line.id,
+                    line.points.clone(),
+                    line.label.clone(),
+                    line.label_at,
+                    line.dashed,
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+    let slots = |scene: &Scene| {
+        scene
+            .slots
+            .iter()
+            .map(|slot| {
+                (
+                    slot.slot.parent,
+                    slot.slot.before,
+                    slot.y,
+                    slot.label.clone(),
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(boxes(a), boxes(b));
+    assert_eq!(lines(a), lines(b));
+    assert_eq!(slots(a), slots(b));
+}
+
+#[test]
+fn absent_and_empty_saved_layouts_remain_saved_ready_representations() {
+    let (mut project, owner) = fixture();
+    let absent = save(&mut project, owner, None);
+    let empty = save(&mut project, owner, Some(ScenarioLayout::default()));
+    assert_admitted(&project);
+    let automatic = present(&project, Representation::Derived { owner }, owner);
+    assert_eq!(automatic.status(), &PresentationStatus::Ready);
+    for diagram in [absent, empty] {
+        let requested = Representation::Saved { diagram };
+        let displayed = present(&project, requested, owner);
+        assert_eq!(displayed.requested(), requested);
+        assert_eq!(displayed.geometry_representation(), Some(requested));
+        assert_eq!(displayed.owner(), Some(owner));
+        assert_eq!(displayed.status(), &PresentationStatus::Ready);
+        assert!(displayed.capabilities().coordinate_input);
+        assert_eq!(displayed.bounds(), automatic.bounds());
+        same_geometry(displayed.scene().unwrap(), automatic.scene().unwrap());
+    }
+}
+
+#[test]
+fn successful_crossing_diagnostic_keeps_authored_geometry_and_latent_identity() {
+    let (mut project, owner) = fixture();
+    let first = named(&project, "first");
+    let second = named(&project, "second");
+    let left = named(&project, "left");
+    let unfinished = named(&project, "unfinished");
+    let diagram = save(
+        &mut project,
+        owner,
+        Some(layout(
+            &[(first, 1000.), (unfinished, 2000.)],
+            &[(left, 900.)],
+        )),
+    );
+    assert_admitted(&project);
+    let shown = present(&project, Representation::Saved { diagram }, first);
+    assert_eq!(shown.status(), &PresentationStatus::Ready);
+    assert_eq!(shown.scene().unwrap().rows[&first].1, 1000.);
+    assert_eq!(shown.scene().unwrap().rows[&second].1, 240.);
+    assert_eq!(shown.scene().unwrap().render_lanes[&left], 900.);
+    assert!(
+        shown
+            .diagnostics()
+            .contains(&Diagnostic::SourceOrderCrossing {
+                scope: owner,
+                before: first,
+                after: second
+            })
+    );
+    assert_eq!(shown.latent_messages(), &[unfinished]);
+    assert_eq!(shown.scene().unwrap().rows[&unfinished].1, 516.);
+}
+
+#[test]
+fn hard_failure_uses_complete_automatic_geometry_but_retains_each_saved_request_and_latent_notice()
+{
+    let (mut project, owner) = fixture();
+    let call = named(&project, "call");
+    let reply = named(&project, "reply");
+    let unfinished = named(&project, "unfinished");
+    let left = named(&project, "left");
+    let right = named(&project, "right");
+    let authored = layout(
+        &[(reply, 300.), (unfinished, 2000.)],
+        &[(left, 900.), (right, -500.)],
+    );
+    let a = save(&mut project, owner, Some(authored.clone()));
+    let b = save(&mut project, owner, Some(authored));
+    assert_admitted(&project);
+    let before = project.clone();
+    let automatic = present(&project, Representation::Derived { owner }, call);
+    let control = automatic.scene().unwrap();
+    assert_eq!(control.render_lanes[&left], 160.);
+    assert_eq!(control.render_lanes[&right], 400.);
+    assert_eq!(control.rows[&reply].1, 424.);
+    assert_eq!(control.activations.len(), 1);
+    assert_eq!(
+        (
+            control.activations[0].rect.y,
+            control.activations[0].rect.height
+        ),
+        (356., 68.)
+    );
+    for diagram in [a, b] {
+        let request = Representation::Saved { diagram };
+        let shown = present(&project, request, call);
+        assert_eq!(shown.requested(), request);
+        assert_eq!(
+            shown.geometry_representation(),
+            Some(Representation::Derived { owner })
+        );
+        assert_eq!(
+            shown.status(),
+            &PresentationStatus::Fallback {
+                requested_issues: vec![GeometryIssue::TypedActivationCrossingNotSupported {
+                    call,
+                    event: reply
+                }],
+            }
+        );
+        assert_eq!(
+            shown.capabilities(),
+            PresentationCapabilities {
+                geometry_navigation: true,
+                coordinate_input: false
+            }
+        );
+        assert_eq!(shown.latent_messages(), &[unfinished]);
+        assert!(shown.diagnostics().is_empty());
+        assert_eq!(shown.bounds(), automatic.bounds());
+        same_geometry(shown.scene().unwrap(), control);
+    }
+    assert_eq!(project, before);
+}
+
+#[test]
+fn missing_or_incompatible_identity_and_structural_coordinate_errors_are_unavailable() {
+    let (mut project, owner) = fixture();
+    let left = named(&project, "left");
+    let diagram = save(&mut project, owner, None);
+    let missing = Id::new_v4();
+    for request in [
+        Representation::Saved { diagram: missing },
+        Representation::Derived { owner: left },
+    ] {
+        let shown = present(&project, request, owner);
+        assert_eq!(shown.requested(), request);
+        assert_eq!(shown.owner(), None);
+        assert!(
+            matches!(shown.status(), PresentationStatus::Unavailable { automatic_issues, .. } if automatic_issues.is_empty())
+        );
+        assert!(shown.scene().is_none() && shown.bounds().is_none());
+        assert_eq!(
+            shown.capabilities(),
+            PresentationCapabilities {
+                geometry_navigation: false,
+                coordinate_input: false
+            }
+        );
+    }
+    project.diagrams.get_mut(&diagram).unwrap().projection =
+        ProjectionKind::Scenario { scenario: missing };
+    assert!(matches!(
+        present(&project, Representation::Saved { diagram }, owner).status(),
+        PresentationStatus::Unavailable { .. }
+    ));
+    // Deliberately invalid-model control, not a warning-admitted geometry failure.
+    project.diagrams.get_mut(&diagram).unwrap().projection =
+        ProjectionKind::Scenario { scenario: owner };
+    project.diagrams.get_mut(&diagram).unwrap().layout = Some(DiagramLayout::Scenario(layout(
+        &[],
+        &[(left, oa_core::MAX_COORDINATE + 1.)],
+    )));
+    assert!(
+        validation::validate(&project)
+            .iter()
+            .any(|issue| issue.severity == validation::Severity::Error)
+    );
+    let before = project.clone();
+    let shown = present(&project, Representation::Saved { diagram }, owner);
+    assert!(
+        matches!(shown.status(), PresentationStatus::Unavailable { requested_issues, automatic_issues }
+        if requested_issues == &[GeometryIssue::InvalidCoordinate(left)] && automatic_issues.is_empty())
+    );
+    assert!(shown.scene().is_none());
+    assert_eq!(project, before);
+}
+
+#[test]
+fn passive_fallback_preserves_exact_document_source_and_one_step_undo_redo() {
+    let (mut project, owner) = fixture();
+    let first = named(&project, "first");
+    let reply = named(&project, "reply");
+    let view = save(&mut project, owner, Some(layout(&[(reply, 300.)], &[])));
+    assert_admitted(&project);
+    let mut document = Document::from_project(project, Default::default()).unwrap();
+    let initial_project = document.project().clone();
+    let initial_source = document.bundle().clone();
+    document
+        .execute(Command::Rename(first, "An intentional prior edit".into()))
+        .unwrap();
+    let accepted_project = document.project().clone();
+    let accepted_source = document.bundle().clone();
+    let revision = document.revision();
+    {
+        let shown = present(
+            document.project(),
+            Representation::Saved { diagram: view },
+            first,
+        );
+        assert!(matches!(
+            shown.status(),
+            PresentationStatus::Fallback { .. }
+        ));
+        assert!(shown.scene().is_some());
+    }
+    assert_eq!(document.project(), &accepted_project);
+    assert_eq!(document.bundle(), &accepted_source);
+    assert_eq!(document.revision(), revision);
+    assert!(document.undo());
+    assert_eq!(document.project(), &initial_project);
+    assert_eq!(document.bundle(), &initial_source);
+    assert!(document.redo());
+    assert_eq!(document.project(), &accepted_project);
+    assert_eq!(document.bundle(), &accepted_source);
+}
+
+const FIXTURE: &str = r#"arcadia 7;
+project display_probe "Scenario display probe" id "70000000-0000-4000-8000-000000000001" {
+ oa_activity source "Source" id "70000000-0000-4000-8000-000000000002" {}
+ oa_activity target "Target" id "70000000-0000-4000-8000-000000000003" {}
+ interaction exchange "Repeated exchange" id "70000000-0000-4000-8000-000000000004" { source @source; target @target; }
+ oa_scenario conversation "Conversation" id "70000000-0000-4000-8000-000000000005" { viewpoint OperationalActivity; steps [@first, @second, @call, @reply, @unfinished]; }
+ oa_lifeline left "Left" id "70000000-0000-4000-8000-000000000006" { parent @conversation; represented @source; }
+ oa_lifeline right "Right" id "70000000-0000-4000-8000-000000000007" { parent @conversation; represented @target; }
+ oa_occurrence first "First" id "70000000-0000-4000-8000-000000000008" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver @right; message_kind Asynchronous; }; }; }
+ oa_occurrence second "Second" id "70000000-0000-4000-8000-000000000009" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver @right; message_kind Asynchronous; }; }; }
+ oa_occurrence call "Call" id "70000000-0000-4000-8000-00000000000a" { parent @conversation; body { Exchange { exchange none; sender @right; receiver @right; message_kind Call; }; }; }
+ oa_occurrence reply "Reply" id "70000000-0000-4000-8000-00000000000b" { parent @conversation; body { Exchange { exchange none; sender @right; receiver @right; message_kind Reply; reply_to @call; }; }; }
+ oa_occurrence unfinished "Unfinished" id "70000000-0000-4000-8000-00000000000c" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver none; message_kind Asynchronous; }; }; }
+}
+"#;

crates/oa-desktop/src/behavior/scenario_lifecycle/render.rs

@@ -8,6 +8,21 @@ use iced::{
 use oa_core::{Id, OccurrenceBody, Project, SharedBody};
 use std::collections::BTreeMap;
 
+// Test-only geometry input, deliberately upstream of rows, scopes, lifecycle
+// and activations. This is not an authored placement or drag policy.
+#[cfg(test)]
+thread_local! {
+    static TEST_ROW_OFFSETS: std::cell::RefCell<BTreeMap<Id, f32>> = Default::default();
+}
+#[cfg(test)]
+pub(in crate::behavior) fn apply_test_row_offset(id: Id, y: &mut f32) {
+    TEST_ROW_OFFSETS.with(|offsets| {
+        if let Some(offset) = offsets.borrow().get(&id) {
+            *y += offset;
+        }
+    });
+}
+
 #[derive(Debug, Clone, PartialEq)]
 struct EventMarker {
     event: Marker,
@@ -16,6 +31,7 @@ struct EventMarker {
     capsule: Rectangle,
     name: String,
     sender_x: Option<f32>,
+    self_message: bool,
 }
 
 #[derive(Debug, Default, Clone, PartialEq)]
@@ -74,7 +90,7 @@ impl Rendering {
                 continue;
             };
             for event in &lane.markers {
-                let sender_x = project
+                let sender_id = project
                     .elements
                     .get(&event.occurrence)
                     .and_then(|e| e.shared())
@@ -86,7 +102,7 @@ impl Rendering {
                                     ..
                                 },
                             ..
-                        } => lanes.get(sender).copied(),
+                        } => Some(*sender),
                         _ => None,
                     });
                 markers.push(EventMarker {
@@ -98,7 +114,8 @@ impl Rendering {
                         Size::new(140., 28.),
                     ),
                     name: project.named(lane.lifeline).to_owned(),
-                    sender_x,
+                    sender_x: sender_id.and_then(|id| lanes.get(&id).copied()),
+                    self_message: sender_id == Some(lane.lifeline),
                 });
             }
         }
@@ -123,7 +140,7 @@ impl Rendering {
             };
             let x = marker.center.x;
             let y = marker.center.y;
-            let self_message = sender == x;
+            let self_message = marker.self_message;
             let end_x = match marker.event.kind {
                 MarkerKind::Birth if sender < x => marker.capsule.x,
                 MarkerKind::Birth => marker.capsule.x + marker.capsule.width,
@@ -151,6 +168,48 @@ impl Rendering {
         }
     }
 
+    /// Geometry loss is distinct from warning-admitted semantic uncertainty.
+    /// The saved bridge compares these exact projector diagnostics with baseline.
+    pub(in crate::behavior) fn missing_geometry(&self) -> std::collections::BTreeSet<(Id, Id)> {
+        self.lifetimes
+            .iter()
+            .flat_map(|lane| {
+                lane.uncertainties
+                    .iter()
+                    .filter(|issue| issue.reason == super::UncertaintyReason::MissingGeometry)
+                    .map(|issue| (lane.lifeline, issue.scope))
+            })
+            .collect()
+    }
+
+    /// Complete structural lifetime bounds, including the birth capsule and death mark.
+    pub(in crate::behavior) fn bounds(&self) -> Option<Rectangle> {
+        let mut bounds = self.span.and_then(|span| {
+            self.lanes
+                .values()
+                .map(|x| {
+                    Rectangle::new(
+                        Point::new(*x, span.start),
+                        Size::new(0., span.end - span.start),
+                    )
+                })
+                .reduce(crate::behavior::scenario_layout::union)
+        });
+        for marker in &self.markers {
+            let rect = match marker.event.kind {
+                MarkerKind::Birth => marker.capsule,
+                MarkerKind::Death => Rectangle::new(
+                    Point::new(marker.center.x - 10., marker.center.y - 10.),
+                    Size::new(20., 20.),
+                ),
+            };
+            bounds = Some(bounds.map_or(rect, |old| {
+                crate::behavior::scenario_layout::union(old, rect)
+            }));
+        }
+        bounds
+    }
+
     pub(in crate::behavior) fn alive_spans(
         &self,
         lifeline: Id,

crates/oa-desktop/src/behavior/scenario_lifecycle/render_tests.rs

@@ -3,6 +3,9 @@ use crate::{behavior::Scene, document::Document};
 use iced::Size;
 use oa_core::*;
 
+#[path = "union_tests.rs"]
+mod union_tests;
+
 struct Fixture {
     project: Project,
     owner: Id,
@@ -100,6 +103,21 @@ impl Fixture {
             },
         )
     }
+    fn reply(&mut self, parent: Id, call: Id) -> Id {
+        self.occurrence(
+            parent,
+            "Reply",
+            OccurrenceBody::Exchange {
+                exchange: Some(self.exchange),
+                sender: Some(self.receiver),
+                receiver: Some(self.sender),
+                message_kind: MessageKind::Reply,
+                operation: None,
+                reply_to: Some(call),
+                values: vec![],
+            },
+        )
+    }
     fn fragment(&mut self, parent: Id, operator: FragmentOperator) -> Id {
         self.occurrence(
             parent,
@@ -488,9 +506,9 @@ fn real_scene_branch_delete_clips_only_its_activation_and_keeps_unanswered_call_
         let (left_start, left_end) = scene.sequence_bounds[&left];
         let (right_start, _) = scene.sequence_bounds[&right];
         let bars: Vec<_> = scene
-            .boxes
+            .activations
             .iter()
-            .filter(|b| b.id == call && b.rect.width == 8.)
+            .filter(|b| b.call == call && b.receiver == f.receiver)
             .map(|b| b.rect)
             .collect();
         assert!(

crates/oa-desktop/src/behavior/scenario_lifecycle/union_tests.rs

@@ -0,0 +1,498 @@
+use super::*;
+use crate::behavior::scenario_activation::{Finish, Segment};
+
+fn line(scene: &Scene, id: Id) -> &crate::behavior::Line {
+    scene.lines.iter().find(|line| line.id == id).unwrap()
+}
+fn segments(scene: &Scene, call: Id) -> Vec<&Segment> {
+    scene
+        .activations
+        .iter()
+        .filter(|a| a.call == call)
+        .collect()
+}
+fn assert_visible_lifetime(scene: &Scene) {
+    for a in &scene.activations {
+        assert_eq!(
+            scene
+                .lifecycle
+                .alive_spans(a.receiver, a.scope, a.rect.y, a.rect.y + a.rect.height),
+            vec![Span {
+                start: a.rect.y,
+                end: a.rect.y + a.rect.height
+            }]
+        );
+        if let Finish::Reply(reply) = a.finish {
+            assert_eq!(a.rect.y + a.rect.height, line(scene, reply).points[0].y);
+        }
+    }
+}
+
+#[test]
+fn admitted_delayed_create_nested_calls_replies_delete_share_one_geometry_pipeline() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let birth = f.message(f.owner, MessageKind::Create);
+        let c1 = f.message(f.owner, MessageKind::Call);
+        let c2 = f.message(f.owner, MessageKind::Call);
+        let r2 = f.reply(f.owner, c2);
+        let r1 = f.reply(f.owner, c1);
+        let death = f.message(f.owner, MessageKind::Delete);
+        let scene = f.scene();
+        assert_eq!(scene.activations.len(), 2);
+        for (call, reply, column) in [(c1, r1, 0), (c2, r2, 1)] {
+            let a = segments(&scene, call)[0];
+            assert_eq!(
+                (a.receiver, a.scope, a.column, a.finish),
+                (f.receiver, f.owner, column, Finish::Reply(reply))
+            );
+            let received = *line(&scene, call).points.last().unwrap();
+            let sent = line(&scene, reply).points[0];
+            assert_eq!((a.rect.y, a.rect.y + a.rect.height), (received.y, sent.y));
+            assert_eq!(received.x, sent.x);
+            assert!(
+                a.rect.y > scene.rows[&birth].1 && a.rect.y + a.rect.height < scene.rows[&death].1
+            );
+        }
+        assert_visible_lifetime(&scene);
+        assert!(scene.open_calls.is_empty());
+        for event in [birth, death] {
+            assert_eq!(
+                scene.hit(Point::new(scene.lanes[&f.receiver], scene.rows[&event].1)),
+                Some(event)
+            );
+        }
+    }
+}
+
+#[test]
+fn admitted_death_and_incomplete_later_reply_do_not_fabricate_an_answered_execution() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let call = f.message(f.owner, MessageKind::Call);
+        let death = f.message(f.owner, MessageKind::Delete);
+        let reply = f.reply(f.owner, call);
+        if let SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange {
+                sender, exchange, ..
+            },
+            ..
+        } = f
+            .project
+            .elements
+            .get_mut(&reply)
+            .unwrap()
+            .shared_mut()
+            .unwrap()
+        {
+            *sender = None;
+            *exchange = None;
+        }
+        let scene = f.scene();
+        let a = segments(&scene, call)[0];
+        assert_eq!(a.finish, Finish::Terminated(death));
+        assert_eq!(a.rect.y + a.rect.height, scene.rows[&death].1);
+        assert!(
+            scene.boxes.iter().any(|b| b.id == reply),
+            "The incomplete reply remains a repairable card"
+        );
+        assert_eq!(scene.open_calls.len(), 1);
+        assert_visible_lifetime(&scene);
+    }
+}
+
+#[test]
+fn admitted_self_lifecycle_and_self_call_keep_distinct_send_receive_rows() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let action = f.occurrence(
+            f.owner,
+            "Sender preparation",
+            OccurrenceBody::Action {
+                action: None,
+                lifeline: Some(f.sender),
+            },
+        );
+        let birth = f.message(f.owner, MessageKind::Create);
+        let call = f.message(f.owner, MessageKind::Call);
+        let reply = f.reply(f.owner, call);
+        let death = f.message(f.owner, MessageKind::Delete);
+        for event in [birth, call, reply, death] {
+            if let SharedBody::Occurrence {
+                body:
+                    OccurrenceBody::Exchange {
+                        sender,
+                        receiver,
+                        exchange,
+                        ..
+                    },
+                ..
+            } = f
+                .project
+                .elements
+                .get_mut(&event)
+                .unwrap()
+                .shared_mut()
+                .unwrap()
+            {
+                *sender = Some(f.receiver);
+                *receiver = Some(f.receiver);
+                *exchange = None;
+            }
+        }
+        let scene = f.scene();
+        let preparation = scene.boxes.iter().find(|b| b.id == action).unwrap();
+        assert!(line(&scene, birth).label_at.y > preparation.rect.y + preparation.rect.height);
+        for event in [birth, death] {
+            let message = line(&scene, event);
+            assert_eq!(message.points[0].y, scene.rows[&event].1 - 24.);
+            assert_eq!(message.points.last().unwrap().y, scene.rows[&event].1);
+            assert_eq!(
+                scene.hit(Point::new(scene.lanes[&f.receiver], scene.rows[&event].1)),
+                Some(event)
+            );
+        }
+        let activation = segments(&scene, call)[0];
+        assert_eq!(activation.rect.y, scene.rows[&call].1 + 24.);
+        assert_eq!(
+            activation.rect.y,
+            line(&scene, call).points.last().unwrap().y
+        );
+        assert_eq!(
+            activation.rect.y + activation.rect.height,
+            line(&scene, reply).points[0].y
+        );
+        assert_eq!(activation.finish, Finish::Reply(reply));
+        assert_visible_lifetime(&scene);
+    }
+}
+
+#[test]
+fn admitted_unresolved_operand_keeps_unanswered_cue_without_any_visible_segment() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let fragment = f.fragment(f.owner, FragmentOperator::Alternative);
+        let left = f.branch(fragment);
+        f.message(left, MessageKind::Create);
+        let right = f.branch(fragment);
+        let call = f.message(right, MessageKind::Call);
+        let scene = f.scene();
+        assert!(segments(&scene, call).is_empty());
+        assert!(
+            intervals(&scene, f.receiver, right)
+                .iter()
+                .all(|i| i.2 == Life::Unresolved)
+        );
+        assert_eq!(scene.open_calls.len(), 1);
+        assert!(scene.open_calls[0].y > scene.rows[&call].1);
+        assert_eq!(
+            line(&scene, call).points.last().unwrap().x,
+            scene.lanes[&f.receiver]
+        );
+    }
+}
+
+#[test]
+fn admitted_calls_without_sender_polylines_still_have_logical_correlation_metadata() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let c1 = f.message(f.owner, MessageKind::Call);
+        let c2 = f.message(f.owner, MessageKind::Call);
+        for call in [c1, c2] {
+            if let SharedBody::Occurrence {
+                body:
+                    OccurrenceBody::Exchange {
+                        sender, exchange, ..
+                    },
+                ..
+            } = f
+                .project
+                .elements
+                .get_mut(&call)
+                .unwrap()
+                .shared_mut()
+                .unwrap()
+            {
+                *sender = None;
+                *exchange = None;
+            }
+        }
+        let outgoing = f.occurrence(
+            f.owner,
+            "Outgoing",
+            OccurrenceBody::Exchange {
+                exchange: None,
+                sender: Some(f.receiver),
+                receiver: Some(f.sender),
+                message_kind: MessageKind::Asynchronous,
+                operation: None,
+                reply_to: None,
+                values: vec![],
+            },
+        );
+        f.reply(f.owner, c2);
+        f.reply(f.owner, c1);
+        let scene = f.scene();
+        assert!(scene.boxes.iter().any(|b| b.id == c1));
+        assert!(scene.boxes.iter().any(|b| b.id == c2));
+        let inner = segments(&scene, c2)[0];
+        let expected = if scene.lanes[&f.sender] > scene.lanes[&f.receiver] {
+            inner.rect.x + inner.rect.width
+        } else {
+            inner.rect.x
+        };
+        assert_eq!(line(&scene, outgoing).points[0].x, expected);
+    }
+}
+
+fn lifetime_rejected(f: &Fixture) {
+    assert!(validate_candidate(&f.project).is_err());
+    assert!(
+        validation::validate(&f.project)
+            .iter()
+            .any(|issue| issue.severity == validation::Severity::Error
+                && issue.code == "lifeline_lifetime")
+    );
+}
+
+#[test]
+fn invalid_prebirth_call_and_postdeath_reply_remain_rejected_with_defensive_scene_clipping() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for later_birth in [false, true] {
+            let mut f = Fixture::new(layer);
+            let call = f.message(f.owner, MessageKind::Call);
+            let death = f.message(f.owner, MessageKind::Delete);
+            if later_birth {
+                f.message(f.owner, MessageKind::Create);
+            }
+            let reply = f.reply(f.owner, call);
+            lifetime_rejected(&f);
+            // Deliberately bypass Document only for defensive renderer coverage
+            // of rejected data. This is not an admitted editing workflow.
+            let scene = Scene::sequence(&f.project, f.owner, f.owner);
+            assert!(
+                scene
+                    .activations
+                    .iter()
+                    .all(|a| a.rect.y + a.rect.height <= scene.rows[&death].1)
+            );
+            assert!(
+                scene
+                    .activations
+                    .iter()
+                    .all(|a| a.finish != Finish::Reply(reply))
+            );
+            assert_eq!(line(&scene, reply).points[0].x, scene.lanes[&f.receiver]);
+            assert!(!scene.open_calls.is_empty());
+            assert_visible_lifetime(&scene);
+        }
+        let mut f = Fixture::new(layer);
+        let call = f.message(f.owner, MessageKind::Call);
+        let birth = f.message(f.owner, MessageKind::Create);
+        let reply = f.reply(f.owner, call);
+        lifetime_rejected(&f);
+        let scene = Scene::sequence(&f.project, f.owner, f.owner);
+        assert_eq!(segments(&scene, call)[0].rect.y, scene.rows[&birth].1);
+        assert_eq!(segments(&scene, call)[0].finish, Finish::Reply(reply));
+        assert_eq!(
+            line(&scene, call).points.last().unwrap().x,
+            scene.lanes[&f.receiver]
+        );
+        assert_visible_lifetime(&scene);
+    }
+}
+
+#[test]
+fn conditional_death_then_recreate_never_revives_call_but_keeps_open_sibling() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        f.message(f.owner, MessageKind::Create);
+        let call = f.message(f.owner, MessageKind::Call);
+        let fragment = f.fragment(f.owner, FragmentOperator::Alternative);
+        let left = f.branch(fragment);
+        let death = f.message(left, MessageKind::Delete);
+        let right = f.branch(fragment);
+        let rebirth = f.message(f.owner, MessageKind::Create);
+        let reply = f.reply(f.owner, call);
+        lifetime_rejected(&f);
+        let scene = Scene::sequence(&f.project, f.owner, f.owner);
+        let bars = segments(&scene, call);
+        assert!(
+            bars.iter()
+                .any(|a| a.scope == left && a.finish == Finish::Terminated(death))
+        );
+        assert!(
+            bars.iter().any(|a| a.scope == right
+                && a.rect.height == 26.
+                && a.finish == Finish::Continuation)
+        );
+        assert!(
+            bars.iter()
+                .all(|a| a.rect.y + a.rect.height < scene.rows[&rebirth].1)
+        );
+        assert!(!bars.iter().any(|a| a.finish == Finish::Reply(reply)));
+        assert_eq!(line(&scene, reply).points[0].x, scene.lanes[&f.receiver]);
+        assert_eq!(
+            scene.open_calls.len(),
+            3,
+            "Terminated, open sibling and uncertain parent cues survive"
+        );
+        assert_visible_lifetime(&scene);
+    }
+}
+
+#[test]
+fn clipped_operand_preserves_original_nested_or_crossed_correlation_distinction() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for nested in [false, true] {
+            let mut f = Fixture::new(layer);
+            f.message(f.owner, MessageKind::Create);
+            let c1 = f.message(f.owner, MessageKind::Call);
+            let c2 = f.message(f.owner, MessageKind::Call);
+            let fragment = f.fragment(f.owner, FragmentOperator::Alternative);
+            let left = f.branch(fragment);
+            f.message(left, MessageKind::Delete);
+            let right = f.branch(fragment);
+            let outgoing = f.occurrence(
+                right,
+                "Outgoing",
+                OccurrenceBody::Exchange {
+                    exchange: None,
+                    sender: Some(f.receiver),
+                    receiver: Some(f.sender),
+                    message_kind: MessageKind::Asynchronous,
+                    operation: None,
+                    reply_to: None,
+                    values: vec![],
+                },
+            );
+            let r1 = f.reply(f.owner, if nested { c2 } else { c1 });
+            let r2 = f.reply(f.owner, if nested { c1 } else { c2 });
+            lifetime_rejected(&f);
+            let scene = Scene::sequence(&f.project, f.owner, f.owner);
+            let send = line(&scene, outgoing).points[0];
+            let expected = if nested {
+                let inner = segments(&scene, c2)
+                    .into_iter()
+                    .find(|a| a.scope == right)
+                    .unwrap();
+                if scene.lanes[&f.sender] > scene.lanes[&f.receiver] {
+                    inner.rect.x + inner.rect.width
+                } else {
+                    inner.rect.x
+                }
+            } else {
+                scene.lanes[&f.receiver]
+            };
+            assert_eq!(send.x, expected);
+            for call in [c1, c2] {
+                assert!(segments(&scene, call).iter().any(|a| a.scope == right
+                    && a.rect.y <= send.y
+                    && send.y < a.rect.y + a.rect.height));
+            }
+            assert!(scene.rows[&r1].1 < scene.rows[&r2].1);
+            assert_visible_lifetime(&scene);
+        }
+    }
+}
+
+fn with_offset<T>(id: Id, offset: f32, f: impl FnOnce() -> T) -> T {
+    struct Restore(BTreeMap<Id, f32>);
+    impl Drop for Restore {
+        fn drop(&mut self) {
+            TEST_ROW_OFFSETS.with(|current| *current.borrow_mut() = std::mem::take(&mut self.0));
+        }
+    }
+    let _restore =
+        Restore(TEST_ROW_OFFSETS.with(|current| current.replace(BTreeMap::from([(id, offset)]))));
+    f()
+}
+fn snapshot(scene: &Scene) -> String {
+    format!(
+        "{:?}",
+        (
+            &scene.lifecycle,
+            &scene.activations,
+            &scene.open_calls,
+            &scene.rows,
+            &scene.sequence_bounds,
+            scene
+                .lines
+                .iter()
+                .map(|l| (l.id, &l.points, &l.label, l.label_at, l.dashed))
+                .collect::<Vec<_>>(),
+            scene
+                .boxes
+                .iter()
+                .map(|b| (b.id, b.rect, &b.title, &b.detail, b.marker))
+                .collect::<Vec<_>>(),
+            scene
+                .slots
+                .iter()
+                .map(|s| (s.slot, s.y, &s.label))
+                .collect::<Vec<_>>(),
+            scene.size,
+        )
+    )
+}
+
+#[test]
+fn test_only_upstream_row_offsets_update_lifetime_segments_and_endpoints_without_authoring() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let birth = f.message(f.owner, MessageKind::Create);
+        let c1 = f.message(f.owner, MessageKind::Call);
+        let c2 = f.message(f.owner, MessageKind::Call);
+        let r2 = f.reply(f.owner, c2);
+        let r1 = f.reply(f.owner, c1);
+        let death = f.message(f.owner, MessageKind::Delete);
+        let document = f.document();
+        let before = document.snapshot();
+        let baseline = Scene::sequence(document.project(), f.owner, c1);
+        let moved = with_offset(birth, 60., || {
+            Scene::sequence(document.project(), f.owner, c1)
+        });
+        assert_eq!(moved.rows[&birth].1, baseline.rows[&birth].1 + 60.);
+        assert_eq!(moved.rows[&death].1, baseline.rows[&death].1 + 60.);
+        for scene in [&baseline, &moved] {
+            assert_eq!(scene.activations.len(), 2);
+            for (call, reply) in [(c1, r1), (c2, r2)] {
+                assert!(scene.activations.iter().any(|segment| {
+                    segment.call == call
+                        && segment.finish == Finish::Reply(reply)
+                }));
+            }
+        }
+        for (a, b) in baseline.activations.iter().zip(&moved.activations) {
+            assert_eq!(
+                (a.call, a.receiver, a.scope, a.column, a.finish),
+                (b.call, b.receiver, b.scope, b.column, b.finish)
+            );
+            assert_eq!(
+                b.rect,
+                Rectangle::new(
+                    a.rect.position() + iced::Vector::new(0., 60.),
+                    a.rect.size()
+                )
+            );
+        }
+        assert_eq!(baseline.activations.len(), moved.activations.len());
+        assert_visible_lifetime(&moved);
+        let reparsed = language::parse(&language::format(document.project())).unwrap();
+        assert_eq!(reparsed, *document.project());
+        assert_eq!(
+            snapshot(&moved),
+            with_offset(birth, 60., || snapshot(&Scene::sequence(
+                &reparsed, f.owner, c1
+            )))
+        );
+        assert_eq!(
+            snapshot(&baseline),
+            snapshot(&Scene::sequence(document.project(), f.owner, c1))
+        );
+        assert_eq!(document.project(), &before.decoded.project);
+        assert_eq!(document.bundle(), &before.bundle);
+        assert_eq!(document.revision(), 0);
+        assert!(!document.dirty() && !document.can_undo() && !document.can_redo());
+    }
+}

crates/oa-desktop/src/behavior/state_canvas.rs

@@ -1712,6 +1712,7 @@ mod tests {
                 layer: Layer::Sa,
                 projection: ProjectionKind::StateMachine { machine },
                 nodes: BTreeMap::new(),
+                layout: None,
                 routes: vec![],
                 view_options: Default::default(),
             },

crates/oa-desktop/src/behavior/state_edit.rs

@@ -292,6 +292,7 @@ pub fn create_view(project: &Project, machine: Id) -> Result<Plan, ModelError> {
             layer: owner.layer(),
             projection: ProjectionKind::StateMachine { machine },
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
             view_options: Default::default(),
         },

crates/oa-desktop/src/behavior/topology/view.rs

@@ -219,6 +219,7 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
     graph.interaction = Some((context, state.tool, clean));
     let scale = graph.scale;
     let scope = super::super::canvas_workspace::Scope {
+        scenario_view: None,
         document: context.document,
         owner,
         revision: context.revision,

crates/oa-desktop/src/diagram.rs

@@ -1594,11 +1594,32 @@ fn hex(c: Color) -> String {
         (c.b * 255.) as u8
     )
 }
-pub fn export_svg(p: &Project, diagram: Id) -> String {
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ExportError {
+    MissingDiagram(Id),
+    UnsupportedScenario(Id),
+}
+impl std::fmt::Display for ExportError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::MissingDiagram(id) => write!(f, "Cannot export: diagram {id} no longer exists."),
+            Self::UnsupportedScenario(_) => {
+                f.write_str("SVG export of saved Scenario views is not available yet.")
+            }
+        }
+    }
+}
+impl std::error::Error for ExportError {}
+
+pub fn export_svg(p: &Project, diagram: Id) -> Result<String, ExportError> {
+    let d = p
+        .diagrams
+        .get(&diagram)
+        .ok_or(ExportError::MissingDiagram(diagram))?;
+    if d.projection.scenario().is_some() {
+        return Err(ExportError::UnsupportedScenario(diagram));
+    }
     let view = project_view(p, diagram);
-    let Some(d) = p.diagrams.get(&diagram) else {
-        return String::new();
-    };
     let routed = route_diagram(p, d, &view);
     let left = routed.bounds.position.x - 30.;
     let top = routed.bounds.position.y - 30.;
@@ -1737,7 +1758,7 @@ pub fn export_svg(p: &Project, diagram: Id) -> String {
         svg.push_str("</g>");
     }
     svg.push_str("</svg>");
-    svg
+    Ok(svg)
 }
 
 #[cfg(test)]
@@ -1747,6 +1768,83 @@ mod pointer_tests;
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn svg_rejects_saved_scenario_with_absent_or_authored_layout_without_mutation() {
+        let f = crate::behavior::scenario::direct_tests::fixture();
+        let mut p = f.project;
+        let diagram = p.ensure_diagram(Layer::Oa);
+        let d = p.diagrams.get_mut(&diagram).unwrap();
+        d.projection = ProjectionKind::Scenario { scenario: f.owner };
+        d.nodes.clear();
+        d.routes.clear();
+        for layout in [
+            None,
+            Some(DiagramLayout::Scenario(ScenarioLayout {
+                lanes: vec![ScenarioLanePosition {
+                    lifeline: f.sender,
+                    x: 240.,
+                }],
+                messages: vec![ScenarioMessagePosition {
+                    address: OccurrenceEndpoint {
+                        references: vec![],
+                        occurrence: f.call,
+                    },
+                    send_y: 180.,
+                }],
+            })),
+        ] {
+            p.diagrams.get_mut(&diagram).unwrap().layout = layout;
+            let admitted = execute_batch(&p, &[]).expect("valid saved Scenario fixture");
+            assert_eq!(admitted, p);
+            let before = p.clone();
+            assert_eq!(
+                export_svg(&p, diagram),
+                Err(ExportError::UnsupportedScenario(diagram))
+            );
+            assert_eq!(p, before);
+        }
+    }
+
+    #[test]
+    fn svg_rejects_missing_diagram_without_mutation() {
+        let p = Project::demo();
+        let missing = Id::new_v4();
+        let before = p.clone();
+        assert_eq!(
+            export_svg(&p, missing),
+            Err(ExportError::MissingDiagram(missing))
+        );
+        assert_eq!(p, before);
+    }
+
+    #[test]
+    fn svg_accepts_populated_and_empty_architecture_views() {
+        let mut p = Project::demo();
+        let diagram = p
+            .diagrams
+            .values()
+            .find(|d| d.projection.is_architecture() && !d.nodes.is_empty())
+            .unwrap()
+            .id;
+        let before = p.clone();
+        let svg = export_svg(&p, diagram).expect("populated architecture");
+        assert!(svg.starts_with("<svg "));
+        assert!(svg.contains("<text "));
+        assert!(svg.ends_with("</svg>"));
+        assert_eq!(p, before);
+        let d = p.diagrams.get_mut(&diagram).unwrap();
+        d.projection = ProjectionKind::Overview;
+        d.nodes.clear();
+        d.routes.clear();
+        assert_eq!(execute_batch(&p, &[]).expect("valid empty architecture"), p);
+        let before = p.clone();
+        let svg = export_svg(&p, diagram).expect("empty architecture is supported");
+        assert!(svg.contains("viewBox=\"-30 -30 60 60\""));
+        assert!(svg.ends_with("</svg>"));
+        assert_eq!(p, before);
+    }
+
     #[test]
     fn typed_function_glyphs_and_unoriented_standard_connections_have_distinct_svg() {
         let p = Project::demo();
@@ -1780,7 +1878,7 @@ mod tests {
             .find(|d| d.layer == Layer::Sa && d.projection == ProjectionKind::Allocation)
             .unwrap()
             .id;
-        let svg = export_svg(&p, diagram);
+        let svg = export_svg(&p, diagram).expect("supported diagram");
         let title = format!("<title>{}</title>", escape(&boundary.name));
         let edge_path = svg
             .split(&title)
@@ -1854,7 +1952,7 @@ mod tests {
                 p.place(diagram, id, Position { x: 60., y: 60. });
             }
             let p = execute_batch(&p, &[Command::Layout(diagram)]).unwrap();
-            let svg = export_svg(&p, diagram);
+            let svg = export_svg(&p, diagram).expect("supported diagram");
             let group = svg
                 .split("<g>")
                 .find(|g| g.contains(">Grouped work</text>"))
@@ -1944,7 +2042,7 @@ mod tests {
             .unwrap()
             .id;
         let view = project_view(&p, diagram);
-        let svg = export_svg(&p, diagram);
+        let svg = export_svg(&p, diagram).expect("supported diagram");
         for edge in &view.edges {
             assert!(svg.contains(&format!(">{}</text>", escape(&short(p.named(edge.id), 32)))));
         }
@@ -1959,7 +2057,7 @@ mod tests {
         p.place(d, a, Position { x: 0., y: 0. });
         p.place(d, b, Position { x: 400., y: 0. });
         p.relate(RelationKind::CapabilityInclude, "Uses", a, b);
-        let svg = export_svg(&p, d);
+        let svg = export_svg(&p, d).expect("supported diagram");
         assert!(svg.contains("«include»</text>"));
         assert!(svg.contains("stroke-dasharray=\"6 4\""));
     }
@@ -2046,7 +2144,7 @@ mod tests {
             .unwrap();
         assert_eq!(moved.position.x, port.position.x + 100.);
         assert_eq!(moved.position.y, port.position.y + 70.);
-        let svg = export_svg(&p, diagram);
+        let svg = export_svg(&p, diagram).expect("supported diagram");
         for port in &view.ports {
             assert!(svg.contains(&format!("<title>{}</title>", escape(p.named(port.element)))));
         }
@@ -2503,7 +2601,7 @@ mod tests {
         });
         let view = project_view(&p, diagram);
         let geometry = route_diagram(&p, &p.diagrams[&diagram], &view);
-        let svg = export_svg(&p, diagram);
+        let svg = export_svg(&p, diagram).expect("supported diagram");
         let route = &geometry.edges[&edge];
         let path = route
             .points
@@ -2563,7 +2661,7 @@ mod tests {
             let routed = route_diagram(&p, &p.diagrams[&diagram], &projected);
             let ends = routing::association_end_geometry(&p.relations[&edge], &routed.edges[&edge]);
             assert_eq!(ends.len(), 2);
-            let svg = export_svg(&p, diagram);
+            let svg = export_svg(&p, diagram).expect("supported diagram");
             assert!(svg.contains("parent [0..1]</text>"));
             assert!(svg.contains("children [0..*]</text>"));
             assert!(!svg.contains("data-navigation=\"source\""));

crates/oa-desktop/src/diagram/view_options_tests.rs

@@ -27,7 +27,7 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
     validate_candidate(&p).unwrap();
     let initial = p.clone();
     let path_key = format!("<path data-edge=\"{edge}\"");
-    let svg = export_svg(&p, diagram);
+    let svg = export_svg(&p, diagram).expect("supported diagram");
     let edge_path = svg
         .split(&path_key)
         .nth(1)
@@ -46,7 +46,7 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
         .unwrap()
         .view_options
         .exchange_labels = ExchangeLabels::Items;
-    let items_svg = export_svg(&p, diagram);
+    let items_svg = export_svg(&p, diagram).expect("supported diagram");
     assert!(items_svg.contains("Data &amp; status"));
     let RelationBody::CommunicationMean { oriented, .. } =
         &mut p.relations.get_mut(&edge).unwrap().body
@@ -54,7 +54,7 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
         unreachable!()
     };
     *oriented = true;
-    let svg = export_svg(&p, diagram);
+    let svg = export_svg(&p, diagram).expect("supported diagram");
     assert!(
         svg.split(&path_key)
             .nth(1)
@@ -71,7 +71,11 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
         .view_options
         .hidden_edges
         .push(edge);
-    assert!(!export_svg(&p, diagram).contains(&path_key));
+    assert!(
+        !export_svg(&p, diagram)
+            .expect("supported diagram")
+            .contains(&path_key)
+    );
     p.diagrams
         .get_mut(&diagram)
         .unwrap()
@@ -83,7 +87,11 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
         .unwrap()
         .view_options
         .relation_kinds = RelationKinds::Only(vec![]);
-    assert!(!export_svg(&p, diagram).contains(&path_key));
+    assert!(
+        !export_svg(&p, diagram)
+            .expect("supported diagram")
+            .contains(&path_key)
+    );
     assert_eq!(p.diagrams[&diagram].nodes, placements);
     assert_eq!(language::parse(&language::format(&p)).unwrap(), p);
 }

crates/oa-desktop/src/diagram_usage.rs

@@ -170,6 +170,13 @@ impl Surface {
             {
                 "State views"
             }
+            Self::Saved(id)
+                if p.diagrams
+                    .get(&id)
+                    .is_some_and(|d| d.projection.scenario().is_some()) =>
+            {
+                "Scenarios"
+            }
             Self::Saved(_) => "Architecture",
             Self::Process(_) => "Processes and chains",
             Self::Scenario(_) => "Scenarios",
@@ -276,6 +283,18 @@ pub(crate) fn saved_usages_for(p: &Project, subject: Id, only_diagram: Option<Id
     if only_diagram.is_some_and(|id| !p.diagrams.contains_key(&id)) {
         return Vec::new();
     }
+    if let Some(diagram) = only_diagram
+        .and_then(|id| p.diagrams.get(&id))
+        .filter(|d| d.projection.scenario().is_some())
+    {
+        return crate::behavior::scenario::State::default().representation_usages(
+            p,
+            crate::behavior::scenario_layout::Representation::Saved {
+                diagram: diagram.id,
+            },
+            subject,
+        );
+    }
     let index = ViewIndex::new(p);
     let mut usages = Vec::new();
     for diagram in p
@@ -283,6 +302,18 @@ pub(crate) fn saved_usages_for(p: &Project, subject: Id, only_diagram: Option<Id
         .values()
         .filter(|diagram| only_diagram.is_none_or(|id| diagram.id == id))
     {
+        if diagram.projection.scenario().is_some() {
+            usages.extend(
+                crate::behavior::scenario::State::default().representation_usages(
+                    p,
+                    crate::behavior::scenario_layout::Representation::Saved {
+                        diagram: diagram.id,
+                    },
+                    subject,
+                ),
+            );
+            continue;
+        }
         let view = projection::project_diagram_with_index(p, diagram, &index);
         let surface = Surface::Saved(diagram.id);
         if subject == diagram.id || diagram.projection.state_machine() == Some(subject) {

crates/oa-desktop/src/forms.rs

@@ -1535,7 +1535,8 @@ fn group_label(path: &str) -> Option<&'static str> {
 }
 
 fn placement_allowed(project: &Project, diagram: &Diagram, element: &Element, current: Id) -> bool {
-    (diagram.projection == ProjectionKind::Traceability || diagram.layer == element.layer())
+    diagram.projection.scenario().is_none()
+        && (diagram.projection == ProjectionKind::Traceability || diagram.layer == element.layer())
         && diagram
             .projection
             .state_machine()
@@ -2683,6 +2684,7 @@ mod tests {
                 description: String::new(),
                 layer: Layer::Oa,
                 projection: ProjectionKind::Overview,
+                layout: None,
                 routes: Vec::new(),
                 view_options: Default::default(),
                 nodes: BTreeMap::new(),

crates/oa-desktop/src/port_workflow.rs

@@ -813,6 +813,7 @@ mod tests {
                     description: String::new(),
                     layer: Layer::Sa,
                     projection: ProjectionKind::Overview,
+                    layout: None,
                     routes: Vec::new(),
                     view_options: Default::default(),
                     nodes: Default::default(),

crates/oa-desktop/src/views.rs

@@ -389,11 +389,24 @@ fn modal_width<'a>(
     .into()
 }
 fn diagram(app: &App) -> View<'_, Message> {
+    if app
+        .active_diagram
+        .and_then(|id| app.project().diagrams.get(&id))
+        .is_some_and(|d| d.projection.scenario().is_some())
+    {
+        return heading(
+            "Saved Scenario view",
+            crate::app::SAVED_SCENARIO_UNAVAILABLE,
+        );
+    }
     let mut diagrams = app
         .project()
         .diagrams
         .values()
-        .filter(|d| d.layer == app.layer || d.projection == ProjectionKind::Traceability)
+        .filter(|d| {
+            d.projection.scenario().is_none()
+                && (d.layer == app.layer || d.projection == ProjectionKind::Traceability)
+        })
         .map(|d| Choice {
             id: d.id,
             label: d.name.clone(),

crates/oa-desktop/src/workflow.rs

@@ -352,7 +352,8 @@ impl Transition {
 }
 
 fn result_view_compatible(p: &Project, diagram: &Diagram, targets: &[Id], layer: Layer) -> bool {
-    (diagram.layer == layer || diagram.projection == ProjectionKind::Traceability)
+    (diagram.projection.is_architecture() || diagram.projection.state_machine().is_some())
+        && (diagram.layer == layer || diagram.projection == ProjectionKind::Traceability)
         && (diagram.projection.state_machine().is_none() || !targets.is_empty())
         && targets.iter().all(|id| {
             p.elements.get(id).is_some_and(|e| {
@@ -1972,3 +1973,37 @@ mod port_authoring_tests {
         }
     }
 }
+
+#[cfg(test)]
+mod saved_scenario_destination_tests {
+    use super::*;
+
+    #[test]
+    fn empty_transition_results_do_not_make_a_scenario_an_architecture_destination() {
+        let mut p = Project::empty();
+        let owner = p
+            .add_element(Kind::Scenario, Layer::Oa, "Scenario", None)
+            .unwrap();
+        let mut diagram = Diagram {
+            id: Id::new_v4(),
+            alias: "target_view".into(),
+            name: "Target".into(),
+            description: String::new(),
+            layer: Layer::Oa,
+            projection: ProjectionKind::Scenario { scenario: owner },
+            view_options: Default::default(),
+            nodes: Default::default(),
+            routes: vec![],
+            layout: None,
+        };
+        assert!(!result_view_compatible(&p, &diagram, &[], Layer::Oa));
+        let machine = p
+            .add_element(Kind::StateMachine, Layer::Oa, "Machine", None)
+            .unwrap();
+        diagram.projection = ProjectionKind::StateMachine { machine };
+        assert!(result_view_compatible(&p, &diagram, &[machine], Layer::Oa));
+        assert!(!result_view_compatible(&p, &diagram, &[], Layer::Oa));
+        diagram.projection = ProjectionKind::Overview;
+        assert!(result_view_compatible(&p, &diagram, &[], Layer::Oa));
+    }
+}

crates/oa-desktop/src/workflow/transition_tests.rs

@@ -13,6 +13,7 @@ fn view(p: &mut Project, number: u128, projection: ProjectionKind) -> Id {
             projection,
             view_options: Default::default(),
             nodes: Default::default(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-server/tests/http.rs

@@ -20,6 +20,8 @@ mod semantic_transitions;
 mod source6_views;
 #[path = "http/source7_contracts.rs"]
 mod source7_contracts;
+#[path = "http/scenario_layout.rs"]
+mod scenario_layout;
 #[path = "http/source_projects.rs"]
 mod source_projects;
 

crates/oa-server/tests/http/scenario_layout.rs

@@ -0,0 +1,344 @@
+//! Saved Scenario geometry uses the same atomic model/source HTTP transaction.
+use super::*;
+use oa_core::{
+    Diagram, DiagramLayout, MessageKind, OccurrenceBody, OccurrenceEndpoint, ProjectionKind,
+    ScenarioLanePosition, ScenarioLayout, ScenarioMessagePosition, ScenarioViewpoint, SharedBody,
+    source_project::{ProjectLimits, SourceBundle, compile_bundle, format_bundle},
+};
+use std::collections::BTreeMap;
+
+struct Fixture {
+    bundle: SourceBundle,
+    views: [Diagram; 2],
+    lane: Id,
+    messages: [Id; 3],
+    foreign: Id,
+}
+
+fn address(occurrence: Id) -> OccurrenceEndpoint {
+    OccurrenceEndpoint {
+        references: vec![],
+        occurrence,
+    }
+}
+
+fn fixture() -> Fixture {
+    let mut model = Project::empty();
+    let owner = model
+        .add_element(Kind::Scenario, Layer::Oa, "Delivery", None)
+        .unwrap();
+    let other = model
+        .add_element(Kind::Scenario, Layer::Oa, "Other delivery", None)
+        .unwrap();
+    for id in [owner, other] {
+        let Some(SharedBody::Scenario { viewpoint, .. }) =
+            model.elements.get_mut(&id).unwrap().shared_mut()
+        else {
+            panic!("Scenario body")
+        };
+        *viewpoint = ScenarioViewpoint::ParticipantInteraction;
+    }
+    let sender = model
+        .add_element(Kind::Entity, Layer::Oa, "Sender", None)
+        .unwrap();
+    let receiver = model
+        .add_element(Kind::Entity, Layer::Oa, "Receiver", None)
+        .unwrap();
+    let lane = model
+        .add_element(Kind::Lifeline, Layer::Oa, "Sender lane", Some(owner))
+        .unwrap();
+    let destination = model
+        .add_element(Kind::Lifeline, Layer::Oa, "Receiver lane", Some(owner))
+        .unwrap();
+    for (id, represented) in [(lane, sender), (destination, receiver)] {
+        *model.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Lifeline {
+            represented: Some(represented),
+        };
+    }
+    let exchange = model.relate(
+        RelationKind::CommunicationMean,
+        "Delivery channel",
+        sender,
+        receiver,
+    );
+    let mut occurrences = Vec::new();
+    for (name, parent, complete) in [
+        ("First delivery", owner, true),
+        ("Repeated delivery", owner, true),
+        ("Unfinished delivery", owner, false),
+        ("Foreign delivery", other, false),
+    ] {
+        let id = model
+            .add_element(Kind::Occurrence, Layer::Oa, name, Some(parent))
+            .unwrap();
+        *model.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange {
+                exchange: complete.then_some(exchange),
+                sender: complete.then_some(lane),
+                receiver: complete.then_some(destination),
+                message_kind: MessageKind::Asynchronous,
+                reply_to: None,
+                values: vec![],
+                operation: None,
+            },
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+        occurrences.push(id);
+    }
+    *model.elements.get_mut(&owner).unwrap().steps_mut().unwrap() = occurrences[..3].to_vec();
+    *model.elements.get_mut(&other).unwrap().steps_mut().unwrap() = vec![occurrences[3]];
+    let views = ["delivery_wide", "delivery_review"].map(|alias| Diagram {
+        id: Id::new_v4(),
+        alias: alias.into(),
+        name: alias.into(),
+        description: String::new(),
+        layer: Layer::Oa,
+        projection: ProjectionKind::Scenario { scenario: owner },
+        view_options: Default::default(),
+        nodes: BTreeMap::new(),
+        routes: vec![],
+        layout: None,
+    });
+    let mut bundle = format_bundle(&model);
+    let entry = bundle.files.get_mut(&bundle.entry).unwrap();
+    *entry = format!(
+        "// Transport fixture rationale\n{}",
+        entry.replacen("{\n", "{\n include \"notes.arcadia\";\n", 1)
+    );
+    bundle.files.insert(
+        "notes.arcadia".into(),
+        "// Unrelated rationale: 航海\r\n".into(),
+    );
+    let compiled = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    assert_eq!(compiled.decoded.project, model);
+    assert!(
+        oa_core::validation::validate(&model)
+            .iter()
+            .all(|issue| issue.severity != oa_core::validation::Severity::Error)
+    );
+    Fixture {
+        bundle: compiled.bundle,
+        views,
+        lane,
+        messages: [occurrences[0], occurrences[1], occurrences[2]],
+        foreign: occurrences[3],
+    }
+}
+
+async fn post(
+    server: &TestServer,
+    current: &StoredProject,
+    etag: &str,
+    commands: Value,
+    dry_run: bool,
+) -> (StatusCode, Option<String>, Value) {
+    let response = server
+        .client
+        .post(server.url(&format!("/projects/{}/transactions", current.resource_id)))
+        .header("if-match", etag)
+        .json(&json!({"commands": commands, "dry_run": dry_run}))
+        .send()
+        .await
+        .unwrap();
+    let status = response.status();
+    let etag = response
+        .headers()
+        .get("etag")
+        .map(|value| value.to_str().unwrap().to_owned());
+    (status, etag, response.json().await.unwrap())
+}
+
+async fn assert_unchanged(server: &TestServer, current: &StoredProject, disk: &Path, bytes: &[u8]) {
+    assert_eq!(
+        serde_json::to_value(server.get(current.resource_id).await).unwrap(),
+        serde_json::to_value(current).unwrap(),
+        "entire stored envelope, including Project, source and revision"
+    );
+    assert_eq!(
+        std::fs::read(disk).unwrap(),
+        bytes,
+        "physical stored envelope must not be rewritten"
+    );
+}
+
+fn assert_source_pair(current: &StoredProject, notes: &str) {
+    let compiled = compile_bundle(&current.source_project, ProjectLimits::default()).unwrap();
+    assert_eq!(compiled.bundle, current.source_project);
+    assert_eq!(compiled.decoded.project, current.model);
+    assert_eq!(current.source_project.files["notes.arcadia"], notes);
+    assert!(
+        current.source_project.files[&current.source_project.entry]
+            .starts_with("// Transport fixture rationale\n")
+    );
+}
+
+#[tokio::test]
+async fn saved_scenario_positions_roundtrip_through_http_without_partial_or_noop_writes() {
+    let f = fixture();
+    let directory = tempfile::tempdir().unwrap();
+    let server = TestServer::start(directory.path(), None).await;
+    let response = server
+        .client
+        .post(server.url("/projects/import-source-project"))
+        .json(&f.bundle)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::CREATED);
+    let summary: Value = response.json().await.unwrap();
+    let id = summary["resource_id"].as_str().unwrap().parse().unwrap();
+    let original = server.get(id).await;
+    assert_eq!(original.source_project, f.bundle);
+    let disk = directory.path().join(format!("{id}.json"));
+    let original_bytes = std::fs::read(&disk).unwrap();
+    let [wide, review] = f.views.clone();
+    // Raw JSON exercises the actual externally-tagged transport fields. Two
+    // messages deliberately share one engineering exchange but retain distinct IDs.
+    let commands = json!([
+        {"CreateDiagram": wide}, {"CreateDiagram": review},
+        {"SetScenarioLanePosition": {"diagram": wide.id, "position": {"lifeline": f.lane, "x": -120.0}}},
+        {"SetScenarioMessagePosition": {"diagram": wide.id, "position": {"address": {"references": [], "occurrence": f.messages[0]}, "send_y": 200.0}}},
+        {"SetScenarioMessagePosition": {"diagram": wide.id, "position": {"address": {"references": [], "occurrence": f.messages[1]}, "send_y": 275.0}}},
+        {"SetScenarioMessagePosition": {"diagram": wide.id, "position": {"address": {"references": [], "occurrence": f.messages[2]}, "send_y": -35.0}}},
+        {"SetScenarioLanePosition": {"diagram": review.id, "position": {"lifeline": f.lane, "x": 760.0}}},
+        {"SetScenarioMessagePosition": {"diagram": review.id, "position": {"address": {"references": [], "occurrence": f.messages[0]}, "send_y": 430.0}}}
+    ]);
+    // Independent expected Project: populate the specified records directly;
+    // do not use execute_batch/prepare_command as the success oracle.
+    let mut expected = original.model.clone();
+    let mut expected_wide = wide.clone();
+    expected_wide.layout = Some(DiagramLayout::Scenario(ScenarioLayout {
+        lanes: vec![ScenarioLanePosition {
+            lifeline: f.lane,
+            x: -120.0,
+        }],
+        messages: f
+            .messages
+            .into_iter()
+            .zip([200., 275., -35.])
+            .map(|(id, send_y)| ScenarioMessagePosition {
+                address: address(id),
+                send_y,
+            })
+            .collect(),
+    }));
+    let mut expected_review = review.clone();
+    expected_review.layout = Some(DiagramLayout::Scenario(ScenarioLayout {
+        lanes: vec![ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 760.0,
+        }],
+        messages: vec![ScenarioMessagePosition {
+            address: address(f.messages[0]),
+            send_y: 430.0,
+        }],
+    }));
+    expected.diagrams.insert(wide.id, expected_wide);
+    expected.diagrams.insert(review.id, expected_review.clone());
+    let (status, etag, preview) =
+        post(&server, &original, &original.etag(), commands.clone(), true).await;
+    assert_eq!(status, StatusCode::OK, "{preview}");
+    assert_eq!(etag, Some(original.etag()));
+    assert_eq!(preview["revision"], original.revision);
+    assert_eq!(preview["changed"], true);
+    assert_eq!(
+        serde_json::from_value::<Project>(preview["model"].clone()).unwrap(),
+        expected
+    );
+    let preview_source: SourceBundle =
+        serde_json::from_value(preview["source_project"].clone()).unwrap();
+    assert_eq!(
+        compile_bundle(&preview_source, ProjectLimits::default())
+            .unwrap()
+            .decoded
+            .project,
+        expected
+    );
+    assert_unchanged(&server, &original, &disk, &original_bytes).await;
+    let (status, etag, committed) =
+        post(&server, &original, &original.etag(), commands, false).await;
+    assert_eq!(status, StatusCode::OK, "{committed}");
+    assert_eq!(committed["changed"], true);
+    let current = server.get(id).await;
+    assert_eq!(etag, Some(current.etag()));
+    assert_eq!(current.revision, original.revision + 1);
+    assert_eq!(current.model, expected);
+    assert_eq!(
+        current.source_project, preview_source,
+        "preview and commit must agree exactly"
+    );
+    assert_source_pair(&current, &f.bundle.files["notes.arcadia"]);
+    let current_bytes = std::fs::read(&disk).unwrap();
+    let no_op = json!([
+        {"SetScenarioLanePosition": {"diagram": wide.id, "position": {"lifeline": f.lane, "x": -120.0}}},
+        {"SetScenarioMessagePosition": {"diagram": wide.id, "position": {"address": {"references": [], "occurrence": f.messages[2]}, "send_y": -35.0}}}
+    ]);
+    for dry_run in [true, false] {
+        let (status, etag, result) =
+            post(&server, &current, &current.etag(), no_op.clone(), dry_run).await;
+        assert_eq!(status, StatusCode::OK, "{result}");
+        assert_eq!(etag, Some(current.etag()));
+        assert_eq!(result["changed"], false);
+        assert_eq!(result["revision"], current.revision);
+        assert_unchanged(&server, &current, &disk, &current_bytes).await;
+    }
+    // A stale request must fail even when its coordinate value is a no-op.
+    let (status, _, result) = post(&server, &current, &original.etag(), no_op, false).await;
+    assert_eq!(status, StatusCode::PRECONDITION_FAILED, "{result}");
+    assert_eq!(result["code"], "revision_conflict");
+    assert_unchanged(&server, &current, &disk, &current_bytes).await;
+    // First command is valid. The second belongs to another Scenario; neither
+    // a dry-run nor a real transaction may expose/persist the partial candidate.
+    let invalid = json!([
+        {"SetScenarioLanePosition": {"diagram": wide.id, "position": {"lifeline": f.lane, "x": 999.0}}},
+        {"SetScenarioMessagePosition": {"diagram": wide.id, "position": {"address": {"references": [], "occurrence": f.foreign}, "send_y": 400.0}}}
+    ]);
+    for dry_run in [true, false] {
+        let (status, _, result) =
+            post(&server, &current, &current.etag(), invalid.clone(), dry_run).await;
+        assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY, "{result}");
+        assert_eq!(result["code"], "command_rejected");
+        assert!(result.get("model").is_none());
+        assert_unchanged(&server, &current, &disk, &current_bytes).await;
+    }
+    let mut removals =
+        vec![json!({"RemoveScenarioLanePosition": {"diagram": wide.id, "lifeline": f.lane}})];
+    removals.extend(f.messages.map(|occurrence| json!({"RemoveScenarioMessagePosition": {"diagram": wide.id, "address": {"references": [], "occurrence": occurrence}}})));
+    let removals = Value::Array(removals);
+    let (status, _, result) =
+        post(&server, &current, &current.etag(), removals.clone(), false).await;
+    assert_eq!(status, StatusCode::OK, "{result}");
+    assert_eq!(result["changed"], true);
+    let removed = server.get(id).await;
+    assert_eq!(removed.revision, current.revision + 1);
+    expected.diagrams.get_mut(&wide.id).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()));
+    assert_eq!(
+        removed.model, expected,
+        "removal changes only the addressed saved view"
+    );
+    assert_eq!(removed.model.diagrams[&review.id], expected_review);
+    assert_source_pair(&removed, &f.bundle.files["notes.arcadia"]);
+    let removed_bytes = std::fs::read(&disk).unwrap();
+    let (status, _, result) = post(&server, &removed, &removed.etag(), removals, false).await;
+    assert_eq!(status, StatusCode::OK, "{result}");
+    assert_eq!(result["changed"], false);
+    assert_unchanged(&server, &removed, &disk, &removed_bytes).await;
+    let exported = server
+        .client
+        .get(server.url(&format!("/projects/{id}/source-project")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(exported.status(), StatusCode::OK);
+    assert_eq!(exported.headers()["etag"].to_str().unwrap(), removed.etag());
+    assert_eq!(
+        exported.json::<SourceBundle>().await.unwrap(),
+        removed.source_project
+    );
+    server.stop().await;
+    let restarted = TestServer::start(directory.path(), None).await;
+    assert_unchanged(&restarted, &removed, &disk, &removed_bytes).await;
+    restarted.stop().await;
+}

examples/release1/model.rs

@@ -151,7 +151,7 @@ fn diagram(
             (node.id, node)
         })
         .collect();
-    p.diagrams.insert(diagram_id, Diagram { id: diagram_id, alias: alias.into(), name: name.into(), description: "Teaching view: positions and filters do not change ownership or exchange identities.".into(), layer, projection, view_options: ViewOptions::default(), nodes, routes: vec![] });
+    p.diagrams.insert(diagram_id, Diagram { id: diagram_id, alias: alias.into(), name: name.into(), description: "Teaching view: positions and filters do not change ownership or exchange identities.".into(), layer, projection, view_options: ViewOptions::default(), nodes, layout: None, routes: vec![] });
     diagram_id
 }
 

harness/basic-editing-contract.rs

@@ -84,6 +84,7 @@ fn fixture() -> Project {
                 description: String::new(),
                 layer,
                 projection,
+                layout: None,
                 routes: vec![],
                 view_options: Default::default(),
                 nodes: BTreeMap::new(),

harness/behavior-creation-contract.rs

@@ -315,6 +315,7 @@ fn predict(base: &CompiledSourceProject, stage: Stage, carrier: &Project) -> Com
             description: String::new(),
             layer: Layer::Sa,
             projection: ProjectionKind::StateMachine { machine },
+            layout: None,
             routes: vec![],
             view_options: Default::default(),
             nodes: BTreeMap::from([(
@@ -401,6 +402,7 @@ fn false_carrier(base: &Project) -> Project {
             projection: ProjectionKind::StateMachine {
                 machine: test_id(3),
             },
+            layout: None,
             routes: vec![],
             view_options: Default::default(),
             nodes: BTreeMap::from([(

harness/child-work-native-contract.rs

@@ -23,7 +23,7 @@ fn fixture(layer: Layer) -> Project {
         let key=id(50+index as u128);
         p.artifact_links.insert(key, ArtifactLink { id:key, alias:format!("evidence_{index}"), name:format!("Responsibility evidence {index}"), description:"Keep owner identity and evidence metadata".into(), owner, relation:ArtifactRelation::References, uri:format!("https://example.invalid/evidence/{index}"), revision:Some("review-7".into()), fragment:Some("assignment".into()) });
     }
-    p.diagrams.insert(id(2), Diagram { id:id(2), alias:"allocation_view".into(), name:format!("{layer:?} allocated work"), description:"Native child-work fixture".into(), layer, projection:ProjectionKind::Allocation, routes:vec![], view_options:Default::default(), nodes:BTreeMap::new() });
+    p.diagrams.insert(id(2), Diagram { id:id(2), alias:"allocation_view".into(), name:format!("{layer:?} allocated work"), description:"Native child-work fixture".into(), layer, projection:ProjectionKind::Allocation, layout:None, routes:vec![], view_options:Default::default(), nodes:BTreeMap::new() });
     for (n,element,x,y,collapsed) in [(40,id(10),60.,60.,false),(41,id(11),84.,124.,true)] {
         p.diagrams.get_mut(&id(2)).unwrap().nodes.insert(id(n), NodePlacement { id:id(n), alias:format!("seed_view_{n}"), element, position:Position{x,y}, size:Size{width:224.,height:94.}, collapsed, port_anchors:vec![] });
     }

harness/experiments/scenario-label-fields-20260913/README.md

@@ -0,0 +1,31 @@
+# Unwired Scenario label field experiment
+
+This experiment starts from `c4a2cf63f11818cf7fc766acf3a2779768a2a658`. Initial extraction is commit `c3ad6f130ba6dda271fe8417db46df29e4033ad8`; the follow-up strengthens its evaluators. Neither version wires `scenario_label` into production. No renderer, App, navigation, source language, or model behavior is adopted here.
+
+The implementation lives in `crates/oa-desktop/src/behavior/scenario_label.rs`, with focused evaluators in `scenario_label/field_tests.rs`. It preserves the winning shaped buffer's cluster advance rectangles and exact scalar source mapping. Returned covered, truncated, and unresolved ranges are distinct; partial retention and shared clusters are explicit. Synthetic ellipsis never represents source text. Missing glyphs, controls/default-ignorables, and absent advance geometry cannot establish affirmative coverage. These are advance/hit rectangles, not ink bounds or proof of actual viewport visibility.
+
+## Follow-up evaluator corrections
+
+The original mixed bidi fixture is Latin-leading. Its glyph embedding levels are mixed, but `LayoutRun::rtl` is false, so it cannot exercise Iced's RTL paragraph alignment branch. Two added cases require a genuinely RTL-leading full and ellipsized paragraph and assert `run.rtl == true`. Their geometry oracle builds a separate Iced Paragraph using the actual displayed string and compares the **complete rectangle set**, rejecting omissions, extras and duplicate output boxes. Explicit source word spans are clipped only against the literal displayed prefix before ellipsis; no candidate retained-source map or cluster snapshot supplies the expected answer. The existing mixed-direction case now uses the same complete-set comparison in addition to its visual-gap checks.
+
+The relevant pinned sources are `iced_graphics 0.14.0/src/text.rs:202–256` (measurement and RTL alignment), `src/text/cache.rs` (winning buffer), and `cosmic-text 0.15.0/src/buffer.rs`/`layout.rs` (actual layout runs and clusters). `iced_widget` is 0.14.2; the graphics package is 0.14.0. Reproduce package inputs through the base commit's Cargo.lock.
+
+## Font and execution limitations
+
+At source 11c605f9170eae461913410f83f333e9314714a5, the isolated harness compiled and its default-test diagnostic reported 21 passed, two failed and two ignored. The intended first listing accidentally executed tests; a later literal listing reported all 25. A separate serial normal run reproduced the same two failures before either reached field_layout: the host font did not meet the tests' exact ffi-cluster preconditions. No actual face identity was captured for those failed cases, so the failure must not be attributed to a guessed family. Parent-owned closed runner receipts are the execution authority; this note does not turn the failed diagnostic into a passing gate.
+
+The correction uses an unmodified, byte-pinned Noto Sans fixture from cosmic-text 0.15.0 for exactly those two tests; see [fixture source, hashes and license](../../../crates/oa-desktop/src/behavior/scenario_label/fixtures/README.md). Standard liga contains the required ffi substitution. Each test verifies the actual Paragraph face bytes and retains its positive nonzero ffi-cluster precondition. The partial-field case compares the complete shared rectangle; the Auto case also requires three initial Basic clusters followed by the actual Advanced final-buffer rectangle set. Neither infers successful geometry merely from a shaping enum.
+
+The two fixture-loading tests are ignored by default because their isolated setup replaces the global font database. Run each as the sole exact test in a fresh process: --ignored --exact <actual-listed-name> --nocapture --test-threads=1. Do not run all ignored tests together. This prevents ordinary/default parallel test execution from invalidating render sessions. Their leaf names are advanced_ligature_partial_field_uses_whole_shared_cluster_not_fraction and auto_ascii_to_ellipsis_advanced_transition_uses_final_buffer. The existing font-load invalidation test remains separately isolated.
+
+Other cases retain installed system-font selection and explicit font/cluster/coverage preconditions. RTL font IDs, PostScript names and family records are diagnostic metadata, not portable content hashes. No new dependency or production font policy is introduced. A missing precondition remains an evaluator/environment finding, not a geometry pass.
+
+After this correction the field module contains ten normal tests and three ignored tests (two isolated ligature cases plus the lookup diagnostic). Across the parent label module the intended inventory remains 25, now 21 normal and four ignored. The corrected source is **UNEXECUTED** at handoff. The parent module remains unwired; ordinary desktop listing does not include it without the isolated evaluator harness. Source review is not compilation or execution evidence.
+
+## Optional bounded lookup diagnostic
+
+Ignored leaf name: `field_lookup_4096_scalars_and_combining_heavy_full_coverage`. Run only this exact test, once an isolated compiled harness exists, with `--ignored --exact <actual-listed-name> --nocapture --test-threads=1`; obtain the qualified name from its real listing. Set `SCENARIO_LABEL_FIELDS_SOURCE_PIN` to the tested commit and separately bind the executable, source and toolchain in the runner receipt.
+
+It measures one resolver call and three full-field lookups for each of two cases: 4,096 ordinary scalars/graphemes, and 4,096 scalars arranged as 1,024 combining-heavy graphemes. Both remain within the existing 64-KiB source/4,096-grapheme experiment budgets. An independent Paragraph warms the font machinery before timing, checks glyph coverage and supplies the complete expected rectangle set. Every lookup must cover the full original source, retain no unresolved/truncated ranges, and match that set exactly; its invariants are checked outside the timed interval.
+
+On success it prints `FIELD_LOOKUP_TIMING_JSON=` with schema `scenario_label_field_lookup_v1`, per-case counts/font identities/resolver nanoseconds/three lookup samples, profile/OS/architecture, optional runner pin, and an explicit passed invariant status. It has no latency threshold and makes no native responsiveness claim. No optimization has been attempted before measurement. The combining case stresses clustered source mapping, while the plain case reaches the existing grapheme budget; neither claims exhaustive worst-case performance over every permitted 64-KiB input.

harness/experiments/scenario-label-lookup-20260913/README.md

@@ -0,0 +1,26 @@
+# Indexed field lookup experiment
+
+This unwired experiment extends source `4c9bc87e4e66bba573dd63b23df5ea039f85d0ca`. It does not adopt measured labels or field navigation in the renderer. This revision has **not been compiled or executed**. The baseline debug diagnostic reported roughly 2.4–6.6 seconds for a 4096-scalar plain field and 1.3–1.9 seconds for a 4096-scalar combining-heavy field; these are motivation, not results for this patch.
+
+`Label` now stores an overlap index built from the winning shaped buffer's clusters and the existing ordered, disjoint normalized scalar spans. For S spans, C clusters, and I actual span/cluster overlap memberships, index construction takes O(C log S + I) work and O(S + C + I) storage. A lookup visits the source spans and their indexed matches, then emits selected cluster rectangles in the original cluster/rectangle order. Hash membership replaces repeated linear rectangle searches. Signed zeros share a deduplication key, as with `Rectangle::PartialEq`, while the first original rectangle's bits remain unchanged. Hash iteration never determines output order.
+
+Per-cluster source end/start extrema preserve the old shared-cluster predicate, including whitespace and nonpainting spans. Source scalar overlap, truncation, missing-glyph and nonpainting precedence, partial/shared flags, invalid-range errors, session/font/zoom guards, and position/overflow rejection are unchanged. No new length limit is introduced. Index storage can be dense for intentionally overlapping synthetic clusters. Existing shaping and `field_clusters` extraction are unchanged, including that extractor's per-cluster linear rectangle deduplication; this is not a claim of globally linear shaping or preparation.
+
+The test-only `Label::original_field_layout` retains the baseline method body verbatim. Four new normal tests compare every `FieldLayout` field and every rectangle's exact component bits and position in the output:
+
+- Real Auto/Advanced shaping at two zooms and three widths, over every legal UTF-8 boundary pair, including scalar boundaries inside combining graphemes.
+- Overlapping, reordered, whitespace-spanning, missing, empty and reversed cluster ranges; partial retention and nonpainting/coverage precedence.
+- First-occurrence signed-zero bits, shared clusters and truncation.
+- Guard/error precedence, malformed fields, nonfinite positions and overflow.
+
+The existing ignored `field_lookup_4096_scalars_and_combining_heavy_full_coverage` diagnostic retains its two inputs and independent Paragraph coverage/rectangle oracle. It now times the original lookup separately, three indexed queries on the retained label, and three fresh-cache resolve-plus-lookup operations. Exact old/new results and independent complete rectangle sets are checked outside timed intervals. The original lookup precedes indexed samples; font caches are warm. These are debug experiment measurements, not a latency guarantee or a cold-process benchmark. Fresh resolution includes index construction so its cost cannot disappear into an unmeasured preprocessing step.
+
+The isolated harness should list 29 tests: 25 normal and four ignored. The production desktop does not register this module. Reuse the explicit dependency-bound harness recipe for the baseline, replacing its source binding with this revision and adding `scenario_label/lookup_tests.rs` to the input closure. Required execution is the normal suite plus these three ignored tests, each in a fresh process:
+
+```text
+scenario_label::field_tests::advanced_ligature_partial_field_uses_whole_shared_cluster_not_fraction
+scenario_label::field_tests::auto_ascii_to_ellipsis_advanced_transition_uses_final_buffer
+scenario_label::tests::actual_font_load_rejects_retained_label_and_old_session
+```
+
+Run the timing diagnostic separately with `--exact scenario_label::field_tests::field_lookup_4096_scalars_and_combining_heavy_full_coverage --ignored --nocapture --test-threads=1`. It remains optional functional-gate evidence; its exact full-coverage assertions are not waived. The new differential filter is `scenario_label::lookup_tests::` (four tests). The pinned-font checks retain their existing isolated-process contract. Other real-shaping differential cases use the current system default font and compare both methods on the same resolved buffer; they do not establish cross-machine glyph identity.

harness/experiments/scenario-label-wgpu-20260913/README.md

@@ -0,0 +1,89 @@
+# Actual WGPU label-ink evaluator — 2026-09-13
+
+Status: **second caller policy authored, not compiled or executed**. The first policy completed an actual Windows WGPU run with eight corridor findings; its raw evidence remains untouched. This revision changes only this harness's caller positioning/width policy and adds backplate-containment checks. The measured-label module, corridor helper and production renderer remain untouched.
+
+## Preserved first-policy result and second-policy question
+
+The parent gate `.local/scenario-label-wgpu-gates-20260913` completed 32 cases with zero invalid controls, eight findings (all italic) and 12 advance-spill cases. Every finding was `outside_corridor_x_plus_one_pixel`; every case had `outside_plate=0` and `blocker_changed_pixels=0`. The actual resolved italic face was Segoe UI Italic. The first-policy source hash was `48236A9A6FD0156A9DB4CAF7520D48F00FE8697202E036B697A03C27632CED95`; its stable executable hash was `BE5B044A974AF61E471D0A887C8DF1DCD73C5CC582AC5E8CCEBCD343D77752E2`. The gate's receipts/manifests bind the exact module and dependency inputs. Parent owns publication; these local paths describe inspected evidence, not a cross-machine handoff.
+
+Independent readback of narrow italic `text.rgba` confirmed the left-side violations: at zoom0.65/DPI1 the true corridor began at physical x60.8125, with one violating pixel in column59; at1/1 it began73.5, with two in column71; at1.75/1 it began100.6875, with seven across96..99; at1/1.5 it began110.25, with five across106..108. All four counts apply the unchanged channel threshold and one-physical-pixel halo. This supports testing reserved internal space; it does not prove a universal three-unit glyph overhang bound.
+
+**Policy 2:** keep the true world corridor at x36.25 with width160 or760, and keep camera, viewport and blocker positions unchanged. Reserve 3 world units on each horizontal side: resolve the label against width154 or754, and paint at x39.25. Grow its backplate by the existing3 horizontal/2 vertical world units. Never grow or shift the true corridor to make the result pass. All 32 strings/styles/zoom/DPI/control combinations remain; narrower displayed prefixes may legitimately change because the available advance budget decreased.
+
+New oracles require the constructed backplate's exact world left/right edges to remain within the true corridor, with no epsilon or clamp, and measure its actual painted yellow pixels against that corridor (strict and one-pixel-halo counts). A world containment failure or painted spill beyond the halo is a candidate finding. The first policy did not test backplate-within-corridor containment; the additional requirement is recorded explicitly instead of rewriting its historical result. Widths at or below the six-unit reserve are outside these 32 probes; no empty-corridor product behavior is selected here.
+
+## Question and competing expectations
+
+Does a single-line label measured by the pinned Iced text allocator fit its proposed painted backplate and horizontal free interval after the actual canvas camera transform? Layout advances are not glyph-ink bounds. Italic bearings, combining marks, fallback fonts, antialiasing and device scaling can falsify containment despite a successful width measurement.
+
+The experiment distinguishes three claims:
+
+1. **Advance-only hypothesis:** every painted pixel lies in the returned layout rectangle. Count strict violations and violations after a one-physical-pixel halo. Violations are evidence, not automatic evaluator failure: the module explicitly does not promise ink containment.
+2. **Candidate padding hypothesis:** adding 3 horizontal / 2 vertical world units to that rectangle contains ink, with a separately reported one-physical-pixel halo. This is an unaccepted probe policy. A violation beyond the halo is a finding, not grounds to silently increase the constant.
+3. **Corridor/blocker hypothesis:** ink does not extend horizontally beyond the fixed true interval plus one physical pixel, the backplate's world edges stay within that interval, its painted pixels remain within the reported halo, and text does not change painted blocker interiors. These are independent probes, not the `widest_clear` algorithm or real Scene membership.
+
+Strict counts remain visible even when the one-pixel halo passes; the halo is an explicit experimental allowance, not proof of zero overlap. Pixel difference threshold is greater than 3 in any 8-bit RGBA channel. We retain raw pixels so weaker ink and alternative tolerances can be investigated without rerendering.
+
+## Actual path and independent controls
+
+`main.rs` imports the existing `scenario_label.rs` using `#[path]`, without copying it and without enabling its test module. It creates an actual `iced::Renderer` through `Headless::new(..., Some("wgpu"))`, creates `canvas::Frame`, applies translation then positive uniform scale, calls the label's `canvas_text` followed by `Frame::fill_text`, records `draw_geometry`, and reads actual RGBA using `Headless::screenshot`. No alternate text renderer, native window, screenshot mock, or hand-drawn glyph is involved.
+
+All 32 cases are evaluated in one dedicated executable process. Global fonts initialize before a fresh renderer and `RenderSession`; no font mutation is allowed until process exit. Each frame resets renderer geometry while retaining its genuine WGPU caches. Cases cover:
+
+- A realistic existing scenario-style call label, CJK, decomposed combining marks, and an italic label beginning with `jfj`.
+- True corridor widths160 and760 world units, giving policy2 text budgets154 and754. The wide case must preserve the explicit full source; the narrow case must show an ellipsis and retain a nonempty proper source prefix.
+- `(zoom, DPI)` of `(0.65,1)`, `(1,1)`, `(1.75,1)`, `(1,1.5)`. Fractional camera translation and text origins exercise subpixel positioning.
+
+The independently constructed `canvas::Text` control must paint the same pixels as the guarded payload. A second actual Frame shifts camera translation by exactly 16 physical pixels; its pixels must equal the original shifted by 16. These checks can reveal wrong coordinate assumptions before any ink conclusion. The viewport has generous right/bottom margin; any observed ink touching its boundary invalidates the probe because clipping may have hidden overhang.
+
+Text-only pixels against white provide the ink mask. A separate decoration render contains yellow backplate then blue blocker rectangles. A composite adds actual text. Actual opaque blue interior pixels must remain unchanged. Because the blockers are painted after the backplate, this specifically evaluates foreground text interference; it does not infer that every antialiased blocker border remains untouched. Policy2 separately tests backplate world containment and actual yellow plate pixels, including attenuated antialiased edges. Its fixed blockers begin4 world units outside the true corridor; the maximum backplate may reach the corridor boundary but cannot consume that clearance.
+
+Actual shaped glyph IDs and resolved font faces are recorded as a **coverage gate only**. Glyph ID zero, no glyphs, or no resolved italic/oblique face for the italic case invalidates that case. CJK missing-font boxes cannot count as CJK acceptance. The inspected shaping buffer does not supply the ink bounds. System fonts may differ across machines; face identities/families/styles are recorded, but this is not a portable pixel-golden suite or a complete font-file provenance recorder. Pin and hash relevant system font files for a cross-machine comparison.
+
+## Build and run: integration owner only
+
+No Cargo or new crate dependencies are required. Compile a normal executable, **not `rustc --test`**, against the exact already-built Iced 0.14.0 and unicode-segmentation artifacts, plus their matching transitive dependency directory. The active Iced artifact must have WGPU, canvas and advanced enabled; tiny-skia fallback is not accepted by this harness. This imports the real candidate but does not wire it into desktop production.
+
+Equivalent raw invocation, substituting actual absolute paths:
+
+```powershell
+& $rustc --edition=2024 --crate-name scenario_label_wgpu --crate-type bin `
+  -C debuginfo=0 -C "linker=$clang" -L "dependency=$deps" -L "native=$nativeLibs" `
+  --extern "iced=$icedRlib" --extern "unicode_segmentation=$unicodeRlib" `
+  $mainRs -o $newExecutable
+& $newExecutable $newPixelDirectory
+```
+
+`build-and-run.ps1` accepts those paths explicitly and refuses an existing run directory. It hashes the resolved compiler, linker, direct libraries and source inputs, and passes the resolved linker path through `-C linker=...`. For Windows gnullvm, initialize the parent's existing `.local/toolchain/env.ps1`, resolve `$clang = (Get-Command clang.exe).Source`, and set `$nativeLibs` to the repository's `.local/toolchain/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/windows_x86_64_gnullvm-0.52.6/lib`. This exact native search directory and `linker=clang.exe` appear in the successful parent `.local/scenario-label-gates-attempt4-20260913/compile-receipt.json` (rustc 1.98.1, x86_64-pc-windows-gnullvm). That prior module gate is linkage evidence, not an executed result for this WGPU harness.
+
+The runner records the complete recursively enumerated Rust link/metadata artifact set (`.rlib`, `.rmeta`, `.dll`, `.lib`, `.a`, `.o`, `.obj`) in the supplied dependency directory and every file in the explicit native directory. It rehashes and compares both manifests after linking, detecting additions, removals or changed content. It separately rechecks source/direct-library/compiler/linker inputs before running. These are artifact supersets, not assertions that every file was linked. It hashes the executable before and after its fresh-process run and preserves an output manifest of generated logs, receipts, executable, metrics and images, including nonzero evaluator outcomes.
+
+The successful attempt4 used Iced `ee73abd722c72024` and unicode-segmentation `85698043f7780858`. Another Iced artifact `a4e48b220c5d9711` also exists; use the matching tested dependency set rather than treating them as interchangeable. Required runtime DLL paths and a working WGPU adapter remain prerequisites. Adapter/device creation failure is an infrastructure failure, never an ignored pass.
+
+```powershell
+& ./build-and-run.ps1 -Rustc $rustc -IcedRlib $icedRlib `
+  -UnicodeSegmentationRlib $unicodeRlib -DependencyDirectory $deps `
+  -Linker $clang -NativeLibraryDirectory $nativeLibs `
+  -NewRunDirectory $freshRun
+```
+
+The script completed the first-policy build/run described above and requires PowerShell7 (`Path.GetRelativePath`). The second-policy Rust revision remains uncompiled/unexecuted. Select a NEW run directory; never reuse the first raw gate. Compile/run only after acquiring the parent's sole compiler/GPU resource. Before/after hashes do not detect a file temporarily changed and restored during linking; exclusive input ownership remains required. This is not a hermetic toolchain capture: implicitly searched system SDK libraries, clang's auxiliary executables/DLLs, runtime dependencies, system fonts and GPU drivers outside the explicit directories are not all hashed. Preserve that environment separately. The renderer exposes the backend name `wgpu`, not complete adapter identity through `Headless`; retain driver/backend logs and hardware identity separately. `WGPU_BACKEND` is recorded if set. Do not infer native acceptance from this offscreen run.
+
+## Artifacts and interpretation
+
+Each case writes `metrics.txt` with source/display/prefix, font faces, coordinates, ink pixel bounding box/counts, control differences and findings. It writes `text`, `decoration` and `composite` as both tightly packed, top-to-bottom RGBA8 `.rgba` and standard P6 `.ppm`. Width/height are in `metrics.txt` and the PPM header. Failed controls also preserve their rendered pixels. No image conversion participates in the oracle. These are real WGPU readbacks; inspect the PPMs or convert the preserved pixels for review after the numeric run.
+
+Exit 0 means exactly 32 valid probes without a candidate-padding/corridor finding. Exit 2 means a candidate finding. Exit 3 means a coverage or control failure makes at least one probe invalid. Panic, missing summary or fewer than 32 cases is nonacceptance. Every completed run writes `summary.txt`; preserve failures before changing source. Report exact source, executable, artifact and environment provenance alongside any finding. A positive result supports only the specified strings/fonts/scales/padding; no universal raster containment claim follows.
+
+This is intentionally smaller than Scene integration: no parsed model, occurrence/navigation hit testing, old renderer comparison, real activation/frame paint ordering, self-call or reversed-message corridor selection, clipping near viewport edges, rotation, wrapping, row-height policy, gesture performance, dynamic font replacement, or native user workflow is accepted. Those remain integration evaluators. A finding here should refine the shared measured-label/ink-clearance contract before production callers are added.
+
+## Pinned primary API evidence
+
+Registry source root is the repository-local `.local/toolchain/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/` (outside this worktree):
+
+- `iced_core-0.14.0/src/renderer.rs`: `Headless::new`, `name`, `screenshot` explicitly return RGBA; `Renderer::reset` resets the frame.
+- `iced_wgpu-0.14.0/src/lib.rs:912`: headless creation uses WGPU's actual adapter/device, RGBA render target and MSAAx4; screenshot uses a physical viewport and supplied DPI.
+- `iced_wgpu-0.14.0/src/geometry.rs:306`: positive uniform-scale `fill_text` transforms the position, scales font size/absolute line height, and emits `Text::Cached`. Nonuniform/rotated vector fallback is outside this experiment.
+- `iced_widget-0.14.2/src/canvas.rs`: canvas draws generated geometry through `geometry::Renderer::draw_geometry`.
+- `iced_graphics-0.14.0/src/text/cache.rs`: glyph coverage introspection uses the actual allocator's buffer and resolved fonts. Its metrics are not substituted for screenshots.
+- Current desktop `behavior.rs:2158` translates the camera then scales its actual Frame. This evaluator preserves that order without claiming to import the whole Scene.

harness/experiments/scenario-label-wgpu-20260913/build-and-run.ps1

@@ -0,0 +1,109 @@
+param(
+    [Parameter(Mandatory = $true)][string]$Rustc,
+    [Parameter(Mandatory = $true)][string]$IcedRlib,
+    [Parameter(Mandatory = $true)][string]$UnicodeSegmentationRlib,
+    [Parameter(Mandatory = $true)][string]$DependencyDirectory,
+    [Parameter(Mandatory = $true)][string]$Linker,
+    [Parameter(Mandatory = $true)][string]$NativeLibraryDirectory,
+    [Parameter(Mandatory = $true)][string]$NewRunDirectory
+)
+$ErrorActionPreference = 'Stop'
+# Only the integration owner may invoke this while holding the compiler/GPU gate.
+# No Cargo, dependency fetching, source mutation or existing output replacement.
+$labelRustc = (Resolve-Path -LiteralPath $Rustc).Path
+$labelIced = (Resolve-Path -LiteralPath $IcedRlib).Path
+$labelUnicode = (Resolve-Path -LiteralPath $UnicodeSegmentationRlib).Path
+$labelDeps = (Resolve-Path -LiteralPath $DependencyDirectory).Path
+$labelLinker = (Resolve-Path -LiteralPath $Linker).Path
+$labelNative = (Resolve-Path -LiteralPath $NativeLibraryDirectory).Path
+$labelRun = [IO.Path]::GetFullPath($NewRunDirectory)
+if (Test-Path -LiteralPath $labelRun) { throw 'Run directory already exists; preserve it and select a new path.' }
+$labelMain = Join-Path $PSScriptRoot 'main.rs'
+$labelModule = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '../../../crates/oa-desktop/src/behavior/scenario_label.rs'))
+$labelScript = Join-Path $PSScriptRoot 'build-and-run.ps1'
+New-Item -ItemType Directory -Path $labelRun | Out-Null
+$labelExe = Join-Path $labelRun 'scenario-label-wgpu.exe'
+$labelArguments = @(
+    '--edition=2024', '--crate-name', 'scenario_label_wgpu', '--crate-type', 'bin',
+    '-C', 'debuginfo=0', '-L', ('dependency=' + $labelDeps),
+    '-C', ('linker=' + $labelLinker), '-L', ('native=' + $labelNative),
+    '--extern', ('iced=' + $labelIced),
+    '--extern', ('unicode_segmentation=' + $labelUnicode),
+    $labelMain, '-o', $labelExe
+)
+$labelInputs = @($labelRustc, $labelLinker, $labelIced, $labelUnicode, $labelMain, $labelModule, $labelScript) | ForEach-Object {
+    $labelHash = Get-FileHash -LiteralPath $_ -Algorithm SHA256
+    [ordered]@{ path = $_; sha256 = $labelHash.Hash }
+}
+function Get-LabelArtifactManifest([string]$Directory, [switch]$AllFiles) {
+    Get-ChildItem -LiteralPath $Directory -File -Recurse | Where-Object {
+        $AllFiles -or $_.Extension -in @('.rlib', '.rmeta', '.dll', '.lib', '.a', '.o', '.obj')
+    } | Sort-Object FullName | ForEach-Object {
+        [ordered]@{
+            path = [IO.Path]::GetRelativePath($Directory, $_.FullName)
+            bytes = $_.Length
+            sha256 = (Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256).Hash
+        }
+    }
+}
+# Supersets of Rust link/metadata artifacts and all explicit native-dir inputs,
+# not a claim that every inventoried artifact is actually linked.
+$labelDependencyManifest = @(Get-LabelArtifactManifest $labelDeps)
+$labelNativeManifest = @(Get-LabelArtifactManifest $labelNative -AllFiles)
+if ($labelDependencyManifest.Count -eq 0 -or $labelNativeManifest.Count -eq 0) { throw 'Empty dependency or native-library directory.' }
+ConvertTo-Json -InputObject $labelDependencyManifest -Depth 4 | Set-Content -LiteralPath (Join-Path $labelRun 'dependency-artifacts-before.json') -Encoding utf8
+ConvertTo-Json -InputObject $labelNativeManifest -Depth 4 | Set-Content -LiteralPath (Join-Path $labelRun 'native-artifacts-before.json') -Encoding utf8
+$labelRecord = [ordered]@{
+    scope = 'Standalone actual WGPU canvas label evaluator; not desktop Scene/native acceptance'
+    startedUtc = [DateTime]::UtcNow.ToString('o')
+    os = [Environment]::OSVersion.ToString()
+    rustc = (& $labelRustc --version --verbose | Out-String)
+    arguments = $labelArguments
+    inputs = $labelInputs
+    dependencyDirectory = $labelDeps
+    nativeLibraryDirectory = $labelNative
+    WGPU_BACKEND = $env:WGPU_BACKEND
+    WGPU_ADAPTER_NAME = $env:WGPU_ADAPTER_NAME
+}
+$labelRecord | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath (Join-Path $labelRun 'inputs.json') -Encoding utf8
+& $labelRustc @labelArguments 2>&1 | Tee-Object -FilePath (Join-Path $labelRun 'build.log')
+$labelBuildExit = $LASTEXITCODE
+$labelDependenciesAfter = @(Get-LabelArtifactManifest $labelDeps)
+$labelNativeAfter = @(Get-LabelArtifactManifest $labelNative -AllFiles)
+ConvertTo-Json -InputObject $labelDependenciesAfter -Depth 4 | Set-Content -LiteralPath (Join-Path $labelRun 'dependency-artifacts-after.json') -Encoding utf8
+ConvertTo-Json -InputObject $labelNativeAfter -Depth 4 | Set-Content -LiteralPath (Join-Path $labelRun 'native-artifacts-after.json') -Encoding utf8
+$labelDependenciesStable = (ConvertTo-Json -InputObject $labelDependencyManifest -Depth 4 -Compress) -ceq (ConvertTo-Json -InputObject $labelDependenciesAfter -Depth 4 -Compress)
+$labelNativeStable = (ConvertTo-Json -InputObject $labelNativeManifest -Depth 4 -Compress) -ceq (ConvertTo-Json -InputObject $labelNativeAfter -Depth 4 -Compress)
+[ordered]@{
+    exit = $labelBuildExit; dependencyManifestStable = $labelDependenciesStable
+    nativeManifestStable = $labelNativeStable; endedUtc = [DateTime]::UtcNow.ToString('o')
+} | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $labelRun 'compile-receipt.json') -Encoding utf8
+if ($labelBuildExit -ne 0) { throw "Compilation failed with exit $labelBuildExit; this run is nonacceptance." }
+if (!$labelDependenciesStable -or !$labelNativeStable) { throw 'Dependency/native inputs changed during linking; preserve this run as nonacceptance.' }
+foreach ($labelInput in $labelInputs) {
+    if ((Get-FileHash -LiteralPath $labelInput.path -Algorithm SHA256).Hash -ne $labelInput.sha256) {
+        throw ('Input changed during compilation: ' + $labelInput.path)
+    }
+}
+$labelExeHash = (Get-FileHash -LiteralPath $labelExe -Algorithm SHA256).Hash
+$labelOutput = Join-Path $labelRun 'pixels'
+# A single NEW process owns initialization, settled fonts, renderer and all cases.
+& $labelExe $labelOutput 2>&1 | Tee-Object -FilePath (Join-Path $labelRun 'run.log')
+$labelRunExit = $LASTEXITCODE
+$labelExeAfterHash = (Get-FileHash -LiteralPath $labelExe -Algorithm SHA256).Hash
+$labelReceipt = [ordered]@{
+    executable = $labelExe; sha256Before = $labelExeHash; sha256After = $labelExeAfterHash
+    binaryStable = ($labelExeHash -ceq $labelExeAfterHash); exit = $labelRunExit
+    endedUtc = [DateTime]::UtcNow.ToString('o')
+    interpretation = '0=32 valid probes without candidate findings; 2=padding/corridor finding; 3=invalid coverage/contract probe; other=infrastructure/panic'
+}
+$labelReceipt | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath (Join-Path $labelRun 'receipt.json') -Encoding utf8
+# Capture all produced evidence, even for exit 2/3 or a missing summary. The
+# manifest itself is excluded naturally because it does not exist until written.
+$labelOutputManifest = @(Get-LabelArtifactManifest $labelRun -AllFiles)
+ConvertTo-Json -InputObject $labelOutputManifest -Depth 4 | Set-Content -LiteralPath (Join-Path $labelRun 'output-artifacts.json') -Encoding utf8
+if ($labelExeHash -cne $labelExeAfterHash) { throw 'Executable changed during execution; this run is nonacceptance.' }
+$labelSummary = Join-Path $labelOutput 'summary.txt'
+if (!(Test-Path -LiteralPath $labelSummary)) { throw 'No complete summary: infrastructure failure or panic, not acceptance.' }
+if ((Get-Content -LiteralPath $labelSummary -Raw) -notmatch '(?m)^cases=32\r?$') { throw 'Expected exactly 32 completed cases.' }
+if ($labelRunExit -ne 0) { throw "Evaluator exit $labelRunExit. Preserve metrics/images; diagnose before changing the candidate." }

harness/experiments/scenario-label-wgpu-20260913/main.rs

@@ -0,0 +1,565 @@
+//! Standalone offscreen evaluator; deliberately compiled WITHOUT --test.
+//! Imports the actual candidate, never a copy of its shaping or truncation code.
+#[path = "../../../crates/oa-desktop/src/behavior/scenario_label.rs"]
+mod scenario_label;
+
+use iced::advanced::{
+    graphics::{geometry::Renderer as _, text as graphics_text},
+    renderer::{Headless, Renderer as _},
+    text::{Alignment, LineHeight, Shaping},
+};
+use iced::{Color, Font, Pixels, Point, Rectangle, Size, Vector, widget::canvas};
+use scenario_label::{Cache, Label, RenderSession, Style};
+use std::{collections::BTreeSet, fmt::Write as _, fs, future::Future, path::Path, sync::Arc};
+
+const PAN: Vector = Vector::new(37.25, 23.5);
+// POSITION remains the TRUE corridor origin, unchanged from empirical policy 1.
+const POSITION: Point = Point::new(36.25, 40.5);
+const PIXEL_DELTA: u8 = 3;
+const HORIZONTAL_INSET: f32 = 3.;
+const POLICY: &str = "2-fixed-corridor-inset-3-world-units";
+
+struct Case {
+    name: &'static str,
+    source: &'static str,
+    style: Style,
+    require_italic: bool,
+}
+
+fn cases() -> [Case; 4] {
+    let advanced = Style {
+        shaping: Shaping::Advanced,
+        ..Style::default()
+    };
+    [
+        Case {
+            name: "realistic-default",
+            source: "1. call · Request valve repair · Technician service conversation",
+            style: Style::default(),
+            require_italic: false,
+        },
+        Case {
+            name: "cjk-advanced",
+            source: "2. call · 请求阀门维修并确认压力传感器状态 · 技术人员服务会话",
+            style: advanced,
+            require_italic: false,
+        },
+        Case {
+            name: "combining-advanced",
+            source: "3. call · A\u{0301}\u{0323}larm e\u{0301}valuation · verify technician's pressure-report acknowledgement",
+            style: advanced,
+            require_italic: false,
+        },
+        Case {
+            name: "italic-advanced",
+            source: "jfj · Verify valve qualification, pressure relief and technician signoff",
+            style: Style {
+                font: Font {
+                    style: iced::font::Style::Italic,
+                    ..Font::DEFAULT
+                },
+                ..advanced
+            },
+            require_italic: true,
+        },
+    ]
+}
+
+// No runtime or test-suite global executor: this executable owns the GPU/font
+// process. WGPU's adapter/device futures provide their normal wake notifications.
+fn block_on<T>(future: impl Future<Output = T>) -> T {
+    struct WakeThread(std::thread::Thread);
+    impl std::task::Wake for WakeThread {
+        fn wake(self: Arc<Self>) {
+            self.0.unpark();
+        }
+        fn wake_by_ref(self: &Arc<Self>) {
+            self.0.unpark();
+        }
+    }
+    let waker = std::task::Waker::from(Arc::new(WakeThread(std::thread::current())));
+    let mut context = std::task::Context::from_waker(&waker);
+    let mut future = std::pin::pin!(future);
+    loop {
+        match future.as_mut().poll(&mut context) {
+            std::task::Poll::Ready(value) => return value,
+            std::task::Poll::Pending => std::thread::park(),
+        }
+    }
+}
+
+#[derive(Clone, Copy)]
+enum Pass {
+    Text,
+    ManualText,
+    Decoration,
+    Composite,
+}
+
+struct Surface {
+    logical: Size,
+    physical: Size<u32>,
+    dpi: f32,
+    zoom: f32,
+    text_position: Point,
+    advance: Rectangle,
+    plate: Rectangle,
+    corridor: Rectangle,
+    blockers: [Rectangle; 2],
+}
+
+impl Surface {
+    fn new(label: &Label, session: &RenderSession, zoom: f32, dpi: f32, width: f32) -> Self {
+        let text_position = Point::new(POSITION.x + HORIZONTAL_INSET, POSITION.y);
+        let advance = label.bounds_at(session, zoom, text_position).unwrap();
+        // Explicit EXPERIMENT candidate: 3 horizontal / 2 vertical world units.
+        // It is not an accepted production padding or an assertion about ink.
+        let plate = grow(advance, HORIZONTAL_INSET, 2.);
+        // Do not derive corridor.x from the shifted text or widen the corridor
+        // to excuse overhang. Its original origin/width and blockers stay fixed.
+        let corridor = Rectangle {
+            x: POSITION.x,
+            width,
+            ..advance
+        };
+        let blockers = [
+            Rectangle {
+                x: POSITION.x - 12.,
+                y: POSITION.y - 12.,
+                width: 8.,
+                height: 52.,
+            },
+            Rectangle {
+                x: POSITION.x + width + 4.,
+                y: POSITION.y - 12.,
+                width: 8.,
+                height: 52.,
+            },
+        ];
+        let physical = Size::new(
+            ((PAN.x + (POSITION.x + width + 70.) * zoom) * dpi).ceil() as u32,
+            ((PAN.y + (POSITION.y + 90.) * zoom) * dpi).ceil() as u32,
+        );
+        let logical = Size::new(physical.width as f32 / dpi, physical.height as f32 / dpi);
+        Self {
+            logical,
+            physical,
+            dpi,
+            zoom,
+            text_position,
+            advance,
+            plate,
+            corridor,
+            blockers,
+        }
+    }
+
+    fn pixels(&self, rect: Rectangle) -> Rectangle {
+        Rectangle {
+            x: (PAN.x + rect.x * self.zoom) * self.dpi,
+            y: (PAN.y + rect.y * self.zoom) * self.dpi,
+            width: rect.width * self.zoom * self.dpi,
+            height: rect.height * self.zoom * self.dpi,
+        }
+    }
+}
+
+fn grow(rect: Rectangle, x: f32, y: f32) -> Rectangle {
+    Rectangle {
+        x: rect.x - x,
+        y: rect.y - y,
+        width: rect.width + 2. * x,
+        height: rect.height + 2. * y,
+    }
+}
+
+fn render(
+    renderer: &mut iced::Renderer,
+    surface: &Surface,
+    label: &Label,
+    session: &RenderSession,
+    style: Style,
+    pass: Pass,
+    pixel_shift: f32,
+) -> Vec<u8> {
+    renderer.reset(Rectangle::with_size(surface.logical));
+    let mut frame = canvas::Frame::new(renderer, surface.logical);
+    // Same order as actual scenario Frame: camera translation, then uniform scale.
+    // The extra translation is only the independent integer-pixel shift oracle.
+    frame.translate(Vector::new(PAN.x + pixel_shift / surface.dpi, PAN.y));
+    frame.scale(surface.zoom);
+    if matches!(pass, Pass::Decoration | Pass::Composite) {
+        frame.fill_rectangle(
+            surface.plate.position(),
+            surface.plate.size(),
+            Color::from_rgb8(255, 230, 120),
+        );
+        // Backplate precedes activation-like blockers; text remains foreground.
+        // These are probes, not imported Scene activations or a corridor planner.
+        for blocker in surface.blockers {
+            frame.fill_rectangle(
+                blocker.position(),
+                blocker.size(),
+                Color::from_rgb8(0, 40, 255),
+            );
+        }
+    }
+    if !matches!(pass, Pass::Decoration) {
+        let text = if matches!(pass, Pass::ManualText) {
+            // Independently construct the documented paint payload. Both paths
+            // use actual Frame::fill_text; no alternate renderer is involved.
+            canvas::Text {
+                content: label.displayed(session, surface.zoom).unwrap().to_owned(),
+                position: surface.text_position,
+                color: Color::BLACK,
+                size: style.size,
+                line_height: style.line_height,
+                font: style.font,
+                shaping: style.shaping,
+                max_width: f32::INFINITY,
+                ..canvas::Text::default()
+            }
+        } else {
+            label
+                .canvas_text(session, surface.zoom, surface.text_position, Color::BLACK)
+                .unwrap()
+        };
+        frame.fill_text(text);
+    }
+    renderer.draw_geometry(frame.into_geometry());
+    let pixels = Headless::screenshot(renderer, surface.physical, surface.dpi, Color::WHITE);
+    assert_eq!(
+        pixels.len(),
+        surface.physical.width as usize * surface.physical.height as usize * 4
+    );
+    pixels
+}
+
+fn differs(a: &[u8], b: &[u8]) -> bool {
+    a.iter().zip(b).any(|(&a, &b)| a.abs_diff(b) > PIXEL_DELTA)
+}
+
+fn inside(rect: Rectangle, x: usize, y: usize) -> bool {
+    let x = x as f32 + 0.5;
+    let y = y as f32 + 0.5;
+    x >= rect.x && x < rect.x + rect.width && y >= rect.y && y < rect.y + rect.height
+}
+
+#[derive(Default, Debug)]
+struct Ink {
+    count: usize,
+    bounds: Option<(usize, usize, usize, usize)>,
+    outside_advance: usize,
+    outside_advance_plus_one_pixel: usize,
+    outside_plate: usize,
+    outside_plate_plus_one_pixel: usize,
+    outside_corridor_x_plus_one_pixel: usize,
+    touches_viewport: usize,
+}
+
+fn ink(pixels: &[u8], surface: &Surface) -> Ink {
+    let advance = surface.pixels(surface.advance);
+    let plate = surface.pixels(surface.plate);
+    let corridor = surface.pixels(surface.corridor);
+    let mut out = Ink::default();
+    for (i, rgba) in pixels.chunks_exact(4).enumerate() {
+        if !differs(rgba, &[255, 255, 255, 255]) {
+            continue;
+        }
+        let (x, y) = (
+            i % surface.physical.width as usize,
+            i / surface.physical.width as usize,
+        );
+        out.count += 1;
+        out.bounds = Some(match out.bounds {
+            None => (x, y, x + 1, y + 1),
+            Some((l, t, r, b)) => (l.min(x), t.min(y), r.max(x + 1), b.max(y + 1)),
+        });
+        out.outside_advance += usize::from(!inside(advance, x, y));
+        out.outside_advance_plus_one_pixel += usize::from(!inside(grow(advance, 1., 1.), x, y));
+        out.outside_plate += usize::from(!inside(plate, x, y));
+        out.outside_plate_plus_one_pixel += usize::from(!inside(grow(plate, 1., 1.), x, y));
+        let px = x as f32 + 0.5;
+        out.outside_corridor_x_plus_one_pixel +=
+            usize::from(px < corridor.x - 1. || px >= corridor.x + corridor.width + 1.);
+        out.touches_viewport += usize::from(
+            x == 0
+                || y == 0
+                || x + 1 == surface.physical.width as usize
+                || y + 1 == surface.physical.height as usize,
+        );
+    }
+    out
+}
+
+// Independent inspection of the actual shaped glyphs is ONLY a coverage gate:
+// metrics from this buffer do not serve as the painted-ink oracle.
+fn font_coverage(
+    displayed: &str,
+    style: Style,
+    zoom: f32,
+) -> (usize, usize, bool, BTreeSet<String>) {
+    let size = Pixels(style.size.0 * zoom);
+    let line_height = match style.line_height {
+        LineHeight::Absolute(value) => value.0 * zoom,
+        LineHeight::Relative(value) => value * size.0,
+    };
+    let mut fonts = graphics_text::font_system().write().unwrap();
+    let mut shapes = graphics_text::Cache::new();
+    let (_, entry) = shapes.allocate(
+        fonts.raw(),
+        graphics_text::cache::Key {
+            content: displayed,
+            size: size.0,
+            line_height,
+            font: style.font,
+            bounds: Size::INFINITE,
+            shaping: style.shaping,
+            align_x: Alignment::Default,
+        },
+    );
+    let (mut glyphs, mut missing, mut italic) = (0, 0, false);
+    let mut faces = BTreeSet::new();
+    for run in entry.buffer.layout_runs() {
+        for glyph in run.glyphs {
+            glyphs += 1;
+            missing += usize::from(glyph.glyph_id == 0);
+            if let Some(face) = fonts.raw().db().face(glyph.font_id) {
+                italic |= face.style != graphics_text::cosmic_text::fontdb::Style::Normal;
+                faces.insert(format!(
+                    "{:?} {:?} {:?}",
+                    glyph.font_id, face.families, face.style
+                ));
+            }
+        }
+    }
+    (glyphs, missing, italic, faces)
+}
+
+fn save_pixels(dir: &Path, name: &str, pixels: &[u8], size: Size<u32>) {
+    fs::write(dir.join(format!("{name}.rgba")), pixels).unwrap();
+    // Standard portable pixmap for immediate image inspection, no image crate.
+    let mut ppm = format!("P6\n{} {}\n255\n", size.width, size.height).into_bytes();
+    for pixel in pixels.chunks_exact(4) {
+        ppm.extend_from_slice(&pixel[..3]);
+    }
+    fs::write(dir.join(format!("{name}.ppm")), ppm).unwrap();
+}
+
+fn evaluate(
+    renderer: &mut iced::Renderer,
+    session: &RenderSession,
+    case: &Case,
+    zoom: f32,
+    dpi: f32,
+    width: f32,
+    dir: &Path,
+) -> (usize, usize, bool) {
+    fs::create_dir(dir).unwrap();
+    let mut cache = Cache::default();
+    let text_budget = width - 2. * HORIZONTAL_INSET;
+    assert!(
+        text_budget > 0.,
+        "these 32 probes require a positive inset text budget"
+    );
+    let label = cache
+        .resolve(session, case.source, text_budget, zoom, case.style)
+        .unwrap();
+    let displayed = label.displayed(session, zoom).unwrap();
+    let retained = label.retained_source(session, zoom).unwrap();
+    let surface = Surface::new(&label, session, zoom, dpi, width);
+    let text = render(
+        renderer,
+        &surface,
+        &label,
+        session,
+        case.style,
+        Pass::Text,
+        0.,
+    );
+    let manual = render(
+        renderer,
+        &surface,
+        &label,
+        session,
+        case.style,
+        Pass::ManualText,
+        0.,
+    );
+    let moved = render(
+        renderer,
+        &surface,
+        &label,
+        session,
+        case.style,
+        Pass::Text,
+        16.,
+    );
+    let decoration = render(
+        renderer,
+        &surface,
+        &label,
+        session,
+        case.style,
+        Pass::Decoration,
+        0.,
+    );
+    let composite = render(
+        renderer,
+        &surface,
+        &label,
+        session,
+        case.style,
+        Pass::Composite,
+        0.,
+    );
+    let measured_ink = ink(&text, &surface);
+    let (glyphs, missing, italic, faces) = font_coverage(displayed, case.style, zoom);
+    let payload_mismatch = text
+        .chunks_exact(4)
+        .zip(manual.chunks_exact(4))
+        .filter(|(a, b)| differs(a, b))
+        .count();
+    let mut translation_mismatch = 0;
+    let mut blocker_changed = 0;
+    let mut blocker_samples = 0;
+    let plate_inside_corridor_x = surface.plate.x >= surface.corridor.x
+        && surface.plate.x + surface.plate.width <= surface.corridor.x + surface.corridor.width;
+    let corridor_pixels = surface.pixels(surface.corridor);
+    let mut painted_plate_samples = 0;
+    let mut painted_plate_outside_corridor_x = 0;
+    let mut painted_plate_outside_corridor_x_plus_one_pixel = 0;
+    for (i, rgba) in moved.chunks_exact(4).enumerate() {
+        let x = i % surface.physical.width as usize;
+        let expected = if x >= 16 {
+            &text[(i - 16) * 4..(i - 16) * 4 + 4]
+        } else {
+            &[255, 255, 255, 255]
+        };
+        translation_mismatch += usize::from(differs(rgba, expected));
+    }
+    for (i, (before, after)) in decoration
+        .chunks_exact(4)
+        .zip(composite.chunks_exact(4))
+        .enumerate()
+    {
+        // Sample actual opaque blue blocker interiors, not a guessed screen box.
+        if before[0] < 8 && before[1] < 60 && before[2] > 245 {
+            blocker_samples += 1;
+            blocker_changed += usize::from(differs(before, after));
+        }
+        // Yellow plate over white has full red and attenuated blue. This mask
+        // also includes weak antialiased plate edges; blue blockers cannot match.
+        if before[0] > 247 && before[2] < 252 {
+            painted_plate_samples += 1;
+            let x = (i % surface.physical.width as usize) as f32 + 0.5;
+            painted_plate_outside_corridor_x += usize::from(
+                x < corridor_pixels.x || x >= corridor_pixels.x + corridor_pixels.width,
+            );
+            painted_plate_outside_corridor_x_plus_one_pixel += usize::from(
+                x < corridor_pixels.x - 1. || x >= corridor_pixels.x + corridor_pixels.width + 1.,
+            );
+        }
+    }
+    let source_expectation = if width > 500. {
+        displayed == case.source && retained == (0..case.source.len())
+    } else {
+        displayed.ends_with('…') && retained.end < case.source.len() && retained.end > 0
+    };
+    // Infrastructure/contract failures differ from geometric candidate findings.
+    let invalid = usize::from(!source_expectation)
+        + usize::from(glyphs == 0 || missing > 0 || (case.require_italic && !italic))
+        + usize::from(measured_ink.count == 0 || measured_ink.touches_viewport > 0)
+        + usize::from(
+            payload_mismatch > 0
+                || translation_mismatch > 0
+                || blocker_samples == 0
+                || painted_plate_samples == 0,
+        );
+    let finding = usize::from(measured_ink.outside_plate_plus_one_pixel > 0)
+        + usize::from(measured_ink.outside_corridor_x_plus_one_pixel > 0)
+        + usize::from(blocker_changed > 0)
+        + usize::from(!plate_inside_corridor_x)
+        + usize::from(painted_plate_outside_corridor_x_plus_one_pixel > 0);
+    let mut report = format!(
+        "policy={POLICY}\nsource={:?}\ndisplayed={displayed:?}\nretained={retained:?}\nstyle={:?}\nzoom={zoom}\ndpi={dpi}\nwidth={width}\ntext_budget={text_budget}\nhorizontal_inset={HORIZONTAL_INSET}\nphysical={:?}\nadvance_world={:?}\nplate_world={:?}\nblockers_world={:?}\nink={measured_ink:#?}\nglyphs={glyphs}\nmissing_glyphs={missing}\nresolved_italic={italic}\npayload_mismatch_pixels={payload_mismatch}\ntranslation_mismatch_pixels={translation_mismatch}\nblocker_samples={blocker_samples}\nblocker_changed_pixels={blocker_changed}\nplate_inside_corridor_x={plate_inside_corridor_x}\npainted_plate_samples={painted_plate_samples}\npainted_plate_outside_corridor_x={painted_plate_outside_corridor_x}\npainted_plate_outside_corridor_x_plus_one_pixel={painted_plate_outside_corridor_x_plus_one_pixel}\ninvalid_checks={invalid}\ncandidate_findings={finding}\n",
+        case.source, case.style, surface.physical, surface.advance, surface.plate, surface.blockers,
+    );
+    writeln!(
+        &mut report,
+        "corridor_world={:?}\ntext_position={:?}",
+        surface.corridor, surface.text_position
+    )
+    .unwrap();
+    for face in faces {
+        writeln!(&mut report, "resolved_face={face}").unwrap();
+    }
+    fs::write(dir.join("metrics.txt"), report).unwrap();
+    for (name, pixels) in [
+        ("text", &text),
+        ("decoration", &decoration),
+        ("composite", &composite),
+    ] {
+        save_pixels(dir, name, pixels, surface.physical);
+    }
+    if payload_mismatch > 0 {
+        save_pixels(dir, "manual-control", &manual, surface.physical);
+    }
+    if translation_mismatch > 0 {
+        save_pixels(dir, "shift-control", &moved, surface.physical);
+    }
+    (invalid, finding, measured_ink.outside_advance > 0)
+}
+
+fn main() {
+    let args: Vec<_> = std::env::args_os().collect();
+    assert_eq!(
+        args.len(),
+        2,
+        "usage: scenario-label-wgpu.exe NEW_OUTPUT_DIRECTORY"
+    );
+    let out = Path::new(&args[1]);
+    fs::create_dir(out).expect("output directory must be new; preserve prior runs");
+    // Initialize the system font database before the new renderer. No fonts are
+    // loaded after this point, through all screenshots and coverage inspection.
+    let version = graphics_text::font_system().read().unwrap().version();
+    let mut renderer = block_on(<iced::Renderer as Headless>::new(
+        Font::DEFAULT,
+        Pixels(16.),
+        Some("wgpu"),
+    ))
+    .expect("WGPU adapter/device unavailable: infrastructure failure, never a skipped pass");
+    assert_eq!(Headless::name(&renderer), "wgpu");
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let mut summary = format!(
+        "policy={POLICY}\nhorizontal_inset={HORIZONTAL_INSET}\nfont_version={version:?}\nrenderer=wgpu\nchannel_delta_threshold={PIXEL_DELTA}\nimported_module=crates/oa-desktop/src/behavior/scenario_label.rs\n"
+    );
+    let (mut cases_run, mut invalid, mut findings, mut advance_spill_cases) = (0, 0, 0, 0);
+    for case in cases() {
+        for (zoom, dpi) in [(0.65, 1.), (1., 1.), (1.75, 1.), (1., 1.5)] {
+            for width in [160., 760.] {
+                let name = format!("{}-z{zoom}-dpi{dpi}-w{width}", case.name);
+                let dir = out.join(&name);
+                let (bad, found, advance_spill) =
+                    evaluate(&mut renderer, &session, &case, zoom, dpi, width, &dir);
+                // Summary is only an index; full numeric ink fields are per case.
+                advance_spill_cases += usize::from(advance_spill);
+                writeln!(&mut summary, "{name}: invalid={bad} findings={found}").unwrap();
+                invalid += bad;
+                findings += found;
+                cases_run += 1;
+            }
+        }
+    }
+    assert_eq!(cases_run, 32);
+    writeln!(&mut summary, "cases={cases_run}\ninvalid_checks={invalid}\ncandidate_findings={findings}\nadvance_spill_cases={advance_spill_cases}\n").unwrap();
+    summary.push_str("Advance spill is measured evidence, not automatically a failure. Candidate findings reject this probe's padding/corridor assumptions. This is not Scene/native acceptance.\n");
+    fs::write(out.join("summary.txt"), &summary).unwrap();
+    print!("{summary}");
+    if invalid > 0 {
+        std::process::exit(3);
+    }
+    if findings > 0 {
+        std::process::exit(2);
+    }
+}

harness/experiments/scenario-movement-workflows-20260913/README.md

@@ -0,0 +1,39 @@
+# Scenario movement: source evidence and discriminating workflows
+
+This extends the earlier [anchor-plan experiment](../behavior-anchor-plan-20260912/README.md) and the [layout contract candidate](../../scenario-layout-contract-candidate.md). It informs the user's #20 request for ordinary diagram manipulation and the application specification's requirement to learn from Capella. It does not select a final gesture policy or claim native Capella evaluation.
+
+## Verified primary-source behavior
+
+Capella7.1.0, commit3153b930a4284f6c82952658f1e8d8d6d8c8f340, connects movement of messages, Create/Delete, returns and executions to DoReorder. Its service moves sending and receiving interaction fragments separately, then moves the existing message in ownedMessages, retaining identities. See [tool mapping](https://github.com/eclipse-capella/capella/blob/3153b930a4284f6c82952658f1e8d8d6d8c8f340/core/plugins/org.polarsys.capella.core.sirius.analysis/description/common.odesign#L15777) and [implementation](https://github.com/eclipse-capella/capella/blob/3153b930a4284f6c82952658f1e8d8d6d8c8f340/core/plugins/org.polarsys.capella.core.sirius.analysis/src/org/polarsys/capella/core/sirius/analysis/SequenceDiagramServices.java#L257).
+
+Sirius documents separate blank-space insertion/removal using Ctrl-drag on the vertical ruler or Ctrl+Shift-drag on the canvas. Arrange All preserves order while reducing spacing. Create moves a lifeline's birth/header and Delete its death/bottom. The [user guide](https://eclipse.dev/sirius/doc/user/sequences/Sequence%20Diagrams.html) describes these operations. Sirius7.6.1, commit0a7288dda7c0069659b54091ba811abab0d247c2, [spacing assertions](https://github.com/eclipse-sirius/sirius-desktop/blob/0a7288dda7c0069659b54091ba811abab0d247c2/plugins/org.eclipse.sirius.tests.swtbot/src/org/eclipse/sirius/tests/swtbot/sequence/SequenceSpaceTest.java#L75) demonstrate that inserting space within an execution leaves the call fixed but moves the return and extends the lifeline; inserting below leaves both fixed.
+
+Sirius [destruction movement tests](https://github.com/eclipse-sirius/sirius-desktop/blob/0a7288dda7c0069659b54091ba811abab0d247c2/plugins/org.eclipse.sirius.tests.swtbot/src/org/eclipse/sirius/tests/swtbot/sequence/SequenceDestroyMessageMoveTest.java#L61) permit ordinary drag from y400 to230 across an unrelated message at300, preserving that message's coordinates, but reject death before earlier use of the receiver. Crossing is constrained by affected lifelines, not universally forbidden.
+
+Call/execution/return movement can be coupled, including self calls. Sirius has distinct predecessor values for starting and finishing event ends ([reorder tool contract](https://eclipse.dev/sirius/doc/specifier/sequences/Sequence%20Diagrams.html#EventReorderTool)); [synchronous call assertions](https://github.com/eclipse-sirius/sirius-desktop/blob/0a7288dda7c0069659b54091ba811abab0d247c2/plugins/org.eclipse.sirius.tests.swtbot/src/org/eclipse/sirius/tests/swtbot/sequence/SyncCallMoveTest.java#L330) check coordinated movement and birth/death limits.
+
+Messages and executions must keep their endpoints within the same operand. [Frame coverage tests](https://github.com/eclipse-sirius/sirius-desktop/blob/0a7288dda7c0069659b54091ba811abab0d247c2/plugins/org.eclipse.sirius.tests.swtbot/src/org/eclipse/sirius/tests/swtbot/sequence/CombinedFragmentsMoveTests.java#L103) reject enclosing a fragment within one covering fewer required participants. [Whole-frame movement assertions](https://github.com/eclipse-sirius/sirius-desktop/blob/0a7288dda7c0069659b54091ba811abab0d247c2/plugins/org.eclipse.sirius.tests.swtbot/src/org/eclipse/sirius/tests/swtbot/sequence/SyncCallInOperandReorderTest.java#L75) translate enclosed calls and can enlarge a containing execution. This does not establish unrestricted semantic reparenting.
+
+## Interpretation and alternatives still to evaluate
+
+The evidence rules out assuming every sequence drag is cosmetic. It does not justify copying Capella event-end reorder directly: ARCADIA Studio currently orders complete occurrences in Scenario/Branch sequences, and validates reply dominance, lifetime and operand relations at that granularity. Independent Capella event-end ordering is a material semantic difference.
+
+Candidate A uses direct dragging for presentation spacing and a separately discoverable semantic reorder action. It reduces accidental semantic changes but may make the common order-correction task less discoverable.
+
+Candidate B uses one drag with explicit spacing or semantic-reorder preview according to the prospective position, preflighted against actual chronology/operand constraints. It may better support direct manipulation but must make a semantic transition clear before commit and prevent accidental changes near a boundary. No coordinate-only finite check authorizes that semantic operation.
+
+Both candidates need actual geometry feasibility, clear rejected-move feedback, cancellation, one transaction for model and presentation, exact Undo and saved/reopened geometry. Existing floor-clamp counterexamples remain rejected; silently snapping to a different chronology does not satisfy an exact authored coordinate request.
+
+| Engineer workflow | Observable discriminator |
+| --- | --- |
+| Make room for a commissioning review note without changing behavior | Predictable spacing; no unintended semantic order mutation near another row |
+| Correct vent-then-isolate to isolate-then-vent within an operand | Discoverable reorder, comprehensible semantic preview, one coherent Undo |
+| Extend service duration around a self call | Coupled reply/activation effects visible before acceptance; start and duration operations distinguishable |
+| Move shutdown earlier across unrelated telemetry | Valid crossing allowed; death before last receiver use rejected clearly; exact lifecycle anchors retained |
+| Adjust a fault-handling message near an alt divider, then move its frame | No accidental operand change; whole-frame translation distinguishable from semantic reparenting |
+
+Record task completion, unintended semantic mutations, preview comprehension, cancellation, Undo and reopen behavior. Pointer distance alone is not an adequate evaluator. The user request includes resizing and ordinary controls beyond this initial sparse lane/message storage slice.
+
+## Evidence limits
+
+This was source inspection, not executed native Capella/Sirius validation. Exact modifiers, feedback and persistence/Undo behavior have not been observed locally. Capella and Sirius revisions were inspected separately; their precise bundled dependency relationship was not established. Findings follow assertions rather than misleading test names. Real GUI acceptance remains required for the chosen product behavior.

harness/fixtures/release1-native/communication-means/generate-communication-means.rs

@@ -104,6 +104,7 @@ fn diagram(p: &mut Project, n: u32, layer: Layer, name: &str, rows: &[(Id, f32,
             projection: ProjectionKind::Overview,
             view_options: ViewOptions::default(),
             nodes,
+            layout: None,
             routes: vec![],
         },
     );

harness/scenario-layout-design.md

@@ -74,6 +74,14 @@ Compare these two user gestures before selecting the release behavior:
 
 Evaluate ordinary spacing, intentional and accidental crossings, Call/Reply and Create/Delete validity, same-owner view switches, discoverability, cancellation and one-step Undo. Both candidates must preserve operand membership unless the user invokes an explicit structural move. A persistence-home choice does not settle this gesture choice.
 
+The next bounded workflow prototype will evaluate **spacing through the arrow or label, with explicitly named Reorder available at the selection**. This is a candidate for runtime evaluation, not release acceptance. Spacing has a view-local purpose; reordering changes the shared Scenario and therefore affects its other representations. Inferring that shared semantic instruction merely from pointer travel is the principal reason to try separate actions first. Continuous spacing/reorder retains today's motor behavior and remains the alternative if the explicit action proves difficult to discover or use.
+
+This deliberately changes the current body-drag behavior: both an occurrence hit and the selected handle currently capture Reorder, with a three-screen-pixel movement threshold. Retaining only the existing handle is insufficient. Its world rectangle at x6..28 becomes 1.1 screen pixels wide at 0.05 zoom and can pan offscreen while the selected message remains visible. The named action must remain reachable at the current selection and camera position.
+
+The prototype must distinguish arrow/label, activation shoulder, lifecycle marker and reorder-handle hit roles; a shared occurrence UUID does not imply a shared drag action. It must preserve exact authored values, source, revision and redo on cancellation, stale view-visit context or return to the starting position. Geometry diagnostics are inputs to explicit preview feedback, not permission to rewrite steps, clamp stored values or manufacture missing arrows. The complete resolver's acceptance of source-admitted crossings does not itself select the gesture's crossing policy.
+
+Acceptance needs one independent native workflow: make two close messages easier to read, then deliberately swap them without being taught the handle. Include negative/far-right selections, Fit zoom, self Call/Reply and Delete, activation-shoulder input, and two saved views of one owner. Compare complete steps, both layouts, source and one-step Undo. Failure to discover Reorder or understand a refused spacing preview requires revising the interaction before adoption. No full implementation of both candidates is required merely to compare their risks; this first experiment does not replace the broader direct-editing acceptance matrix below.
+
 ## Labels are part of the spacing outcome
 
 Both reviewed renderers shorten each complete message label to 32 graphemes independently of lane spacing. Their 225-unit backplate estimate is not a matching text clip. Existing release1 call/reply names already expose this truncation. The navigation membership helper independently assumes the same shortened label; changing paint alone would make its visibility claims wrong.

harness/staged-source-authoring-contract.rs

@@ -298,6 +298,7 @@ fn stage_commands(before: &Project, stage: Stage, roles: &mut Roles<'_>) -> Vec<
                 description: String::new(),
                 layer: Layer::Sa,
                 projection: ProjectionKind::StateMachine { machine },
+                layout: None,
                 routes: vec![],
                 view_options: Default::default(),
                 nodes: BTreeMap::from([(
@@ -422,6 +423,7 @@ fn false_carrier(base: &Project) -> Project {
             projection: ProjectionKind::StateMachine {
                 machine: test_id(6),
             },
+            layout: None,
             routes: vec![],
             view_options: Default::default(),
             nodes: BTreeMap::from([(