Sync agent instructions from main

.gitattributes

@@ -22,67 +22,65 @@ harness/history/2026-09-06-ledgers-before-consolidation/** -text
 harness/history/2026-09-10-ledgers-before-continuation-refresh/** -text
 harness/history/2026-09-10-ledgers-before-second-consolidation/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
 harness/experiments/textual-authoring-20260911-local/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/history/2026-09-11-ytr83r-integration/** -text whitespace=cr-at-eol
 crates/oa-desktop/src/recovery/fixtures/*.json -text
-crates/oa-core/src/analysis_numeric/fixtures/** -text whitespace=cr-at-eol
 harness/fixtures/source7-native/** -text
 harness/fixtures/basic-editing/** -text
 harness/fixtures/scenario-authoring/base/** -text whitespace=cr-at-eol
 harness/experiments/textual-authoring-20260911/** -text whitespace=cr-at-eol
 harness/experiments/textual-authoring-20260911/observed/split-entry.arcadia whitespace=-blank-at-eol,cr-at-eol
 harness/experiments/analysis-context-20260911/** -text whitespace=cr-at-eol
-harness/experiments/analysis-baseline-20260911/** -text whitespace=cr-at-eol
-harness/experiments/library-compatibility-20260911/** -text whitespace=cr-at-eol
-harness/experiments/refined-contracts-review-20260911/** -text whitespace=cr-at-eol
+harness/experiments/constructor-defaults-20260911/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/experiments/constructor-defaults-20260911/results/*.arcadia whitespace=-blank-at-eol,cr-at-eol
+harness/experiments/behavior-creation-native-20260911/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
 harness/behavior-creation-contract.rs -text whitespace=cr-at-eol
 harness/experiments/source-cli-independent-20260911/** -text whitespace=cr-at-eol
-harness/experiments/authoring-prerelease-20260911/** -text whitespace=cr-at-eol
-harness/experiments/cli-packaging-20260911/** -text whitespace=cr-at-eol
-harness/experiments/cli-prerelease-20260911/** -text whitespace=cr-at-eol
-harness/experiments/contextual-source-20260911/** -text whitespace=cr-at-eol
-harness/experiments/contextual-source-20260911/**/*.log whitespace=-blank-at-eof,cr-at-eol
-harness/fixtures/staged-source-authoring/** -text whitespace=cr-at-eol
-harness/staged-source-authoring-contract.rs -text whitespace=cr-at-eol
+harness/fixtures/scenario-lifecycle-native/**/*.arcadia -text whitespace=cr-at-eol
+harness/experiments/lifecycle-native-ytr83r-20260911/** -text whitespace=cr-at-eol
+harness/experiments/lifecycle-native-ytr83r-20260911/*.log -text -whitespace
+harness/experiments/lifecycle-native-ui-oa-20260911/** -text -whitespace
+harness/experiments/lifecycle-native-ui-sa-20260911/** -text -whitespace
+harness/experiments/wsl-postboot-ytr83r-20260911/** -text -whitespace
 
 # Preserve checksum-bound font notices verbatim through Git round trips.
 scripts/windows-notices/GNOME-Cantarell-61362600e104-COPYING -text
 scripts/windows-notices/Fira-OFL.txt -text
 scripts/windows-notices/FiraSans-Regular-NOTICE.txt -text
-harness/experiments/behavior-creation-native-20260911/** -text whitespace=cr-at-eol
-harness/experiments/constructor-defaults-20260911/** -text whitespace=cr-at-eol
-harness/experiments/constructor-defaults-20260911/results/*.arcadia whitespace=-blank-at-eol,cr-at-eol
-harness/release-scenario-native-9e8r6t-20260911.md -text whitespace=cr-at-eol
-harness/experiments/analysis-numeric-gate-20260911/** -text
-harness/experiments/chooser-correction-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/chooser-lint-gate-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/history/2026-09-11-behavior-wiki-before-refresh.md -text whitespace=cr-at-eol
-# Preserve the independently fingerprinted historical review verbatim.
-harness/release-behavior-canvas-phase1-review-20260911.md -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/scenario-native-3c9e6ee-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/scenario-native-3c9e6ee-20260911/**/*.arcadia whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/analysis-codec-windows-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/history/2026-09-11-ledgers-before-gitea-migration/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/canvas-union-windows-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/canvas-a31b40d-windows-native-20260911/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/allocation-d9b3f0d-windows-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/allocation-3840ca2-pause-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/diagram-removal-windows-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/diagram-resize-foundation-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/delete-native-f7-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/canvas-editing-followup-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/resize-port-policy-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/canvas-native-83f53c7-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/nested-lifecycle-union-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/canvas-native-d61f1f3-20260912/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/lifecycle-fixture-preflight-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/palette-readability-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/release-analysis-next-acceptance-20260913.md -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/runtime-notices-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/analysis-checked-save-windows-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/canvas-native-dd39e1f-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/navigation-palette-e124029-windows-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/navigation-native-preparation-e124029-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/analysis-source-s0-s1-windows-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/analysis-source3-bridge-windows-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/scenario-analysis-version-integration-review-20260913.md -text whitespace=cr-at-eol
-harness/scenario-analysis-version-integration-inputs-20260913.json -text whitespace=cr-at-eol
-harness/experiments/analysis-source-s2a-windows-20260913/** -text whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
+scripts/windows-notices/llvm-6dfe1677ab8d-libunwind-LICENSE.TXT -text
+
+harness/experiments/lifecycle-header-overflow-before-20260911/** -text -whitespace
+harness/history/2026-09-11-ytr83r-record-migration/STATE-before.md -text -whitespace
+
+harness/fixtures/staged-source-authoring/** -text whitespace=cr-at-eol
+harness/staged-source-authoring-contract.rs -text whitespace=cr-at-eol
+
+harness/experiments/contextual-lifecycle-integration-ytr83r-20260911/** -text -whitespace
+harness/experiments/windows-runtime-321897f-20260911/** -text -whitespace
+harness/child-work-native-contract.rs -text whitespace=cr-at-eol
+harness/fixtures/child-work-native/** -text whitespace=cr-at-eol
+harness/experiments/windows-gates-865483b-20260911/** -text -whitespace
+harness/experiments/native-child-oa-865483b-20260911/** -text -whitespace
+harness/experiments/packaged-server-865483b-20260911/** -text -whitespace
+
+harness/experiments/canvas-union-a57c334-20260911/** -text -whitespace
+harness/experiments/windows-gates-a57c334-20260911/** -text -whitespace
+harness/experiments/native-child-continuation-865483b-20260911/** -text -whitespace
+harness/experiments/lifecycle-header-correction-native-865483b-20260911/** -text -whitespace
+harness/release-native-child-continuation-review-20260911.md -text -whitespace
+
+harness/experiments/packaged-gui-close-865483b-20260911/** -text -whitespace
+harness/release-grapheme-shortening-review-20260911.md -text -whitespace
+harness/experiments/staged-source-native-a57c334-20260911/** -text -whitespace
+harness/experiments/grapheme-windows-cb91525-20260911/** -text -whitespace
+harness/experiments/canvas-native-close-a57c334-20260911/** -text -whitespace
+harness/release-staged-native-a57-independent-review-20260911.md -text -whitespace
+harness/release-saved-destination-independent-review-20260912.md -text -whitespace
+harness/experiments/repair-union-windows-33e30c1-20260912/** -text -whitespace
+harness/experiments/canvas-camera-a57c334-20260912/** -text -whitespace
+harness/release-camera-a57-independent-review-20260912.md -text -whitespace
+
+harness/experiments/canvas-repair-package-33e30c1-20260912/** -text -whitespace
+harness/experiments/canvas-repair-native-33e30c1-20260912/** -text -whitespace
+harness/experiments/canvas-repair-server-33e30c1-20260912/** -text -whitespace
+
+harness/experiments/canvas-repair-publication-20260912/** -text -whitespace

Cargo.lock

@@ -2107,25 +2107,6 @@ dependencies = [
  "jni-sys 0.3.1",
 ]
 
-[[package]]
-name = "num-bigint"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
-dependencies = [
- "num-integer",
- "num-traits",
-]
-
-[[package]]
-name = "num-integer"
-version = "0.1.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
-dependencies = [
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2172,9 +2153,6 @@ name = "oa-core"
 version = "0.2.0"
 dependencies = [
  "libc",
- "num-bigint",
- "num-integer",
- "num-traits",
  "same-file",
  "serde",
  "serde_json",

crates/oa-core/Cargo.toml

@@ -12,9 +12,6 @@ uuid.workspace = true
 thiserror.workspace = true
 tempfile = "3"
 same-file = "1"
-num-bigint = "0.5.1"
-num-integer = "0.1.47"
-num-traits = "0.2.19"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 libc = "0.2"

crates/oa-core/examples/release_dense_views.rs

@@ -230,7 +230,7 @@ fn fixture() -> (Project, Id, Vec<Id>, Vec<Id>, Vec<Id>) {
             )
         })
         .collect();
-    p.diagrams.insert(diagram, Diagram { id: diagram, alias: "forty_exchange_view".into(), name: "Forty service exchanges · all concerns".into(), description: "Start with All. Compare first category, overlapping concerns, global coverage and chosen processes. No hand-routed edges.".into(), layer: Layer::Oa, projection: ProjectionKind::FunctionalDataflow, view_options: ViewOptions::default(), nodes, routes: vec![] });
+    p.diagrams.insert(diagram, Diagram { id: diagram, alias: "forty_exchange_view".into(), name: "Forty service exchanges · all concerns".into(), description: "Start with All. Compare first category, overlapping concerns, global coverage and chosen processes. No hand-routed edges.".into(), layer: Layer::Oa, projection: ProjectionKind::FunctionalDataflow, view_options: ViewOptions::default(), nodes, layout: None, routes: vec![] });
     (p, diagram, exchanges, categories, contexts)
 }
 

crates/oa-core/src/analysis_numeric.rs

@@ -1,103 +0,0 @@
-//! Exact numeric foundation for analysis; no model, expression, or package resolver.
-//!
-//! Values use reduced rational coordinates. All nontrivial arithmetic takes one
-//! request-local [WorkMeter]. The future evaluator must also charge *expanded*
-//! expression/call/property/list/target visits and retain the same logical walk on
-//! cache hits. Stored AST size is not a dynamic execution limit.
-//!
-//! Approximate engineering functions/irrational unit scales require a subsequent
-//! explicit numeric profile; rationals do not implement degree/radian conversion
-//! or transcendental mathematics.
-
-mod dimension;
-mod exact;
-mod meter;
-mod quantity;
-
-pub use dimension::{Dimension, DimensionAxis};
-pub use exact::{Exact, ExactWire};
-pub use meter::{
-    EvaluationStep, NumericOperation, WorkExhaustion, WorkLimits, WorkMeter, WorkResource,
-    WorkSite, WorkUsage,
-};
-pub use quantity::{NumericType, NumericValue, ResolvedKind, Unit};
-
-use serde::{Deserialize, Serialize};
-use thiserror::Error;
-
-/// Profile identity includes the accounting rules, not crate-internal timing.
-pub const WORK_PROFILE: &str = "Q1-logical-work-1";
-pub const MAX_COMPONENT_BITS: u64 = 4096;
-/// Cross products require 8192 bits; their sum can require one additional bit.
-pub const MAX_INTERMEDIATE_BITS: u64 = 8193;
-pub const MAX_COMPONENT_DIGITS: usize = 1234;
-pub const MAX_DECIMAL_EXPONENT: i32 = 128;
-pub const MAX_INTEGER_POWER: i8 = 16;
-/// Includes ratio punctuation/whitespace without permitting unbounded scanning.
-pub const MAX_LITERAL_BYTES: usize = 2 * MAX_COMPONENT_DIGITS + 32;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub enum NumberComponent {
-    Numerator,
-    Denominator,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Error, Serialize, Deserialize)]
-pub enum NumericLimit {
-    #[error("request work exhausted: {0}")]
-    Work(WorkExhaustion),
-    #[error("{component:?} uses {bits} bits, above the {limit}-bit {stage} limit")]
-    Bits {
-        component: NumberComponent,
-        bits: u64,
-        limit: u64,
-        stage: String,
-    },
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Error, Serialize, Deserialize)]
-pub enum NumericError {
-    #[error("numeric limit: {0}")]
-    Limit(NumericLimit),
-    #[error("invalid numeric literal")]
-    InvalidLiteral,
-    #[error("numeric literal exceeds its digit or byte limit")]
-    LiteralTooLong,
-    #[error("decimal exponent is outside -128 through 128")]
-    DecimalExponent,
-    #[error("wire rational is not in canonical reduced form")]
-    NonCanonicalWire,
-    #[error("rational denominator is zero")]
-    ZeroDenominator,
-    #[error("division by zero")]
-    DivisionByZero,
-    #[error("zero to the power zero is undefined in this profile")]
-    ZeroPowerZero,
-    #[error("integer power is outside -16 through 16")]
-    IntegerPower,
-    #[error("dimension exponent at {axis:?} is outside -32 through 32: {value}")]
-    DimensionExponent { axis: DimensionAxis, value: i32 },
-    #[error("unit scale must be strictly positive")]
-    UnitScale,
-    #[error("a linear unit must have zero offset")]
-    LinearOffset,
-    #[error("an affine point must have a distinct linear difference kind")]
-    DifferenceKind,
-    #[error("numeric kinds or dimensions are incompatible")]
-    IncompatibleTypes,
-    #[error("operation is not defined for affine points")]
-    AffineOperation,
-    #[error("AsKind requires an anonymous matching dimension and a linear target")]
-    KindAssertion,
-    #[error("request work limits exceed the provisional reference ceilings")]
-    InvalidWorkLimits,
-}
-
-impl NumericError {
-    pub fn is_terminal_work_exhaustion(&self) -> bool {
-        matches!(self, Self::Limit(NumericLimit::Work(_)))
-    }
-}
-
-#[cfg(test)]
-mod tests;

crates/oa-core/src/analysis_numeric/dimension.rs

@@ -1,107 +0,0 @@
-use super::NumericError;
-use serde::{Deserialize, Serialize};
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DimensionAxis {
-    Length,
-    Mass,
-    Time,
-    ElectricCurrent,
-    Temperature,
-    Amount,
-    LuminousIntensity,
-}
-
-impl DimensionAxis {
-    pub const ALL: [Self; 7] = [
-        Self::Length,
-        Self::Mass,
-        Self::Time,
-        Self::ElectricCurrent,
-        Self::Temperature,
-        Self::Amount,
-        Self::LuminousIntensity,
-    ];
-}
-
-/// SI base-dimension vector in DimensionAxis::ALL order, each entry -32..=32.
-/// This is a dimension, never a nominal quantity-kind compatibility proof.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(try_from = "[i16; 7]", into = "[i16; 7]")]
-pub struct Dimension([i16; 7]);
-
-impl Dimension {
-    pub const ZERO: Self = Self([0; 7]);
-
-    pub fn new(exponents: [i16; 7]) -> Result<Self, NumericError> {
-        for (index, value) in exponents.iter().copied().enumerate() {
-            if !(-32..=32).contains(&value) {
-                return Err(NumericError::DimensionExponent {
-                    axis: DimensionAxis::ALL[index],
-                    value: i32::from(value),
-                });
-            }
-        }
-        Ok(Self(exponents))
-    }
-
-    pub fn exponents(self) -> [i16; 7] {
-        self.0
-    }
-
-    pub fn is_dimensionless(self) -> bool {
-        self == Self::ZERO
-    }
-
-    pub fn checked_product(self, rhs: Self) -> Result<Self, NumericError> {
-        self.combine(rhs, 1)
-    }
-
-    pub fn checked_quotient(self, rhs: Self) -> Result<Self, NumericError> {
-        self.combine(rhs, -1)
-    }
-
-    pub fn checked_power(self, exponent: i8) -> Result<Self, NumericError> {
-        if !(-super::MAX_INTEGER_POWER..=super::MAX_INTEGER_POWER).contains(&exponent) {
-            return Err(NumericError::IntegerPower);
-        }
-        let mut output = [0; 7];
-        for (index, value) in self.0.iter().enumerate() {
-            output[index] = Self::checked_exponent(index, i32::from(*value) * i32::from(exponent))?;
-        }
-        Ok(Self(output))
-    }
-
-    fn combine(self, rhs: Self, sign: i32) -> Result<Self, NumericError> {
-        let mut output = [0; 7];
-        for (index, value) in self.0.iter().enumerate() {
-            output[index] =
-                Self::checked_exponent(index, i32::from(*value) + sign * i32::from(rhs.0[index]))?;
-        }
-        Ok(Self(output))
-    }
-
-    fn checked_exponent(index: usize, value: i32) -> Result<i16, NumericError> {
-        if !(-32..=32).contains(&value) {
-            return Err(NumericError::DimensionExponent {
-                axis: DimensionAxis::ALL[index],
-                value,
-            });
-        }
-        Ok(value as i16)
-    }
-}
-
-impl TryFrom<[i16; 7]> for Dimension {
-    type Error = NumericError;
-
-    fn try_from(value: [i16; 7]) -> Result<Self, Self::Error> {
-        Self::new(value)
-    }
-}
-
-impl From<Dimension> for [i16; 7] {
-    fn from(value: Dimension) -> Self {
-        value.0
-    }
-}

crates/oa-core/src/analysis_numeric/exact.rs

@@ -1,469 +0,0 @@
-use super::meter::{normalization_cost, parse_cost, product_cost, sum_cost, words};
-use super::{
-    MAX_COMPONENT_BITS, MAX_COMPONENT_DIGITS, MAX_DECIMAL_EXPONENT, MAX_INTEGER_POWER,
-    MAX_INTERMEDIATE_BITS, MAX_LITERAL_BYTES, NumberComponent, NumericError, NumericLimit,
-    NumericOperation, WorkLimits, WorkMeter,
-};
-use num_bigint::BigInt;
-use num_integer::Integer;
-use num_traits::{One, Signed, Zero};
-use serde::{Deserialize, Serialize};
-use std::cmp::Ordering;
-
-/// The interchange representation deliberately does not use num-bigint's serde
-/// format or JSON numeric values. Duplicate/missing/unknown fields reject.
-/// Its derived decoder allocates String fields before numeric validation; a
-/// transport/document adapter must bound the encoded envelope and decoded text.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct ExactWire {
-    pub numerator: String,
-    pub denominator: String,
-}
-
-/// Reduced rational with positive denominator and <=4096-bit components.
-///
-/// There are no unmetered arithmetic/ordering traits. Eq is structural equality
-/// of already normalized bounded values, not an expression comparison API.
-/// Standalone serde admission bounds the subsequent BigInt validation, not the
-/// preceding String decoding. Document adapters must bound encoded/decoded input
-/// and aggregate admission work. Evaluation uses one explicit WorkMeter.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(try_from = "ExactWire", into = "ExactWire")]
-pub struct Exact {
-    numerator: BigInt,
-    denominator: BigInt,
-}
-
-impl Exact {
-    pub fn from_integer(value: i64) -> Self {
-        Self {
-            numerator: BigInt::from(value),
-            denominator: BigInt::one(),
-        }
-    }
-
-    pub fn is_zero(&self) -> bool {
-        self.numerator.is_zero()
-    }
-
-    pub fn is_positive(&self) -> bool {
-        self.numerator.is_positive()
-    }
-
-    pub fn component_bits(&self) -> (u64, u64) {
-        (self.numerator.bits(), self.denominator.bits())
-    }
-
-    pub fn to_wire(&self) -> ExactWire {
-        ExactWire {
-            numerator: self.numerator.to_string(),
-            denominator: self.denominator.to_string(),
-        }
-    }
-
-    /// Canonical *literal* spelling, not a generic expression formatter.
-    /// Negative literal nodes use ratio(-n,d), even when d=1. A leading minus
-    /// belongs to the future expression parser's UnaryNegate node instead.
-    pub fn canonical_literal(&self) -> String {
-        if self.denominator.is_one() && !self.numerator.is_negative() {
-            self.numerator.to_string()
-        } else {
-            format!("ratio({}, {})", self.numerator, self.denominator)
-        }
-    }
-
-    pub fn from_wire(wire: &ExactWire, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        let n_digits = wire_digits(&wire.numerator, true)?;
-        let d_digits = wire_digits(&wire.denominator, false)?;
-        let n_bound = decimal_bits(n_digits.len());
-        let d_bound = decimal_bits(d_digits.len());
-        meter.numeric(
-            NumericOperation::ParseWire,
-            parse_cost(n_digits.len(), n_bound)
-                + parse_cost(d_digits.len(), d_bound)
-                + normalization_cost(n_bound, d_bound),
-        )?;
-        let numerator = parse_integer(&wire.numerator)?;
-        let denominator = parse_integer(&wire.denominator)?;
-        Self::check_bits(&numerator, &denominator, MAX_COMPONENT_BITS, "wire")?;
-        if denominator.is_zero() {
-            return Err(NumericError::ZeroDenominator);
-        }
-        if !numerator.gcd(&denominator).is_one() {
-            return Err(NumericError::NonCanonicalWire);
-        }
-        Ok(Self {
-            numerator,
-            denominator,
-        })
-    }
-
-    /// Reads one unsigned decimal/integer atom or a ratio(n,d) literal only.
-    /// It does not parse expressions, unary operators, units, calls or names.
-    /// Source ratios/decimals may reduce; wire values must already be canonical.
-    pub fn parse_literal(source: &str, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        if source.len() > MAX_LITERAL_BYTES {
-            return Err(NumericError::LiteralTooLong);
-        }
-        let source = trim_ascii(source);
-        if let Some(body) = source.strip_prefix("ratio(") {
-            let body = body.strip_suffix(')').ok_or(NumericError::InvalidLiteral)?;
-            let (n, d) = body.split_once(',').ok_or(NumericError::InvalidLiteral)?;
-            return Self::parse_ratio(trim_ascii(n), trim_ascii(d), meter);
-        }
-        Self::parse_decimal(source, meter)
-    }
-
-    fn parse_ratio(n: &str, d: &str, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        let n_digits = source_integer_digits(n, true)?;
-        let d_digits = source_integer_digits(d, false)?;
-        let n_bound = decimal_bits(n_digits.len());
-        let d_bound = decimal_bits(d_digits.len());
-        Self::check_estimates(n_bound, d_bound)?;
-        meter.numeric(
-            NumericOperation::ParseLiteral,
-            parse_cost(n_digits.len(), n_bound)
-                + parse_cost(d_digits.len(), d_bound)
-                + normalization_cost(n_bound, d_bound),
-        )?;
-        Self::normalize_precharged(parse_integer(n)?, parse_integer(d)?)
-    }
-
-    fn parse_decimal(source: &str, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        let mut parts = source.split(['e', 'E']);
-        let mantissa = parts.next().ok_or(NumericError::InvalidLiteral)?;
-        let exponent = match parts.next() {
-            Some(text) => parse_exponent(text)?,
-            None => 0,
-        };
-        if parts.next().is_some() {
-            return Err(NumericError::InvalidLiteral);
-        }
-        let (whole, fraction) = match mantissa.split_once('.') {
-            Some((whole, fraction)) if !fraction.is_empty() => (whole, fraction),
-            Some(_) => return Err(NumericError::InvalidLiteral),
-            None => (mantissa, ""),
-        };
-        source_integer_digits(whole, false)?;
-        if !fraction.bytes().all(|byte| byte.is_ascii_digit()) {
-            return Err(NumericError::InvalidLiteral);
-        }
-        let digit_count = whole.len() + fraction.len();
-        if digit_count > MAX_COMPONENT_DIGITS {
-            return Err(NumericError::LiteralTooLong);
-        }
-        let adjustment = exponent - fraction.len() as i32;
-        let power = adjustment.unsigned_abs();
-        let mantissa_bound = decimal_bits(digit_count);
-        let scale_bound = decimal_bits(power as usize + 1);
-        let (n_bound, d_bound) = if adjustment >= 0 {
-            (mantissa_bound + scale_bound, 1)
-        } else {
-            (mantissa_bound, scale_bound)
-        };
-        Self::check_estimates(n_bound, d_bound)?;
-        // Fixed logical allowance for constructing 10^power; independent of
-        // num-bigint's selected multiplication/exponentiation implementation.
-        let power_steps = 1 + 2 * u64::from(u32::BITS - power.leading_zeros());
-        meter.numeric(
-            NumericOperation::ParseLiteral,
-            parse_cost(digit_count, mantissa_bound)
-                + power_steps * product_cost(scale_bound, scale_bound)
-                + product_cost(mantissa_bound, scale_bound)
-                + normalization_cost(n_bound, d_bound),
-        )?;
-        let digits = format!("{whole}{fraction}");
-        let mut numerator = parse_integer(&digits)?;
-        let scale = BigInt::from(10_u8).pow(power);
-        let denominator = if adjustment >= 0 {
-            numerator *= scale;
-            BigInt::one()
-        } else {
-            scale
-        };
-        Self::normalize_precharged(numerator, denominator)
-    }
-
-    pub fn add(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        self.add_or_subtract(rhs, false, meter)
-    }
-
-    pub fn subtract(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        self.add_or_subtract(rhs, true, meter)
-    }
-
-    fn add_or_subtract(
-        &self,
-        rhs: &Self,
-        subtract: bool,
-        meter: &mut WorkMeter,
-    ) -> Result<Self, NumericError> {
-        let (a, b) = self.component_bits();
-        let (c, d) = rhs.component_bits();
-        let left_bound = a + d;
-        let right_bound = c + b;
-        let n_bound = left_bound.max(right_bound) + 1;
-        let d_bound = b + d;
-        Self::check_estimates(n_bound, d_bound)?;
-        meter.numeric(
-            if subtract {
-                NumericOperation::Subtract
-            } else {
-                NumericOperation::Add
-            },
-            product_cost(a, d)
-                + product_cost(c, b)
-                + sum_cost(left_bound, right_bound)
-                + product_cost(b, d)
-                + normalization_cost(n_bound, d_bound),
-        )?;
-        let left = &self.numerator * &rhs.denominator;
-        let right = &rhs.numerator * &self.denominator;
-        let numerator = if subtract { left - right } else { left + right };
-        let denominator = &self.denominator * &rhs.denominator;
-        Self::normalize_precharged(numerator, denominator)
-    }
-
-    pub fn multiply(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        let (a, b) = self.component_bits();
-        let (c, d) = rhs.component_bits();
-        Self::check_estimates(a + c, b + d)?;
-        meter.numeric(
-            NumericOperation::Multiply,
-            product_cost(a, c) + product_cost(b, d) + normalization_cost(a + c, b + d),
-        )?;
-        Self::normalize_precharged(
-            &self.numerator * &rhs.numerator,
-            &self.denominator * &rhs.denominator,
-        )
-    }
-
-    pub fn divide(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        let (a, b) = self.component_bits();
-        let (c, d) = rhs.component_bits();
-        Self::check_estimates(a + d, b + c)?;
-        meter.numeric(
-            NumericOperation::Divide,
-            product_cost(a, d) + product_cost(b, c) + normalization_cost(a + d, b + c),
-        )?;
-        if rhs.is_zero() {
-            return Err(NumericError::DivisionByZero);
-        }
-        Self::normalize_precharged(
-            &self.numerator * &rhs.denominator,
-            &self.denominator * &rhs.numerator,
-        )
-    }
-
-    pub fn compare(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Ordering, NumericError> {
-        let (a, b) = self.component_bits();
-        let (c, d) = rhs.component_bits();
-        Self::check_estimates((a + d).max(c + b), 1)?;
-        meter.numeric(
-            NumericOperation::Compare,
-            product_cost(a, d) + product_cost(c, b) + sum_cost(a + d, c + b),
-        )?;
-        Ok((&self.numerator * &rhs.denominator).cmp(&(&rhs.numerator * &self.denominator)))
-    }
-
-    pub fn negated(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.numeric(NumericOperation::Negate, self.copy_cost())?;
-        Ok(Self {
-            numerator: -&self.numerator,
-            denominator: self.denominator.clone(),
-        })
-    }
-
-    pub fn absolute(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.numeric(NumericOperation::Absolute, self.copy_cost())?;
-        Ok(Self {
-            numerator: self.numerator.abs(),
-            denominator: self.denominator.clone(),
-        })
-    }
-
-    pub fn reciprocal(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.numeric(NumericOperation::Reciprocal, self.copy_cost())?;
-        if self.is_zero() {
-            return Err(NumericError::DivisionByZero);
-        }
-        Ok(Self {
-            numerator: if self.numerator.is_negative() {
-                -&self.denominator
-            } else {
-                self.denominator.clone()
-            },
-            denominator: self.numerator.abs(),
-        })
-    }
-
-    /// Fixed left-to-right repeated multiplication, at most 16 multiplications.
-    /// Each reduced stage obeys the same component bound; no large power is
-    /// allocated and subsequently discarded after discovering it is oversized.
-    pub fn power(&self, exponent: i8, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.numeric(NumericOperation::Power, self.copy_cost())?;
-        if !(-MAX_INTEGER_POWER..=MAX_INTEGER_POWER).contains(&exponent) {
-            return Err(NumericError::IntegerPower);
-        }
-        if self.is_zero() && exponent == 0 {
-            return Err(NumericError::ZeroPowerZero);
-        }
-        let factor = if exponent < 0 {
-            self.reciprocal(meter)?
-        } else {
-            self.clone()
-        };
-        let mut value = Self::from_integer(1);
-        for _ in 0..exponent.unsigned_abs() {
-            value = value.multiply(&factor, meter)?;
-        }
-        Ok(value)
-    }
-
-    pub(super) fn copy_cost(&self) -> u64 {
-        let (n, d) = self.component_bits();
-        1 + words(n) + words(d)
-    }
-
-    fn normalize_precharged(
-        mut numerator: BigInt,
-        mut denominator: BigInt,
-    ) -> Result<Self, NumericError> {
-        Self::check_bits(
-            &numerator,
-            &denominator,
-            MAX_INTERMEDIATE_BITS,
-            "intermediate",
-        )?;
-        if denominator.is_zero() {
-            return Err(NumericError::ZeroDenominator);
-        }
-        if denominator.is_negative() {
-            numerator = -numerator;
-            denominator = -denominator;
-        }
-        let gcd = numerator.gcd(&denominator);
-        numerator /= &gcd;
-        denominator /= gcd;
-        Self::check_bits(&numerator, &denominator, MAX_COMPONENT_BITS, "reduced")?;
-        Ok(Self {
-            numerator,
-            denominator,
-        })
-    }
-
-    fn check_estimates(n: u64, d: u64) -> Result<(), NumericError> {
-        Self::check_bit_count(
-            n,
-            NumberComponent::Numerator,
-            MAX_INTERMEDIATE_BITS,
-            "predicted",
-        )?;
-        Self::check_bit_count(
-            d,
-            NumberComponent::Denominator,
-            MAX_INTERMEDIATE_BITS,
-            "predicted",
-        )
-    }
-
-    fn check_bits(n: &BigInt, d: &BigInt, limit: u64, stage: &str) -> Result<(), NumericError> {
-        Self::check_bit_count(n.bits(), NumberComponent::Numerator, limit, stage)?;
-        Self::check_bit_count(d.bits(), NumberComponent::Denominator, limit, stage)
-    }
-
-    fn check_bit_count(
-        bits: u64,
-        component: NumberComponent,
-        limit: u64,
-        stage: &str,
-    ) -> Result<(), NumericError> {
-        if bits > limit {
-            return Err(NumericError::Limit(NumericLimit::Bits {
-                component,
-                bits,
-                limit,
-                stage: stage.to_owned(),
-            }));
-        }
-        Ok(())
-    }
-}
-
-impl TryFrom<ExactWire> for Exact {
-    type Error = NumericError;
-
-    fn try_from(value: ExactWire) -> Result<Self, Self::Error> {
-        // BigInt validation is bounded after ExactWire strings have decoded.
-        // The adapter owns envelope/text/aggregate admission bounds and must not
-        // reset evaluation meters.
-        Self::from_wire(&value, &mut WorkMeter::new(WorkLimits::REFERENCE))
-    }
-}
-
-impl From<Exact> for ExactWire {
-    fn from(value: Exact) -> Self {
-        value.to_wire()
-    }
-}
-
-fn trim_ascii(text: &str) -> &str {
-    text.trim_matches(|ch: char| ch.is_ascii_whitespace())
-}
-
-fn source_integer_digits(text: &str, signed: bool) -> Result<&str, NumericError> {
-    let digits = if signed {
-        text.strip_prefix('-').unwrap_or(text)
-    } else {
-        text
-    };
-    if digits.len() > MAX_COMPONENT_DIGITS {
-        return Err(NumericError::LiteralTooLong);
-    }
-    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
-        return Err(NumericError::InvalidLiteral);
-    }
-    Ok(digits)
-}
-
-fn wire_digits(text: &str, signed: bool) -> Result<&str, NumericError> {
-    let digits = source_integer_digits(text, signed).map_err(|error| match error {
-        NumericError::LiteralTooLong => error,
-        _ => NumericError::NonCanonicalWire,
-    })?;
-    if (digits.len() > 1 && digits.starts_with('0')) || (text.starts_with('-') && digits == "0") {
-        return Err(NumericError::NonCanonicalWire);
-    }
-    Ok(digits)
-}
-
-fn parse_integer(text: &str) -> Result<BigInt, NumericError> {
-    BigInt::parse_bytes(text.as_bytes(), 10).ok_or(NumericError::InvalidLiteral)
-}
-
-fn parse_exponent(text: &str) -> Result<i32, NumericError> {
-    let (negative, digits) = if let Some(digits) = text.strip_prefix('-') {
-        (true, digits)
-    } else {
-        (false, text.strip_prefix('+').unwrap_or(text))
-    };
-    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
-        return Err(NumericError::InvalidLiteral);
-    }
-    let mut value = 0_i32;
-    for digit in digits.bytes() {
-        value = value * 10 + i32::from(digit - b'0');
-        if value > MAX_DECIMAL_EXPONENT {
-            return Err(NumericError::DecimalExponent);
-        }
-    }
-    Ok(if negative { -value } else { value })
-}
-
-fn decimal_bits(digits: usize) -> u64 {
-    // 3.322 exceeds log2(10); dimensions are bounded before this conversion.
-    (digits as u64 * 3322).div_ceil(1000).max(1)
-}

crates/oa-core/src/analysis_numeric/fixtures/r7-literal-boundaries.json

@@ -1,32 +0,0 @@
-[
-  {
-    "canonical_source": "1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-    "expression": {
-      "Number": {
-        "denominator": "1",
-        "numerator": "1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
-      }
-    },
-    "name": "ten_to_300"
-  },
-  {
-    "canonical_source": "ratio(1, 522194440706576253345876355358312191289982124523691890192116741641976953985778728424413405967498779170445053357219631418993786719092896803631618043925682638972978488271854999170180795067191859157214035005927973113188159419698856372836167342172293308748403954352901852035642024370059304557233988891799014503343469488440893892973452815095130470299789726716411734651513348221529512507986199933857107770846917779942645743159118957217248367043905936319748237550094520674504208530837546834166925275516486044134775384991808184705966507606898412918594045916828375610659246423184062775112999150206172392431297837246097308511903252956622805412865917690043804311051417135098849101156584508839003337597742539960818209685142687562392007453579567729991395256699805775897135553415567045292136442139895777424891477161767258532611634530697452993846501061481697843891439474220308003706472837459911525285821188577408160690315522951458068463354171428220365223949985950890732881736611925133626529949897998045399734600887312408859224933727829625089164535236559716582775403784110923285873186648442456409760158728501220463308455437074192539205964902261490928669488824051563042951500651206733594863336608245755565801460390869016718045121902354170201577095168)",
-    "expression": {
-      "Number": {
-        "denominator": "522194440706576253345876355358312191289982124523691890192116741641976953985778728424413405967498779170445053357219631418993786719092896803631618043925682638972978488271854999170180795067191859157214035005927973113188159419698856372836167342172293308748403954352901852035642024370059304557233988891799014503343469488440893892973452815095130470299789726716411734651513348221529512507986199933857107770846917779942645743159118957217248367043905936319748237550094520674504208530837546834166925275516486044134775384991808184705966507606898412918594045916828375610659246423184062775112999150206172392431297837246097308511903252956622805412865917690043804311051417135098849101156584508839003337597742539960818209685142687562392007453579567729991395256699805775897135553415567045292136442139895777424891477161767258532611634530697452993846501061481697843891439474220308003706472837459911525285821188577408160690315522951458068463354171428220365223949985950890732881736611925133626529949897998045399734600887312408859224933727829625089164535236559716582775403784110923285873186648442456409760158728501220463308455437074192539205964902261490928669488824051563042951500651206733594863336608245755565801460390869016718045121902354170201577095168",
-        "numerator": "1"
-      }
-    },
-    "name": "one_over_two_to_4095"
-  },
-  {
-    "canonical_source": "ratio(-1044388881413152506691752710716624382579964249047383780384233483283953907971557456848826811934997558340890106714439262837987573438185793607263236087851365277945956976543709998340361590134383718314428070011855946226376318839397712745672334684344586617496807908705803704071284048740118609114467977783598029006686938976881787785946905630190260940599579453432823469303026696443059025015972399867714215541693835559885291486318237914434496734087811872639496475100189041349008417061675093668333850551032972088269550769983616369411933015213796825837188091833656751221318492846368125550225998300412344784862595674492194617023806505913245610825731835380087608622102834270197698202313169017678006675195485079921636419370285375124784014907159135459982790513399611551794271106831134090584272884279791554849782954323534517065223269061394905987693002122963395687782878948440616007412945674919823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335, 1)",
-    "expression": {
-      "Number": {
-        "denominator": "1",
-        "numerator": "-1044388881413152506691752710716624382579964249047383780384233483283953907971557456848826811934997558340890106714439262837987573438185793607263236087851365277945956976543709998340361590134383718314428070011855946226376318839397712745672334684344586617496807908705803704071284048740118609114467977783598029006686938976881787785946905630190260940599579453432823469303026696443059025015972399867714215541693835559885291486318237914434496734087811872639496475100189041349008417061675093668333850551032972088269550769983616369411933015213796825837188091833656751221318492846368125550225998300412344784862595674492194617023806505913245610825731835380087608622102834270197698202313169017678006675195485079921636419370285375124784014907159135459982790513399611551794271106831134090584272884279791554849782954323534517065223269061394905987693002122963395687782878948440616007412945674919823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335"
-      }
-    },
-    "name": "negative_4096_bit_bound"
-  }
-]

crates/oa-core/src/analysis_numeric/meter.rs

@@ -1,240 +0,0 @@
-use super::{NumericError, NumericLimit};
-use serde::{Deserialize, Serialize};
-use thiserror::Error;
-
-/// Every event is charged once per dynamic occurrence, before entering it.
-///
-/// A Call expression therefore charges Expression and CalculationEntry; a
-/// Property read charges Expression and PropertyBinding. List element visits
-/// are additional to evaluation of their expressions. Only executed branches
-/// are charged. Targets are sorted by category (properties, then checks), then
-/// stable UUID bytes, by the integrating evaluator.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub enum EvaluationStep {
-    Target,
-    Expression,
-    CalculationEntry,
-    PropertyBinding,
-    ListElement,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub enum NumericOperation {
-    ParseWire,
-    ParseLiteral,
-    Add,
-    Subtract,
-    Multiply,
-    Divide,
-    Compare,
-    Negate,
-    Absolute,
-    Reciprocal,
-    Power,
-    KindAssertion,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub enum WorkResource {
-    DynamicEvents,
-    NumericUnits,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub enum WorkSite {
-    Evaluation(EvaluationStep),
-    Numeric(NumericOperation),
-}
-
-/// Failed reservations consume no partial charge. The first failure is latched.
-#[derive(Debug, Clone, PartialEq, Eq, Error, Serialize, Deserialize)]
-#[error("{resource:?}: used {used}, requested {requested}, limit {limit}, at {site:?}")]
-pub struct WorkExhaustion {
-    pub resource: WorkResource,
-    pub used: u64,
-    pub requested: u64,
-    pub limit: u64,
-    pub site: WorkSite,
-}
-
-/// Provisional calibration ceilings, not measured execution-time guarantees.
-///
-/// Effective limits, profile identity, capture, targets and context must all be
-/// recorded in request/result/frozen identity. A caller may lower these ceilings.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(try_from = "WorkLimitsWire", into = "WorkLimitsWire")]
-pub struct WorkLimits {
-    dynamic_events: u64,
-    numeric_units: u64,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct WorkLimitsWire {
-    dynamic_events: u64,
-    numeric_units: u64,
-}
-
-impl WorkLimits {
-    pub const REFERENCE: Self = Self {
-        dynamic_events: 1_000_000,
-        numeric_units: 50_000_000,
-    };
-
-    pub fn new(dynamic_events: u64, numeric_units: u64) -> Result<Self, NumericError> {
-        if dynamic_events > Self::REFERENCE.dynamic_events
-            || numeric_units > Self::REFERENCE.numeric_units
-        {
-            return Err(NumericError::InvalidWorkLimits);
-        }
-        Ok(Self {
-            dynamic_events,
-            numeric_units,
-        })
-    }
-
-    pub fn dynamic_events(self) -> u64 {
-        self.dynamic_events
-    }
-
-    pub fn numeric_units(self) -> u64 {
-        self.numeric_units
-    }
-}
-
-impl TryFrom<WorkLimitsWire> for WorkLimits {
-    type Error = NumericError;
-
-    fn try_from(value: WorkLimitsWire) -> Result<Self, Self::Error> {
-        Self::new(value.dynamic_events, value.numeric_units)
-    }
-}
-
-impl From<WorkLimits> for WorkLimitsWire {
-    fn from(value: WorkLimits) -> Self {
-        Self {
-            dynamic_events: value.dynamic_events,
-            numeric_units: value.numeric_units,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct WorkUsage {
-    pub dynamic_events: u64,
-    pub numeric_units: u64,
-}
-
-/// Intentionally neither Clone nor Default: pass the same mutable meter through
-/// every target, numeric operation and expanded call in one evaluation request.
-///
-/// Exhaustion is terminal. Integrators must stop traversing siblings/targets and
-/// mark already collected causes as incomplete. Replaying an aggregate cache
-/// cost is insufficient if it changes the exact exhaustion location; initially
-/// retain logical traversal even when numerical values come from a cache.
-#[derive(Debug)]
-pub struct WorkMeter {
-    limits: WorkLimits,
-    usage: WorkUsage,
-    exhausted: Option<WorkExhaustion>,
-}
-
-impl WorkMeter {
-    pub fn new(limits: WorkLimits) -> Self {
-        Self {
-            limits,
-            usage: WorkUsage::default(),
-            exhausted: None,
-        }
-    }
-
-    pub fn limits(&self) -> WorkLimits {
-        self.limits
-    }
-
-    pub fn usage(&self) -> WorkUsage {
-        self.usage
-    }
-
-    pub fn exhaustion(&self) -> Option<&WorkExhaustion> {
-        self.exhausted.as_ref()
-    }
-
-    pub fn ensure_active(&self) -> Result<(), NumericError> {
-        match &self.exhausted {
-            Some(failure) => Err(NumericError::Limit(NumericLimit::Work(failure.clone()))),
-            None => Ok(()),
-        }
-    }
-
-    pub fn visit(&mut self, step: EvaluationStep) -> Result<(), NumericError> {
-        self.reserve(WorkResource::DynamicEvents, 1, WorkSite::Evaluation(step))
-    }
-
-    pub(super) fn numeric(
-        &mut self,
-        operation: NumericOperation,
-        units: u64,
-    ) -> Result<(), NumericError> {
-        self.reserve(
-            WorkResource::NumericUnits,
-            units,
-            WorkSite::Numeric(operation),
-        )
-    }
-
-    fn reserve(
-        &mut self,
-        resource: WorkResource,
-        requested: u64,
-        site: WorkSite,
-    ) -> Result<(), NumericError> {
-        self.ensure_active()?;
-        let (used, limit) = match resource {
-            WorkResource::DynamicEvents => (self.usage.dynamic_events, self.limits.dynamic_events),
-            WorkResource::NumericUnits => (self.usage.numeric_units, self.limits.numeric_units),
-        };
-        // Subtraction is safe: only successful reservations update usage.
-        if requested > limit - used {
-            let failure = WorkExhaustion {
-                resource,
-                used,
-                requested,
-                limit,
-                site,
-            };
-            self.exhausted = Some(failure.clone());
-            return Err(NumericError::Limit(NumericLimit::Work(failure)));
-        }
-        match resource {
-            WorkResource::DynamicEvents => self.usage.dynamic_events += requested,
-            WorkResource::NumericUnits => self.usage.numeric_units += requested,
-        }
-        Ok(())
-    }
-}
-
-// Logical 64-bit words are platform independent. These are deterministic
-// accounting weights, not a claim about num-bigint's internal algorithm/timing.
-pub(super) fn words(bits: u64) -> u64 {
-    bits.max(1).div_ceil(64)
-}
-
-pub(super) fn product_cost(a_bits: u64, b_bits: u64) -> u64 {
-    1 + words(a_bits) * words(b_bits)
-}
-
-pub(super) fn sum_cost(a_bits: u64, b_bits: u64) -> u64 {
-    1 + words(a_bits.max(b_bits))
-}
-
-pub(super) fn normalization_cost(n_bits: u64, d_bits: u64) -> u64 {
-    let width = words(n_bits.max(d_bits));
-    // 64*w² for GCD plus 2*w² for the two quotient operations.
-    1 + 66 * width * width
-}
-
-pub(super) fn parse_cost(digits: usize, estimated_bits: u64) -> u64 {
-    1 + digits as u64 * words(estimated_bits)
-}

crates/oa-core/src/analysis_numeric/quantity.rs

@@ -1,378 +0,0 @@
-use super::{Dimension, Exact, MAX_INTEGER_POWER, NumericError, NumericOperation, WorkMeter};
-use std::cmp::Ordering;
-
-/// K is supplied by the common resolver's verified nominal compatibility
-/// relation. It is not inferred from dimension/name/symbol/archive bytes here.
-/// Coordinate basis/algebra/difference-kind closure must be part of that proof.
-/// Exact definition references and pins remain the caller's provenance.
-/// K must be a bounded, cheap-to-clone/compare verified handle. Constructing or
-/// comparing an unbounded rooted contract graph is resolver admission work and
-/// must not be hidden inside K's Clone/Eq implementations. Rust trait bounds do
-/// not enforce this resource contract.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ResolvedKind<K> {
-    key: K,
-    dimension: Dimension,
-    difference: Option<K>,
-}
-
-impl<K> ResolvedKind<K> {
-    pub fn linear(key: K, dimension: Dimension) -> Self {
-        Self {
-            key,
-            dimension,
-            difference: None,
-        }
-    }
-
-    pub fn key(&self) -> &K {
-        &self.key
-    }
-
-    pub fn dimension(&self) -> Dimension {
-        self.dimension
-    }
-
-    pub fn is_affine(&self) -> bool {
-        self.difference.is_some()
-    }
-}
-
-impl<K: Clone + Eq> ResolvedKind<K> {
-    pub fn affine(key: K, difference: &Self) -> Result<Self, NumericError> {
-        if difference.is_affine() || key == difference.key {
-            return Err(NumericError::DifferenceKind);
-        }
-        Ok(Self {
-            key,
-            dimension: difference.dimension,
-            difference: Some(difference.key.clone()),
-        })
-    }
-
-    pub fn difference_kind(&self) -> Option<Self> {
-        self.difference
-            .as_ref()
-            .map(|key| Self::linear(key.clone(), self.dimension))
-    }
-}
-
-/// Canonical coordinate = magnitude * scale + offset.
-/// Unit symbols and display preferences are outside this numeric representation.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct Unit<K> {
-    kind: ResolvedKind<K>,
-    scale: Exact,
-    offset: Exact,
-}
-
-impl<K: Clone + Eq> Unit<K> {
-    pub fn new(kind: ResolvedKind<K>, scale: Exact, offset: Exact) -> Result<Self, NumericError> {
-        if !scale.is_positive() {
-            return Err(NumericError::UnitScale);
-        }
-        if !kind.is_affine() && !offset.is_zero() {
-            return Err(NumericError::LinearOffset);
-        }
-        Ok(Self {
-            kind,
-            scale,
-            offset,
-        })
-    }
-
-    pub fn kind(&self) -> &ResolvedKind<K> {
-        &self.kind
-    }
-
-    pub fn scale(&self) -> &Exact {
-        &self.scale
-    }
-
-    pub fn offset(&self) -> &Exact {
-        &self.offset
-    }
-
-    /// Fixed multiply-then-add path. Each reduced arithmetic stage is bounded.
-    /// A mathematically cancelling wider intermediate still reports NumericLimit;
-    /// replacing this path with a fused operation requires a new work profile.
-    pub fn to_canonical(
-        &self,
-        magnitude: &Exact,
-        meter: &mut WorkMeter,
-    ) -> Result<Exact, NumericError> {
-        magnitude
-            .multiply(&self.scale, meter)?
-            .add(&self.offset, meter)
-    }
-
-    /// Fixed subtract-then-divide path; never rounds a coordinate.
-    pub fn from_canonical(
-        &self,
-        coordinate: &Exact,
-        meter: &mut WorkMeter,
-    ) -> Result<Exact, NumericError> {
-        coordinate
-            .subtract(&self.offset, meter)?
-            .divide(&self.scale, meter)
-    }
-
-    pub fn convert(
-        &self,
-        magnitude: &Exact,
-        target: &Self,
-        meter: &mut WorkMeter,
-    ) -> Result<Exact, NumericError> {
-        meter.ensure_active()?;
-        if self.kind != target.kind {
-            return Err(NumericError::IncompatibleTypes);
-        }
-        target.from_canonical(&self.to_canonical(magnitude, meter)?, meter)
-    }
-}
-
-/// Internal numerical types. Boolean/list/check semantics belong to the common
-/// expression evaluator. Anonymous zero dimension normalizes to Number.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum NumericType<K> {
-    Number,
-    Named(ResolvedKind<K>),
-    Anonymous(Dimension),
-}
-
-impl<K> NumericType<K> {
-    pub fn dimension(&self) -> Dimension {
-        match self {
-            Self::Number => Dimension::ZERO,
-            Self::Named(kind) => kind.dimension,
-            Self::Anonymous(dimension) => *dimension,
-        }
-    }
-
-    pub fn is_affine(&self) -> bool {
-        matches!(self, Self::Named(kind) if kind.is_affine())
-    }
-
-    fn anonymous(dimension: Dimension) -> Self {
-        if dimension.is_dimensionless() {
-            Self::Number
-        } else {
-            Self::Anonymous(dimension)
-        }
-    }
-
-    fn normalized(self) -> Self {
-        match self {
-            Self::Anonymous(dimension) => Self::anonymous(dimension),
-            other => other,
-        }
-    }
-}
-
-/// A canonical rational coordinate with an internal numerical type.
-///
-/// Derived Eq compares stored representation. Formal equality/ordering must call
-/// compare(), which rejects mismatched nominal kinds instead of treating them
-/// as a false predicate. Public property output must still check its declared
-/// type and anchor the result to that declaration's exact definition reference.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct NumericValue<K> {
-    value_type: NumericType<K>,
-    coordinate: Exact,
-}
-
-impl<K: Clone + Eq> NumericValue<K> {
-    pub fn new(value_type: NumericType<K>, coordinate: Exact) -> Self {
-        Self {
-            value_type: value_type.normalized(),
-            coordinate,
-        }
-    }
-
-    pub fn number(coordinate: Exact) -> Self {
-        Self::new(NumericType::Number, coordinate)
-    }
-
-    pub fn from_unit(
-        magnitude: &Exact,
-        unit: &Unit<K>,
-        meter: &mut WorkMeter,
-    ) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        Ok(Self::new(
-            NumericType::Named(unit.kind.clone()),
-            unit.to_canonical(magnitude, meter)?,
-        ))
-    }
-
-    pub fn value_type(&self) -> &NumericType<K> {
-        &self.value_type
-    }
-
-    pub fn coordinate(&self) -> &Exact {
-        &self.coordinate
-    }
-
-    pub fn display_in(&self, unit: &Unit<K>, meter: &mut WorkMeter) -> Result<Exact, NumericError> {
-        meter.ensure_active()?;
-        if !matches!(&self.value_type, NumericType::Named(kind) if kind == &unit.kind) {
-            return Err(NumericError::IncompatibleTypes);
-        }
-        unit.from_canonical(&self.coordinate, meter)
-    }
-
-    pub fn add(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        let output = self.additive_type(rhs, false)?;
-        Ok(Self::new(
-            output,
-            self.coordinate.add(&rhs.coordinate, meter)?,
-        ))
-    }
-
-    pub fn subtract(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        let output = self.additive_type(rhs, true)?;
-        Ok(Self::new(
-            output,
-            self.coordinate.subtract(&rhs.coordinate, meter)?,
-        ))
-    }
-
-    fn additive_type(&self, rhs: &Self, subtract: bool) -> Result<NumericType<K>, NumericError> {
-        use NumericType::{Anonymous, Named, Number};
-        match (&self.value_type, &rhs.value_type) {
-            (Number, Number) => Ok(Number),
-            (Anonymous(left), Anonymous(right)) if left == right => Ok(Anonymous(*left)),
-            (Named(left), Named(right)) => match (&left.difference, &right.difference) {
-                (None, None) if left == right => Ok(Named(left.clone())),
-                (Some(difference), Some(_)) if subtract && left == right => Ok(Named(
-                    ResolvedKind::linear(difference.clone(), left.dimension),
-                )),
-                (Some(difference), None)
-                    if difference == &right.key && left.dimension == right.dimension =>
-                {
-                    Ok(Named(left.clone()))
-                }
-                (None, Some(difference))
-                    if !subtract
-                        && difference == &left.key
-                        && left.dimension == right.dimension =>
-                {
-                    Ok(Named(right.clone()))
-                }
-                _ => Err(NumericError::IncompatibleTypes),
-            },
-            _ => Err(NumericError::IncompatibleTypes),
-        }
-    }
-
-    pub fn multiply(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        let output = self.multiplicative_type(rhs, false)?;
-        Ok(Self::new(
-            output,
-            self.coordinate.multiply(&rhs.coordinate, meter)?,
-        ))
-    }
-
-    pub fn divide(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        let output = self.multiplicative_type(rhs, true)?;
-        Ok(Self::new(
-            output,
-            self.coordinate.divide(&rhs.coordinate, meter)?,
-        ))
-    }
-
-    fn multiplicative_type(
-        &self,
-        rhs: &Self,
-        divide: bool,
-    ) -> Result<NumericType<K>, NumericError> {
-        use NumericType::Number;
-        if self.value_type.is_affine() || rhs.value_type.is_affine() {
-            return Err(NumericError::AffineOperation);
-        }
-        match (&self.value_type, &rhs.value_type) {
-            (Number, Number) => Ok(Number),
-            (_, Number) => Ok(self.value_type.clone()),
-            (Number, _) if !divide => Ok(rhs.value_type.clone()),
-            _ => {
-                let left = self.value_type.dimension();
-                let right = rhs.value_type.dimension();
-                let dimension = if divide {
-                    left.checked_quotient(right)?
-                } else {
-                    left.checked_product(right)?
-                };
-                Ok(NumericType::anonymous(dimension))
-            }
-        }
-    }
-
-    pub fn negated(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        if self.value_type.is_affine() {
-            return Err(NumericError::AffineOperation);
-        }
-        Ok(Self::new(
-            self.value_type.clone(),
-            self.coordinate.negated(meter)?,
-        ))
-    }
-
-    pub fn absolute(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        if self.value_type.is_affine() {
-            return Err(NumericError::AffineOperation);
-        }
-        Ok(Self::new(
-            self.value_type.clone(),
-            self.coordinate.absolute(meter)?,
-        ))
-    }
-
-    pub fn power(&self, exponent: i8, meter: &mut WorkMeter) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        if !(-MAX_INTEGER_POWER..=MAX_INTEGER_POWER).contains(&exponent) {
-            return Err(NumericError::IntegerPower);
-        }
-        if self.value_type.is_affine() {
-            return Err(NumericError::AffineOperation);
-        }
-        let output = match exponent {
-            0 => NumericType::Number,
-            1 => self.value_type.clone(),
-            _ => NumericType::anonymous(self.value_type.dimension().checked_power(exponent)?),
-        };
-        Ok(Self::new(output, self.coordinate.power(exponent, meter)?))
-    }
-
-    pub fn compare(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Ordering, NumericError> {
-        meter.ensure_active()?;
-        if self.value_type != rhs.value_type {
-            return Err(NumericError::IncompatibleTypes);
-        }
-        self.coordinate.compare(&rhs.coordinate, meter)
-    }
-
-    pub fn as_kind(
-        &self,
-        target: &ResolvedKind<K>,
-        meter: &mut WorkMeter,
-    ) -> Result<Self, NumericError> {
-        meter.ensure_active()?;
-        if target.is_affine()
-            || matches!(self.value_type, NumericType::Named(_))
-            || self.value_type.dimension() != target.dimension
-        {
-            return Err(NumericError::KindAssertion);
-        }
-        meter.numeric(NumericOperation::KindAssertion, self.coordinate.copy_cost())?;
-        Ok(Self::new(
-            NumericType::Named(target.clone()),
-            self.coordinate.clone(),
-        ))
-    }
-}

crates/oa-core/src/analysis_numeric/tests.rs

@@ -1,804 +0,0 @@
-use super::*;
-use num_bigint::BigInt;
-use num_traits::One;
-use std::cmp::Ordering;
-
-fn meter() -> WorkMeter {
-    WorkMeter::new(WorkLimits::REFERENCE)
-}
-
-fn exact(n: impl ToString, d: impl ToString) -> Exact {
-    Exact::from_wire(
-        &ExactWire {
-            numerator: n.to_string(),
-            denominator: d.to_string(),
-        },
-        &mut meter(),
-    )
-    .unwrap()
-}
-
-fn source(text: &str) -> Exact {
-    Exact::parse_literal(text, &mut meter()).unwrap()
-}
-
-fn assert_fraction(value: &Exact, n: impl ToString, d: impl ToString) {
-    assert_eq!(
-        value.to_wire(),
-        ExactWire {
-            numerator: n.to_string(),
-            denominator: d.to_string(),
-        }
-    );
-}
-
-// Independent bounded i128 oracle. It does not call the production Exact/GCD
-// implementation when deriving expected arithmetic or ordering.
-fn small_fraction(mut n: i128, mut d: i128) -> (i128, i128) {
-    assert_ne!(d, 0);
-    if d < 0 {
-        n = -n;
-        d = -d;
-    }
-    let (mut a, mut b) = (n.abs(), d);
-    while b != 0 {
-        (a, b) = (b, a % b);
-    }
-    (n / a, d / a)
-}
-
-#[test]
-fn arithmetic_matches_independent_small_integer_oracle() {
-    for a in [-5_i128, -2, 0, 1, 4] {
-        for b in [1_i128, 2, 3, 7] {
-            for c in [-5_i128, -2, 0, 1, 4] {
-                for d in [1_i128, 2, 3, 7] {
-                    let (an, ad) = small_fraction(a, b);
-                    let (bn, bd) = small_fraction(c, d);
-                    let left = exact(an, ad);
-                    let right = exact(bn, bd);
-                    let mut work = meter();
-                    let (n, den) = small_fraction(a * d + c * b, b * d);
-                    assert_fraction(&left.add(&right, &mut work).unwrap(), n, den);
-                    let (n, den) = small_fraction(a * d - c * b, b * d);
-                    assert_fraction(&left.subtract(&right, &mut work).unwrap(), n, den);
-                    let (n, den) = small_fraction(a * c, b * d);
-                    assert_fraction(&left.multiply(&right, &mut work).unwrap(), n, den);
-                    if c != 0 {
-                        let (n, den) = small_fraction(a * d, b * c);
-                        assert_fraction(&left.divide(&right, &mut work).unwrap(), n, den);
-                    } else {
-                        assert_eq!(
-                            left.divide(&right, &mut work),
-                            Err(NumericError::DivisionByZero)
-                        );
-                    }
-                    assert_eq!(
-                        left.compare(&right, &mut work).unwrap(),
-                        (a * d).cmp(&(c * b))
-                    );
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn decimals_are_exact_and_source_ratios_reduce() {
-    assert_fraction(
-        &source("0.1").add(&source("0.2"), &mut meter()).unwrap(),
-        3,
-        10,
-    );
-    assert_fraction(&source("0.50"), 1, 2);
-    assert_fraction(&source("12.50e-2"), 1, 8);
-    assert_fraction(&source("1e+3"), 1000, 1);
-    assert_fraction(&source("0001.2500"), 5, 4);
-    assert_fraction(&source(" ratio( -6, 8 ) "), -3, 4);
-    assert_fraction(&source("ratio(-0, 27)"), 0, 1);
-    assert_eq!(source("0.5").canonical_literal(), "ratio(1, 2)");
-    assert_eq!(source("42").canonical_literal(), "42");
-}
-
-#[test]
-fn powers_and_signs_have_explicit_domains() {
-    let x = exact(-2, 3);
-    assert_fraction(&x.power(3, &mut meter()).unwrap(), -8, 27);
-    assert_fraction(&x.power(-3, &mut meter()).unwrap(), -27, 8);
-    assert_fraction(&x.power(0, &mut meter()).unwrap(), 1, 1);
-    assert_fraction(&x.absolute(&mut meter()).unwrap(), 2, 3);
-    assert_fraction(&x.negated(&mut meter()).unwrap(), 2, 3);
-    assert_fraction(&x.reciprocal(&mut meter()).unwrap(), -3, 2);
-    let zero = Exact::from_integer(0);
-    assert_eq!(
-        zero.power(0, &mut meter()),
-        Err(NumericError::ZeroPowerZero)
-    );
-    assert_eq!(
-        zero.power(-1, &mut meter()),
-        Err(NumericError::DivisionByZero)
-    );
-    assert_eq!(x.power(17, &mut meter()), Err(NumericError::IntegerPower));
-    assert_eq!(
-        x.power(i8::MIN, &mut meter()),
-        Err(NumericError::IntegerPower)
-    );
-}
-
-#[test]
-fn canonical_wire_rejects_both_component_noncanonical_forms() {
-    for (n, d) in [
-        ("+1", "1"),
-        ("01", "1"),
-        ("-0", "1"),
-        ("1", "+1"),
-        ("1", "-1"),
-        ("1", "01"),
-        ("2", "4"),
-        ("0", "3"),
-        ("", "1"),
-        ("1", ""),
-        ("1.0", "1"),
-        ("1", "1.0"),
-        ("1e1", "1"),
-        ("1", "1e1"),
-        (" 1", "1"),
-        ("1", "1 "),
-    ] {
-        assert!(
-            Exact::from_wire(
-                &ExactWire {
-                    numerator: n.into(),
-                    denominator: d.into()
-                },
-                &mut meter(),
-            )
-            .is_err(),
-            "accepted {n}/{d}"
-        );
-    }
-    assert_eq!(
-        Exact::from_wire(
-            &ExactWire {
-                numerator: "1".into(),
-                denominator: "0".into()
-            },
-            &mut meter()
-        ),
-        Err(NumericError::ZeroDenominator)
-    );
-    assert_fraction(&exact(0, 1), 0, 1);
-    assert_fraction(&exact(-1, 2), -1, 2);
-}
-
-#[test]
-fn serde_uses_closed_canonical_string_wire() {
-    let value = exact(-3, 7);
-    let encoded = serde_json::to_value(&value).unwrap();
-    assert_eq!(
-        encoded,
-        serde_json::json!({"numerator":"-3","denominator":"7"})
-    );
-    assert_eq!(serde_json::from_value::<Exact>(encoded).unwrap(), value);
-    for invalid in [
-        r#"{"numerator":1,"denominator":"2"}"#,
-        r#"{"numerator":"1","denominator":2}"#,
-        r#"{"numerator":"1","denominator":"2","other":0}"#,
-        r#"{"numerator":"1","numerator":"2","denominator":"3"}"#,
-        r#"{"numerator":"1"}"#,
-        r#"{"numerator":"2","denominator":"4"}"#,
-    ] {
-        assert!(serde_json::from_str::<Exact>(invalid).is_err(), "{invalid}");
-    }
-}
-
-#[test]
-fn literal_reader_does_not_fold_expression_unary_minus() {
-    assert_eq!(
-        Exact::parse_literal("-2", &mut meter()),
-        Err(NumericError::InvalidLiteral)
-    );
-    let negative_literal = source("ratio(-2, 1)");
-    assert_eq!(negative_literal.canonical_literal(), "ratio(-2, 1)");
-    assert_eq!(source("2").negated(&mut meter()).unwrap(), negative_literal);
-    // Equality of coordinates does not claim AST equality. The expression
-    // parser must preserve UnaryNegate independently of its operand literal.
-    assert_eq!(source("2").canonical_literal(), "2");
-}
-
-#[test]
-fn literal_syntax_and_decimal_exponent_are_bounded() {
-    for invalid in [
-        "",
-        "-",
-        "+1",
-        ".5",
-        "1.",
-        "1.2.3",
-        "1e",
-        "1ee2",
-        "1e+-2",
-        "1_000",
-        "NaN",
-        "Infinity",
-        "1/2",
-        "ratio(1)",
-        "ratio(1,2,3)",
-        "ratio(1,-2)",
-        "ratio(+1,2)",
-        "ratio(1,2) + 1",
-        "１２",
-    ] {
-        assert!(
-            Exact::parse_literal(invalid, &mut meter()).is_err(),
-            "{invalid}"
-        );
-    }
-    for invalid in ["1e129", "1e-129", "1e9999999999999999999999"] {
-        assert_eq!(
-            Exact::parse_literal(invalid, &mut meter()),
-            Err(NumericError::DecimalExponent)
-        );
-    }
-    assert!(Exact::parse_literal("1e128", &mut meter()).is_ok());
-    assert!(Exact::parse_literal("1e-128", &mut meter()).is_ok());
-    assert_eq!(
-        Exact::parse_literal(&"1".repeat(MAX_COMPONENT_DIGITS + 1), &mut meter()),
-        Err(NumericError::LiteralTooLong)
-    );
-    assert_eq!(
-        Exact::parse_literal(&" ".repeat(MAX_LITERAL_BYTES + 1), &mut meter()),
-        Err(NumericError::LiteralTooLong)
-    );
-}
-
-#[test]
-fn full_independent_r7_packets_round_trip_as_literals_and_wire() {
-    let packets: serde_json::Value =
-        serde_json::from_str(include_str!("fixtures/r7-literal-boundaries.json")).unwrap();
-    for packet in packets.as_array().unwrap() {
-        let wire: ExactWire =
-            serde_json::from_value(packet["expression"]["Number"].clone()).unwrap();
-        let expected = Exact::from_wire(&wire, &mut meter()).unwrap();
-        let spelling = packet["canonical_source"].as_str().unwrap();
-        assert_eq!(expected.canonical_literal(), spelling);
-        assert_eq!(
-            Exact::parse_literal(spelling, &mut meter()).unwrap(),
-            expected
-        );
-        let serialized = serde_json::to_string(&expected).unwrap();
-        assert_eq!(
-            serde_json::from_str::<Exact>(&serialized).unwrap(),
-            expected
-        );
-        assert_eq!(expected.to_wire(), wire);
-    }
-}
-
-#[test]
-fn full_8193_bit_sum_intermediate_can_reduce_to_admitted_value() {
-    // N=(2^4096)-1, D=N-1. gcd(N,D)=1 and D is even.
-    // N/D + N/D = N/(D/2), although its un-reduced numerator needs 8193 bits.
-    let n = (BigInt::one() << 4096_usize) - 1_u8;
-    let d = &n - 1_u8;
-    let value = exact(&n, &d);
-    let result = value.add(&value, &mut meter()).unwrap();
-    assert_fraction(&result, &n, &d / 2_u8);
-}
-
-#[test]
-fn cross_products_cancel_before_reduced_component_limit() {
-    let n = BigInt::one() << 4095_usize;
-    let d = &n - 1_u8;
-    let left = exact(&n, &d);
-    let right = exact(&d, &n);
-    assert_fraction(&left.multiply(&right, &mut meter()).unwrap(), 1, 1);
-    assert_fraction(
-        &left
-            .add(&left.negated(&mut meter()).unwrap(), &mut meter())
-            .unwrap(),
-        0,
-        1,
-    );
-}
-
-#[test]
-fn both_reduced_component_overflows_are_reported() {
-    let n = BigInt::one() << 4095_usize;
-    let mut work = meter();
-    let failure = exact(&n, 1)
-        .multiply(&Exact::from_integer(2), &mut work)
-        .unwrap_err();
-    assert!(matches!(
-        failure,
-        NumericError::Limit(NumericLimit::Bits {
-            component: NumberComponent::Numerator,
-            bits: 4097,
-            ..
-        })
-    ));
-    assert!(work.exhaustion().is_none());
-    let failure = exact(1, &n)
-        .divide(&Exact::from_integer(2), &mut work)
-        .unwrap_err();
-    assert!(matches!(
-        failure,
-        NumericError::Limit(NumericLimit::Bits {
-            component: NumberComponent::Denominator,
-            bits: 4097,
-            ..
-        })
-    ));
-    // Value overflow is a nonterminal supported-operation failure; fuel
-    // exhaustion, in contrast, terminates the entire request.
-    assert_fraction(&source("1").add(&source("1"), &mut work).unwrap(), 2, 1);
-}
-
-#[test]
-fn wire_rejects_4097_bits_before_gcd_can_reduce_them() {
-    let oversized = (BigInt::one() << 4096_usize).to_string();
-    for wire in [
-        ExactWire {
-            numerator: oversized.clone(),
-            denominator: "1".into(),
-        },
-        ExactWire {
-            numerator: "1".into(),
-            denominator: oversized.clone(),
-        },
-        ExactWire {
-            numerator: oversized.clone(),
-            denominator: oversized,
-        },
-    ] {
-        assert!(matches!(
-            Exact::from_wire(&wire, &mut meter()),
-            Err(NumericError::Limit(NumericLimit::Bits { stage, .. })) if stage == "wire"
-        ));
-    }
-}
-
-#[test]
-fn numeric_precharge_precedes_big_integer_result_allocation() {
-    let n = BigInt::one() << 4095_usize;
-    let left = exact(&n, 1);
-    let mut work = WorkMeter::new(WorkLimits::new(10, 0).unwrap());
-    let failure = left
-        .multiply(&Exact::from_integer(2), &mut work)
-        .unwrap_err();
-    assert!(failure.is_terminal_work_exhaustion());
-    assert_eq!(work.usage().numeric_units, 0);
-    assert!(matches!(
-        work.exhaustion().unwrap().site,
-        WorkSite::Numeric(NumericOperation::Multiply)
-    ));
-    // With available fuel the same operation reaches the 4097-bit result check.
-    assert!(matches!(
-        left.multiply(&Exact::from_integer(2), &mut meter()),
-        Err(NumericError::Limit(NumericLimit::Bits { .. }))
-    ));
-    let too_wide_wire = ExactWire {
-        numerator: (BigInt::one() << 4096_usize).to_string(),
-        denominator: "1".into(),
-    };
-    let mut parse_work = WorkMeter::new(WorkLimits::new(0, 0).unwrap());
-    assert!(
-        Exact::from_wire(&too_wide_wire, &mut parse_work)
-            .unwrap_err()
-            .is_terminal_work_exhaustion()
-    );
-}
-
-#[test]
-fn provisional_limits_and_effective_limits_round_trip() {
-    let limits = WorkLimits::new(500, 2000).unwrap();
-    let encoded = serde_json::to_value(limits).unwrap();
-    assert_eq!(
-        encoded,
-        serde_json::json!({"dynamic_events":500,"numeric_units":2000})
-    );
-    assert_eq!(
-        serde_json::from_value::<WorkLimits>(encoded).unwrap(),
-        limits
-    );
-    assert_eq!(
-        WorkLimits::new(1_000_001, 0),
-        Err(NumericError::InvalidWorkLimits)
-    );
-    assert_eq!(
-        WorkLimits::new(0, 50_000_001),
-        Err(NumericError::InvalidWorkLimits)
-    );
-    assert!(
-        serde_json::from_str::<WorkLimits>(r#"{"dynamic_events":1000001,"numeric_units":0}"#)
-            .is_err()
-    );
-}
-
-#[test]
-fn exact_accounting_boundary_and_terminal_failure_are_stable() {
-    // One-word addition: three products at 2, one sum at 2,
-    // normalization at 67 => 75 logical numeric units.
-    let mut work = WorkMeter::new(WorkLimits::new(4, 75).unwrap());
-    assert_fraction(&exact(1, 2).add(&exact(1, 3), &mut work).unwrap(), 5, 6);
-    assert_eq!(work.usage().numeric_units, 75);
-    assert!(work.exhaustion().is_none());
-    let first = Exact::from_integer(1).negated(&mut work).unwrap_err();
-    let at_failure = work.usage();
-    assert_eq!(
-        work.exhaustion().unwrap(),
-        &WorkExhaustion {
-            resource: WorkResource::NumericUnits,
-            used: 75,
-            requested: 3,
-            limit: 75,
-            site: WorkSite::Numeric(NumericOperation::Negate),
-        }
-    );
-    assert_eq!(work.visit(EvaluationStep::Target).unwrap_err(), first);
-    assert_eq!(
-        Exact::from_integer(1)
-            .divide(&Exact::from_integer(0), &mut work)
-            .unwrap_err(),
-        first
-    );
-    assert_eq!(
-        work.numeric(NumericOperation::Compare, 0).unwrap_err(),
-        first
-    );
-    assert_eq!(work.usage(), at_failure);
-}
-
-#[test]
-fn zero_cost_and_maximum_reservation_do_not_underflow_or_reactivate() {
-    let mut work = WorkMeter::new(WorkLimits::new(0, 0).unwrap());
-    work.numeric(NumericOperation::Compare, 0).unwrap();
-    let failure = work
-        .numeric(NumericOperation::Multiply, u64::MAX)
-        .unwrap_err();
-    assert!(failure.is_terminal_work_exhaustion());
-    assert_eq!(work.usage(), WorkUsage::default());
-    assert_eq!(
-        work.numeric(NumericOperation::Compare, 0).unwrap_err(),
-        failure
-    );
-    let mut dynamic = WorkMeter::new(WorkLimits::new(0, 5).unwrap());
-    assert!(dynamic.visit(EvaluationStep::Target).is_err());
-    assert_eq!(dynamic.usage(), WorkUsage::default());
-}
-
-#[test]
-fn multiple_targets_share_one_aggregate_meter() {
-    let mut work = WorkMeter::new(WorkLimits::new(3, 50).unwrap());
-    work.visit(EvaluationStep::Target).unwrap();
-    work.visit(EvaluationStep::Expression).unwrap();
-    work.visit(EvaluationStep::Target).unwrap();
-    let failure = work.visit(EvaluationStep::Expression).unwrap_err();
-    assert!(failure.is_terminal_work_exhaustion());
-    assert_eq!(work.usage().dynamic_events, 3);
-}
-
-// A direct bounded call-tree workload, not an expression interpreter/dialect.
-fn expanded_calls(
-    depth: u8,
-    x: u64,
-    work: &mut WorkMeter,
-    entered: &mut u64,
-) -> Result<u64, NumericError> {
-    work.visit(EvaluationStep::CalculationEntry)?;
-    *entered += 1;
-    if depth == 0 {
-        return Ok(x);
-    }
-    let left = expanded_calls(depth - 1, 2 * x, work, entered)?;
-    let right = expanded_calls(depth - 1, 2 * x + 1, work, entered)?;
-    Ok(left + right)
-}
-
-#[test]
-fn c1_expanded_call_witness_terminates_at_dynamic_limit() {
-    let mut work = WorkMeter::new(WorkLimits::new(10_000, 0).unwrap());
-    let mut entered = 0;
-    let failure = expanded_calls(30, 0, &mut work, &mut entered).unwrap_err();
-    assert!(failure.is_terminal_work_exhaustion());
-    assert_eq!(entered, 10_000);
-    assert_eq!(work.usage().dynamic_events, 10_000);
-    assert_eq!(
-        work.exhaustion().unwrap().site,
-        WorkSite::Evaluation(EvaluationStep::CalculationEntry)
-    );
-    // Nearby finite control: 63 invocations, leaves 0..31, sum 496.
-    let mut bounded = WorkMeter::new(WorkLimits::new(63, 0).unwrap());
-    let mut entered = 0;
-    assert_eq!(
-        expanded_calls(5, 0, &mut bounded, &mut entered).unwrap(),
-        496
-    );
-    assert_eq!(entered, 63);
-    assert!(bounded.exhaustion().is_none());
-}
-
-fn dim(value: [i16; 7]) -> Dimension {
-    Dimension::new(value).unwrap()
-}
-
-fn linear(key: &str, dimension: Dimension) -> ResolvedKind<String> {
-    ResolvedKind::linear(key.to_owned(), dimension)
-}
-
-fn named(n: i64, kind: &ResolvedKind<String>) -> NumericValue<String> {
-    NumericValue::new(NumericType::Named(kind.clone()), Exact::from_integer(n))
-}
-
-#[test]
-fn dimensions_use_checked_seven_axis_integer_algebra() {
-    let length = dim([1, 0, 0, 0, 0, 0, 0]);
-    let mass = dim([0, 1, 0, 0, 0, 0, 0]);
-    let time = dim([0, 0, 1, 0, 0, 0, 0]);
-    assert_eq!(
-        mass.checked_product(length)
-            .unwrap()
-            .checked_quotient(time.checked_power(2).unwrap())
-            .unwrap(),
-        dim([1, 1, -2, 0, 0, 0, 0])
-    );
-    assert!(time.checked_quotient(time).unwrap().is_dimensionless());
-    assert!(matches!(
-        dim([32, 0, 0, 0, 0, 0, 0]).checked_product(length),
-        Err(NumericError::DimensionExponent {
-            axis: DimensionAxis::Length,
-            value: 33
-        })
-    ));
-    assert!(dim([0, 0, -32, 0, 0, 0, 0]).checked_quotient(time).is_err());
-    assert!(length.checked_power(i8::MIN).is_err());
-    assert!(Dimension::new([33, 0, 0, 0, 0, 0, 0]).is_err());
-    assert_eq!(
-        serde_json::to_value(time).unwrap(),
-        serde_json::json!([0, 0, 1, 0, 0, 0, 0])
-    );
-    for invalid in ["[0,0,33,0,0,0,0]", "[0,0,1]", "[0,0,1,0,0,0,0,0]"] {
-        assert!(serde_json::from_str::<Dimension>(invalid).is_err());
-    }
-}
-
-#[test]
-fn duration_unit_coordinates_are_exact_and_nominal() {
-    let duration = linear("duration", dim([0, 0, 1, 0, 0, 0, 0]));
-    let s = Unit::new(duration.clone(), source("1"), source("0")).unwrap();
-    let ms = Unit::new(duration.clone(), source("0.001"), source("0")).unwrap();
-    assert_fraction(&ms.convert(&source("750"), &s, &mut meter()).unwrap(), 3, 4);
-    let receive = NumericValue::from_unit(&source("750"), &ms, &mut meter()).unwrap();
-    let dispatch = NumericValue::from_unit(&source("1"), &s, &mut meter()).unwrap();
-    let total = receive.add(&dispatch, &mut meter()).unwrap();
-    assert_fraction(total.coordinate(), 7, 4);
-    assert_fraction(&total.display_in(&ms, &mut meter()).unwrap(), 1750, 1);
-    let different = Unit::new(
-        linear("different-kind", duration.dimension()),
-        source("1"),
-        source("0"),
-    )
-    .unwrap();
-    assert_eq!(
-        ms.convert(&source("750"), &different, &mut meter()),
-        Err(NumericError::IncompatibleTypes)
-    );
-    let inconsistent = Unit::new(
-        linear("duration", dim([1, 0, 0, 0, 0, 0, 0])),
-        source("1"),
-        source("0"),
-    )
-    .unwrap();
-    assert!(
-        ms.convert(&source("1"), &inconsistent, &mut meter())
-            .is_err()
-    );
-    assert!(Unit::new(duration.clone(), source("0"), source("0")).is_err());
-    assert!(Unit::new(duration.clone(), source("ratio(-1,1)"), source("0")).is_err());
-    assert_eq!(
-        Unit::new(duration, source("1"), source("1")).unwrap_err(),
-        NumericError::LinearOffset
-    );
-}
-
-#[test]
-fn affine_point_and_difference_arithmetic_has_distinct_kinds() {
-    let interval = linear("temperature-difference", dim([0, 0, 0, 0, 1, 0, 0]));
-    let point = ResolvedKind::affine("temperature-point".to_owned(), &interval).unwrap();
-    let celsius = Unit::new(point.clone(), source("1"), source("273.15")).unwrap();
-    let fahrenheit = Unit::new(
-        point.clone(),
-        source("ratio(5,9)"),
-        source("ratio(45967,180)"),
-    )
-    .unwrap();
-    let kelvin_interval = Unit::new(interval.clone(), source("1"), source("0")).unwrap();
-    assert_fraction(
-        &celsius
-            .convert(&source("0"), &fahrenheit, &mut meter())
-            .unwrap(),
-        32,
-        1,
-    );
-    assert_fraction(
-        &fahrenheit
-            .convert(&source("70"), &celsius, &mut meter())
-            .unwrap(),
-        190,
-        9,
-    );
-    let p20 = NumericValue::from_unit(&source("20"), &celsius, &mut meter()).unwrap();
-    let p10 = NumericValue::from_unit(&source("10"), &celsius, &mut meter()).unwrap();
-    let difference = p20.subtract(&p10, &mut meter()).unwrap();
-    assert_eq!(
-        difference.value_type(),
-        &NumericType::Named(interval.clone())
-    );
-    assert_fraction(
-        &difference
-            .display_in(&kelvin_interval, &mut meter())
-            .unwrap(),
-        10,
-        1,
-    );
-    let delta5 = named(5, &interval);
-    let p25 = p20.add(&delta5, &mut meter()).unwrap();
-    assert_fraction(&p25.display_in(&celsius, &mut meter()).unwrap(), 25, 1);
-    assert_eq!(delta5.add(&p20, &mut meter()).unwrap(), p25);
-    assert!(p20.add(&p10, &mut meter()).is_err());
-    assert!(delta5.subtract(&p20, &mut meter()).is_err());
-    assert_eq!(
-        p20.power(1, &mut meter()),
-        Err(NumericError::AffineOperation)
-    );
-    assert_eq!(
-        p20.negated(&mut meter()),
-        Err(NumericError::AffineOperation)
-    );
-    assert_eq!(p20.compare(&p10, &mut meter()).unwrap(), Ordering::Greater);
-    assert!(p20.display_in(&kelvin_interval, &mut meter()).is_err());
-    assert!(ResolvedKind::affine(interval.key().clone(), &interval).is_err());
-    assert!(ResolvedKind::affine("other".to_owned(), &point).is_err());
-}
-
-#[test]
-fn affine_conversion_rejects_a_wider_stage_even_when_the_final_value_would_fit() {
-    // A fused coordinate calculation 2*m-m equals m, where m=2^4095 fits.
-    // The fixed multiply stage produces 2^4096, so it must fail before offset
-    // cancellation. The inverse path likewise rejects (m-(-m))/2 at subtraction.
-    let large = BigInt::one() << 4095_usize;
-    let magnitude = exact(&large, 1);
-    let interval = linear("temperature-interval", dim([0, 0, 0, 0, 1, 0, 0]));
-    let point = ResolvedKind::affine("temperature-point".to_owned(), &interval).unwrap();
-    let unit = Unit::new(point, Exact::from_integer(2), exact(-&large, 1)).unwrap();
-    let mut work = meter();
-    for outcome in [
-        unit.to_canonical(&magnitude, &mut work),
-        unit.from_canonical(&magnitude, &mut work),
-    ] {
-        assert!(matches!(
-            outcome,
-            Err(NumericError::Limit(NumericLimit::Bits {
-                component: NumberComponent::Numerator,
-                bits: 4097,
-                limit: MAX_COMPONENT_BITS,
-                ..
-            }))
-        ));
-    }
-    assert!(work.exhaustion().is_none());
-    let half = exact(&large >> 1_usize, 1);
-    assert_fraction(&unit.to_canonical(&half, &mut work).unwrap(), 0, 1);
-    assert_eq!(
-        unit.from_canonical(&Exact::from_integer(0), &mut work)
-            .unwrap(),
-        half
-    );
-}
-
-#[test]
-fn r6_anonymous_compound_energy_needs_one_outer_assertion() {
-    let force = linear("force", dim([1, 1, -2, 0, 0, 0, 0]));
-    let length = linear("length", dim([1, 0, 0, 0, 0, 0, 0]));
-    let energy = linear("energy", dim([2, 1, -2, 0, 0, 0, 0]));
-    let a = named(3, &force)
-        .multiply(&named(4, &length), &mut meter())
-        .unwrap();
-    let b = named(2, &force)
-        .multiply(&named(7, &length), &mut meter())
-        .unwrap();
-    assert_eq!(a.value_type(), &NumericType::Anonymous(energy.dimension()));
-    let sum = a.add(&b, &mut meter()).unwrap();
-    let result = sum.as_kind(&energy, &mut meter()).unwrap();
-    assert_fraction(result.coordinate(), 26, 1);
-    assert_eq!(result.value_type(), &NumericType::Named(energy.clone()));
-    assert_eq!(a.compare(&b, &mut meter()).unwrap(), Ordering::Less);
-    assert!(result.add(&sum, &mut meter()).is_err());
-    assert_eq!(
-        result.as_kind(&energy, &mut meter()),
-        Err(NumericError::KindAssertion)
-    );
-}
-
-#[test]
-fn anonymous_product_then_quotient_closes_and_preserves_scaling() {
-    let mass = linear("mass", dim([0, 1, 0, 0, 0, 0, 0]));
-    let length = linear("length", dim([1, 0, 0, 0, 0, 0, 0]));
-    let time = linear("duration", dim([0, 0, 1, 0, 0, 0, 0]));
-    let momentum = linear("momentum", dim([1, 1, -1, 0, 0, 0, 0]));
-    let result = named(2, &mass)
-        .multiply(&named(3, &length), &mut meter())
-        .unwrap()
-        .divide(&named(2, &time), &mut meter())
-        .unwrap()
-        .as_kind(&momentum, &mut meter())
-        .unwrap();
-    assert_fraction(result.coordinate(), 3, 1);
-    let scalar = NumericValue::number(source("2"));
-    let scaled = scalar.multiply(&named(3, &time), &mut meter()).unwrap();
-    assert_eq!(scaled.value_type(), &NumericType::Named(time.clone()));
-    assert_fraction(scaled.coordinate(), 6, 1);
-    assert_eq!(
-        named(3, &time)
-            .divide(&scalar, &mut meter())
-            .unwrap()
-            .value_type(),
-        &NumericType::Named(time.clone())
-    );
-    assert_eq!(
-        scalar
-            .divide(&named(3, &time), &mut meter())
-            .unwrap()
-            .value_type(),
-        &NumericType::Anonymous(dim([0, 0, -1, 0, 0, 0, 0]))
-    );
-}
-
-#[test]
-fn nominal_kinds_survive_comparison_but_explicit_quotients_can_erase_dimension() {
-    let energy = linear("energy", dim([2, 1, -2, 0, 0, 0, 0]));
-    let torque = linear("torque", energy.dimension());
-    let left = named(7, &energy);
-    let right = named(7, &torque);
-    assert!(left.add(&right, &mut meter()).is_err());
-    assert!(left.compare(&right, &mut meter()).is_err());
-    let ratio = left.divide(&right, &mut meter()).unwrap();
-    assert_eq!(ratio.value_type(), &NumericType::Number);
-    assert_fraction(ratio.coordinate(), 1, 1);
-    let named_ratio = linear("chosen-ratio", Dimension::ZERO);
-    let asserted = ratio.as_kind(&named_ratio, &mut meter()).unwrap();
-    assert_eq!(
-        asserted.value_type(),
-        &NumericType::Named(named_ratio.clone())
-    );
-    assert!(asserted.add(&ratio, &mut meter()).is_err());
-    assert_eq!(
-        NumericValue::<String>::new(NumericType::Anonymous(Dimension::ZERO), source("1")),
-        NumericValue::number(source("1"))
-    );
-}
-
-#[test]
-fn numerical_power_types_and_dimension_overflow_are_checked() {
-    let length = linear("length", dim([1, 0, 0, 0, 0, 0, 0]));
-    let value = named(2, &length);
-    assert_eq!(
-        value.power(0, &mut meter()).unwrap().value_type(),
-        &NumericType::Number
-    );
-    assert_eq!(
-        value.power(1, &mut meter()).unwrap().value_type(),
-        value.value_type()
-    );
-    assert_eq!(
-        value.power(-2, &mut meter()).unwrap().value_type(),
-        &NumericType::Anonymous(dim([-2, 0, 0, 0, 0, 0, 0]))
-    );
-    let large_dimension = linear("large-dimension", dim([32, 0, 0, 0, 0, 0, 0]));
-    assert!(
-        named(1, &large_dimension)
-            .multiply(&value, &mut meter())
-            .is_err()
-    );
-    assert!(named(1, &large_dimension).power(2, &mut meter()).is_err());
-}

crates/oa-core/src/demo.rs

@@ -81,6 +81,7 @@ fn diagram(
             projection,
             view_options: Default::default(),
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-core/src/language.rs

@@ -1823,7 +1823,7 @@ pub(crate) fn resolve_declarations(
                         return Err(conversion_error(std::format!("Unknown diagram field '{key}' in the frozen pre6 contract.")));
                     }
                     let defaults =
-                        serde_json::json!({"description":"","layer":"Oa","projection":"Overview","routes":[],"view_options":crate::view_options::ViewOptions::default()});
+                        serde_json::json!({"description":"","layer":"Oa","projection":"Overview","routes":[],"view_options":crate::view_options::ViewOptions::default(),"layout":null});
                     let mut record = merge_fields(defaults.as_object().unwrap().clone(), fields)
                         .map_err(&conversion_error)?;
                     header(&mut record, d, true);

crates/oa-core/src/lib.rs

@@ -1,5 +1,4 @@
 //! Framework-independent OA/SA model, transactional commands and editing services.
-pub mod analysis_numeric;
 pub mod data;
 pub mod language;
 pub mod model;
@@ -9,6 +8,7 @@ pub mod ports;
 pub mod projection;
 pub mod references;
 pub mod routing;
+pub mod scenario_layout;
 pub mod semantic;
 pub mod session;
 pub mod source_files;
@@ -19,6 +19,9 @@ pub mod validation;
 pub mod view_options;
 pub use model::*;
 pub use ports::*;
+pub use scenario_layout::{
+    DiagramLayout, ScenarioLanePosition, ScenarioLayout, ScenarioMessagePosition,
+};
 pub use semantic::*;
 pub use session::*;
 mod demo;

crates/oa-core/src/model.rs

@@ -1436,6 +1436,7 @@ pub enum ProjectionKind {
     FunctionalDataflow,
     Capabilities,
     StateMachine { machine: Id },
+    Scenario { scenario: Id },
 }
 impl ProjectionKind {
     pub fn state_machine(self) -> Option<Id> {
@@ -1445,8 +1446,30 @@ impl ProjectionKind {
         }
     }
 
+    /// The semantic owner of a saved Scenario representation.
+    pub fn scenario(self) -> Option<Id> {
+        match self {
+            Self::Scenario { scenario } => Some(scenario),
+            _ => None,
+        }
+    }
+
+    /// Explicitly classify architecture views; absence of a state machine is insufficient.
+    pub fn is_architecture(self) -> bool {
+        match self {
+            Self::Overview
+            | Self::Decomposition
+            | Self::Allocation
+            | Self::Traceability
+            | Self::FunctionalDataflow
+            | Self::Capabilities => true,
+            Self::StateMachine { .. } | Self::Scenario { .. } => false,
+        }
+    }
+
     pub fn includes(self, kind: Kind) -> bool {
         match self {
+            Self::Scenario { .. } => false,
             Self::StateMachine { .. } => {
                 matches!(kind, Kind::StateMachine | Kind::Region) || kind.is_state()
             }
@@ -1471,6 +1494,7 @@ impl std::fmt::Display for ProjectionKind {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(match self {
             Self::StateMachine { .. } => "State machine",
+            Self::Scenario { .. } => "Scenario",
             Self::Allocation => "Architecture · allocated work",
             Self::FunctionalDataflow => "Functional dataflow",
             Self::Capabilities => "Missions & capabilities",
@@ -1495,6 +1519,8 @@ pub struct Diagram {
     pub nodes: BTreeMap<Id, NodePlacement>,
     #[serde(default)]
     pub routes: Vec<EdgeRoute>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub layout: Option<crate::scenario_layout::DiagramLayout>,
 }
 /// Authored presentation for one existing relation or trace in one diagram.
 /// Computed endpoints and automatic routing elbows are never persisted here.
@@ -1921,6 +1947,7 @@ impl Project {
                 view_options: crate::view_options::ViewOptions::default(),
                 nodes: BTreeMap::new(),
                 routes: vec![],
+                layout: None,
             },
         );
         id

crates/oa-core/src/projection.rs

@@ -278,6 +278,11 @@ fn project_diagram_impl(
     mut availability: Option<&mut BTreeMap<Id, crate::view_options::EdgeAvailability>>,
     index: Option<&crate::view_options::ViewIndex>,
 ) -> ProjectedView {
+    // Saved Scenario layout is not an architecture/state projection. Its dedicated
+    // renderer is not wired yet; never interpret its payload through this fallback.
+    if d.projection.scenario().is_some() {
+        return ProjectedView::default();
+    }
     let parents = parents(p, d);
     let mut nodes = Vec::new();
     for n in d.nodes.values() {
@@ -394,6 +399,7 @@ fn project_diagram_impl(
             continue;
         }
         let included = match d.projection {
+            ProjectionKind::Scenario { .. } => false,
             ProjectionKind::StateMachine { machine } => matches!(&r.body,
                 RelationBody::StateTransition { transition_kind, .. }
                     if *transition_kind != TransitionKind::Internal

crates/oa-core/src/references.rs

@@ -203,7 +203,81 @@ pub fn visit_relation_refs(r: &mut Relation, mut visit: impl FnMut(&mut Id)) {
         _ => {}
     }
 }
-pub fn remap_references(p: &mut Project, old: Id, new: Id) {
+/// Every semantic/presentation reference in a diagram, excluding its own identities.
+pub fn diagram_references(d: &Diagram) -> Vec<Id> {
+    let mut copy = d.clone();
+    let mut refs = Vec::new();
+    visit_diagram_refs(&mut copy, |id| refs.push(*id));
+    refs
+}
+
+pub fn visit_diagram_refs(d: &mut Diagram, mut visit: impl FnMut(&mut Id)) {
+    d.view_options.visit_references(&mut visit);
+    match &mut d.projection {
+        ProjectionKind::StateMachine { machine } => visit(machine),
+        ProjectionKind::Scenario { scenario } => visit(scenario),
+        _ => {}
+    }
+    if let Some(layout) = &mut d.layout {
+        layout.visit_references(&mut visit);
+    }
+    for route in &mut d.routes {
+        visit(&mut route.edge);
+    }
+    for node in d.nodes.values_mut() {
+        for anchor in &mut node.port_anchors {
+            visit(&mut anchor.port);
+        }
+        visit(&mut node.element);
+    }
+}
+
+/// Preflight reference-key collisions before the caller changes object identities.
+/// Fresh targets are allowed. This is not whole-project admission: unrelated
+/// invalid records remain repairable within a transaction. Future typed reference
+/// domains must compose their own preflight here before any remap mutation.
+pub fn check_remap(p: &Project, old: Id, new: Id) -> Result<(), ModelError> {
+    if old == new {
+        return Ok(());
+    }
+    let remap = |id: Id| if id == old { new } else { id };
+    for diagram in p.diagrams.values() {
+        let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+            continue;
+        };
+        let mut lanes = std::collections::BTreeMap::new();
+        for lane in &layout.lanes {
+            let affected = lane.lifeline == old;
+            if let Some(previous_affected) = lanes.insert(remap(lane.lifeline), affected)
+                && (affected || previous_affected)
+            {
+                return Err(ModelError(
+                    "Identity remap would collide with a Scenario lane position.".into(),
+                ));
+            }
+        }
+        let mut messages = std::collections::BTreeMap::new();
+        for message in &layout.messages {
+            let mut address = message.address.clone();
+            let affected = address.occurrence == old || address.references.contains(&old);
+            address.occurrence = remap(address.occurrence);
+            for reference in &mut address.references {
+                *reference = remap(*reference);
+            }
+            if let Some(previous_affected) = messages.insert(address, affected)
+                && (affected || previous_affected)
+            {
+                return Err(ModelError(
+                    "Identity remap would collide with a Scenario message position.".into(),
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+pub fn remap_references(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
+    check_remap(p, old, new)?;
     for e in p.elements.values_mut() {
         visit_element_refs(e, |id| {
             if *id == old {
@@ -219,31 +293,11 @@ pub fn remap_references(p: &mut Project, old: Id, new: Id) {
         });
     }
     for d in p.diagrams.values_mut() {
-        d.view_options.visit_references(|id| {
+        visit_diagram_refs(d, |id| {
             if *id == old {
                 *id = new;
             }
         });
-        if let ProjectionKind::StateMachine { machine } = &mut d.projection
-            && *machine == old
-        {
-            *machine = new;
-        }
-        for route in &mut d.routes {
-            if route.edge == old {
-                route.edge = new;
-            }
-        }
-        for n in d.nodes.values_mut() {
-            for anchor in &mut n.port_anchors {
-                if anchor.port == old {
-                    anchor.port = new;
-                }
-            }
-            if n.element == old {
-                n.element = new;
-            }
-        }
     }
     for a in p.artifact_links.values_mut() {
         if a.owner == old {
@@ -265,6 +319,7 @@ pub fn remap_references(p: &mut Project, old: Id, new: Id) {
             });
         }
     }
+    Ok(())
 }
 /// IDs removed by a cascade. Cross-layer traced counterparts are never included.
 pub fn deletion_impact(p: &Project, id: Id) -> BTreeSet<Id> {
@@ -339,7 +394,8 @@ fn deletion_impact_inner(p: &Project, id: Id, defer_exchange_allocations: bool)
         for d in p.diagrams.values() {
             if d.projection
                 .state_machine()
-                .is_some_and(|machine| removed.contains(&machine))
+                .or_else(|| d.projection.scenario())
+                .is_some_and(|owner| removed.contains(&owner))
             {
                 removed.insert(d.id);
             }
@@ -412,6 +468,7 @@ fn remove_objects(p: &mut Project, removed: BTreeSet<Id>) {
     p.artifact_links.retain(|id, _| !removed.contains(id));
     for d in p.diagrams.values_mut() {
         d.view_options.retain_references(|id| !removed.contains(id));
+        crate::scenario_layout::prune_deleted(d, &removed);
         d.nodes.retain(|id, _| !removed.contains(id));
         d.routes.retain(|route| !removed.contains(&route.edge));
         for node in d.nodes.values_mut() {
@@ -589,3 +646,7 @@ fn remove_objects(p: &mut Project, removed: BTreeSet<Id>) {
         }
     }
 }
+
+#[cfg(test)]
+#[path = "references/scenario_layout_tests.rs"]
+mod scenario_layout_tests;

crates/oa-core/src/references/scenario_layout_tests.rs

@@ -0,0 +1,388 @@
+use super::*;
+use std::collections::BTreeMap;
+
+struct Fixture {
+    project: Project,
+    owner: Id,
+    lanes: [Id; 2],
+    messages: [Id; 2],
+    views: [Id; 2],
+}
+
+fn address(occurrence: Id) -> OccurrenceEndpoint {
+    OccurrenceEndpoint {
+        references: vec![],
+        occurrence,
+    }
+}
+
+fn layout(project: &Project, view: Id) -> &ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) = &project.diagrams[&view].layout else {
+        panic!("expected authored Scenario positions")
+    };
+    layout
+}
+
+fn layout_mut(project: &mut Project, view: Id) -> &mut ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) =
+        &mut project.diagrams.get_mut(&view).unwrap().layout
+    else {
+        panic!("expected authored Scenario positions")
+    };
+    layout
+}
+
+fn admitted(project: &Project) {
+    let errors: Vec<_> = crate::validation::validate(project)
+        .into_iter()
+        .filter(|issue| issue.severity == crate::validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+}
+
+fn fixture() -> Fixture {
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::Scenario, Layer::Oa, "Delivery", None)
+        .unwrap();
+    let lanes = ["Sender", "Receiver"].map(|name| {
+        project
+            .add_element(Kind::Lifeline, Layer::Oa, name, Some(owner))
+            .unwrap()
+    });
+    let messages = ["First message", "Second message"].map(|name| {
+        let id = project
+            .add_element(Kind::Occurrence, Layer::Oa, name, Some(owner))
+            .unwrap();
+        *project.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange {
+                exchange: None,
+                sender: Some(lanes[0]),
+                receiver: Some(lanes[1]),
+                message_kind: MessageKind::Asynchronous,
+                reply_to: None,
+                values: vec![],
+                operation: None,
+            },
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+        id
+    });
+    *project
+        .elements
+        .get_mut(&owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = messages.to_vec();
+    let views = ["delivery_view", "review_view"].map(|alias| {
+        let id = Id::new_v4();
+        project.diagrams.insert(
+            id,
+            Diagram {
+                id,
+                alias: alias.into(),
+                name: alias.into(),
+                description: String::new(),
+                layer: Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: owner },
+                view_options: Default::default(),
+                nodes: BTreeMap::new(),
+                routes: vec![],
+                layout: Some(DiagramLayout::Scenario(ScenarioLayout {
+                    lanes: vec![
+                        ScenarioLanePosition {
+                            lifeline: lanes[0],
+                            x: 120.,
+                        },
+                        ScenarioLanePosition {
+                            lifeline: lanes[1],
+                            x: 420.,
+                        },
+                    ],
+                    messages: vec![
+                        ScenarioMessagePosition {
+                            address: address(messages[0]),
+                            send_y: 220.,
+                        },
+                        ScenarioMessagePosition {
+                            address: address(messages[1]),
+                            send_y: 360.,
+                        },
+                    ],
+                })),
+            },
+        );
+        id
+    });
+    admitted(&project);
+    Fixture {
+        project,
+        owner,
+        lanes,
+        messages,
+        views,
+    }
+}
+
+#[test]
+fn fresh_identity_swap_preserves_coordinates_and_semantic_sequence() {
+    let mut f = fixture();
+    let before = f.project.clone();
+    let temporary = Id::new_v4();
+    for ids in [f.lanes, f.messages] {
+        f.project = crate::execute_batch(
+            &f.project,
+            &[
+                Command::Reidentify(ids[0], temporary),
+                Command::Reidentify(ids[1], ids[0]),
+                Command::Reidentify(temporary, ids[1]),
+            ],
+        )
+        .unwrap();
+    }
+    admitted(&f.project);
+    assert_eq!(
+        f.project.elements[&f.owner].steps().unwrap(),
+        &vec![f.messages[1], f.messages[0]]
+    );
+    for view in f.views {
+        let rows = layout(&f.project, view);
+        assert_eq!(
+            rows.lanes,
+            vec![
+                ScenarioLanePosition {
+                    lifeline: f.lanes[1],
+                    x: 120.
+                },
+                ScenarioLanePosition {
+                    lifeline: f.lanes[0],
+                    x: 420.
+                }
+            ]
+        );
+        assert_eq!(
+            rows.messages,
+            vec![
+                ScenarioMessagePosition {
+                    address: address(f.messages[1]),
+                    send_y: 220.
+                },
+                ScenarioMessagePosition {
+                    address: address(f.messages[0]),
+                    send_y: 360.
+                }
+            ]
+        );
+    }
+    // Reverse the swaps: no values or identities other than those requested drift.
+    for ids in [f.lanes, f.messages] {
+        f.project = crate::execute_batch(
+            &f.project,
+            &[
+                Command::Reidentify(ids[0], temporary),
+                Command::Reidentify(ids[1], ids[0]),
+                Command::Reidentify(temporary, ids[1]),
+            ],
+        )
+        .unwrap();
+    }
+    assert_eq!(f.project, before);
+}
+
+#[test]
+fn colliding_lane_or_message_remap_rejects_before_any_reference_changes() {
+    for message in [false, true] {
+        let mut f = fixture();
+        let [old, new] = if message { f.messages } else { f.lanes };
+        let before = f.project.clone();
+        assert!(check_remap(&f.project, old, new).is_err());
+        assert!(remap_references(&mut f.project, old, new).is_err());
+        assert_eq!(f.project, before);
+    }
+}
+
+#[test]
+fn reidentify_preflight_precedes_object_map_mutation_for_fresh_colliding_target() {
+    let mut f = fixture();
+    let fresh = Id::new_v4();
+    // A repair candidate can already have a dangling coordinate key. It must not
+    // silently merge with the live lane, even though the destination ID is vacant.
+    layout_mut(&mut f.project, f.views[0]).lanes[1].lifeline = fresh;
+    let before = f.project.clone();
+    assert!(crate::session::reidentify(&mut f.project, f.lanes[0], fresh).is_err());
+    assert_eq!(f.project, before);
+}
+
+#[test]
+fn full_address_paths_are_walked_and_collision_checked_without_admitting_expansion() {
+    let mut f = fixture();
+    let [old, new] = [Id::new_v4(), Id::new_v4()];
+    let rows = layout_mut(&mut f.project, f.views[0]);
+    // Future/invalid expanded candidates still participate in reference safety.
+    rows.messages[0].address.references = vec![old];
+    rows.messages[1].address = OccurrenceEndpoint {
+        references: vec![new],
+        occurrence: f.messages[0],
+    };
+    let refs = diagram_references(&f.project.diagrams[&f.views[0]]);
+    assert!(refs.contains(&f.owner) && refs.contains(&old) && refs.contains(&new));
+    let before = f.project.clone();
+    assert!(remap_references(&mut f.project, old, new).is_err());
+    assert_eq!(f.project, before);
+    let fresh = Id::new_v4();
+    remap_references(&mut f.project, old, fresh).unwrap();
+    let rows = layout(&f.project, f.views[0]);
+    assert_eq!(rows.messages[0].address.references, vec![fresh]);
+    assert_eq!(rows.messages[0].address.occurrence, f.messages[0]);
+    assert_eq!(rows.messages[1].address.references, vec![new]);
+}
+
+#[test]
+fn owner_reidentify_and_delete_cover_all_saved_views_without_deleting_other_owners() {
+    let mut f = fixture();
+    let other_owner = f
+        .project
+        .add_element(Kind::Scenario, Layer::Oa, "Independent", None)
+        .unwrap();
+    let mut other_view = f.project.diagrams[&f.views[0]].clone();
+    other_view.id = Id::new_v4();
+    other_view.alias = "independent_view".into();
+    other_view.projection = ProjectionKind::Scenario {
+        scenario: other_owner,
+    };
+    other_view.layout = None;
+    f.project.diagrams.insert(other_view.id, other_view.clone());
+    admitted(&f.project);
+    let fresh_owner = Id::new_v4();
+    f.project = crate::prepare_command(&f.project, &Command::Reidentify(f.owner, fresh_owner))
+        .unwrap()
+        .project;
+    for view in f.views {
+        assert_eq!(
+            f.project.diagrams[&view].projection.scenario(),
+            Some(fresh_owner)
+        );
+    }
+    let impact = deletion_impact(&f.project, fresh_owner);
+    assert!(
+        f.views
+            .iter()
+            .chain(&f.lanes)
+            .chain(&f.messages)
+            .all(|id| impact.contains(id))
+    );
+    assert!(!impact.contains(&other_owner) && !impact.contains(&other_view.id));
+    delete_cascade(&mut f.project, fresh_owner);
+    assert_eq!(f.project.diagrams[&other_view.id], other_view);
+    assert!(
+        f.views
+            .iter()
+            .all(|id| !f.project.diagrams.contains_key(id))
+    );
+    admitted(&f.project);
+}
+
+#[test]
+fn deletion_then_recreation_never_resurrects_lane_or_message_coordinates() {
+    let mut f = fixture();
+    let lane = f.project.elements[&f.lanes[0]].clone();
+    let message = f.project.elements[&f.messages[0]].clone();
+    delete_cascade(&mut f.project, lane.id);
+    for view in f.views {
+        let rows = layout(&f.project, view);
+        assert_eq!(rows.lanes.len(), 1);
+        assert_eq!(rows.lanes[0].lifeline, f.lanes[1]);
+        // Missing endpoint assignment does not erase a still-live message's spacing.
+        assert_eq!(rows.messages.len(), 2);
+    }
+    let mut pending = BTreeSet::new();
+    delete_cascade_deferred(&mut f.project, message.id, &mut pending);
+    // Pruning happens during deletion, before later batch commands can recreate IDs.
+    assert!(
+        layout(&f.project, f.views[0])
+            .messages
+            .iter()
+            .all(|row| row.address.occurrence != message.id)
+    );
+    f.project.elements.insert(lane.id, lane);
+    f.project.elements.insert(message.id, message);
+    f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .insert(0, f.messages[0]);
+    finish_deletions(&mut f.project, &pending);
+    for view in f.views {
+        let rows = layout(&f.project, view);
+        assert_eq!(rows.lanes.len(), 1);
+        assert_eq!(
+            rows.messages,
+            vec![ScenarioMessagePosition {
+                address: address(f.messages[1]),
+                send_y: 360.
+            }]
+        );
+    }
+    admitted(&f.project);
+}
+
+#[test]
+fn unrelated_invalid_records_do_not_block_scoped_remap_or_get_repaired_implicitly() {
+    let mut f = fixture();
+    let unrelated = Id::new_v4();
+    let rows = layout_mut(&mut f.project, f.views[1]);
+    let invalid = ScenarioLanePosition {
+        lifeline: unrelated,
+        x: MAX_COORDINATE * 2.,
+    };
+    rows.lanes.extend([invalid.clone(), invalid]);
+    let fresh = Id::new_v4();
+    let untouched = f.project.diagrams[&f.views[1]].clone();
+    let before = f.project.clone();
+    remap_references(&mut f.project, f.owner, f.owner).unwrap();
+    assert_eq!(f.project, before);
+    // The duplicate lane records do not involve the remapped message identity.
+    remap_references(&mut f.project, f.messages[0], fresh).unwrap();
+    assert_eq!(
+        layout(&f.project, f.views[1]).lanes,
+        layout_from(&untouched).lanes
+    );
+    assert_eq!(
+        layout(&f.project, f.views[1]).messages[0]
+            .address
+            .occurrence,
+        fresh
+    );
+    assert_eq!(layout(&f.project, f.views[1]).messages[0].send_y, 220.);
+}
+
+fn layout_from(diagram: &Diagram) -> &ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+        panic!("missing layout")
+    };
+    layout
+}
+
+#[test]
+fn deletion_prunes_an_explicit_address_path_without_pruning_other_message_rows() {
+    let mut f = fixture();
+    // Expanded addresses are not admitted in this slice, but deleting their
+    // explicit references must still make an intermediate repair candidate safe.
+    layout_mut(&mut f.project, f.views[0]).messages[0]
+        .address
+        .references = vec![f.lanes[0]];
+    delete_cascade(&mut f.project, f.lanes[0]);
+    assert_eq!(
+        layout(&f.project, f.views[0]).messages,
+        vec![ScenarioMessagePosition {
+            address: address(f.messages[1]),
+            send_y: 360.
+        }]
+    );
+    assert_eq!(layout(&f.project, f.views[1]).messages.len(), 2);
+    assert!(f.project.elements.contains_key(&f.messages[0]));
+    admitted(&f.project);
+}

crates/oa-core/src/scenario_layout.rs

@@ -0,0 +1,429 @@
+//! Authored Scenario presentation. Structural admission never changes event order.
+use crate::{
+    Diagram, Id, Kind, Layer, MAX_COORDINATE, ModelError, OccurrenceBody, OccurrenceEndpoint,
+    Project, SharedBody, validation,
+};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeSet;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum DiagramLayout {
+    Scenario(ScenarioLayout),
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
+pub struct ScenarioLayout {
+    #[serde(default)]
+    pub lanes: Vec<ScenarioLanePosition>,
+    #[serde(default)]
+    pub messages: Vec<ScenarioMessagePosition>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ScenarioLanePosition {
+    pub lifeline: Id,
+    pub x: f32,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ScenarioMessagePosition {
+    pub address: OccurrenceEndpoint,
+    /// Actual send endpoint, not the renderer's receive-oriented lifecycle row.
+    pub send_y: f32,
+}
+
+impl DiagramLayout {
+    /// Visit every explicit reference, including unsupported paths in a candidate.
+    /// The caller owns remap preflight and final atomic validation.
+    pub fn visit_references(&mut self, mut visit: impl FnMut(&mut Id)) {
+        match self {
+            Self::Scenario(layout) => {
+                for lane in &mut layout.lanes {
+                    visit(&mut lane.lifeline);
+                }
+                for message in &mut layout.messages {
+                    for reference in &mut message.address.references {
+                        visit(reference);
+                    }
+                    visit(&mut message.address.occurrence);
+                }
+            }
+        }
+    }
+}
+
+/// Proposed aggregate accounting contribution; the shared admission owner applies it.
+/// One payload plus one record per lane/message. No graph objects are introduced.
+pub fn record_count(diagram: &Diagram) -> usize {
+    match &diagram.layout {
+        None => 0,
+        Some(DiagramLayout::Scenario(layout)) => 1usize
+            .saturating_add(layout.lanes.len())
+            .saturating_add(layout.messages.len()),
+    }
+}
+
+fn coordinate(value: f32) -> bool {
+    value.is_finite() && value.abs() <= MAX_COORDINATE
+}
+
+fn owner(p: &Project, diagram: &Diagram) -> Result<Id, ModelError> {
+    let scenario = diagram
+        .projection
+        .scenario()
+        .ok_or_else(|| ModelError("Scenario layout requires a Scenario projection.".into()))?;
+    if !p
+        .elements
+        .get(&scenario)
+        .is_some_and(|element| element.kind() == Kind::Scenario && element.layer() == diagram.layer)
+    {
+        return Err(ModelError(
+            "Scenario projection requires an existing Scenario in the diagram layer.".into(),
+        ));
+    }
+    Ok(scenario)
+}
+
+fn lane_member(p: &Project, owner: Id, layer: Layer, lifeline: Id) -> bool {
+    p.elements.get(&lifeline).is_some_and(|element| {
+        element.kind() == Kind::Lifeline
+            && element.parent == Some(owner)
+            && element.layer() == layer
+    })
+}
+
+/// Only actual steps of this Scenario and its own Fragment/Branch sequences.
+/// ScenarioUse/SequenceReference are deliberately never expanded. Invalid graph
+/// cycles terminate, and malformed parent/step links do not manufacture membership.
+fn direct_messages(p: &Project, owner: Id, layer: Layer) -> BTreeSet<Id> {
+    let mut messages = BTreeSet::new();
+    let mut visited = BTreeSet::new();
+    let mut pending = vec![owner];
+    while let Some(scope) = pending.pop() {
+        if !visited.insert(scope) {
+            continue;
+        }
+        let Some(element) = p.elements.get(&scope) else {
+            continue;
+        };
+        for id in element.steps().into_iter().flatten() {
+            let Some(item) = p.elements.get(id) else {
+                continue;
+            };
+            if item.parent != Some(scope) || item.layer() != layer {
+                continue;
+            }
+            match item.shared() {
+                Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Exchange { .. },
+                    ..
+                }) => {
+                    messages.insert(*id);
+                }
+                Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Fragment { branches, .. },
+                    ..
+                }) => {
+                    for branch in branches {
+                        if p.elements.get(branch).is_some_and(|operand| {
+                            operand.parent == Some(*id)
+                                && operand.layer() == layer
+                                && matches!(
+                                    operand.shared(),
+                                    Some(SharedBody::Occurrence {
+                                        body: OccurrenceBody::Branch { .. },
+                                        ..
+                                    })
+                                )
+                        }) {
+                            pending.push(*branch);
+                        }
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+    messages
+}
+
+pub(crate) fn validate_diagram(p: &Project, diagram: &Diagram, out: &mut Vec<validation::Issue>) {
+    if diagram.projection.scenario().is_none() {
+        if diagram.layout.is_some() {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_projection",
+                "layout",
+                "Only a Scenario projection accepts a Scenario layout, including an empty payload.",
+            );
+        }
+        return;
+    }
+    let scenario = match owner(p, diagram) {
+        Ok(owner) => owner,
+        Err(error) => {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_diagram_context",
+                "projection",
+                error.0,
+            );
+            return;
+        }
+    };
+    if !diagram.nodes.is_empty() || !diagram.routes.is_empty() {
+        validation::error(
+            out,
+            diagram.id,
+            "scenario_diagram_content",
+            "layout",
+            "Scenario views do not accept architecture node placements or edge routes.",
+        );
+    }
+    let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+        return;
+    };
+    let mut lanes = BTreeSet::new();
+    for lane in &layout.lanes {
+        if !lanes.insert(lane.lifeline) {
+            validation::error(
+                out,
+                diagram.id,
+                "duplicate_scenario_lane",
+                "layout",
+                "A Scenario layout has at most one position per lifeline.",
+            );
+        }
+        if !lane_member(p, scenario, diagram.layer, lane.lifeline) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_lifeline",
+                "layout",
+                "Lane positions reference a Lifeline directly owned by the projected Scenario.",
+            );
+        }
+        if !coordinate(lane.x) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_coordinate",
+                "layout",
+                "Scenario positions must be finite and within the shared coordinate bounds.",
+            );
+        }
+    }
+    let members = direct_messages(p, scenario, diagram.layer);
+    let mut addresses = BTreeSet::new();
+    for message in &layout.messages {
+        // Reject expanded paths without cloning or indexing their potentially large contents.
+        if !message.address.references.is_empty() {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_address",
+                "layout",
+                "Expanded-reference message positions are not supported; references must be empty.",
+            );
+        } else if !addresses.insert(message.address.occurrence) {
+            validation::error(
+                out,
+                diagram.id,
+                "duplicate_scenario_message",
+                "layout",
+                "A Scenario layout has at most one position per message address.",
+            );
+        }
+        if !members.contains(&message.address.occurrence) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_message",
+                "layout",
+                "Message positions reference Exchange occurrences in the Scenario's own ordered sequence tree.",
+            );
+        }
+        if !coordinate(message.send_y) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_coordinate",
+                "layout",
+                "Scenario positions must be finite and within the shared coordinate bounds.",
+            );
+        }
+    }
+}
+
+fn editable(p: &Project, id: Id) -> Result<(&Diagram, Id), ModelError> {
+    let diagram = p
+        .diagrams
+        .get(&id)
+        .ok_or_else(|| ModelError("Scenario diagram does not exist.".into()))?;
+    let scenario = owner(p, diagram)?;
+    if !diagram.nodes.is_empty() || !diagram.routes.is_empty() {
+        return Err(ModelError(
+            "Scenario views do not accept architecture node placements or edge routes.".into(),
+        ));
+    }
+    Ok((diagram, scenario))
+}
+
+fn check_message(
+    p: &Project,
+    diagram: &Diagram,
+    owner: Id,
+    address: &OccurrenceEndpoint,
+) -> Result<(), ModelError> {
+    if !address.references.is_empty() {
+        return Err(ModelError(
+            "Expanded-reference message positions are not supported; references must be empty."
+                .into(),
+        ));
+    }
+    if !direct_messages(p, owner, diagram.layer).contains(&address.occurrence) {
+        return Err(ModelError("Message position requires an Exchange occurrence in the Scenario's own ordered sequence tree.".into()));
+    }
+    Ok(())
+}
+
+fn payload(diagram: &mut Diagram) -> &mut ScenarioLayout {
+    let DiagramLayout::Scenario(layout) = diagram
+        .layout
+        .get_or_insert_with(|| DiagramLayout::Scenario(ScenarioLayout::default()));
+    layout
+}
+
+/// Target-scoped preparation, not whole-project or whole-layout validation.
+/// Unrelated intermediate errors remain repairable by later commands in a batch.
+pub fn set_lane(
+    p: &Project,
+    diagram: Id,
+    position: ScenarioLanePosition,
+) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    if !lane_member(p, owner, current.layer, position.lifeline) || !coordinate(position.x) {
+        return Err(ModelError(
+            "Lane position requires an owned Lifeline and a finite bounded x coordinate.".into(),
+        ));
+    }
+    let mut result = current.clone();
+    let layout = payload(&mut result);
+    if layout
+        .lanes
+        .iter()
+        .filter(|row| row.lifeline == position.lifeline)
+        .count()
+        > 1
+    {
+        return Err(ModelError(
+            "Cannot set an ambiguous duplicate lane position.".into(),
+        ));
+    }
+    if let Some(existing) = layout
+        .lanes
+        .iter_mut()
+        .find(|row| row.lifeline == position.lifeline)
+    {
+        if existing.x != position.x {
+            *existing = position;
+        }
+    } else {
+        layout.lanes.push(position);
+    }
+    Ok(result)
+}
+
+pub fn remove_lane(p: &Project, diagram: Id, lifeline: Id) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    if !lane_member(p, owner, current.layer, lifeline) {
+        return Err(ModelError(
+            "Removing a lane position requires an owned Lifeline.".into(),
+        ));
+    }
+    let mut result = current.clone();
+    if let Some(DiagramLayout::Scenario(layout)) = &mut result.layout {
+        layout.lanes.retain(|row| row.lifeline != lifeline);
+    }
+    Ok(result)
+}
+
+pub fn set_message(
+    p: &Project,
+    diagram: Id,
+    position: ScenarioMessagePosition,
+) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    check_message(p, current, owner, &position.address)?;
+    if !coordinate(position.send_y) {
+        return Err(ModelError(
+            "Message position requires a finite bounded send_y coordinate.".into(),
+        ));
+    }
+    let mut result = current.clone();
+    let layout = payload(&mut result);
+    if layout
+        .messages
+        .iter()
+        .filter(|row| row.address == position.address)
+        .count()
+        > 1
+    {
+        return Err(ModelError(
+            "Cannot set an ambiguous duplicate message position.".into(),
+        ));
+    }
+    if let Some(existing) = layout
+        .messages
+        .iter_mut()
+        .find(|row| row.address == position.address)
+    {
+        if existing.send_y != position.send_y {
+            *existing = position;
+        }
+    } else {
+        layout.messages.push(position);
+    }
+    Ok(result)
+}
+
+pub fn remove_message(
+    p: &Project,
+    diagram: Id,
+    address: &OccurrenceEndpoint,
+) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    check_message(p, current, owner, address)?;
+    let mut result = current.clone();
+    if let Some(DiagramLayout::Scenario(layout)) = &mut result.layout {
+        layout.messages.retain(|row| &row.address != address);
+    }
+    Ok(result)
+}
+
+/// Prune only identities in the caller's actual deletion closure, never visibility
+/// or missing endpoint assignments. Owner-view cascade remains the caller's job.
+pub fn prune_deleted(diagram: &mut Diagram, deleted: &BTreeSet<Id>) {
+    if let Some(DiagramLayout::Scenario(layout)) = &mut diagram.layout {
+        layout
+            .lanes
+            .retain(|lane| !deleted.contains(&lane.lifeline));
+        layout.messages.retain(|message| {
+            !deleted.contains(&message.address.occurrence)
+                && !message
+                    .address
+                    .references
+                    .iter()
+                    .any(|id| deleted.contains(id))
+        });
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/scenario_layout/tests.rs

@@ -0,0 +1,800 @@
+use super::*;
+use crate::{
+    Element, FragmentOperator, MessageKind, ProjectionKind, Relation, RelationBody, RelationKind,
+    ScenarioViewpoint,
+};
+use std::collections::BTreeMap;
+
+struct Fixture {
+    project: Project,
+    owner: Id,
+    performer: Id,
+    lane: Id,
+    repeated_lane: Id,
+    first: Id,
+    second: Id,
+    nested: Id,
+    fragment: Id,
+    branch: Id,
+    view: Id,
+    other_view: Id,
+    exchange: Id,
+}
+
+fn set_body(element: &mut Element, body: OccurrenceBody) {
+    *element.shared_mut().unwrap() = SharedBody::Occurrence {
+        body,
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+}
+fn address(occurrence: Id) -> OccurrenceEndpoint {
+    OccurrenceEndpoint {
+        references: vec![],
+        occurrence,
+    }
+}
+fn diagram(owner: Id, alias: &str) -> Diagram {
+    Diagram {
+        id: Id::new_v4(),
+        alias: alias.into(),
+        name: alias.into(),
+        description: String::new(),
+        layer: Layer::Oa,
+        projection: ProjectionKind::Scenario { scenario: owner },
+        view_options: Default::default(),
+        nodes: BTreeMap::new(),
+        routes: vec![],
+        layout: None,
+    }
+}
+fn assert_admitted(project: &Project) {
+    let errors: Vec<_> = validation::validate(project)
+        .into_iter()
+        .filter(|issue| issue.severity == validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+}
+fn has_code(project: &Project, code: &str) -> bool {
+    validation::validate(project)
+        .iter()
+        .any(|issue| issue.code == code)
+}
+fn layout(diagram: &Diagram) -> &ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+        panic!("expected saved payload")
+    };
+    layout
+}
+fn save(project: &mut Project, replacement: Diagram) {
+    project.diagrams.insert(replacement.id, replacement);
+}
+fn fixture() -> Fixture {
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::Scenario, Layer::Oa, "Nominal", None)
+        .unwrap();
+    let Some(SharedBody::Scenario { viewpoint, .. }) =
+        project.elements.get_mut(&owner).unwrap().shared_mut()
+    else {
+        panic!("Scenario fixture body");
+    };
+    *viewpoint = ScenarioViewpoint::ParticipantInteraction;
+    let performer = project
+        .add_element(Kind::Entity, Layer::Oa, "Controller", None)
+        .unwrap();
+    let receiver = project
+        .add_element(Kind::Entity, Layer::Oa, "Provider", None)
+        .unwrap();
+    let lane = project
+        .add_element(Kind::Lifeline, Layer::Oa, "Controller lane", Some(owner))
+        .unwrap();
+    let repeated_lane = project
+        .add_element(
+            Kind::Lifeline,
+            Layer::Oa,
+            "Controller review lane",
+            Some(owner),
+        )
+        .unwrap();
+    let receiver_lane = project
+        .add_element(Kind::Lifeline, Layer::Oa, "Provider lane", Some(owner))
+        .unwrap();
+    for (id, represented) in [
+        (lane, performer),
+        (repeated_lane, performer),
+        (receiver_lane, receiver),
+    ] {
+        *project.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Lifeline {
+            represented: Some(represented),
+        };
+    }
+    let exchange = Id::new_v4();
+    project.relations.insert(
+        exchange,
+        Relation {
+            id: exchange,
+            alias: "delivery_channel".into(),
+            name: "Delivery".into(),
+            description: String::new(),
+            body: RelationBody::new(RelationKind::CommunicationMean, performer, receiver),
+        },
+    );
+    let first = project
+        .add_element(Kind::Occurrence, Layer::Oa, "First delivery", Some(owner))
+        .unwrap();
+    let second = project
+        .add_element(Kind::Occurrence, Layer::Oa, "Second delivery", Some(owner))
+        .unwrap();
+    for (id, sender) in [(first, lane), (second, repeated_lane)] {
+        set_body(
+            project.elements.get_mut(&id).unwrap(),
+            OccurrenceBody::Exchange {
+                exchange: Some(exchange),
+                sender: Some(sender),
+                receiver: Some(receiver_lane),
+                message_kind: MessageKind::Asynchronous,
+                reply_to: None,
+                values: vec![],
+                operation: None,
+            },
+        );
+    }
+    let fragment = project
+        .add_element(
+            Kind::Occurrence,
+            Layer::Oa,
+            "Optional delivery",
+            Some(owner),
+        )
+        .unwrap();
+    set_body(
+        project.elements.get_mut(&fragment).unwrap(),
+        OccurrenceBody::Fragment {
+            operator: FragmentOperator::Optional,
+            branches: vec![],
+        },
+    );
+    let branch = project
+        .add_element(Kind::Occurrence, Layer::Oa, "Option body", Some(fragment))
+        .unwrap();
+    let nested = project
+        .add_element(
+            Kind::Occurrence,
+            Layer::Oa,
+            "Unfinished nested delivery",
+            Some(branch),
+        )
+        .unwrap();
+    set_body(
+        project.elements.get_mut(&nested).unwrap(),
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: None,
+            receiver: None,
+            message_kind: MessageKind::Asynchronous,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    set_body(
+        project.elements.get_mut(&branch).unwrap(),
+        OccurrenceBody::Branch {
+            guard: "requested".into(),
+            occurrences: vec![nested],
+        },
+    );
+    set_body(
+        project.elements.get_mut(&fragment).unwrap(),
+        OccurrenceBody::Fragment {
+            operator: FragmentOperator::Optional,
+            branches: vec![branch],
+        },
+    );
+    *project
+        .elements
+        .get_mut(&owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![first, second, fragment];
+    let view_record = diagram(owner, "nominal_view");
+    let other_record = diagram(owner, "review_view");
+    let view = view_record.id;
+    let other_view = other_record.id;
+    save(&mut project, view_record);
+    save(&mut project, other_record);
+    assert_admitted(&project);
+    Fixture {
+        project,
+        owner,
+        performer,
+        lane,
+        repeated_lane,
+        first,
+        second,
+        nested,
+        fragment,
+        branch,
+        view,
+        other_view,
+        exchange,
+    }
+}
+
+#[test]
+fn two_views_and_repeated_semantic_definitions_keep_independent_overrides() {
+    let mut f = fixture();
+    let semantics = (f.project.elements.clone(), f.project.relations.clone());
+    for (view, line, x) in [
+        (f.view, f.lane, 420.),
+        (f.view, f.repeated_lane, 680.),
+        (f.other_view, f.lane, 900.),
+    ] {
+        let result =
+            set_lane(&f.project, view, ScenarioLanePosition { lifeline: line, x }).unwrap();
+        save(&mut f.project, result);
+    }
+    for (view, id, y) in [
+        (f.view, f.first, 200.),
+        (f.view, f.second, 350.),
+        (f.other_view, f.first, 260.),
+    ] {
+        let result = set_message(
+            &f.project,
+            view,
+            ScenarioMessagePosition {
+                address: address(id),
+                send_y: y,
+            },
+        )
+        .unwrap();
+        save(&mut f.project, result);
+    }
+    assert_eq!(
+        layout(&f.project.diagrams[&f.view]).lanes,
+        vec![
+            ScenarioLanePosition {
+                lifeline: f.lane,
+                x: 420.
+            },
+            ScenarioLanePosition {
+                lifeline: f.repeated_lane,
+                x: 680.
+            },
+        ]
+    );
+    assert_eq!(
+        layout(&f.project.diagrams[&f.view])
+            .messages
+            .iter()
+            .map(|r| (r.address.occurrence, r.send_y))
+            .collect::<Vec<_>>(),
+        vec![(f.first, 200.), (f.second, 350.)]
+    );
+    assert_eq!(
+        layout(&f.project.diagrams[&f.other_view]).messages[0].send_y,
+        260.
+    );
+    assert_eq!(layout(&f.project.diagrams[&f.other_view]).lanes[0].x, 900.);
+    assert_eq!(
+        (f.project.elements.clone(), f.project.relations.clone()),
+        semantics
+    );
+    assert_admitted(&f.project);
+}
+
+#[test]
+fn own_nested_unfinished_message_is_admitted_but_expansion_is_not() {
+    let mut f = fixture();
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.nested),
+            send_y: -80.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    assert_admitted(&f.project);
+    let before = f.project.clone();
+    let expanded = OccurrenceEndpoint {
+        references: vec![f.fragment],
+        occurrence: f.nested,
+    };
+    assert!(
+        set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: expanded.clone(),
+                send_y: 400.
+            }
+        )
+        .is_err()
+    );
+    assert!(remove_message(&f.project, f.view, &expanded).is_err());
+    assert_eq!(f.project, before);
+    payload(f.project.diagrams.get_mut(&f.view).unwrap()).messages[0].address = expanded;
+    assert!(has_code(&f.project, "scenario_layout_address"));
+}
+
+#[test]
+fn only_ordered_message_appearances_and_owned_lifelines_are_targets() {
+    let mut f = fixture();
+    assert!(
+        set_lane(
+            &f.project,
+            f.view,
+            ScenarioLanePosition {
+                lifeline: f.performer,
+                x: 10.
+            }
+        )
+        .is_err()
+    );
+    for id in [f.exchange, f.fragment, f.branch, f.owner, Id::new_v4()] {
+        assert!(
+            set_message(
+                &f.project,
+                f.view,
+                ScenarioMessagePosition {
+                    address: address(id),
+                    send_y: 100.
+                }
+            )
+            .is_err()
+        );
+    }
+    let foreign = f
+        .project
+        .add_element(Kind::Scenario, Layer::Oa, "Foreign", None)
+        .unwrap();
+    let foreign_lane = f
+        .project
+        .add_element(Kind::Lifeline, Layer::Oa, "Foreign lane", Some(foreign))
+        .unwrap();
+    assert!(remove_lane(&f.project, f.view, foreign_lane).is_err());
+    f.project.elements.get_mut(&f.first).unwrap().parent = Some(foreign);
+    assert!(
+        set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: address(f.first),
+                send_y: 100.
+            }
+        )
+        .is_err()
+    );
+    f.project.elements.get_mut(&f.first).unwrap().parent = Some(f.owner);
+    f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .retain(|id| *id != f.first);
+    assert!(
+        set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: address(f.first),
+                send_y: 100.
+            }
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn duplicate_positions_reject_even_when_values_match() {
+    let mut f = fixture();
+    let lane = ScenarioLanePosition {
+        lifeline: f.lane,
+        x: 10.,
+    };
+    let message = ScenarioMessagePosition {
+        address: address(f.first),
+        send_y: 100.,
+    };
+    let entries = payload(f.project.diagrams.get_mut(&f.view).unwrap());
+    entries.lanes = vec![lane.clone(), lane.clone()];
+    entries.messages = vec![message.clone(), message.clone()];
+    assert!(has_code(&f.project, "duplicate_scenario_lane"));
+    assert!(has_code(&f.project, "duplicate_scenario_message"));
+    assert!(set_lane(&f.project, f.view, lane).is_err());
+    assert!(set_message(&f.project, f.view, message).is_err());
+    // Explicit removal can repair all duplicates of the targeted identity.
+    let result = remove_lane(&f.project, f.view, f.lane).unwrap();
+    save(&mut f.project, result);
+    let result = remove_message(&f.project, f.view, &address(f.first)).unwrap();
+    save(&mut f.project, result);
+    assert_admitted(&f.project);
+}
+
+#[test]
+fn sparse_absence_empty_payload_and_signed_zero_are_preserved() {
+    let mut f = fixture();
+    let absent = f.project.diagrams[&f.view].clone();
+    assert_eq!(remove_lane(&f.project, f.view, f.lane).unwrap(), absent);
+    assert_eq!(
+        remove_message(&f.project, f.view, &address(f.first)).unwrap(),
+        absent
+    );
+    assert!(
+        serde_json::to_value(&absent)
+            .unwrap()
+            .get("layout")
+            .is_none()
+    );
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: -0.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: -0.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 0.,
+        },
+    )
+    .unwrap();
+    assert_eq!(layout(&result).lanes[0].x.to_bits(), (-0.0_f32).to_bits());
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: 0.,
+        },
+    )
+    .unwrap();
+    assert_eq!(
+        layout(&result).messages[0].send_y.to_bits(),
+        (-0.0_f32).to_bits()
+    );
+    assert_eq!(
+        serde_json::to_string(&result).unwrap(),
+        serde_json::to_string(&f.project.diagrams[&f.view]).unwrap()
+    );
+    let result = remove_lane(&f.project, f.view, f.lane).unwrap();
+    save(&mut f.project, result);
+    let result = remove_message(&f.project, f.view, &address(f.first)).unwrap();
+    assert_eq!(
+        result.layout,
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()))
+    );
+    assert_ne!(result, absent);
+}
+
+#[test]
+fn bounds_are_structural_and_rejected_helpers_do_not_mutate_project() {
+    let mut f = fixture();
+    for value in [-MAX_COORDINATE, MAX_COORDINATE, -7., 0.] {
+        let result = set_lane(
+            &f.project,
+            f.view,
+            ScenarioLanePosition {
+                lifeline: f.lane,
+                x: value,
+            },
+        )
+        .unwrap();
+        save(&mut f.project, result);
+        let result = set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: address(f.first),
+                send_y: value,
+            },
+        )
+        .unwrap();
+        save(&mut f.project, result);
+        assert_admitted(&f.project);
+    }
+    let before = serde_json::to_string(&f.project).unwrap();
+    for value in [
+        f32::NAN,
+        f32::INFINITY,
+        f32::NEG_INFINITY,
+        MAX_COORDINATE + 1.,
+    ] {
+        assert!(
+            set_lane(
+                &f.project,
+                f.view,
+                ScenarioLanePosition {
+                    lifeline: f.lane,
+                    x: value
+                }
+            )
+            .is_err()
+        );
+        assert!(
+            set_message(
+                &f.project,
+                f.view,
+                ScenarioMessagePosition {
+                    address: address(f.first),
+                    send_y: value
+                }
+            )
+            .is_err()
+        );
+    }
+    assert_eq!(serde_json::to_string(&f.project).unwrap(), before);
+    payload(f.project.diagrams.get_mut(&f.view).unwrap()).messages[0].send_y = f32::NAN;
+    assert!(has_code(&f.project, "scenario_layout_coordinate"));
+}
+
+#[test]
+fn helpers_do_not_validate_unrelated_transient_records_in_repair_batches() {
+    let mut f = fixture();
+    payload(f.project.diagrams.get_mut(&f.view).unwrap())
+        .messages
+        .push(ScenarioMessagePosition {
+            address: address(f.second),
+            send_y: f32::INFINITY,
+        });
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 420.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    assert!(has_code(&f.project, "scenario_layout_coordinate"));
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.second),
+            send_y: 300.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    assert_admitted(&f.project);
+}
+
+#[test]
+fn projection_context_and_architecture_payloads_are_explicitly_separate() {
+    let mut f = fixture();
+    let scenario = f.project.diagrams[&f.view].projection;
+    assert_eq!(scenario.scenario(), Some(f.owner));
+    assert!(!scenario.is_architecture());
+    assert!(!scenario.includes(Kind::Lifeline));
+    assert!(ProjectionKind::Overview.is_architecture());
+    assert!(!ProjectionKind::StateMachine { machine: f.owner }.is_architecture());
+    f.project.diagrams.get_mut(&f.view).unwrap().layer = Layer::Sa;
+    assert!(has_code(&f.project, "scenario_diagram_context"));
+    assert!(remove_lane(&f.project, f.view, f.lane).is_err());
+    f.project.diagrams.get_mut(&f.view).unwrap().layer = Layer::Oa;
+    f.project
+        .diagrams
+        .get_mut(&f.view)
+        .unwrap()
+        .routes
+        .push(crate::EdgeRoute {
+            edge: f.exchange,
+            waypoints: vec![],
+            label: None,
+        });
+    assert!(has_code(&f.project, "scenario_diagram_content"));
+    f.project.diagrams.get_mut(&f.view).unwrap().routes.clear();
+    payload(f.project.diagrams.get_mut(&f.view).unwrap());
+    f.project.diagrams.get_mut(&f.view).unwrap().projection = ProjectionKind::Overview;
+    assert!(has_code(&f.project, "scenario_layout_projection"));
+    assert!(
+        set_lane(
+            &f.project,
+            f.view,
+            ScenarioLanePosition {
+                lifeline: f.lane,
+                x: 10.
+            }
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn typed_json_records_round_trip_and_reject_unknown_or_missing_fields() {
+    let mut f = fixture();
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: 200.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let encoded = serde_json::to_value(&f.project.diagrams[&f.view]).unwrap();
+    assert_eq!(
+        serde_json::from_value::<Diagram>(encoded.clone()).unwrap(),
+        f.project.diagrams[&f.view]
+    );
+    assert_eq!(
+        encoded["layout"]["Scenario"]["messages"][0]["address"]["occurrence"],
+        serde_json::json!(f.first)
+    );
+    let mut unknown = encoded.clone();
+    unknown["layout"]["Scenario"]["messages"][0]["extra"] = serde_json::json!(1);
+    assert!(serde_json::from_value::<Diagram>(unknown).is_err());
+    let mut missing = encoded;
+    missing["layout"]["Scenario"]["messages"][0]["address"]
+        .as_object_mut()
+        .unwrap()
+        .remove("references");
+    assert!(serde_json::from_value::<Diagram>(missing).is_err());
+}
+
+#[test]
+fn deleting_only_actual_ids_preserves_latent_message_positions_and_other_views() {
+    let mut f = fixture();
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 420.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: 200.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let mut copied = f.project.diagrams[&f.view].clone();
+    copied.id = f.other_view;
+    copied.alias = "review_view".into();
+    copied.name = "Review view".into();
+    save(&mut f.project, copied.clone());
+    assert_admitted(&f.project);
+    assert_eq!(layout(&copied).messages[0].address.occurrence, f.first);
+    let mut candidate = f.project.diagrams[&f.view].clone();
+    prune_deleted(&mut candidate, &BTreeSet::from([f.lane, f.exchange]));
+    assert!(layout(&candidate).lanes.is_empty());
+    assert_eq!(layout(&candidate).messages.len(), 1);
+    prune_deleted(&mut candidate, &BTreeSet::from([f.first]));
+    assert!(layout(&candidate).messages.is_empty());
+    assert!(candidate.layout.is_some());
+    assert_eq!(f.project.diagrams[&f.other_view], copied);
+}
+
+#[test]
+fn reference_visitor_and_record_count_cover_explicit_rows() {
+    let f = fixture();
+    let mut d = f.project.diagrams[&f.view].clone();
+    assert_eq!(record_count(&d), 0);
+    let rows = payload(&mut d);
+    rows.lanes.push(ScenarioLanePosition {
+        lifeline: f.lane,
+        x: 50.,
+    });
+    rows.messages.push(ScenarioMessagePosition {
+        address: address(f.first),
+        send_y: 100.,
+    });
+    assert_eq!(record_count(&d), 3);
+    let replacement = Id::new_v4();
+    d.layout.as_mut().unwrap().visit_references(|id| {
+        if *id == f.first {
+            *id = replacement;
+        }
+    });
+    assert_eq!(layout(&d).messages[0].address.occurrence, replacement);
+    assert_eq!(layout(&d).messages[0].send_y, 100.);
+    assert_eq!(layout(&d).lanes[0].lifeline, f.lane);
+}
+
+#[test]
+fn a_real_scenario_use_never_imports_its_called_message_as_a_direct_target() {
+    let mut f = fixture();
+    let called = f
+        .project
+        .add_element(Kind::Scenario, Layer::Oa, "Called sequence", None)
+        .unwrap();
+    let Some(SharedBody::Scenario { viewpoint, .. }) =
+        f.project.elements.get_mut(&called).unwrap().shared_mut()
+    else {
+        panic!("Called Scenario fixture body");
+    };
+    *viewpoint = ScenarioViewpoint::ParticipantInteraction;
+    let called_message = f
+        .project
+        .add_element(Kind::Occurrence, Layer::Oa, "Called delivery", Some(called))
+        .unwrap();
+    set_body(
+        f.project.elements.get_mut(&called_message).unwrap(),
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: None,
+            receiver: None,
+            message_kind: MessageKind::Asynchronous,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    *f.project
+        .elements
+        .get_mut(&called)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![called_message];
+    let usage = f
+        .project
+        .add_element(Kind::Occurrence, Layer::Oa, "Call sequence", Some(f.owner))
+        .unwrap();
+    set_body(
+        f.project.elements.get_mut(&usage).unwrap(),
+        OccurrenceBody::ScenarioUse {
+            scenario: Some(called),
+            bindings: vec![],
+        },
+    );
+    f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(usage);
+    assert_admitted(&f.project);
+    for target in [
+        address(called_message),
+        address(usage),
+        OccurrenceEndpoint {
+            references: vec![usage],
+            occurrence: called_message,
+        },
+    ] {
+        assert!(
+            set_message(
+                &f.project,
+                f.view,
+                ScenarioMessagePosition {
+                    address: target,
+                    send_y: 200.
+                }
+            )
+            .is_err()
+        );
+    }
+}
+
+mod source_lifecycle;

crates/oa-core/src/scenario_layout/tests/source_lifecycle.rs

@@ -0,0 +1,245 @@
+//! Source/command lifecycle checks for the candidate payload. Public version
+//! assignment remains the coordinated codec integration gate.
+use super::*;
+use crate::{Command, Session, language, prepare_command, source_project::*};
+
+fn authored(f: &Fixture) -> CompiledSourceProject {
+    let mut bundle = format_bundle(&f.project);
+    let initial = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let location = &initial.index.declarations[&f.view];
+    let source = bundle.files.get_mut(&location.path).unwrap();
+    let text = format!(
+        r#"diagram nominal_view "Nominal review" id "{}" {{
+ projection {{ Scenario {{ scenario @{}; }}; }};
+ layout {{ Scenario {{
+  lanes [
+   // Controller spacing rationale.
+   {{ lifeline @ // first lane identity
+      {}; x 4.20e2; }},
+   // Repeated performer has its own lane.
+   {{ lifeline @{}; x 680; }}
+  ];
+  messages [
+   // First delivery timing rationale.
+   {{ address {{ references []; occurrence @{}; }}; send_y 2.00e2; }},
+   // Second delivery timing rationale.
+   {{ address {{ references []; occurrence @{}; }}; send_y 350; }}
+  ];
+ }}; }};
+}}
+"#,
+        f.view,
+        f.project.elements[&f.owner].alias,
+        f.project.elements[&f.lane].alias,
+        f.project.elements[&f.repeated_lane].alias,
+        f.project.elements[&f.first].alias,
+        f.project.elements[&f.second].alias
+    );
+    source.replace_range(location.span.start..location.span.end, &text);
+    compile_bundle(&bundle, ProjectLimits::default()).unwrap()
+}
+
+#[test]
+fn source_rows_follow_identity_order_and_keep_comments_numeric_spelling_and_file_ownership() {
+    let f = fixture();
+    let original = authored(&f);
+    let mut changed = original.decoded.project.clone();
+    let rows = payload(changed.diagrams.get_mut(&f.view).unwrap());
+    rows.lanes.swap(0, 1);
+    rows.messages.swap(0, 1);
+    rows.messages[0].send_y = 390.;
+    changed.elements.get_mut(&f.lane).unwrap().alias = "renamed_controller_lane".into();
+    let updated = update_bundle(&original, &changed, ProjectLimits::default()).unwrap();
+    assert_eq!(updated.decoded.project, changed);
+    let path = &original.index.declarations[&f.view].path;
+    assert_eq!(&updated.index.declarations[&f.view].path, path);
+    let text = &updated.bundle.files[path];
+    assert!(
+        text.find("// Repeated performer").unwrap() < text.find("// Controller spacing").unwrap(),
+        "{text}"
+    );
+    assert!(
+        text.find("// Second delivery").unwrap() < text.find("// First delivery").unwrap(),
+        "{text}"
+    );
+    assert!(
+        text.contains(
+            "lifeline @ // first lane identity\n      renamed_controller_lane; x 4.20e2;"
+        ),
+        "{text}"
+    );
+    assert!(text.contains("send_y 2.00e2"), "{text}");
+    assert!(text.contains("send_y 390"), "{text}");
+    for (other, bytes) in &original.bundle.files {
+        if other != path && !bytes.contains(&f.project.elements[&f.lane].alias) {
+            assert_eq!(&updated.bundle.files[other], bytes);
+        }
+    }
+    assert_eq!(
+        compile_bundle(&updated.bundle, ProjectLimits::default())
+            .unwrap()
+            .decoded
+            .project,
+        changed
+    );
+}
+
+#[test]
+fn source_identity_swap_keeps_each_coordinate_comment_with_its_original_object() {
+    let f = fixture();
+    let original = authored(&f);
+    let temporary = Id::new_v4();
+    let command = Command::Batch(vec![
+        Command::Reidentify(f.first, temporary),
+        Command::Reidentify(f.second, f.first),
+        Command::Reidentify(temporary, f.second),
+    ]);
+    let prepared = prepare_command(&original.decoded.project, &command).unwrap();
+    let mut changed = prepared.project;
+    payload(changed.diagrams.get_mut(&f.view).unwrap())
+        .messages
+        .swap(0, 1);
+    let updated = update_bundle_with_identity_map(
+        &original,
+        &changed,
+        &prepared.identity_map,
+        ProjectLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(updated.decoded.project, changed);
+    let path = &original.index.declarations[&f.view].path;
+    let text = &updated.bundle.files[path];
+    assert!(
+        text.find("// Second delivery").unwrap() < text.find("// First delivery").unwrap(),
+        "{text}"
+    );
+    let first_comment = text.find("// First delivery").unwrap();
+    assert!(text[first_comment..].contains(&format!(
+        "occurrence @{}",
+        changed.elements[&f.second].alias
+    )));
+    assert!(text[first_comment..].contains("send_y 2.00e2"));
+}
+
+#[test]
+fn coordinate_batch_is_one_undo_and_numeric_noop_keeps_source_exact() {
+    let f = fixture();
+    let original = authored(&f);
+    let mut session = Session::new(original.decoded.project.clone());
+    session
+        .execute(Command::Batch(vec![
+            Command::SetScenarioLanePosition {
+                diagram: f.view,
+                position: ScenarioLanePosition {
+                    lifeline: f.lane,
+                    x: 510.,
+                },
+            },
+            Command::SetScenarioMessagePosition {
+                diagram: f.view,
+                position: ScenarioMessagePosition {
+                    address: address(f.second),
+                    send_y: 430.,
+                },
+            },
+        ]))
+        .unwrap();
+    let changed = session.project().clone();
+    assert_eq!(session.revision(), 1);
+    assert_eq!(changed.elements, original.decoded.project.elements);
+    assert_eq!(changed.relations, original.decoded.project.relations);
+    let updated = update_bundle(&original, &changed, ProjectLimits::default()).unwrap();
+    session.undo();
+    assert_eq!(session.project(), &original.decoded.project);
+    assert!(!session.can_undo());
+    session.redo();
+    assert_eq!(session.project(), &changed);
+    session
+        .execute(Command::SetScenarioMessagePosition {
+            diagram: f.view,
+            position: ScenarioMessagePosition {
+                address: address(f.second),
+                send_y: 430.,
+            },
+        })
+        .unwrap();
+    assert_eq!(session.revision(), 3);
+    let noop = update_bundle(&updated, session.project(), ProjectLimits::default()).unwrap();
+    assert_eq!(noop.bundle, updated.bundle);
+}
+
+#[test]
+fn absent_and_empty_payload_round_trip_distinctly_and_remove_does_not_materialize_absence() {
+    let f = fixture();
+    let before = language::format(&f.project);
+    let mut session = Session::new(f.project.clone());
+    session
+        .execute(Command::RemoveScenarioLanePosition {
+            diagram: f.view,
+            lifeline: f.lane,
+        })
+        .unwrap();
+    assert_eq!(session.project(), &f.project);
+    assert!(!session.can_undo());
+    assert_eq!(language::format(session.project()), before);
+    let mut present = f.project.clone();
+    present.diagrams.get_mut(&f.view).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()));
+    let text = language::format(&present);
+    assert_ne!(text, before);
+    assert_eq!(language::parse(&text).unwrap(), present);
+    assert_eq!(language::parse(&before).unwrap(), f.project);
+}
+
+#[test]
+fn invalid_layout_source_rejects_without_changing_last_compiled_workspace() {
+    let f = fixture();
+    let original = authored(&f);
+    let before = original.bundle.clone();
+    let path = original.index.declarations[&f.view].path.clone();
+    for replacement in ["x 1e30", "x not_a_number"] {
+        let mut candidate = before.clone();
+        let source = candidate.files.get_mut(&path).unwrap();
+        *source = source.replace("x 4.20e2", replacement);
+        assert!(compile_bundle(&candidate, ProjectLimits::default()).is_err());
+        assert_eq!(original.bundle, before);
+    }
+    let mut candidate = before.clone();
+    let source = candidate.files.get_mut(&path).unwrap();
+    *source = source.replace(
+        &format!("occurrence @{}", f.project.elements[&f.first].alias),
+        &format!("occurrence @{}", f.project.elements[&f.performer].alias),
+    );
+    assert!(compile_bundle(&candidate, ProjectLimits::default()).is_err());
+    assert_eq!(original.bundle, before);
+}
+
+#[test]
+fn explicit_none_survives_other_edits_while_real_payload_clear_removes_values() {
+    let f = fixture();
+    let mut bundle = format_bundle(&f.project);
+    let compiled = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let location = &compiled.index.declarations[&f.view];
+    let path = location.path.clone();
+    bundle.files.get_mut(&path).unwrap().insert_str(
+        location.span.end - 1,
+        "\n layout // explicitly automatic\n none;\n",
+    );
+    let original = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let mut described = original.decoded.project.clone();
+    described.diagrams.get_mut(&f.view).unwrap().description =
+        "Review spacing independently".into();
+    let updated = update_bundle(&original, &described, ProjectLimits::default()).unwrap();
+    assert!(updated.bundle.files[&path].contains("layout // explicitly automatic\n none;"));
+    assert_eq!(updated.decoded.project, described);
+    let mut empty = described.clone();
+    empty.diagrams.get_mut(&f.view).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()));
+    let present = update_bundle(&updated, &empty, ProjectLimits::default()).unwrap();
+    assert_eq!(present.decoded.project, empty);
+    assert!(present.bundle.files[&path].contains("// explicitly automatic"));
+    let cleared = update_bundle(&present, &described, ProjectLimits::default()).unwrap();
+    assert_eq!(cleared.decoded.project, described);
+    assert!(!cleared.bundle.files[&path].contains("layout"));
+    assert!(cleared.bundle.files[&path].contains("// explicitly automatic"));
+}

crates/oa-core/src/session.rs

@@ -23,6 +23,22 @@ pub enum Command {
     EditRelation(Id, Relation),
     CreateDiagram(Diagram),
     EditDiagram(Id, Diagram),
+    SetScenarioLanePosition {
+        diagram: Id,
+        position: ScenarioLanePosition,
+    },
+    RemoveScenarioLanePosition {
+        diagram: Id,
+        lifeline: Id,
+    },
+    SetScenarioMessagePosition {
+        diagram: Id,
+        position: ScenarioMessagePosition,
+    },
+    RemoveScenarioMessagePosition {
+        diagram: Id,
+        address: OccurrenceEndpoint,
+    },
     CreateArtifact(ArtifactLink),
     EditArtifact(Id, ArtifactLink),
     CreateTrace(Trace),
@@ -488,6 +504,26 @@ fn apply_command(
             reidentify_tracked(p, *old, value.id, provenance)?;
             Some(value.id)
         }
+        Command::SetScenarioLanePosition { diagram, position } => {
+            let replacement = crate::scenario_layout::set_lane(p, *diagram, position.clone())?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
+        Command::RemoveScenarioLanePosition { diagram, lifeline } => {
+            let replacement = crate::scenario_layout::remove_lane(p, *diagram, *lifeline)?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
+        Command::SetScenarioMessagePosition { diagram, position } => {
+            let replacement = crate::scenario_layout::set_message(p, *diagram, position.clone())?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
+        Command::RemoveScenarioMessagePosition { diagram, address } => {
+            let replacement = crate::scenario_layout::remove_message(p, *diagram, address)?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
         Command::CreateArtifact(value) => {
             vacant(p, value.id)?;
             p.artifact_links.insert(value.id, value.clone());
@@ -878,6 +914,7 @@ pub fn reidentify(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
         return Ok(());
     }
     vacant(p, new)?;
+    crate::references::check_remap(p, old, new)?;
     if p.id == old {
         p.id = new;
     } else if let Some(mut v) = p.elements.remove(&old) {
@@ -904,12 +941,17 @@ pub fn reidentify(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
             }
         }
     }
-    crate::references::remap_references(p, old, new);
+    crate::references::remap_references(p, old, new)?;
     Ok(())
 }
 fn layout(p: &mut Project, diagram: Id) -> Result<(), ModelError> {
     use std::collections::{BTreeMap, BTreeSet};
     let d = p.diagrams.get(&diagram).ok_or_else(missing)?;
+    if d.projection.scenario().is_some() {
+        return Err(ModelError(
+            "Scenario layout requires the Scenario geometry operation.".into(),
+        ));
+    }
     let parents = crate::projection::parents(p, d);
     let mut children: BTreeMap<Option<Id>, Vec<Id>> = BTreeMap::new();
     for (id, parent) in &parents {

crates/oa-core/src/source_project.rs

@@ -930,7 +930,18 @@ pub fn update_bundle_with_identity_map(
             };
             let local = edits.entry(path.clone()).or_default();
             update.header(&actual.header, &previous.header, &next.header, local);
-            update.value(&actual.fields, Some(&previous.fields), &next.fields, local);
+            let context = if old.diagrams.contains_key(&id) {
+                EditContext::Diagram
+            } else {
+                EditContext::Other
+            };
+            update.value(
+                &actual.fields,
+                Some(&previous.fields),
+                &next.fields,
+                context,
+                local,
+            );
         }
     }
     if old.id != project.id || old.alias != project.alias || old.name != project.name {
@@ -1119,6 +1130,29 @@ fn inserted_value(text: &str, indent: &str, source: &str) -> String {
     output
 }
 
+// Schema context is explicit: similarly named fields in arbitrary records must
+// never acquire Scenario row identity or move their authored trivia.
+#[derive(Clone, Copy)]
+enum EditContext {
+    Other,
+    Diagram,
+    Layout,
+    Scenario,
+    Lanes,
+    Messages,
+}
+impl EditContext {
+    fn field(self, name: &str) -> Self {
+        match (self, name) {
+            (Self::Diagram, "layout") => Self::Layout,
+            (Self::Layout, "Scenario") => Self::Scenario,
+            (Self::Scenario, "lanes") => Self::Lanes,
+            (Self::Scenario, "messages") => Self::Messages,
+            _ => Self::Other,
+        }
+    }
+}
+
 struct SyntaxUpdate<'a> {
     source: &'a str,
     before: &'a str,
@@ -1185,6 +1219,7 @@ impl SyntaxUpdate<'_> {
         actual: &language::EditValue,
         before: Option<&language::EditValue>,
         after: &language::EditValue,
+        context: EditContext,
         edits: &mut LocalEdits,
     ) {
         use language::EditKind;
@@ -1200,7 +1235,7 @@ impl SyntaxUpdate<'_> {
                         None
                     }
                 });
-                self.record(actual.span, fields, previous, next, edits);
+                self.record(actual.span, fields, previous, next, context, edits);
             }
             (EditKind::List(items), EditKind::List(next)) => {
                 let previous = before.and_then(|old| {
@@ -1210,7 +1245,7 @@ impl SyntaxUpdate<'_> {
                         None
                     }
                 });
-                self.list(actual.span, items, previous, next, edits);
+                self.list(actual.span, items, previous, next, context, edits);
             }
             (EditKind::Reference(_), EditKind::Reference(alias)) => {
                 let token = significant(&self.source[actual.span.start..actual.span.end])
@@ -1263,6 +1298,7 @@ impl SyntaxUpdate<'_> {
         actual: &BTreeMap<String, language::EditField>,
         before: Option<&BTreeMap<String, language::EditField>>,
         after: &BTreeMap<String, language::EditField>,
+        context: EditContext,
         edits: &mut LocalEdits,
     ) {
         // A typed constructor tag change retains shared fields and their trivia.
@@ -1286,7 +1322,13 @@ impl SyntaxUpdate<'_> {
                     },
                     new_key.clone(),
                 ));
-                self.value(&field.value, Some(&old.value), &new.value, edits);
+                self.value(
+                    &field.value,
+                    Some(&old.value),
+                    &new.value,
+                    context.field(new_key),
+                    edits,
+                );
                 return;
             }
         }
@@ -1298,9 +1340,16 @@ impl SyntaxUpdate<'_> {
                         .and_then(|fields| fields.get(key))
                         .map(|field| &field.value),
                     &next.value,
+                    context.field(key),
                     edits,
                 );
-            } else {
+            } else if !(matches!(context, EditContext::Diagram)
+                && key == "layout"
+                && before.is_some_and(|fields| !fields.contains_key(key)))
+            {
+                // Canonical None omits layout. Preserve an authored explicit
+                // none while another field changes; a real Some->None clear
+                // still removes the former payload and retains its trivia.
                 erase_syntax(self.source, field.span, edits);
             }
         }
@@ -1355,6 +1404,7 @@ impl SyntaxUpdate<'_> {
         actual: &[language::EditValue],
         before: Option<&[language::EditValue]>,
         after: &[language::EditValue],
+        context: EditContext,
         edits: &mut LocalEdits,
     ) {
         let previous = before.unwrap_or(&[]);
@@ -1367,6 +1417,7 @@ impl SyntaxUpdate<'_> {
                     self.old_aliases,
                     self.legacy_value_paths,
                     None,
+                    context,
                 )
             })
             .collect();
@@ -1379,6 +1430,7 @@ impl SyntaxUpdate<'_> {
                     self.new_aliases,
                     self.legacy_value_paths,
                     self.identity_origins,
+                    context,
                 )
             })
             .collect();
@@ -1407,7 +1459,7 @@ impl SyntaxUpdate<'_> {
                 .all(|(i, source)| *source == Some(i))
         {
             for (i, (current, next)) in actual.iter().zip(after).enumerate() {
-                self.value(current, previous.get(i), next, edits);
+                self.value(current, previous.get(i), next, EditContext::Other, edits);
             }
             return;
         }
@@ -1440,7 +1492,13 @@ impl SyntaxUpdate<'_> {
                 let chunk = chunks[index];
                 text.push_str(&self.source[chunk.start..current.span.start]);
                 let mut local = Vec::new();
-                self.value(current, previous.get(index), next, &mut local);
+                self.value(
+                    current,
+                    previous.get(index),
+                    next,
+                    EditContext::Other,
+                    &mut local,
+                );
                 text.push_str(&changed_text(self.source, current.span, local));
                 suffix = &self.source[current.span.end..chunk.end];
             } else {
@@ -1483,14 +1541,58 @@ impl SyntaxUpdate<'_> {
     }
 }
 
+fn scenario_item_key(
+    value: &language::EditValue,
+    aliases: &BTreeMap<String, String>,
+    context: EditContext,
+) -> Option<String> {
+    use language::EditKind;
+    let EditKind::Record(fields) = &value.kind else {
+        return None;
+    };
+    let reference = |value: &language::EditValue| {
+        if let EditKind::Reference(alias) = &value.kind {
+            aliases.get(alias).cloned()
+        } else {
+            None
+        }
+    };
+    match context {
+        EditContext::Lanes => {
+            reference(&fields.get("lifeline")?.value).map(|id| format!("scenario-lane:{id}"))
+        }
+        EditContext::Messages => {
+            let EditKind::Record(address) = &fields.get("address")?.value.kind else {
+                return None;
+            };
+            let occurrence = reference(&address.get("occurrence")?.value)?;
+            let path: Vec<_> = match address.get("references") {
+                None => Vec::new(),
+                Some(field) => {
+                    let EditKind::List(path) = &field.value.kind else {
+                        return None;
+                    };
+                    path.iter().map(reference).collect::<Option<Vec<_>>>()?
+                }
+            };
+            Some(format!("scenario-message:{}:{occurrence}", path.join("/")))
+        }
+        _ => None,
+    }
+}
+
 fn item_key(
     value: &language::EditValue,
     source: &str,
     aliases: &BTreeMap<String, String>,
     legacy_value_paths: bool,
     origins: Option<&BTreeMap<Id, Id>>,
+    context: EditContext,
 ) -> Option<String> {
     use language::EditKind;
+    if matches!(context, EditContext::Lanes | EditContext::Messages) {
+        return scenario_item_key(value, aliases, context);
+    }
     if matches!(value.kind, EditKind::Record(_))
         && let Some(key) = language::semantic_row_key(
             &source[value.span.start..value.span.end],

crates/oa-core/src/source_project/source_migration.rs

@@ -68,6 +68,11 @@ pub(super) fn upgrade(
                 &actual.fields,
                 Some(&actual.fields),
                 &next.fields,
+                if project.diagrams.contains_key(&id) {
+                    EditContext::Diagram
+                } else {
+                    EditContext::Other
+                },
                 edits.entry(path.clone()).or_default(),
             );
         }

crates/oa-core/src/validation.rs

@@ -619,6 +619,7 @@ pub fn validate(p: &Project) -> Vec<Issue> {
         }
         text(&mut out, d.id, "name", &d.name);
         text(&mut out, d.id, "description", &d.description);
+        crate::scenario_layout::validate_diagram(p, d, &mut out);
         let option_issues = if d.projection == ProjectionKind::Traceability {
             crate::view_options::validate_options_cross_layer(p, &d.view_options)
         } else {

crates/oa-core/tests/release_routing.rs

@@ -41,6 +41,7 @@ fn fixture() -> Fixture {
             projection: ProjectionKind::Overview,
             view_options: Default::default(),
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-core/tests/source7_contract.rs

@@ -261,7 +261,7 @@ fn source7_context_lifecycle_source_history_and_closed_admission() {
     assert_eq!(session.project(), &after);
     let fresh = Id::new_v4();
     let mut reidentified = after.clone();
-    references::remap_references(&mut reidentified, f.r1, fresh);
+    references::remap_references(&mut reidentified, f.r1, fresh).unwrap();
     let mut e = reidentified.elements.remove(&f.r1).unwrap();
     e.id = fresh;
     reidentified.elements.insert(fresh, e);

crates/oa-core/tests/state_diagrams.rs

@@ -20,6 +20,7 @@ fn view(p: &mut Project, machine: Id, alias: &str) -> Id {
             projection: ProjectionKind::StateMachine { machine },
             view_options: Default::default(),
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-desktop/src/allocation_drag.rs

@@ -1,836 +0,0 @@
-//! Pure, bounded allocation-drag composition. See the v2 interaction contract.
-//!
-//! These values are not input capabilities. The App must independently admit a
-//! clean press and retire its token on every document/input/camera lifetime
-//! change. Cache a SemanticPlan per token and destination; only `place` belongs
-//! on pointer motion. `finish` rechecks the live accepted Project and commands,
-//! but Document::execute still owns source admission and atomic history.
-use oa_core::{
-    projection::{self, ProjectedNode, ProjectedView},
-    validation::{self, Issue, Severity},
-    view_options::ViewIndex,
-    *,
-};
-use std::collections::{BTreeMap, BTreeSet};
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Destination {
-    LayoutOnly,
-    Performer(Id),
-    OutsidePerformers,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Uniform {
-    Assigned(Id),
-    Unassigned,
-    MixedOrUnresolved,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Leaf {
-    pub direct: Option<Relation>,
-    pub role_assignments: Vec<Relation>,
-    pub role_realizations: Vec<Relation>,
-    pub effective_performer: Option<Id>,
-}
-
-/// Exact semantic scope S, leaf scope L and active placement scope Q, including
-/// folded/unplaced leaves. Retaining records detects first-child responsibility
-/// transfer. Revision and input-epoch guards remain the caller's responsibility.
-#[derive(Debug, Clone, PartialEq)]
-pub struct Scope {
-    pub project: Id,
-    pub work: Id,
-    pub placement: Id,
-    pub work_records: BTreeMap<Id, Element>,
-    pub leaves: BTreeMap<Id, Leaf>,
-    pub placements: BTreeMap<Id, NodePlacement>,
-    pub diagram: Diagram,
-    pub uniform: Uniform,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ChangedRecord {
-    pub id: Id,
-    pub name: String,
-    pub category: &'static str,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub enum Refusal {
-    Ineligible(String),
-    StaleScope,
-    MixedLayoutRequired,
-    RoleExitRequired {
-        work: Id,
-        roles: Vec<Id>,
-        performers: Vec<Id>,
-        message: String,
-    },
-    MissingAllocationId(Id),
-    InvalidCandidate(String),
-    CollateralChangeRequired(Vec<ChangedRecord>),
-    LayoutRequired(String),
-}
-
-pub fn capture(p: &Project, diagram: Id, work: Id, placement: Id) -> Result<Scope, Refusal> {
-    validate_candidate(p).map_err(|e| Refusal::InvalidCandidate(e.to_string()))?;
-    let d = p.diagrams.get(&diagram).ok_or(Refusal::StaleScope)?;
-    let root = p.elements.get(&work).ok_or(Refusal::StaleScope)?;
-    if !root.kind().is_work()
-        || d.projection != ProjectionKind::Allocation
-        || d.layer != root.layer()
-    {
-        return Err(Refusal::Ineligible(
-            "Select an activity or function in an Allocation view.".into(),
-        ));
-    }
-    if d.nodes.get(&placement).is_none_or(|n| n.element != work) {
-        return Err(Refusal::StaleScope);
-    }
-    let mut work_records = BTreeMap::new();
-    let mut leaves = BTreeMap::new();
-    let mut pending = vec![work];
-    while let Some(id) = pending.pop() {
-        let element = p.elements.get(&id).ok_or(Refusal::StaleScope)?;
-        if element.kind() != root.kind() || work_records.insert(id, element.clone()).is_some() {
-            return Err(Refusal::StaleScope);
-        }
-        let children: Vec<_> = p
-            .children(id)
-            .filter(|e| e.kind() == root.kind())
-            .map(|e| e.id)
-            .collect();
-        if !children.is_empty() {
-            pending.extend(children);
-            continue;
-        }
-        let direct: Vec<_> = p
-            .relations
-            .values()
-            .filter(|r| r.kind() == RelationKind::Allocation && r.target() == id)
-            .cloned()
-            .collect();
-        if direct.len() > 1 {
-            return Err(Refusal::StaleScope);
-        }
-        let role_assignments: Vec<_> = p
-            .relations
-            .values()
-            .filter(|r| r.kind() == RelationKind::RoleAssignment && r.target() == id)
-            .cloned()
-            .collect();
-        let roles: BTreeSet<_> = role_assignments.iter().map(Relation::source).collect();
-        let role_realizations = p
-            .relations
-            .values()
-            .filter(|r| r.kind() == RelationKind::RoleRealization && roles.contains(&r.target()))
-            .cloned()
-            .collect();
-        leaves.insert(
-            id,
-            Leaf {
-                direct: direct.into_iter().next(),
-                role_assignments,
-                role_realizations,
-                effective_performer: validation::effective_performer(p, id),
-            },
-        );
-    }
-    if leaves.is_empty() {
-        return Err(Refusal::StaleScope);
-    }
-    let uniform = if leaves
-        .values()
-        .all(|l| l.direct.is_none() && l.role_assignments.is_empty())
-    {
-        Uniform::Unassigned
-    } else if let Some(performer) = leaves.values().next().and_then(|l| l.effective_performer)
-        && leaves
-            .values()
-            .all(|l| l.effective_performer == Some(performer))
-    {
-        Uniform::Assigned(performer)
-    } else {
-        Uniform::MixedOrUnresolved
-    };
-    let placements = d
-        .nodes
-        .iter()
-        .filter(|(_, n)| work_records.contains_key(&n.element))
-        .map(|(id, n)| (*id, n.clone()))
-        .collect();
-    Ok(Scope {
-        project: p.id,
-        work,
-        placement,
-        work_records,
-        leaves,
-        placements,
-        diagram: d.clone(),
-        uniform,
-    })
-}
-
-#[derive(Debug)]
-pub struct SemanticPlan {
-    pub scope: Scope,
-    pub destination: Destination,
-    pub label: String,
-    pub warnings: Vec<Issue>,
-    accepted: Project,
-    candidate: Project,
-    index: ViewIndex,
-    commands: Vec<Command>,
-    before_visible: ProjectedView,
-    before_expanded: ProjectedView,
-}
-
-impl SemanticPlan {
-    /// All preview drawing, ports and routing must use this candidate and index.
-    pub fn project(&self) -> &Project {
-        &self.candidate
-    }
-    #[cfg(test)]
-    pub fn index(&self) -> &ViewIndex {
-        &self.index
-    }
-}
-
-/// Allocation identities are allocated once by the gesture owner, keyed by leaf,
-/// and reused on target revisits and release. No random identity generation here.
-pub fn plan_semantics(
-    p: &Project,
-    scope: &Scope,
-    destination: Destination,
-    allocation_ids: &BTreeMap<Id, Id>,
-) -> Result<SemanticPlan, Refusal> {
-    if &capture(p, scope.diagram.id, scope.work, scope.placement)? != scope {
-        return Err(Refusal::StaleScope);
-    }
-    if scope.work_records.len() > 1 && scope.uniform == Uniform::MixedOrUnresolved {
-        return Err(Refusal::MixedLayoutRequired);
-    }
-    if let Destination::Performer(id) = destination {
-        let valid = p
-            .elements
-            .get(&id)
-            .is_some_and(|e| e.kind().is_performer() && e.layer() == scope.diagram.layer);
-        if !valid {
-            return Err(Refusal::Ineligible(
-                "Choose a performer in this layer.".into(),
-            ));
-        }
-    }
-    let before_index = ViewIndex::new(p);
-    let before_visible = projection::project_diagram_with_index(p, &scope.diagram, &before_index);
-    let before_expanded = expanded_view(p, &scope.diagram, scope, &before_index);
-    if scope.work_records.len() > 1 && !coherent(scope, &before_expanded) {
-        return Err(Refusal::MixedLayoutRequired);
-    }
-    let same_performer =
-        matches!(destination, Destination::Performer(id) if scope.uniform == Uniform::Assigned(id));
-    let mut expected = p.clone();
-    let mut commands = Vec::new();
-    let mut deleted = BTreeSet::new();
-    if destination != Destination::LayoutOnly && !same_performer {
-        for (work, leaf) in &scope.leaves {
-            match destination {
-                Destination::Performer(performer) => {
-                    if let Some(existing) = &leaf.direct {
-                        if existing.source() != performer {
-                            let mut edited = existing.clone();
-                            edited.body = RelationBody::Allocation {
-                                source: performer,
-                                target: *work,
-                            };
-                            expected.relations.insert(edited.id, edited.clone());
-                            commands.push(Command::EditRelation(edited.id, edited));
-                        }
-                    } else {
-                        let id = *allocation_ids
-                            .get(work)
-                            .ok_or(Refusal::MissingAllocationId(*work))?;
-                        if id.is_nil() || expected.contains(id) {
-                            return Err(Refusal::InvalidCandidate(
-                                "The gesture's allocation identity is already in use.".into(),
-                            ));
-                        }
-                        let name = format!("{} performs {}", p.named(performer), p.named(*work));
-                        let relation = Relation {
-                            id,
-                            alias: expected.fresh_alias(&name, "allocation", id),
-                            name,
-                            description: String::new(),
-                            body: RelationBody::Allocation {
-                                source: performer,
-                                target: *work,
-                            },
-                        };
-                        expected.relations.insert(id, relation.clone());
-                        commands.push(Command::CreateRelation(relation));
-                    }
-                }
-                Destination::OutsidePerformers => {
-                    if !leaf.role_assignments.is_empty() {
-                        let roles: Vec<_> = leaf
-                            .role_assignments
-                            .iter()
-                            .map(Relation::source)
-                            .collect::<BTreeSet<_>>()
-                            .into_iter()
-                            .collect();
-                        let performers: Vec<_> = leaf
-                            .role_realizations
-                            .iter()
-                            .map(Relation::source)
-                            .collect::<BTreeSet<_>>()
-                            .into_iter()
-                            .collect();
-                        let message = if leaf.direct.is_some() && performers.len() == 1 {
-                            format!(
-                                "Removing direct assignment would place {} in {} through its role.",
-                                p.named(*work),
-                                p.named(performers[0])
-                            )
-                        } else {
-                            format!(
-                                "{} retains role responsibility through {}{}; edit that responsibility before moving outside performers.",
-                                p.named(*work),
-                                roles
-                                    .iter()
-                                    .map(|id| p.named(*id))
-                                    .collect::<Vec<_>>()
-                                    .join(", "),
-                                if performers.is_empty() {
-                                    String::new()
-                                } else {
-                                    format!(
-                                        " ({})",
-                                        performers
-                                            .iter()
-                                            .map(|id| p.named(*id))
-                                            .collect::<Vec<_>>()
-                                            .join(", ")
-                                    )
-                                }
-                            )
-                        };
-                        return Err(Refusal::RoleExitRequired {
-                            work: *work,
-                            roles,
-                            performers,
-                            message,
-                        });
-                    }
-                    if let Some(existing) = &leaf.direct {
-                        expected.relations.remove(&existing.id);
-                        deleted.insert(existing.id);
-                        commands.push(Command::Delete(existing.id));
-                    }
-                }
-                Destination::LayoutOnly => unreachable!(),
-            }
-        }
-    }
-    // A route cannot survive the intentional deletion of its own edge, even in
-    // another diagram. No other saved-view cleanup is authorized by this drag.
-    for diagram in expected.diagrams.values_mut() {
-        diagram.routes.retain(|r| !deleted.contains(&r.edge));
-    }
-    let actual = prepare_command(p, &Command::Batch(commands.clone()))
-        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
-        .project;
-    exact_project(&expected, &actual)?;
-    let retained_roles = scope
-        .leaves
-        .values()
-        .any(|l| !l.role_assignments.is_empty());
-    let label = match destination {
-        Destination::LayoutOnly => "Arrange only".into(),
-        Destination::Performer(id) if same_performer => format!("Arrange within {}", p.named(id)),
-        Destination::Performer(id) => format!(
-            "Assign {} leaf {} to {}{}",
-            scope.leaves.len(),
-            match (scope.diagram.layer, scope.leaves.len()) {
-                (Layer::Oa, 1) => "activity",
-                (Layer::Oa, _) => "activities",
-                (Layer::Sa, 1) => "function",
-                (Layer::Sa, _) => "functions",
-            },
-            p.named(id),
-            if retained_roles {
-                " — explicit assignment; role responsibility retained"
-            } else {
-                ""
-            }
-        ),
-        Destination::OutsidePerformers if commands.is_empty() => {
-            "Arrange unassigned work — decomposition retained".into()
-        }
-        Destination::OutsidePerformers => "Remove assignment — decomposition retained".into(),
-    };
-    let warnings = validation::validate(&actual)
-        .into_iter()
-        .filter(|i| i.severity == Severity::Warning)
-        .collect();
-    let index = ViewIndex::new(&actual);
-    Ok(SemanticPlan {
-        scope: scope.clone(),
-        destination,
-        label,
-        warnings,
-        accepted: p.clone(),
-        candidate: actual,
-        index,
-        commands,
-        before_visible,
-        before_expanded,
-    })
-}
-
-/// World-space rectangle in the gesture's frozen transform. The UI resolver
-/// owns half-open pointer hits, semantic target precedence and occlusion.
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct Rect {
-    pub position: Position,
-    pub size: Size,
-}
-
-impl Rect {
-    fn valid(self) -> bool {
-        [
-            self.position.x,
-            self.position.y,
-            self.size.width,
-            self.size.height,
-        ]
-        .iter()
-        .all(|n| n.is_finite() && n.abs() <= MAX_COORDINATE)
-            && self.size.width > 0.
-            && self.size.height > 0.
-    }
-    fn contains(self, other: Self) -> bool {
-        other.position.x >= self.position.x
-            && other.position.y >= self.position.y
-            && other.position.x + other.size.width <= self.position.x + self.size.width
-            && other.position.y + other.size.height <= self.position.y + self.size.height
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct TargetPresentation {
-    pub placement: Id,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct PresentationContext {
-    /// Visible world rectangle derived from the actual captured pan/zoom/bounds.
-    pub viewport: Rect,
-    pub zoom: f32,
-    pub target: Option<TargetPresentation>,
-}
-
-#[derive(Debug)]
-pub struct PlacementPlan {
-    pub diagram: Diagram,
-    pub view: ProjectedView,
-    pub delta: Position,
-    pub unfolded: Option<Id>,
-    requested: Position,
-    presentation: PresentationContext,
-    commands: Vec<Command>,
-}
-
-/// `requested` is the original selected placement position plus pointer motion
-/// in the frozen transform (therefore preserving the press offset). Snap only
-/// this root; apply the resulting identical delta to captured Q and its routes.
-/// No whole Project clone, validator or semantic ViewIndex rebuild occurs here.
-pub fn place(
-    plan: &SemanticPlan,
-    requested: Position,
-    presentation: PresentationContext,
-) -> Result<PlacementPlan, Refusal> {
-    if !requested.x.is_finite()
-        || !requested.y.is_finite()
-        || !presentation.viewport.valid()
-        || !presentation.zoom.is_finite()
-        || presentation.zoom <= 0.
-    {
-        return Err(Refusal::LayoutRequired(
-            "Make room or adjust the view, then drag again.".into(),
-        ));
-    }
-    let root = &plan.scope.placements[&plan.scope.placement];
-    let delta = Position {
-        x: (requested.x / 10.).round() * 10. - root.position.x,
-        y: (requested.y / 10.).round() * 10. - root.position.y,
-    };
-    let mut diagram = plan.candidate.diagrams[&plan.scope.diagram.id].clone();
-    let mut commands = Vec::new();
-    let mut deltas = BTreeMap::new();
-    for (id, original) in &plan.scope.placements {
-        let node = diagram.nodes.get_mut(id).ok_or(Refusal::StaleScope)?;
-        node.position = Position {
-            x: original.position.x + delta.x,
-            y: original.position.y + delta.y,
-        };
-        if !(Rect {
-            position: node.position,
-            size: node.size,
-        })
-        .valid()
-        {
-            return Err(Refusal::InvalidCandidate(
-                "Moved coordinates exceed the model bounds.".into(),
-            ));
-        }
-        deltas.insert(*id, delta);
-        if node != original {
-            commands.push(Command::EditNode {
-                diagram: diagram.id,
-                original: *id,
-                node: node.clone(),
-            });
-        }
-    }
-    // Resolve endpoints using the captured accepted semantics, not a newly
-    // regrouped descendant walk. Own-edge deletions were removed above already.
-    for route in projection::translated_routes(&plan.accepted, &plan.scope.diagram, &deltas) {
-        if let Some(existing) = diagram.routes.iter_mut().find(|r| r.edge == route.edge) {
-            if route.waypoints.iter().any(|p| {
-                !p.x.is_finite()
-                    || !p.y.is_finite()
-                    || p.x.abs() > MAX_COORDINATE
-                    || p.y.abs() > MAX_COORDINATE
-            }) {
-                return Err(Refusal::InvalidCandidate(
-                    "Moved route exceeds the model bounds.".into(),
-                ));
-            }
-            *existing = route.clone();
-            commands.push(Command::SetEdgeRoute {
-                diagram: diagram.id,
-                route,
-            });
-        }
-    }
-    let mut unfolded = None;
-    if let Destination::Performer(performer) = plan.destination {
-        let target = presentation.target.ok_or_else(|| {
-            Refusal::LayoutRequired("A visible accepted performer target is required.".into())
-        })?;
-        let node = diagram
-            .nodes
-            .get_mut(&target.placement)
-            .ok_or(Refusal::StaleScope)?;
-        let visible_target = plan
-            .before_visible
-            .nodes
-            .iter()
-            .any(|n| n.id == target.placement && n.element == performer);
-        if node.element != performer || !visible_target {
-            return Err(Refusal::LayoutRequired(
-                "Make room or adjust the view, then drag again.".into(),
-            ));
-        }
-        if node.collapsed && !plan.commands.is_empty() {
-            node.collapsed = false;
-            unfolded = Some(node.id);
-            commands.push(Command::EditNode {
-                diagram: diagram.id,
-                original: node.id,
-                node: node.clone(),
-            });
-        }
-    } else if presentation.target.is_some() {
-        return Err(Refusal::Ineligible(
-            "This layout/outside destination has no performer target.".into(),
-        ));
-    }
-    let view = projection::project_diagram_with_index(&plan.candidate, &diagram, &plan.index);
-    let expanded = expanded_view(&plan.candidate, &diagram, &plan.scope, &plan.index);
-    check_geometry(plan, &view, &expanded, delta)?;
-    let selected = view
-        .nodes
-        .iter()
-        .find(|n| n.id == plan.scope.placement)
-        .ok_or_else(|| {
-            Refusal::LayoutRequired("The selected work header would be hidden.".into())
-        })?;
-    let header = Rect {
-        position: selected.position,
-        size: Size {
-            width: selected.size.width,
-            height: selected.size.height.min(62.),
-        },
-    };
-    if !presentation.viewport.contains(header) {
-        return Err(Refusal::LayoutRequired(
-            "Make room or adjust the view, then drag again.".into(),
-        ));
-    }
-    // Destination identity lives in a fixed toolbar slot. Frozen hit geometry
-    // and its outline never introduce an opaque label over this work header.
-    Ok(PlacementPlan {
-        diagram,
-        view,
-        delta,
-        unfolded,
-        requested,
-        presentation,
-        commands,
-    })
-}
-
-/// Final semantic/presentation equality gate, after the App has checked its
-/// current token, owner, revision, clean drafts, frozen target and transform.
-/// Recompute geometry to avoid accepting a modified/stale placement result.
-/// None means a snapped no-op: the caller must not execute or add history.
-pub fn finish(
-    plan: &SemanticPlan,
-    live: &Project,
-    placement: &PlacementPlan,
-) -> Result<Option<Command>, Refusal> {
-    if live != &plan.accepted {
-        return Err(Refusal::StaleScope);
-    }
-    let checked = place(plan, placement.requested, placement.presentation)?;
-    if checked.diagram != placement.diagram
-        || checked.view != placement.view
-        || checked.delta != placement.delta
-        || checked.unfolded != placement.unfolded
-        || checked.commands != placement.commands
-    {
-        return Err(Refusal::StaleScope);
-    }
-    let mut expected = plan.candidate.clone();
-    expected
-        .diagrams
-        .insert(checked.diagram.id, checked.diagram);
-    let mut commands = plan.commands.clone();
-    commands.extend(checked.commands);
-    let command = Command::Batch(commands);
-    let actual = prepare_command(live, &command)
-        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
-        .project;
-    exact_project(&expected, &actual)?;
-    Ok((actual != *live).then_some(command))
-}
-
-fn expanded_view(
-    p: &Project,
-    diagram: &Diagram,
-    scope: &Scope,
-    index: &ViewIndex,
-) -> ProjectedView {
-    let mut expanded = diagram.clone();
-    for id in scope.placements.keys() {
-        if let Some(node) = expanded.nodes.get_mut(id) {
-            node.collapsed = false;
-        }
-    }
-    projection::project_diagram_with_index(p, &expanded, index)
-}
-
-fn ancestors(view: &ProjectedView) -> BTreeMap<Id, BTreeSet<Id>> {
-    let parents: BTreeMap<_, _> = view.nodes.iter().map(|n| (n.id, n.visual_parent)).collect();
-    parents
-        .keys()
-        .map(|node| {
-            let mut current = parents[node];
-            let mut seen = BTreeSet::new();
-            while let Some(id) = current {
-                if !seen.insert(id) {
-                    break;
-                }
-                current = parents.get(&id).copied().flatten();
-            }
-            (*node, seen)
-        })
-        .collect()
-}
-
-fn coherent(scope: &Scope, view: &ProjectedView) -> bool {
-    let ancestors = ancestors(view);
-    scope.placements.keys().all(|id| {
-        ancestors
-            .get(id)
-            .is_some_and(|parents| *id == scope.placement || parents.contains(&scope.placement))
-    })
-}
-
-fn overlap(a: &ProjectedNode, b: &ProjectedNode) -> f32 {
-    let width = (a.position.x + a.size.width).min(b.position.x + b.size.width)
-        - a.position.x.max(b.position.x);
-    let height = (a.position.y + a.size.height).min(b.position.y + b.size.height)
-        - a.position.y.max(b.position.y);
-    width.max(0.) * height.max(0.)
-}
-
-fn overlaps(before: &ProjectedView, after: &ProjectedView) -> bool {
-    // Build geometry ancestry once, avoiding a repeated descendant walk for
-    // every pair during pointer motion. Pairwise collision checking is bounded
-    // to these two projected scenes and does not traverse/clone model semantics.
-    let before_ancestors = ancestors(before);
-    let after_ancestors = ancestors(after);
-    let prior_nodes: BTreeMap<_, _> = before.nodes.iter().map(|n| (n.id, n)).collect();
-    for (i, a) in after.nodes.iter().enumerate() {
-        for b in &after.nodes[i + 1..] {
-            if after_ancestors[&a.id].contains(&b.id) || after_ancestors[&b.id].contains(&a.id) {
-                continue;
-            }
-            let prior = match (prior_nodes.get(&a.id), prior_nodes.get(&b.id)) {
-                (Some(x), Some(y))
-                    if !before_ancestors[&x.id].contains(&y.id)
-                        && !before_ancestors[&y.id].contains(&x.id) =>
-                {
-                    overlap(x, y)
-                }
-                _ => 0.,
-            };
-            if overlap(a, b) > prior + 0.01 {
-                return true;
-            }
-        }
-    }
-    false
-}
-
-fn check_geometry(
-    plan: &SemanticPlan,
-    visible: &ProjectedView,
-    expanded: &ProjectedView,
-    delta: Position,
-) -> Result<(), Refusal> {
-    if visible.nodes.iter().chain(&expanded.nodes).any(|n| {
-        !(Rect {
-            position: n.position,
-            size: n.size,
-        })
-        .valid()
-    }) {
-        return Err(Refusal::InvalidCandidate(
-            "The projected enclosure exceeds the model bounds.".into(),
-        ));
-    }
-    if plan.scope.work_records.len() > 1 {
-        if !coherent(&plan.scope, expanded) {
-            return Err(Refusal::MixedLayoutRequired);
-        }
-        for id in plan.scope.placements.keys() {
-            let old = plan
-                .before_expanded
-                .nodes
-                .iter()
-                .find(|n| n.id == *id)
-                .ok_or(Refusal::MixedLayoutRequired)?;
-            let new = expanded
-                .nodes
-                .iter()
-                .find(|n| n.id == *id)
-                .ok_or(Refusal::MixedLayoutRequired)?;
-            if (new.position.x - old.position.x - delta.x).abs() > 0.01
-                || (new.position.y - old.position.y - delta.y).abs() > 0.01
-                || (new.size.width - old.size.width).abs() > 0.01
-                || (new.size.height - old.size.height).abs() > 0.01
-            {
-                return Err(Refusal::LayoutRequired("This work subtree requires an explicit layout; its footprint cannot be translated unchanged.".into()));
-            }
-        }
-    }
-    if overlaps(&plan.before_visible, visible) || overlaps(&plan.before_expanded, expanded) {
-        return Err(Refusal::LayoutRequired("Make room before moving work: the candidate would introduce or enlarge overlapping cards.".into()));
-    }
-    Ok(())
-}
-
-/// Compare complete records, not just removed IDs. Deleting an Allocation can
-/// rewrite a surviving Constraint, remove artifacts/traces or prune view options.
-fn exact_project(expected: &Project, actual: &Project) -> Result<(), Refusal> {
-    if expected == actual {
-        return Ok(());
-    }
-    let mut records = Vec::new();
-    fn changes<T: PartialEq>(
-        expected: &BTreeMap<Id, T>,
-        actual: &BTreeMap<Id, T>,
-        category: &'static str,
-        project: &Project,
-        other: &Project,
-        records: &mut Vec<ChangedRecord>,
-    ) {
-        let ids: BTreeSet<_> = expected.keys().chain(actual.keys()).copied().collect();
-        for id in ids {
-            if expected.get(&id) != actual.get(&id) {
-                records.push(ChangedRecord {
-                    id,
-                    name: if project.contains(id) {
-                        project.named(id)
-                    } else {
-                        other.named(id)
-                    }
-                    .into(),
-                    category,
-                });
-            }
-        }
-    }
-    changes(
-        &expected.elements,
-        &actual.elements,
-        "element",
-        expected,
-        actual,
-        &mut records,
-    );
-    changes(
-        &expected.relations,
-        &actual.relations,
-        "relation",
-        expected,
-        actual,
-        &mut records,
-    );
-    changes(
-        &expected.diagrams,
-        &actual.diagrams,
-        "diagram",
-        expected,
-        actual,
-        &mut records,
-    );
-    changes(
-        &expected.artifact_links,
-        &actual.artifact_links,
-        "artifact",
-        expected,
-        actual,
-        &mut records,
-    );
-    changes(
-        &expected.traces,
-        &actual.traces,
-        "trace",
-        expected,
-        actual,
-        &mut records,
-    );
-    if expected.schema_version != actual.schema_version
-        || expected.id != actual.id
-        || expected.alias != actual.alias
-        || expected.name != actual.name
-        || expected.description != actual.description
-    {
-        records.push(ChangedRecord {
-            id: expected.id,
-            name: expected.name.clone(),
-            category: "project",
-        });
-    }
-    Err(Refusal::CollateralChangeRequired(records))
-}
-
-#[cfg(test)]
-mod tests;

crates/oa-desktop/src/allocation_input.rs

@@ -1,267 +0,0 @@
-//! A narrow dispatch boundary for Allocation work gestures. Iced rows visit
-//! siblings after capture; refusing inside Canvas alone still blurs an inspector
-//! field. Refuse before dispatching that press to any ordinary child instead.
-use crate::{
-    app::{
-        App, Message,
-        allocation_drag::{self, Event as WorkEvent},
-    },
-    diagram::DiagramCanvas,
-};
-use iced::advanced::{
-    Clipboard, Layout, Shell, Widget, layout, overlay, renderer,
-    widget::{Id, Operation, Tree, tree},
-};
-use iced::{
-    Element, Event, Length, Point, Rectangle, Renderer, Size, Theme, Vector, keyboard, mouse,
-};
-
-pub const CANVAS_ID: &str = "allocation-work-canvas";
-pub const ARRANGE_SHORTCUT: &str = "Alt+A";
-
-struct Root<'a> {
-    app: &'a App,
-    content: Element<'a, Message>,
-}
-#[derive(Default)]
-struct State {
-    pointer: Option<Point>,
-    refused_left: bool,
-}
-#[derive(Default)]
-struct CanvasBounds(Option<Rectangle>);
-impl Operation for CanvasBounds {
-    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation)) {
-        visit(self);
-    }
-    fn container(&mut self, id: Option<&Id>, bounds: Rectangle) {
-        if id == Some(&Id::new(CANVAS_ID)) {
-            self.0 = Some(bounds);
-        }
-    }
-}
-pub fn root<'a>(app: &'a App, content: impl Into<Element<'a, Message>>) -> Element<'a, Message> {
-    Element::new(Root {
-        app,
-        content: content.into(),
-    })
-}
-fn arrange_key(event: &Event) -> bool {
-    matches!(event, Event::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Character(key), modifiers, repeat: false, ..
-    }) if key.eq_ignore_ascii_case("a") && *modifiers == keyboard::Modifiers::ALT)
-}
-impl Root<'_> {
-    fn dirty_object(&self, bounds: Rectangle, screen: Point) -> bool {
-        let Some(diagram) = self.app.active_diagram else {
-            return false;
-        };
-        if !allocation_drag::contains(bounds, screen) {
-            return false;
-        }
-        let canvas = DiagramCanvas {
-            allocation: Some(self.app.allocation_capability()),
-            project: self.app.project(),
-            view_index: Some(self.app.document.view_index()),
-            diagram,
-            selected: self.app.selected,
-            navigation_focus: None,
-            zoom: self.app.zoom,
-            pan: self.app.pan,
-            context: self.app.route_context().unwrap(),
-            selected_bend: None,
-            editable: false,
-            placing: false,
-            connection: None,
-        };
-        canvas.work_dirty_point(bounds, screen)
-    }
-}
-impl Widget<Message, Theme, Renderer> for Root<'_> {
-    fn tag(&self) -> tree::Tag {
-        tree::Tag::of::<State>()
-    }
-    fn state(&self) -> tree::State {
-        tree::State::new(State::default())
-    }
-    fn children(&self) -> Vec<Tree> {
-        vec![Tree::new(self.content.as_widget())]
-    }
-    fn diff(&self, tree: &mut Tree) {
-        tree.diff_children(std::slice::from_ref(&self.content));
-    }
-    fn size(&self) -> Size<Length> {
-        self.content.as_widget().size()
-    }
-    fn layout(
-        &mut self,
-        tree: &mut Tree,
-        renderer: &Renderer,
-        limits: &layout::Limits,
-    ) -> layout::Node {
-        self.content
-            .as_widget_mut()
-            .layout(&mut tree.children[0], renderer, limits)
-    }
-    fn operate(
-        &mut self,
-        tree: &mut Tree,
-        layout: Layout<'_>,
-        renderer: &Renderer,
-        operation: &mut dyn Operation,
-    ) {
-        self.content
-            .as_widget_mut()
-            .operate(&mut tree.children[0], layout, renderer, operation);
-    }
-    fn update(
-        &mut self,
-        tree: &mut Tree,
-        event: &Event,
-        layout: Layout<'_>,
-        cursor: mouse::Cursor,
-        renderer: &Renderer,
-        clipboard: &mut dyn Clipboard,
-        shell: &mut Shell<'_, Message>,
-        viewport: &Rectangle,
-    ) {
-        let state = tree.state.downcast_mut::<State>();
-        match event {
-            Event::Mouse(mouse::Event::CursorMoved { position }) => state.pointer = Some(*position),
-            Event::Mouse(mouse::Event::CursorLeft) => state.pointer = None,
-            Event::Window(iced::window::Event::RedrawRequested(_)) => {
-                state.pointer = cursor.position()
-            }
-            Event::Window(iced::window::Event::Unfocused) => {
-                state.pointer = None;
-                state.refused_left = false;
-            }
-            _ => {}
-        }
-        if state.refused_left {
-            if matches!(
-                event,
-                Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left))
-            ) {
-                state.refused_left = false;
-                shell.capture_event();
-                return;
-            }
-            if matches!(event, Event::Mouse(mouse::Event::CursorMoved { .. })) {
-                shell.capture_event();
-                return;
-            }
-        }
-        if self.app.allocation_input_owner() && !shell.is_event_captured() {
-            if arrange_key(event) {
-                // App rechecks clean ownership before arming. A dirty field
-                // retains its actual widget focus and selection on refusal.
-                shell.publish(Message::WorkDrag(WorkEvent::ArrangeNext));
-                shell.capture_event();
-                return;
-            }
-            if self.app.allocation_drag.arrange_next
-                && matches!(
-                    event,
-                    Event::Keyboard(keyboard::Event::KeyPressed {
-                        key: keyboard::Key::Named(keyboard::key::Named::Escape),
-                        ..
-                    })
-                )
-            {
-                shell.publish(Message::Escape);
-                shell.capture_event();
-                return;
-            }
-            if !self.app.allocation_drag_clean()
-                && matches!(
-                    event,
-                    Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left))
-                )
-                && let Some(screen) = state.pointer.or_else(|| cursor.position())
-            {
-                let mut canvas = CanvasBounds::default();
-                self.content.as_widget_mut().operate(
-                    &mut tree.children[0],
-                    layout,
-                    renderer,
-                    &mut canvas,
-                );
-                if canvas
-                    .0
-                    .is_some_and(|bounds| self.dirty_object(bounds, screen))
-                {
-                    state.refused_left = true;
-                    shell.publish(Message::WorkDrag(WorkEvent::Refused(
-                        self.app.allocation_drag.epoch,
-                        allocation_drag::FINISH_EDIT.into(),
-                    )));
-                    shell.capture_event();
-                    return;
-                }
-            }
-        }
-        self.content.as_widget_mut().update(
-            &mut tree.children[0],
-            event,
-            layout,
-            cursor,
-            renderer,
-            clipboard,
-            shell,
-            viewport,
-        );
-    }
-    fn draw(
-        &self,
-        tree: &Tree,
-        renderer: &mut Renderer,
-        theme: &Theme,
-        style: &renderer::Style,
-        layout: Layout<'_>,
-        cursor: mouse::Cursor,
-        viewport: &Rectangle,
-    ) {
-        self.content.as_widget().draw(
-            &tree.children[0],
-            renderer,
-            theme,
-            style,
-            layout,
-            cursor,
-            viewport,
-        );
-    }
-    fn mouse_interaction(
-        &self,
-        tree: &Tree,
-        layout: Layout<'_>,
-        cursor: mouse::Cursor,
-        viewport: &Rectangle,
-        renderer: &Renderer,
-    ) -> mouse::Interaction {
-        self.content.as_widget().mouse_interaction(
-            &tree.children[0],
-            layout,
-            cursor,
-            viewport,
-            renderer,
-        )
-    }
-    fn overlay<'b>(
-        &'b mut self,
-        tree: &'b mut Tree,
-        layout: Layout<'b>,
-        renderer: &Renderer,
-        viewport: &Rectangle,
-        translation: Vector,
-    ) -> Option<overlay::Element<'b, Message, Theme, Renderer>> {
-        self.content.as_widget_mut().overlay(
-            &mut tree.children[0],
-            layout,
-            renderer,
-            viewport,
-            translation,
-        )
-    }
-}

crates/oa-desktop/src/app.rs

@@ -1,15 +1,7 @@
-pub(crate) mod allocation_drag;
 pub(crate) mod architecture_authoring;
 #[cfg(test)]
 mod architecture_authoring_tests;
-#[cfg(test)]
-mod behavior_removal_tests;
 mod checkpoints;
-#[cfg(test)]
-mod diagram_focus_tests;
-pub(crate) mod diagram_removal;
-#[cfg(test)]
-mod diagram_removal_tests;
 mod diagram_reveal;
 #[cfg(test)]
 mod diagram_selection_tests;
@@ -24,6 +16,7 @@ mod source_symbols;
 mod transition_context_tests;
 #[cfg(test)]
 mod view_copy_tests;
+pub(crate) const SAVED_SCENARIO_UNAVAILABLE: &str = "Saved Scenario layout rendering and canvas editing are not available yet. Select the Scenario in Behavior to use its existing semantic preview.";
 use crate::forms::Draft;
 use crate::{
     behavior,
@@ -339,7 +332,6 @@ pub struct FilePrompt {
 
 #[derive(Debug, Clone)]
 pub enum Message {
-    WorkDrag(allocation_drag::Event),
     BehaviorControl(behavior::canvas_workspace::Intent),
     Architecture(architecture_authoring::Event),
     Home(crate::home::Event),
@@ -404,9 +396,7 @@ pub enum Message {
     RelationKind(RelationKind),
     Command(Command),
     Delete,
-    ConfirmDelete(u64),
-    DiagramRemove(diagram_removal::Intent),
-    DiagramTraverse(bool),
+    ConfirmDelete,
     CancelDelete,
     Undo,
     Redo,
@@ -476,7 +466,6 @@ pub enum Message {
 }
 
 pub struct App {
-    pub allocation_drag: allocation_drag::State,
     pub home: crate::home::State,
     pub recovery: crate::recovery::State,
     recent_target: Option<PathBuf>,
@@ -516,7 +505,6 @@ pub struct App {
     pub busy: bool,
     pub pending: Option<Pending>,
     pub delete_pending: bool,
-    pub delete_target: Option<diagram_removal::Confirmation>,
     pub path: Option<PathBuf>,
     /// A disk transaction requiring an explicit action, independent of lint.
     pub pending_recovery: Option<PathBuf>,
@@ -590,14 +578,13 @@ impl App {
         let active_diagram = project
             .diagrams
             .values()
-            .filter(|d| d.layer == layer)
+            .filter(|d| d.layer == layer && d.projection.scenario().is_none())
             .min_by_key(|d| (d.projection != ProjectionKind::Allocation, d.id))
             .map(|d| d.id);
         let draft = Draft::from_project(&project, selected);
         let explorer_index = crate::explorer::Index::new(&project, layer);
         let explorer_collapsed = project.elements.values().filter_map(|e| e.parent).collect();
         let mut app = Self {
-            allocation_drag: Default::default(),
             home: Default::default(),
             recovery: Default::default(),
             recent_target: None,
@@ -639,7 +626,6 @@ impl App {
             busy: false,
             pending: None,
             delete_pending: false,
-            delete_target: None,
             path: None,
             pending_recovery: None,
             disk_project: None,
@@ -813,7 +799,7 @@ impl App {
                 .project()
                 .diagrams
                 .values()
-                .filter(|d| d.layer == self.layer)
+                .filter(|d| d.layer == self.layer && d.projection.scenario().is_none())
                 .min_by_key(|d| (d.projection != ProjectionKind::Allocation, d.id))
                 .map(|d| d.id);
         }
@@ -1065,7 +1051,7 @@ impl App {
                     self.project()
                         .diagrams
                         .get(id)
-                        .is_some_and(|d| d.layer == layer)
+                        .is_some_and(|d| d.layer == layer && d.projection.scenario().is_none())
                 })
                 .or(retained)
                 .or_else(|| self.diagram_for(layer, target));
@@ -1182,13 +1168,6 @@ impl App {
             window::close_requests().map(|id| Message::Request(Pending::Close(id))),
             window::resize_events().map(|(_, size)| Message::WindowResized(size)),
             architecture_authoring::subscription(self),
-            iced::event::listen_with(|event, _, _| {
-                matches!(
-                    event,
-                    iced::Event::Keyboard(keyboard::Event::KeyPressed { .. })
-                )
-                .then_some(Message::WorkDrag(allocation_drag::Event::KeyboardBoundary))
-            }),
             // Use one captured-Escape bridge: a focused Find input consumes
             // Escape, while modal priority remains in the ordinary handler.
             behavior::creation::subscription(
@@ -1203,9 +1182,6 @@ impl App {
             )
             .map(|()| Message::Escape),
             iced::event::listen_with(|event, status, _| {
-                if matches!(event, iced::Event::Window(window::Event::Unfocused)) {
-                    return Some(Message::WorkDrag(allocation_drag::Event::Unfocused));
-                }
                 let iced::Event::Keyboard(keyboard::Event::KeyPressed {
                     key,
                     modifiers: mods,
@@ -1249,28 +1225,6 @@ impl App {
         ])
     }
     pub fn update(&mut self, message: Message) -> Task<Message> {
-        // These handlers reject old owners/tokens without changing state. Apply
-        // the same admission before shared camera and allocation boundaries.
-        if !self.source_input_envelope(&message)
-            || matches!(&message, Message::DiagramUsage(event) if !self.diagram_usage_envelope(event))
-            || matches!(&message, Message::WorkDrag(event) if !self.allocation_event_envelope(event))
-        {
-            return Task::none();
-        }
-        if let Message::WorkDrag(allocation_drag::Event::Press(press)) = &message
-            && !self.allocation_press_owns_current_view(press)
-        {
-            // Keep the existing stale-press explanation, without treating the
-            // rejected press as a new navigation or allocation boundary.
-            return self.allocation_event(allocation_drag::Event::Press(press.clone()));
-        }
-        // A queued toolbar from a previous input owner cannot retire a newer
-        // navigation destination or allocation capability before dispatch.
-        if let Message::BehaviorControl(intent) = &message
-            && behavior::canvas_workspace::Scope::input_owner(self) != Some(intent.scope)
-        {
-            return Task::none();
-        }
         // Reject stale rename intents before camera/reveal reconciliation or
         // source interaction can disturb a newer navigation destination.
         if let Message::SourceRename(event) = &message
@@ -1289,11 +1243,6 @@ impl App {
             return Task::none();
         }
         self.reconcile_pending_diagram_reveal(&message);
-        self.allocation_before(&message);
-        if let Message::WorkDrag(event) = message {
-            return self.allocation_event(event);
-        }
-        let allocation_before = self.allocation_boundary();
         if let Message::BehaviorControl(intent) = message {
             return self.behavior_control(intent);
         }
@@ -1304,9 +1253,6 @@ impl App {
         );
         let before = self.camera_boundary();
         let task = self.update_inner(message);
-        if self.allocation_boundary() != allocation_before {
-            self.allocation_retire();
-        }
         if window_resized && let Some((_, _, epoch)) = &mut self.pending_diagram_reveal {
             *epoch = self.canvas_epoch;
         }
@@ -1350,14 +1296,27 @@ impl App {
         // This whitelist contains only the production presentation controls.
         // A stamped toolbar cannot smuggle an arbitrary authoring command.
         match &mut message {
+            Message::ScenarioCanvas(Scenario::Camera(c, lifetime, Camera::Focus))
+                if valid_scenario(*c) && *lifetime == scope.epoch =>
+            {
+                return canvas_workspace::focus_task(scope, Camera::Focus);
+            }
+            Message::TopologyCanvas(Process::Camera(c, lifetime, Camera::Focus))
+                if valid_process(*c) && *lifetime == scope.epoch =>
+            {
+                return canvas_workspace::focus_task(scope, Camera::Focus);
+            }
             Message::ScenarioCanvas(
-                Scenario::Zoom(c, _) | Scenario::Choose(c, _) | Scenario::Shelf(c, _),
+                Scenario::Zoom(c, _)
+                | Scenario::Choose(c, _)
+                | Scenario::Focus(c)
+                | Scenario::Shelf(c, _),
             ) if valid_scenario(*c) => {
                 c.epoch = self.canvas_epoch;
             }
-            Message::TopologyCanvas(Process::Zoom(c, _) | Process::Choose(c, _))
-                if valid_process(*c) =>
-            {
+            Message::TopologyCanvas(
+                Process::Zoom(c, _) | Process::Choose(c, _) | Process::Focus(c),
+            ) if valid_process(*c) => {
                 c.epoch = self.canvas_epoch;
             }
             Message::Behavior(behavior::Event::Topology(behavior::topology::Event::Shelf(_)))
@@ -1396,16 +1355,29 @@ impl App {
         )
     }
     fn update_inner(&mut self, message: Message) -> Task<Message> {
-        if !self.source_input_envelope(&message) {
-            return Task::none();
-        }
         let message = match message {
-            Message::SourceFindClose(..) => {
+            Message::SourceFindClose(context, instance) => {
+                if context != self.source_symbol_context()
+                    || instance != self.source_find_instance
+                    || !self.source_navigation.open
+                    || !self.source_navigation_available()
+                {
+                    return Task::none();
+                }
                 // Only the checked envelope may enter the legacy Close handler.
                 Message::SourceNavigation(crate::source_navigation::Event::Close)
             }
+            Message::SourceNavigation(crate::source_navigation::Event::Close) => {
+                return Task::none();
+            }
             message => message,
         };
+        if let Message::SourceSymbols(context, _) = &message
+            && (context.session != self.source_workspace.session()
+                || context.path != self.source_workspace.active)
+        {
+            return Task::none();
+        }
         // Internal results and geometry do not constitute a new user intent.
         // Process query completion even behind a modal to release its worker slot;
         // its handler independently refuses navigation outside the live editor.
@@ -1592,8 +1564,6 @@ impl App {
             }
             if self.delete_pending {
                 self.delete_pending = false;
-                self.delete_target = None;
-                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                 return Task::none();
             }
             if self.pending.take().is_some() {
@@ -1628,7 +1598,7 @@ impl App {
                         Message::FilePath(_) | Message::SubmitFile | Message::CancelFile
                     ))
                 || (self.delete_pending
-                    && !matches!(message, Message::ConfirmDelete(_) | Message::CancelDelete))
+                    && !matches!(message, Message::ConfirmDelete | Message::CancelDelete))
                 || (self.pending.is_some()
                     && self.file_prompt.is_none()
                     && !matches!(
@@ -1777,9 +1747,50 @@ impl App {
         }
         self.behavior.scenario.focus_stamp(self.scenario_context()?)
     }
+    fn saved_scenario_diagram(&self, id: Id) -> bool {
+        self.project()
+            .diagrams
+            .get(&id)
+            .is_some_and(|d| d.projection.scenario().is_some())
+    }
+
+    fn unsupported_saved_scenario_message(&self, message: &Message) -> bool {
+        let active = self
+            .active_diagram
+            .is_some_and(|id| self.saved_scenario_diagram(id));
+        match message {
+            Message::Diagram(choice) => self.saved_scenario_diagram(choice.id),
+            Message::RevealInDiagram(diagram, _) | Message::Command(Command::Layout(diagram)) => {
+                self.saved_scenario_diagram(*diagram)
+            }
+            Message::Projection(projection) => active || projection.scenario().is_some(),
+            Message::SelectNode(_)
+            | Message::PlaceSelected
+            | Message::HideSelected
+            | Message::ToggleCollapse
+            | Message::MoveNode(..)
+            | Message::Route(_)
+            | Message::Connection(_)
+            | Message::PortAnchor(_)
+            | Message::Export
+            | Message::Fit
+            | Message::Zoom(_)
+            | Message::Pan(_) => active,
+            Message::Add(_) | Message::CreateContextElement(..) => {
+                active && self.page == Page::Diagram
+            }
+            _ => false,
+        }
+    }
+
     fn handle(&mut self, message: Message) -> Task<Message> {
+        // Refuse unsupported saved-view actions before they can Apply unrelated drafts.
+        // Generic model/source edits and the semantic Scenario workspace remain available.
+        if self.unsupported_saved_scenario_message(&message) {
+            self.status = SAVED_SCENARIO_UNAVAILABLE.into();
+            return Task::none();
+        }
         match message {
-            Message::WorkDrag(event) => return self.allocation_event(event),
             Message::BehaviorControl(intent) => return self.behavior_control(intent),
             Message::Architecture(event) => return self.architecture_event(event),
             Message::Home(event) => return self.home_event(event),
@@ -1870,7 +1881,8 @@ impl App {
                         return Task::none();
                     }
                     match input {
-                        Event::Traverse(_)
+                        Event::Focus
+                        | Event::Traverse(_)
                         | Event::ControlFocus(_)
                         | Event::ToggleFocus
                         | Event::Leave => {
@@ -1891,19 +1903,9 @@ impl App {
                     return Task::none();
                 }
                 match event {
-                    CanvasEvent::Remove(_, id) => {
-                        if diagram_removal::enabled(self)
-                            && self.selected == id
-                            && self.behavior.scenario.canvas_tool(context.scenario)
-                                == crate::behavior::scenario::CanvasTool::Select
-                            && crate::behavior::scenario::removal_target(
-                                self.project(),
-                                context.scenario,
-                                id,
-                            )
-                        {
-                            self.begin_model_delete(None);
-                        }
+                    CanvasEvent::Focus(_) => {
+                        self.behavior.scenario.toggle_focus();
+                        self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                     }
                     CanvasEvent::Shelf(_, shelf) => {
                         self.behavior.scenario.toggle_shelf(shelf);
@@ -2259,16 +2261,10 @@ impl App {
                 if self.connection.take().is_some() {
                     self.status = "Drawing cancelled · Select / move is active".into();
                 }
-                if restore_source_focus && self.source_navigation.open {
-                    // Dismiss the active Find surface first. Its underlying
-                    // references remain available until a separate Escape.
-                    self.source_navigation.open = false;
-                } else {
-                    self.source_navigation.open = false;
-                    self.source_symbols.open = false;
-                    self.source_symbols.results = None;
-                    self.source_symbols.notice = None;
-                }
+                self.source_navigation.open = false;
+                self.source_symbols.open = false;
+                self.source_symbols.results = None;
+                self.source_symbols.notice = None;
                 if restore_source_focus {
                     self.restore_source_editor_focus();
                 }
@@ -2441,7 +2437,7 @@ impl App {
                             self.project()
                                 .diagrams
                                 .get(&id)
-                                .is_some_and(|d| d.projection.state_machine().is_some())
+                                .is_some_and(|d| !d.projection.is_architecture())
                         })
                     {
                         // Architecture remains reachable from a state workspace.
@@ -2450,9 +2446,7 @@ impl App {
                             .project()
                             .diagrams
                             .values()
-                            .filter(|d| {
-                                d.layer == self.layer && d.projection.state_machine().is_none()
-                            })
+                            .filter(|d| d.layer == self.layer && d.projection.is_architecture())
                             .min_by_key(|d| (d.projection != ProjectionKind::Allocation, d.id))
                             .map(|d| d.id);
                         self.fit();
@@ -2710,7 +2704,7 @@ impl App {
                         .project()
                         .diagrams
                         .values()
-                        .filter(|d| d.layer == layer)
+                        .filter(|d| d.layer == layer && d.projection.scenario().is_none())
                         .min_by_key(|d| (d.projection != ProjectionKind::Allocation, d.id))
                         .map(|d| d.id);
                     self.selected = self.project().id;
@@ -2883,6 +2877,10 @@ impl App {
                 let Some(view) = self.project().diagrams.get(&diagram) else {
                     return Task::none();
                 };
+                if view.projection.scenario().is_some() {
+                    self.status = SAVED_SCENARIO_UNAVAILABLE.into();
+                    return Task::none();
+                }
                 let layer = view.layer;
                 let endpoints = self
                     .project()
@@ -2950,6 +2948,7 @@ impl App {
                         description: String::new(),
                         layer: self.layer,
                         projection: ProjectionKind::Allocation,
+                        layout: None,
                         routes: Vec::new(),
                         view_options: Default::default(),
                         nodes: Default::default(),
@@ -3042,25 +3041,19 @@ impl App {
                     }
                 }
             }
-            Message::DiagramRemove(intent) => self.remove_from_diagram(intent),
-            Message::DiagramTraverse(back) => {
-                return if back {
-                    iced::widget::operation::focus_previous()
-                } else {
-                    iced::widget::operation::focus_next()
-                };
-            }
             Message::Delete => {
                 if self.selected != self.project().id && self.apply() {
-                    self.begin_model_delete(None);
+                    self.delete_pending = true;
                 }
             }
-            Message::ConfirmDelete(token) => self.confirm_model_delete(token),
-            Message::CancelDelete => {
+            Message::ConfirmDelete => {
+                if !self.delete_pending || self.behavior.has_pending() {
+                    return Task::none();
+                }
                 self.delete_pending = false;
-                self.delete_target = None;
-                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                self.execute(Command::Delete(self.selected));
             }
+            Message::CancelDelete => self.delete_pending = false,
             Message::Undo | Message::Redo => {
                 let redo = matches!(message, Message::Redo);
                 if self.apply() {
@@ -3132,6 +3125,10 @@ impl App {
                         .and_then(|id| self.project().diagrams.get(&id))
                         .cloned()
                 {
+                    if d.projection.scenario().is_some() {
+                        self.status = SAVED_SCENARIO_UNAVAILABLE.into();
+                        return Task::none();
+                    }
                     d.projection = projection;
                     self.execute(Command::EditDiagram(d.id, d));
                     self.fit();
@@ -3267,12 +3264,10 @@ impl App {
                 }
             }
             Message::SourceFile(path) => {
-                if path != self.source_workspace.active
-                    && self.source_workspace.files.contains_key(&path)
+                if self
+                    .source_workspace
+                    .switch(&path, self.source_editor.cursor())
                 {
-                    let departure =
-                        crate::source_navigation::selection::capture(&mut self.source_editor);
-                    self.source_workspace.switch(&path, departure);
                     self.show_source_file(true);
                 }
             }
@@ -3698,6 +3693,14 @@ impl App {
                 }
             }
             Message::Export => {
+                let Some(diagram) = self.active_diagram else {
+                    self.status = "Create a diagram first.".into();
+                    return Task::none();
+                };
+                if !self.project().diagrams.contains_key(&diagram) {
+                    self.status = crate::diagram::ExportError::MissingDiagram(diagram).to_string();
+                    return Task::none();
+                }
                 if self.apply() {
                     return self.choose_file(FileOperation::Export);
                 }
@@ -3760,7 +3763,9 @@ impl App {
         };
         let id = e.id;
         let mut commands = vec![Command::CreateElement(e)];
-        let mut diagram_target = self.active_diagram;
+        let mut diagram_target = self
+            .active_diagram
+            .filter(|id| !self.saved_scenario_diagram(*id));
         let preferred = if self.create_kind.is_work() || self.create_kind.is_performer() {
             Some(ProjectionKind::Allocation)
         } else if ProjectionKind::Capabilities.includes(self.create_kind) {
@@ -3790,6 +3795,7 @@ impl App {
                     description: String::new(),
                     layer: self.layer,
                     projection: preferred,
+                    layout: None,
                     routes: Vec::new(),
                     view_options: Default::default(),
                     nodes: Default::default(),
@@ -3805,6 +3811,52 @@ impl App {
                 id,
             ));
         }
+        // Refining a leaf moves its explicit responsibilities to the new leaf.
+        // Later children inherit only the existing unambiguous performer summary.
+        if self.create_kind.is_work()
+            && let Some(owner) = parent
+            && self
+                .project()
+                .elements
+                .get(&owner)
+                .is_some_and(|e| e.layer() == self.layer && e.kind() == self.create_kind)
+        {
+            let performer = oa_core::validation::allocation_summary(self.project(), owner);
+            let leaf = !self
+                .project()
+                .children(owner)
+                .any(|e| e.kind() == self.create_kind);
+            let responsibilities: Vec<_> = self
+                .project()
+                .relations
+                .values()
+                .filter(|r| {
+                    r.target() == owner
+                        && matches!(
+                            r.kind(),
+                            RelationKind::Allocation | RelationKind::RoleAssignment
+                        )
+                })
+                .collect();
+            if leaf && !responsibilities.is_empty() {
+                for original in responsibilities {
+                    let mut responsibility = original.clone();
+                    match &mut responsibility.body {
+                        RelationBody::Allocation { target, .. }
+                        | RelationBody::RoleAssignment { target, .. } => *target = id,
+                        _ => unreachable!(),
+                    }
+                    commands.push(Command::EditRelation(original.id, responsibility));
+                }
+            } else if let Some(performer) = performer {
+                commands.push(Command::Connect(
+                    RelationKind::Allocation,
+                    "Performs".into(),
+                    performer,
+                    id,
+                ));
+            }
+        }
         if self.create_kind == Kind::Occurrence
             && let Some(owner) = parent.and_then(|id| self.project().elements.get(&id))
             && let Some(steps) = owner.steps()
@@ -3822,19 +3874,13 @@ impl App {
                 .get(&diagram)
                 .is_none_or(|d| d.projection.includes(self.create_kind))
         {
-            let mut p = self.project().clone();
-            for command in &commands {
-                if let Command::CreateDiagram(d) = command {
-                    p.diagrams.insert(d.id, d.clone());
+            let mut p = match execute_batch(self.project(), &commands) {
+                Ok(candidate) => candidate,
+                Err(error) => {
+                    self.status = error.to_string();
+                    return;
                 }
-            }
-            p.elements.insert(
-                id,
-                match &commands[0] {
-                    Command::CreateElement(e) => e.clone(),
-                    _ => unreachable!(),
-                },
-            );
+            };
             let owner = if allocated {
                 Some(self.selected)
             } else {
@@ -4089,11 +4135,24 @@ impl App {
         )
     }
     fn export_to(&mut self, path: PathBuf) -> Task<Message> {
+        if self
+            .active_diagram
+            .is_some_and(|id| self.saved_scenario_diagram(id))
+        {
+            self.status = SAVED_SCENARIO_UNAVAILABLE.into();
+            return Task::none();
+        }
         let Some(diagram) = self.active_diagram else {
             self.status = "Create a diagram first.".into();
             return Task::none();
         };
-        let svg = crate::diagram::export_svg(self.project(), diagram);
+        let svg = match crate::diagram::export_svg(self.project(), diagram) {
+            Ok(svg) => svg,
+            Err(error) => {
+                self.status = error.to_string();
+                return Task::none();
+            }
+        };
         self.busy = true;
         Task::perform(
             async move {
@@ -4186,14 +4245,17 @@ impl App {
     }
 
     fn jump_to_source(&mut self, location: SourceLocation) {
-        let Some(target) = self.source_workspace.files.get(&location.path) else {
+        self.source_workspace
+            .switch(&location.path, self.source_editor.cursor());
+        if self.source_workspace.active != location.path {
             self.status = format!(
                 "{} has not been loaded. Use Load includes or create the missing file.",
                 location.path
             );
             return;
-        };
-        let source = &target.text;
+        }
+        self.show_source_file(false);
+        let source = self.source_workspace.text();
         let mut offset = location.span.start.min(source.len());
         while !source.is_char_boundary(offset) {
             offset -= 1;
@@ -4203,9 +4265,6 @@ impl App {
         let column = prefix
             .rfind('\n')
             .map_or(offset, |start| offset - start - 1);
-        let departure = crate::source_navigation::selection::capture(&mut self.source_editor);
-        self.source_workspace.switch(&location.path, departure);
-        self.show_source_file(false);
         self.queue_source_reveal(
             text_editor::Cursor {
                 position: text_editor::Position { line, column },
@@ -4232,7 +4291,6 @@ impl App {
                 .is_ok_and(|includes| includes.iter().any(|include| include.target == path))
         });
         let mut changed = bundle.clone();
-        let mut changed_entry = None;
         if !already_included {
             if self.source_dirty() {
                 return Err(
@@ -4252,30 +4310,16 @@ impl App {
                     serde_json::to_string(&path).map_err(|e| e.to_string())?
                 ),
             );
-            changed_entry = Some(entry.clone());
-        }
-        // All fallible preparation is complete. The intermediate entry buffer
-        // is not displayed, so it must not receive the outgoing editor's cursor.
-        let original_path = self.source_workspace.active.clone();
-        let departure = crate::source_navigation::selection::capture(&mut self.source_editor);
-        if let Some(entry) = changed_entry {
-            self.source_workspace.switch(&bundle.entry, departure);
-            let cursor = if self.source_workspace.active == original_path {
-                departure
-            } else {
-                self.source_workspace.files[&self.source_workspace.active].cursor
-            };
-            self.source_workspace.edit(entry, cursor);
+            self.source_workspace
+                .switch(&bundle.entry, self.source_editor.cursor());
+            self.source_workspace
+                .edit(entry.clone(), self.source_editor.cursor());
         }
         changed.files.insert(path.clone(), String::new());
         self.source_workspace
             .discovered(&changed, changed.files.keys().cloned().collect());
-        let cursor = if self.source_workspace.active == original_path {
-            departure
-        } else {
-            self.source_workspace.files[&self.source_workspace.active].cursor
-        };
-        self.source_workspace.switch(&path, cursor);
+        self.source_workspace
+            .switch(&path, self.source_editor.cursor());
         self.source_workspace.new_path.clear();
         self.show_source_file(true);
         self.source_version += 1;
@@ -4331,6 +4375,9 @@ impl App {
         )
     }
     pub fn route_context(&self) -> Option<crate::route_edit::Context> {
+        if self.saved_scenario_diagram(self.active_diagram?) {
+            return None;
+        }
         Some(crate::route_edit::Context {
             document: self.canvas_document,
             diagram: self.active_diagram?,
@@ -4555,6 +4602,12 @@ impl App {
         }
     }
     pub fn fit(&mut self) {
+        if self
+            .active_diagram
+            .is_some_and(|id| self.saved_scenario_diagram(id))
+        {
+            return;
+        }
         self.fit_to_view = true;
         let view = self
             .active_diagram
@@ -4602,7 +4655,7 @@ fn preferred_diagram(p: &Project, active: Option<Id>, layer: Layer, element: Id)
         return p
             .diagrams
             .values()
-            .filter(|d| d.layer == layer)
+            .filter(|d| d.layer == layer && d.projection.scenario().is_none())
             .min_by_key(|d| {
                 let view = project_view(p, d.id);
                 (
@@ -4616,7 +4669,7 @@ fn preferred_diagram(p: &Project, active: Option<Id>, layer: Layer, element: Id)
     }
     p.diagrams
         .values()
-        .filter(|d| d.layer == layer)
+        .filter(|d| d.layer == layer && d.projection.scenario().is_none())
         .min_by_key(|d| {
             (
                 !p.elements
@@ -5419,6 +5472,7 @@ mod port_view_tests {
                 description: String::new(),
                 layer: Layer::Sa,
                 projection: ProjectionKind::Capabilities,
+                layout: None,
                 routes: Vec::new(),
                 view_options: Default::default(),
                 nodes: Default::default(),
@@ -5585,3 +5639,236 @@ mod data_paging_lifecycle_tests {
         assert_eq!(app.data_state, crate::data_view::State::default());
     }
 }
+
+#[cfg(test)]
+mod saved_scenario_dispatch_tests {
+    use super::*;
+
+    fn fixture() -> (App, Id, Id, Id) {
+        let f = behavior::scenario::direct_tests::fixture();
+        let mut project = f.project;
+        let architecture = project.ensure_diagram(Layer::Oa);
+        let saved = Id::new_v4();
+        project.diagrams.insert(
+            saved,
+            Diagram {
+                id: saved,
+                alias: "saved_scenario_dispatch".into(),
+                name: "Saved Scenario".into(),
+                description: String::new(),
+                layer: Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: f.owner },
+                view_options: Default::default(),
+                nodes: Default::default(),
+                routes: vec![],
+                layout: None,
+            },
+        );
+        let mut app = App::with_project(project);
+        app.page = Page::Diagram;
+        app.active_diagram = Some(architecture);
+        app.select(f.owner);
+        (app, architecture, saved, f.owner)
+    }
+
+    #[test]
+    fn rejected_export_schedules_no_write_and_preserves_draft_history_and_busy_state() {
+        let (mut app, _, saved, _) = fixture();
+        let _ = app.update(Message::Field("/name".into(), "Keep export draft".into()));
+        assert!(app.draft_dirty());
+        let path =
+            std::env::temp_dir().join(format!("arcadia-rejected-export-{}.svg", Id::new_v4()));
+        std::fs::write(&path, b"existing export").unwrap();
+        for target in [Some(saved), Some(Id::new_v4()), None] {
+            for busy in [false, true] {
+                app.active_diagram = target;
+                app.busy = busy;
+                let before = app.document.bundle().clone();
+                let history = (
+                    app.document.revision(),
+                    app.document.can_undo(),
+                    app.document.can_redo(),
+                );
+                let view = (
+                    app.page,
+                    app.selected,
+                    app.active_diagram,
+                    app.zoom,
+                    app.pan,
+                );
+                let task = app.export_to(path.clone());
+                assert_eq!(task.units(), 0, "rejection must not schedule a write");
+                assert_eq!(app.busy, busy);
+                assert_eq!(app.document.bundle(), &before);
+                assert_eq!(
+                    (
+                        app.document.revision(),
+                        app.document.can_undo(),
+                        app.document.can_redo()
+                    ),
+                    history
+                );
+                assert_eq!(
+                    (
+                        app.page,
+                        app.selected,
+                        app.active_diagram,
+                        app.zoom,
+                        app.pan
+                    ),
+                    view
+                );
+                assert!(app.draft_dirty());
+                assert!(app.file_prompt.is_none());
+                assert_eq!(std::fs::read(&path).unwrap(), b"existing export");
+            }
+        }
+        std::fs::remove_file(path).unwrap();
+    }
+
+    #[test]
+    fn missing_export_target_does_not_apply_pending_properties_or_open_dialog() {
+        for target in [None, Some(Id::new_v4())] {
+            let (mut app, _, _, _) = fixture();
+            let _ = app.update(Message::Field(
+                "/name".into(),
+                "Unapplied export draft".into(),
+            ));
+            app.active_diagram = target;
+            let before = app.document.bundle().clone();
+            let revision = app.document.revision();
+            let task = app.handle(Message::Export);
+            assert_eq!(task.units(), 0);
+            assert_eq!(app.document.bundle(), &before);
+            assert_eq!(app.document.revision(), revision);
+            assert!(app.draft_dirty());
+            assert!(app.file_prompt.is_none());
+            assert!(!app.busy);
+        }
+    }
+
+    #[test]
+    fn unsupported_saved_picker_and_reveal_do_not_apply_pending_properties() {
+        for reveal in [false, true] {
+            let (mut app, architecture, saved, owner) = fixture();
+            let _ = app.update(Message::Field(
+                "/name".into(),
+                "Unapplied scenario name".into(),
+            ));
+            assert!(app.draft_dirty());
+            let before = app.document.bundle().clone();
+            let revision = app.document.revision();
+            let selected = app.selected;
+            let message = if reveal {
+                Message::RevealInDiagram(saved, owner)
+            } else {
+                Message::Diagram(Choice {
+                    id: saved,
+                    label: "Saved Scenario".into(),
+                })
+            };
+            let _ = app.update(message);
+            assert_eq!(app.document.bundle(), &before);
+            assert_eq!(app.document.revision(), revision);
+            assert_eq!(app.active_diagram, Some(architecture));
+            assert_eq!(app.selected, selected);
+            assert!(app.draft_dirty());
+            assert_eq!(app.status, SAVED_SCENARIO_UNAVAILABLE);
+        }
+    }
+
+    #[test]
+    fn saved_scenario_cannot_use_architecture_controls_or_change_projection_by_toolbar() {
+        let (mut app, _, saved, _) = fixture();
+        app.active_diagram = Some(saved);
+        let _ = app.update(Message::Field("/name".into(), "Keep pending".into()));
+        let before = app.document.bundle().clone();
+        assert!(app.route_context().is_none());
+        assert!(architecture_authoring::kinds(&app).is_empty());
+        for message in [
+            Message::Projection(ProjectionKind::Overview),
+            Message::PlaceSelected,
+            Message::Command(Command::Layout(saved)),
+            Message::Export,
+        ] {
+            let _ = app.update(message);
+            assert_eq!(app.document.bundle(), &before);
+            assert!(app.draft_dirty());
+            assert!(app.file_prompt.is_none());
+            assert!(
+                app.project().diagrams[&saved]
+                    .projection
+                    .scenario()
+                    .is_some()
+            );
+        }
+    }
+
+    #[test]
+    fn saved_scenario_does_not_start_the_existing_architecture_palette() {
+        let (mut app, _, saved, _) = fixture();
+        app.active_diagram = Some(saved);
+        let before = app.document.bundle().clone();
+        let _ = app.update(Message::Architecture(
+            architecture_authoring::Event::Existing(None),
+        ));
+        assert!(app.architecture.is_none());
+        assert_eq!(app.document.bundle(), &before);
+        assert!(app.status.contains("architecture view"));
+    }
+
+    #[test]
+    fn forged_saved_usage_is_refused_without_selection_or_camera_changes() {
+        let (mut app, architecture, saved, _) = fixture();
+        let before = (
+            app.page,
+            app.selected,
+            app.layer,
+            app.zoom,
+            app.pan,
+            app.canvas_epoch,
+        );
+        let source = app.document.bundle().clone();
+        let usage = crate::diagram_usage::Usage {
+            subject: saved,
+            surface: crate::diagram_usage::Surface::Saved(saved),
+            target: crate::diagram_usage::Target::Whole,
+            role: "diagram".into(),
+            bounds: iced::Rectangle::new(iced::Point::new(500., 600.), iced::Size::new(300., 200.)),
+        };
+        assert!(!app.reveal_diagram_usage(&usage));
+        assert_eq!(
+            (
+                app.page,
+                app.selected,
+                app.layer,
+                app.zoom,
+                app.pan,
+                app.canvas_epoch
+            ),
+            before
+        );
+        assert_eq!(app.active_diagram, Some(architecture));
+        assert!(app.pending_diagram_reveal.is_none());
+        assert_eq!(app.document.bundle(), &source);
+    }
+
+    #[test]
+    fn semantic_scenario_preview_remains_available_and_saved_views_are_not_default_architecture() {
+        let (mut app, architecture, saved, owner) = fixture();
+        assert_eq!(
+            preferred_diagram(app.project(), Some(saved), Layer::Oa, owner),
+            Some(architecture)
+        );
+        app.active_diagram = Some(saved);
+        let before = app.document.bundle().clone();
+        let _ = app.update(Message::Select(owner));
+        let _ = app.update(Message::Page(Page::Behavior));
+        assert_eq!(app.scenario_context().unwrap().scenario, owner);
+        assert_eq!(app.document.bundle(), &before);
+        let mut only_saved = app.project().clone();
+        only_saved.diagrams.retain(|id, _| *id == saved);
+        assert!(preferred_diagram(&only_saved, None, Layer::Oa, owner).is_none());
+        assert!(App::with_project(only_saved).active_diagram.is_none());
+    }
+}

crates/oa-desktop/src/app/allocation_drag.rs

@@ -1,672 +0,0 @@
-//! Allocation work-body input admission. Gesture authority lives here, while
-//! the canvas retains ordered native pointer positions and frozen hit geometry.
-use super::{App, Message, Page};
-use crate::{allocation_drag as plan, route_edit::Context};
-use iced::{Point, Rectangle, Task, Vector};
-use oa_core::{projection::ProjectedView, routing::RoutedView, *};
-use std::{collections::BTreeMap, sync::Arc};
-
-pub const FINISH_EDIT: &str = "Finish or cancel the current edit before selecting or moving work.";
-
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct Stamp {
-    pub context: Context,
-    pub epoch: u64,
-    pub snapshot: usize,
-    pub bounds: Rectangle,
-    pub pan: Vector,
-    pub zoom: f32,
-}
-impl Stamp {
-    pub fn world(self, screen: Point) -> Point {
-        Point::new(
-            (screen.x - self.bounds.x - self.pan.x) / self.zoom,
-            (screen.y - self.bounds.y - self.pan.y) / self.zoom,
-        )
-    }
-    pub fn viewport(self) -> plan::Rect {
-        let p = self.world(Point::new(self.bounds.x, self.bounds.y));
-        plan::Rect {
-            position: Position { x: p.x, y: p.y },
-            size: Size {
-                width: self.bounds.width / self.zoom,
-                height: self.bounds.height / self.zoom,
-            },
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct Target {
-    pub element: Id,
-    pub placement: Id,
-    pub region: Rectangle,
-    pub name: String,
-    pub ancestors: Vec<Id>,
-}
-#[derive(Debug, Clone)]
-pub struct Frozen {
-    pub targets: Vec<Target>,
-    cards: Vec<Rectangle>,
-    controls: Vec<Rectangle>,
-    edges: Vec<(Point, Point)>,
-    radius: f32,
-}
-#[derive(Debug, Clone, PartialEq)]
-pub enum Hit {
-    Destination(plan::Destination, Option<usize>),
-    OutsideViewport,
-    Occluded,
-    Ambiguous(Vec<usize>),
-}
-pub fn contains(r: Rectangle, p: Point) -> bool {
-    p.x >= r.x && p.y >= r.y && p.x < r.x + r.width && p.y < r.y + r.height
-}
-impl Frozen {
-    pub fn capture(
-        project: &Project,
-        scope: &plan::Scope,
-        view: &ProjectedView,
-        routed: &RoutedView,
-        zoom: f32,
-    ) -> Self {
-        let mut targets = Vec::new();
-        let mut cards = Vec::new();
-        for n in &view.nodes {
-            if scope.placements.contains_key(&n.id) {
-                continue;
-            }
-            let region = Rectangle::new(
-                Point::new(n.position.x, n.position.y),
-                iced::Size::new(n.size.width, n.size.height),
-            );
-            let Some(e) = project.elements.get(&n.element) else {
-                cards.push(region);
-                continue;
-            };
-            if e.kind().is_performer() && e.layer() == scope.diagram.layer {
-                let mut ancestors = Vec::new();
-                let mut parent = e.parent;
-                while let Some(id) = parent {
-                    if ancestors.contains(&id) {
-                        break;
-                    }
-                    ancestors.push(id);
-                    parent = project.elements.get(&id).and_then(|e| e.parent);
-                }
-                let name = project.named(e.id).to_owned();
-                let collapsed = scope.diagram.nodes[&n.id].collapsed;
-                targets.push(Target {
-                    element: e.id,
-                    placement: n.id,
-                    region: if collapsed {
-                        Rectangle {
-                            height: region.height.min(62.),
-                            ..region
-                        }
-                    } else {
-                        region
-                    },
-                    name,
-                    ancestors,
-                });
-            } else {
-                cards.push(region);
-            }
-        }
-        let radius = (10. / zoom).max(10.);
-        let mut controls: Vec<_> = view
-            .ports
-            .iter()
-            .filter(|port| !scope.placements.contains_key(&port.owner))
-            .map(|port| {
-                Rectangle::new(
-                    Point::new(port.position.x - radius, port.position.y - radius),
-                    iced::Size::new(radius * 2., radius * 2.),
-                )
-            })
-            .collect();
-        let mut edges = Vec::new();
-        for edge in routed.edges.values() {
-            if let Some(relation) = project.relations.get(&edge.id) {
-                for end in routing::association_end_geometry(relation, edge) {
-                    if !end.label.text.is_empty() {
-                        controls.push(Rectangle::new(
-                            Point::new(end.label.bounds.position.x, end.label.bounds.position.y),
-                            iced::Size::new(
-                                end.label.bounds.size.width,
-                                end.label.bounds.size.height,
-                            ),
-                        ));
-                    }
-                }
-            }
-            if !edge.label.text.is_empty() {
-                controls.push(Rectangle::new(
-                    Point::new(edge.label.bounds.position.x, edge.label.bounds.position.y),
-                    iced::Size::new(edge.label.bounds.size.width, edge.label.bounds.size.height),
-                ));
-            }
-            for pin in &edge.pins {
-                controls.push(Rectangle::new(
-                    Point::new(pin.x - 8. / zoom, pin.y - 8. / zoom),
-                    iced::Size::new(16. / zoom, 16. / zoom),
-                ));
-            }
-            for points in edge.points.windows(2) {
-                edges.push((
-                    Point::new(points[0].x, points[0].y),
-                    Point::new(points[1].x, points[1].y),
-                ));
-            }
-        }
-        Self {
-            targets,
-            cards,
-            controls,
-            edges,
-            radius: 6. / zoom,
-        }
-    }
-    pub fn resolve(&self, stamp: Stamp, screen: Option<Point>, arrange: bool) -> Hit {
-        let Some(screen) = screen.filter(|p| contains(stamp.bounds, *p)) else {
-            return Hit::OutsideViewport;
-        };
-        let p = stamp.world(screen);
-        // Drag status lives in the toolbar, outside this actual canvas viewport.
-        if self
-            .controls
-            .iter()
-            .chain(&self.cards)
-            .any(|r| contains(*r, p))
-            || self.edges.iter().any(|(a, b)| {
-                let d = *b - *a;
-                let length = d.x * d.x + d.y * d.y;
-                let t = if length == 0. {
-                    0.
-                } else {
-                    (((p.x - a.x) * d.x + (p.y - a.y) * d.y) / length).clamp(0., 1.)
-                };
-                p.distance(*a + d * t) <= self.radius
-            })
-        {
-            return Hit::Occluded;
-        }
-        if arrange {
-            return Hit::Destination(plan::Destination::LayoutOnly, None);
-        }
-        let hits: Vec<_> = self
-            .targets
-            .iter()
-            .enumerate()
-            .filter(|(_, t)| contains(t.region, p))
-            .map(|(i, _)| i)
-            .collect();
-        for (i, a) in hits.iter().enumerate() {
-            for b in &hits[i + 1..] {
-                let a = &self.targets[*a];
-                let b = &self.targets[*b];
-                if !a.ancestors.contains(&b.element) && !b.ancestors.contains(&a.element) {
-                    return Hit::Ambiguous(hits);
-                }
-            }
-        }
-        match hits
-            .into_iter()
-            .max_by_key(|i| self.targets[*i].ancestors.len())
-        {
-            Some(i) => Hit::Destination(
-                plan::Destination::Performer(self.targets[i].element),
-                Some(i),
-            ),
-            None => Hit::Destination(plan::Destination::OutsidePerformers, None),
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct Press {
-    pub stamp: Stamp,
-    pub token: Id,
-    pub start: Point,
-    pub scope: plan::Scope,
-    pub frozen: Frozen,
-    pub arrange: bool,
-}
-#[derive(Debug, Clone)]
-pub enum Event {
-    Press(Arc<Press>),
-    Preview(Stamp, Id, Option<Point>),
-    Release(Stamp, Id, Option<Point>),
-    Refused(u64, String),
-    Cancel(Id),
-    ArrangeNext,
-    Unfocused,
-    KeyboardBoundary,
-}
-pub struct Preview {
-    pub token: Id,
-    pub semantic: Arc<plan::SemanticPlan>,
-    pub placement: plan::PlacementPlan,
-    pub routed: Arc<RoutedView>,
-}
-struct Active {
-    press: Arc<Press>,
-    inspection_targets: Vec<usize>,
-    ids: BTreeMap<Id, Id>,
-    cache: Vec<(
-        plan::Destination,
-        Result<Arc<plan::SemanticPlan>, plan::Refusal>,
-    )>,
-}
-pub struct Feedback {
-    pub press: Arc<Press>,
-    pub targets: Vec<usize>,
-    /// Last captured target names for inspection only; never resolver input.
-    pub inspection_targets: Vec<usize>,
-    pub text: String,
-    pub refused: bool,
-}
-impl Feedback {
-    pub fn inspection_identity(&self) -> String {
-        if self.refused && self.targets.is_empty() && !self.inspection_targets.is_empty() {
-            let names = self
-                .inspection_targets
-                .iter()
-                .map(|index| self.press.frozen.targets[*index].name.as_str())
-                .collect::<Vec<_>>()
-                .join(" / ");
-            format!(
-                "{}\nLast target{}: {}\nReturn to the canvas to choose a destination; releasing here cancels the drag.",
-                self.destination_identity(),
-                if self.inspection_targets.len() > 1 {
-                    "s (ambiguous)"
-                } else {
-                    ""
-                },
-                names
-            )
-        } else {
-            self.destination_identity()
-        }
-    }
-    /// Captured accepted names, independent of clipped status/refusal prose.
-    pub fn destination_identity(&self) -> String {
-        match self.targets.as_slice() {
-            [] => if self.press.arrange {
-                "Arrange only"
-            } else if self.refused {
-                "No eligible destination"
-            } else {
-                "Outside performers"
-            }
-            .into(),
-            [index] => self.press.frozen.targets[*index].name.clone(),
-            indices => format!(
-                "Ambiguous: {}",
-                indices
-                    .iter()
-                    .map(|index| self.press.frozen.targets[*index].name.as_str())
-                    .collect::<Vec<_>>()
-                    .join(" / ")
-            ),
-        }
-    }
-}
-#[derive(Default)]
-pub struct State {
-    pub epoch: u64,
-    pub arrange_next: bool,
-    active: Option<Active>,
-    pub preview: Option<Arc<Preview>>,
-    pub feedback: Option<Feedback>,
-}
-#[derive(Clone, Copy)]
-pub struct Capability<'a> {
-    pub state: &'a State,
-    pub clean: bool,
-    pub snapshot: usize,
-}
-impl State {
-    fn retire(&mut self) {
-        self.epoch = self.epoch.wrapping_add(1);
-        self.active = None;
-        self.preview = None;
-        self.feedback = None;
-        self.arrange_next = false;
-    }
-}
-pub fn refusal(r: &plan::Refusal) -> String {
-    match r {
-        plan::Refusal::Ineligible(s) | plan::Refusal::InvalidCandidate(s) | plan::Refusal::LayoutRequired(s) => s.clone(),
-        plan::Refusal::StaleScope => "The view changed. Start this drag again.".into(),
-        plan::Refusal::MixedLayoutRequired => "This work has a distributed or mixed assignment. Drag a specific leaf; arranging this group needs a layout step.".into(),
-        plan::Refusal::RoleExitRequired { message, .. } => message.clone(),
-        plan::Refusal::MissingAllocationId(_) => "Assignment identity expired. Start this drag again.".into(),
-        plan::Refusal::CollateralChangeRequired(records) => format!(
-            "Assignment needs dependent edits to {}. Resolve these before dragging again.",
-            records.iter().map(|r| r.name.as_str()).collect::<Vec<_>>().join(", ")
-        ),
-    }
-}
-impl App {
-    pub fn allocation_drag_clean(&self) -> bool {
-        self.allocation_input_owner()
-            && !self.draft_dirty()
-            && !self.source_dirty()
-            && !self.behavior.has_pending()
-    }
-    pub(crate) fn allocation_input_owner(&self) -> bool {
-        self.page == Page::Diagram
-            && self
-                .active_diagram
-                .and_then(|id| self.project().diagrams.get(&id))
-                .is_some_and(|d| d.projection == ProjectionKind::Allocation)
-            && self.architecture.is_none()
-            && self.connection.is_none()
-            && self.model_menu.is_none()
-            && !self.reference_input_active()
-            && !self.busy
-            && !self.hosted.visible
-            && self.workflow.is_none()
-            && self.pending.is_none()
-            && self.file_prompt.is_none()
-            && !self.delete_pending
-            && self.diagram_usages.is_none()
-    }
-    pub fn allocation_capability(&self) -> Capability<'_> {
-        Capability {
-            state: &self.allocation_drag,
-            clean: self.allocation_drag_clean(),
-            snapshot: Arc::as_ptr(&self.document.snapshot()) as usize,
-        }
-    }
-    fn allocation_stamp_valid(&self, stamp: Stamp) -> bool {
-        self.allocation_drag_clean()
-            && self.route_context() == Some(stamp.context)
-            && self.allocation_drag.epoch == stamp.epoch
-            && Arc::as_ptr(&self.document.snapshot()) as usize == stamp.snapshot
-            && self.pan == stamp.pan
-            && self.zoom == stamp.zoom
-            && self.canvas_size.is_none_or(|s| s == stamp.bounds.size())
-            && stamp.bounds.width > 0.
-            && stamp.bounds.height > 0.
-    }
-    /// Called before general input dispatch. Even equal-valued actions (Fit,
-    /// Undo/Redo, tool/modal round trips) retire old render-time capabilities.
-    pub(super) fn allocation_before(&mut self, message: &Message) {
-        if !matches!(
-            message,
-            Message::WorkDrag(_)
-                | Message::CheckpointTick
-                | Message::CheckpointWritten(..)
-                | Message::Lint(_)
-                | Message::Linted(..)
-                | Message::CanvasResized(_)
-                | Message::WindowResized(_)
-                | Message::SourceViewport(_)
-                | Message::SourceSymbolsReady(_)
-                | Message::SourceRenameReady(_)
-                | Message::DiagramUsagesReady(_)
-                | Message::DiagramRevealViewport(..)
-        ) {
-            self.allocation_drag.retire();
-        }
-    }
-    pub(super) fn allocation_boundary(&self) -> impl PartialEq + use<> {
-        (
-            self.route_context(),
-            self.pan,
-            self.zoom,
-            self.canvas_size,
-            self.window_size,
-            self.allocation_drag_clean(),
-            Arc::as_ptr(&self.document.snapshot()) as usize,
-        )
-    }
-    pub(super) fn allocation_retire(&mut self) {
-        self.allocation_drag.retire();
-    }
-    fn select_work_clean(&mut self, press: &Press) -> bool {
-        if !self.allocation_stamp_valid(press.stamp) {
-            return false;
-        }
-        self.selected = press.scope.work;
-        self.selected_node = Some(press.scope.placement);
-        self.selected_bend = None;
-        self.refresh_draft();
-        true
-    }
-    pub(super) fn allocation_press_owns_current_view(&self, press: &Press) -> bool {
-        self.allocation_drag.active.is_none()
-            && self.allocation_stamp_valid(press.stamp)
-            && press.arrange == self.allocation_drag.arrange_next
-    }
-    pub(super) fn allocation_event_envelope(&self, event: &Event) -> bool {
-        match event {
-            Event::Cancel(token) | Event::Preview(_, token, _) | Event::Release(_, token, _) => {
-                self.allocation_drag
-                    .active
-                    .as_ref()
-                    .is_some_and(|active| active.press.token == *token)
-            }
-            Event::Refused(epoch, _) => *epoch == self.allocation_drag.epoch,
-            // Invalid Press packets deliberately report why the view or draft
-            // changed. Leave their existing validation and feedback intact.
-            _ => true,
-        }
-    }
-    pub(super) fn allocation_event(&mut self, event: Event) -> Task<Message> {
-        if !self.allocation_event_envelope(&event) {
-            return Task::none();
-        }
-        match event {
-            Event::ArrangeNext => {
-                self.allocation_drag.retire();
-                if self.allocation_drag_clean() {
-                    self.allocation_drag.arrange_next = true;
-                    self.status = "Arrange next drag armed · moves work only · Esc cancels".into();
-                } else {
-                    self.status = FINISH_EDIT.into();
-                }
-            }
-            Event::Unfocused => self.allocation_drag.retire(),
-            Event::KeyboardBoundary => {
-                if self.allocation_drag.active.is_some() {
-                    self.allocation_drag.retire();
-                }
-            }
-            Event::Cancel(token) => {
-                if self
-                    .allocation_drag
-                    .active
-                    .as_ref()
-                    .is_some_and(|a| a.press.token == token)
-                {
-                    self.allocation_drag.retire();
-                    self.status = "Work drag canceled".into();
-                }
-            }
-            Event::Refused(epoch, text) => {
-                if epoch == self.allocation_drag.epoch {
-                    self.allocation_drag.retire();
-                    self.status = text;
-                }
-            }
-            Event::Press(press) => {
-                if self.allocation_drag.active.is_some() {
-                    return Task::none();
-                }
-                if !self.allocation_press_owns_current_view(&press) {
-                    self.status = if self.allocation_drag_clean() {
-                        "The view changed. Start this drag again.".into()
-                    } else {
-                        FINISH_EDIT.into()
-                    };
-                    return Task::none();
-                }
-                let checked = plan::capture(
-                    self.project(),
-                    press.scope.diagram.id,
-                    press.scope.work,
-                    press.scope.placement,
-                );
-                if checked.as_ref() != Ok(&press.scope) || !self.select_work_clean(&press) {
-                    self.status = checked
-                        .err()
-                        .as_ref()
-                        .map(refusal)
-                        .unwrap_or_else(|| "The view changed. Start this drag again.".into());
-                    self.allocation_drag.retire();
-                    return Task::none();
-                }
-                let ids = press
-                    .scope
-                    .leaves
-                    .keys()
-                    .map(|id| (*id, Id::new_v4()))
-                    .collect();
-                self.allocation_drag.arrange_next = false;
-                self.allocation_drag.preview = None;
-                self.allocation_drag.feedback = None;
-                self.allocation_drag.active = Some(Active {
-                    press,
-                    inspection_targets: Vec::new(),
-                    ids,
-                    cache: Vec::new(),
-                });
-            }
-            Event::Preview(stamp, token, pointer) => {
-                self.allocation_motion(stamp, token, pointer, false)
-            }
-            Event::Release(stamp, token, pointer) => {
-                self.allocation_motion(stamp, token, pointer, true)
-            }
-        }
-        Task::none()
-    }
-    fn allocation_motion(
-        &mut self,
-        stamp: Stamp,
-        token: Id,
-        pointer: Option<Point>,
-        release: bool,
-    ) {
-        if self
-            .allocation_drag
-            .active
-            .as_ref()
-            .is_none_or(|a| a.press.token != token)
-        {
-            return; // An old packet cannot cancel a newer gesture.
-        }
-        if !self.allocation_stamp_valid(stamp) {
-            self.allocation_drag.retire();
-            self.status = if self.allocation_drag_clean() {
-                "The view changed. Start this drag again.".into()
-            } else {
-                FINISH_EDIT.into()
-            };
-            return;
-        }
-        let Some(mut active) = self.allocation_drag.active.take() else {
-            return;
-        };
-        if active.press.token != token || active.press.stamp != stamp {
-            self.allocation_drag.active = Some(active);
-            return;
-        }
-        let press = active.press.clone();
-        let moved = pointer.is_some_and(|p| p.distance(press.start) > 3.);
-        let hit = press.frozen.resolve(stamp, pointer, press.arrange);
-        if moved {
-            match &hit {
-                Hit::Destination(_, Some(target)) => active.inspection_targets = vec![*target],
-                Hit::Ambiguous(targets) => active.inspection_targets = targets.clone(),
-                _ => {}
-            }
-        }
-        let mut targets = Vec::new();
-        let mut preview = None;
-        let result: Result<String, String> = match hit {
-            Hit::OutsideViewport => Err(if release {
-                "Work drag canceled outside the canvas."
-            } else {
-                "Pointer outside canvas · return to choose a destination; releasing here cancels the drag."
-            }.into()),
-            _ if !moved => Ok("Work selected".into()),
-            Hit::Occluded => Err("Aim at exposed performer space or empty canvas; this card, port, connection or control blocks the drop.".into()),
-            Hit::Ambiguous(indices) => {
-                targets = indices;
-                Err("Two unrelated performers overlap here. Use an exposed region.".into())
-            }
-            Hit::Destination(destination, target) => {
-                targets.extend(target);
-                let semantic = if let Some((_, result)) = active.cache.iter().find(|(d, _)| *d == destination) {
-                    result.clone()
-                } else {
-                    let result = plan::plan_semantics(self.project(), &press.scope, destination, &active.ids).map(Arc::new);
-                    active.cache.push((destination, result.clone()));
-                    result
-                };
-                semantic.map_err(|r| refusal(&r)).and_then(|semantic| {
-                    if stamp.zoom * 16. < 9. {
-                        return Err("Make room or adjust the view, then drag again. Zoom in to read the work and destination.".into());
-                    }
-                    let pointer = pointer.unwrap();
-                    let delta = pointer - press.start;
-                    let original = press.scope.placements[&press.scope.placement].position;
-                    let requested = Position { x: original.x + delta.x / stamp.zoom, y: original.y + delta.y / stamp.zoom };
-                    let presentation = plan::PresentationContext {
-                        viewport: stamp.viewport(), zoom: stamp.zoom,
-                        target: target.map(|i| {
-                            let t = &press.frozen.targets[i];
-                            plan::TargetPresentation { placement: t.placement }
-                        }),
-                    };
-                    let placement = plan::place(&semantic, requested, presentation).map_err(|r| refusal(&r))?;
-                    let label = if semantic.warnings.is_empty() { semantic.label.clone() } else {
-                        format!("{} · {} model warning(s) retained", semantic.label, semantic.warnings.len())
-                    };
-                    if release {
-                        let command = plan::finish(&semantic, self.project(), &placement).map_err(|r| refusal(&r))?;
-                        if let Some(command) = command {
-                            // Bypass applying selectors and unrelated repair helpers. The
-                            // planner's exact Batch enters the authoritative source pipeline.
-                            self.document.execute(command).map_err(|e| format!("{} · retry this drag after correcting the source issue", e))?;
-                            self.sync();
-                            self.selected = press.scope.work;
-                            self.selected_node = Some(press.scope.placement);
-                            self.refresh_draft();
-                        }
-                    } else {
-                        let routed = Arc::new(routing::route_diagram(semantic.project(), &placement.diagram, &placement.view));
-                        preview = Some(Arc::new(Preview { token, semantic, placement, routed }));
-                    }
-                    Ok(label)
-                })
-            }
-        };
-        let refused = result.is_err();
-        let text = result.unwrap_or_else(|text| text);
-        self.status = text.clone();
-        if release {
-            self.allocation_drag.retire();
-        } else {
-            let inspection_targets = active.inspection_targets.clone();
-            self.allocation_drag.active = Some(active);
-            self.allocation_drag.preview = preview;
-            self.allocation_drag.feedback = Some(Feedback {
-                press,
-                targets,
-                inspection_targets,
-                text,
-                refused,
-            });
-        }
-    }
-}
-
-#[cfg(test)]
-#[path = "allocation_drag_tests.rs"]
-mod tests;

crates/oa-desktop/src/app/allocation_drag_full_tree_tests.rs

@@ -1,728 +0,0 @@
-//! Actual App root, retained Iced tree, property widgets and production renderer.
-//! Unlike packet-only tests, these prove the next key still reaches the field.
-use super::*;
-use crate::behavior::canvas_workspace::tests::{Mounted, key};
-use iced::{Event as Input, keyboard};
-
-fn character(text: &str, modifiers: keyboard::Modifiers) -> Input {
-    Input::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Character(text.into()),
-        modified_key: keyboard::Key::Character(text.into()),
-        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::KeyA),
-        location: keyboard::Location::Standard,
-        modifiers,
-        text: Some(text.into()),
-        repeat: false,
-    })
-}
-async fn mount() -> (Fixture, Mounted) {
-    let mut f = fixture(Layer::Oa);
-    f.app.window_size = iced::Size::new(2000., 1400.);
-    let _ = f.app.update(Message::Select(f.work));
-    let mut mounted = Mounted::new(&mut f.app).await;
-    // First sensor measurement intentionally Fits; now use a fixed known camera.
-    f.app.zoom = 1.;
-    f.app.pan = Vector::ZERO;
-    f.app.fit_to_view = false;
-    mounted.settle(&mut f.app).await;
-    (f, mounted)
-}
-fn canvas_bounds(mounted: &mut Mounted, app: &App) -> Rectangle {
-    mounted
-        .geometry(app)
-        .bounds(crate::allocation_input::CANVAS_ID)
-}
-fn at(mounted: &mut Mounted, f: &Fixture, world: Position) -> Point {
-    let bounds = canvas_bounds(mounted, &f.app);
-    Point::new(
-        bounds.x + world.x * f.app.zoom + f.app.pan.x,
-        bounds.y + world.y * f.app.zoom + f.app.pan.y,
-    )
-}
-fn name_field(mounted: &mut Mounted, app: &App) -> Rectangle {
-    mounted
-        .geometry(app)
-        .text_inputs
-        .into_iter()
-        .filter(|b| b.x > app.window_size.width - 320.)
-        .min_by(|a, b| a.y.total_cmp(&b.y))
-        .expect("actual inspector Name TextInput")
-}
-fn description_field(mounted: &mut Mounted, app: &App) -> Rectangle {
-    mounted
-        .geometry(app)
-        .focused
-        .into_iter()
-        .map(|(_, bounds, _)| bounds)
-        .filter(|b| b.x > app.window_size.width - 320. && b.height >= 90.)
-        .min_by(|a, b| a.y.total_cmp(&b.y))
-        .expect("actual inspector Description TextEditor")
-}
-fn is_focused(mounted: &mut Mounted, app: &App, field: Rectangle) -> bool {
-    mounted
-        .geometry(app)
-        .focused
-        .iter()
-        .any(|(_, bounds, focused)| *bounds == field && *focused)
-}
-async fn type_key(mounted: &mut Mounted, app: &mut App, text: &str) -> Vec<Message> {
-    mounted
-        .batch(
-            app,
-            &[character(text, keyboard::Modifiers::empty())],
-            mouse::Cursor::Unavailable,
-        )
-        .await
-}
-async fn refused_click_keeps_field(mounted: &mut Mounted, f: &mut Fixture, field: Rectangle) {
-    let before = f.app.document.bundle().clone();
-    let selected = (f.app.selected, f.app.selected_node);
-    let point = at(mounted, f, xy(140., 535.));
-    let messages = mounted.click(&mut f.app, point).await;
-    assert!(
-        messages
-            .iter()
-            .any(|m| matches!(m, Message::WorkDrag(Event::Refused(..))))
-    );
-    assert!(!messages.iter().any(|m| matches!(
-        m,
-        Message::Select(_) | Message::SelectNode(_) | Message::MoveNode(..)
-    )));
-    assert_eq!(f.app.document.bundle(), &before);
-    assert_eq!((f.app.selected, f.app.selected_node), selected);
-    assert!(
-        is_focused(mounted, &f.app, field),
-        "refused press must not reach the outside-press unfocus handler"
-    );
-}
-
-#[tokio::test]
-async fn actual_app_tree_dirty_name_retains_focus_and_middle_caret_for_next_key() {
-    let (mut f, mut mounted) = mount().await;
-    let field = name_field(&mut mounted, &f.app);
-    mounted.click(&mut f.app, field.center()).await;
-    mounted
-        .batch(
-            &mut f.app,
-            &[key(keyboard::key::Named::Home)],
-            mouse::Cursor::Unavailable,
-        )
-        .await;
-    type_key(&mut mounted, &mut f.app, "X").await;
-    mounted
-        .batch(
-            &mut f.app,
-            &[key(keyboard::key::Named::ArrowLeft)],
-            mouse::Cursor::Unavailable,
-        )
-        .await;
-    assert_eq!(f.app.draft.as_ref().unwrap().inputs["/name"].raw, "XWork");
-    refused_click_keeps_field(&mut mounted, &mut f, field).await;
-    let messages = type_key(&mut mounted, &mut f.app, "Y").await;
-    assert!(
-        messages
-            .iter()
-            .any(|m| matches!(m, Message::Field(path, _) if path == "/name"))
-    );
-    assert_eq!(f.app.draft.as_ref().unwrap().inputs["/name"].raw, "YXWork");
-    assert!(!f.app.document.can_undo());
-}
-
-#[tokio::test]
-async fn actual_app_tree_dirty_description_retains_focus_and_middle_caret_for_next_key() {
-    let (mut f, mut mounted) = mount().await;
-    let field = description_field(&mut mounted, &f.app);
-    mounted
-        .click(&mut f.app, Point::new(field.x + 16., field.y + 16.))
-        .await;
-    type_key(&mut mounted, &mut f.app, "A").await;
-    type_key(&mut mounted, &mut f.app, "B").await;
-    mounted
-        .batch(
-            &mut f.app,
-            &[key(keyboard::key::Named::ArrowLeft)],
-            mouse::Cursor::Unavailable,
-        )
-        .await;
-    assert_eq!(
-        f.app.draft.as_ref().unwrap().inputs["/description"].raw,
-        "AB"
-    );
-    refused_click_keeps_field(&mut mounted, &mut f, field).await;
-    let messages = type_key(&mut mounted, &mut f.app, "X").await;
-    assert!(
-        messages
-            .iter()
-            .any(|m| matches!(m, Message::FieldText(path, _) if path == "/description"))
-    );
-    assert_eq!(
-        f.app.draft.as_ref().unwrap().inputs["/description"].raw,
-        "AXB"
-    );
-    assert!(!f.app.document.can_undo());
-}
-
-#[tokio::test]
-async fn actual_keyboard_arrange_shortcut_consumes_once_escape_cancels_and_dirty_owner_refuses() {
-    let (mut f, mut mounted) = mount().await;
-    let shortcut = character("a", keyboard::Modifiers::ALT);
-    let messages = mounted
-        .batch(
-            &mut f.app,
-            std::slice::from_ref(&shortcut),
-            mouse::Cursor::Unavailable,
-        )
-        .await;
-    assert!(
-        messages
-            .iter()
-            .any(|m| matches!(m, Message::WorkDrag(Event::ArrangeNext)))
-    );
-    assert!(f.app.allocation_drag.arrange_next);
-    mounted
-        .batch(
-            &mut f.app,
-            &[key(keyboard::key::Named::Escape)],
-            mouse::Cursor::Unavailable,
-        )
-        .await;
-    assert!(!f.app.allocation_drag.arrange_next);
-    mounted
-        .batch(
-            &mut f.app,
-            std::slice::from_ref(&shortcut),
-            mouse::Cursor::Unavailable,
-        )
-        .await;
-    let from = at(&mut mounted, &f, xy(140., 535.));
-    let to = from + Vector::new(30., 0.);
-    let messages = mounted
-        .batch(
-            &mut f.app,
-            &[
-                Input::Mouse(mouse::Event::CursorMoved { position: from }),
-                Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                Input::Mouse(mouse::Event::CursorMoved { position: to }),
-                Input::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
-            ],
-            mouse::Cursor::Available(to),
-        )
-        .await;
-    assert!(
-        messages
-            .iter()
-            .any(|m| matches!(m, Message::WorkDrag(Event::Press(p)) if p.arrange))
-    );
-    assert!(!f.app.allocation_drag.arrange_next);
-    assert_eq!(f.app.document.revision(), 1, "{}", f.app.status);
-    assert!(f.app.project().relations.is_empty());
-    let field = name_field(&mut mounted, &f.app);
-    mounted.click(&mut f.app, field.center()).await;
-    type_key(&mut mounted, &mut f.app, "X").await;
-    let raw = f.app.draft.as_ref().unwrap().inputs["/name"].raw.clone();
-    let before = f.app.document.bundle().clone();
-    mounted
-        .batch(&mut f.app, &[shortcut], mouse::Cursor::Unavailable)
-        .await;
-    assert!(!f.app.allocation_drag.arrange_next);
-    assert_eq!(f.app.status, FINISH_EDIT);
-    assert!(is_focused(&mut mounted, &f.app, field));
-    assert_eq!(f.app.draft.as_ref().unwrap().inputs["/name"].raw, raw);
-    assert_eq!(f.app.document.bundle(), &before);
-}
-
-fn canvas_pixels(pixels: &[u8], width: usize, canvas: Rectangle) -> Vec<u8> {
-    let x = canvas.x.ceil() as usize;
-    let y = canvas.y.ceil() as usize;
-    let right = (canvas.x + canvas.width).floor() as usize;
-    let bottom = (canvas.y + canvas.height).floor() as usize;
-    (y..bottom)
-        .flat_map(|row| {
-            pixels[(row * width + x) * 4..(row * width + right) * 4]
-                .iter()
-                .copied()
-        })
-        .collect()
-}
-
-#[tokio::test]
-async fn actual_rendered_canvas_pixels_do_not_change_when_toolbar_feedback_text_changes() {
-    let (mut f, mut mounted) = mount().await;
-    let mut project = f.app.project().clone();
-    let target = project
-        .diagrams
-        .get_mut(&f.diagram)
-        .unwrap()
-        .nodes
-        .values_mut()
-        .find(|n| n.element == f.a)
-        .unwrap();
-    target.position.y = -41.;
-    target.size.height = 300.;
-    replace(&mut f, project);
-    f.app.zoom = 0.75;
-    f.app.pan = Vector::new(15., 15.);
-    let from = at(&mut mounted, &f, xy(140., 535.));
-    let to = at(&mut mounted, &f, xy(200., 80.));
-    mounted
-        .batch(
-            &mut f.app,
-            &[
-                Input::Mouse(mouse::Event::CursorMoved { position: from }),
-                Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                Input::Mouse(mouse::Event::CursorMoved { position: to }),
-            ],
-            mouse::Cursor::Available(to),
-        )
-        .await;
-    let feedback = f
-        .app
-        .allocation_drag
-        .feedback
-        .as_ref()
-        .expect("active frozen destination");
-    assert!(!feedback.refused, "{}", feedback.text);
-    let target = &feedback.press.frozen.targets[feedback.targets[0]];
-    assert!(target.region.y * f.app.zoom + f.app.pan.y < 0.);
-    assert_eq!(feedback.destination_identity(), "A");
-    let canvas = canvas_bounds(&mut mounted, &f.app);
-    let first = mounted.pixels(&f.app);
-    f.app.allocation_drag.feedback.as_mut().unwrap().text =
-        "Very different drag status, retained outside the readable canvas. ".repeat(10);
-    let second = mounted.pixels(&f.app);
-    assert_ne!(first, second, "the actual toolbar status changes");
-    assert_eq!(
-        canvas_pixels(&first, f.app.window_size.width as usize, canvas),
-        canvas_pixels(&second, f.app.window_size.width as usize, canvas),
-        "status must not obscure any candidate header or destination identity"
-    );
-}
-
-fn destination_bounds(mounted: &mut Mounted, app: &App) -> Rectangle {
-    mounted.geometry(app).bounds("allocation-destination")
-}
-fn assert_on_screen(bounds: Rectangle, app: &App) {
-    assert!(
-        bounds.x >= 0. && bounds.y >= 0. && bounds.width >= 400. && bounds.height == 26.,
-        "{bounds:?}"
-    );
-    assert!(
-        bounds.x + bounds.width <= app.window_size.width
-            && bounds.y + bounds.height <= app.window_size.height,
-        "{bounds:?}"
-    );
-}
-
-#[tokio::test]
-async fn actual_app_tree_exact_incoming_drag_keeps_destination_visible_and_canvas_stable() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        for (minimum, name, collapsed, zoom, pan) in [
-            (false, "Receiver", false, 1., Vector::ZERO),
-            (false, "Receiver", false, 0.75, Vector::new(37., -15.)),
-            (
-                false,
-                "Receiving subsystem",
-                true,
-                1.25,
-                Vector::new(-30., 23.),
-            ),
-            (
-                false,
-                "Receiving subsystem",
-                true,
-                1.,
-                Vector::new(0., -100.),
-            ),
-            (true, "Receiving subsystem", true, 1., Vector::ZERO),
-            (
-                true,
-                "Receiving subsystem WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW",
-                true,
-                1.,
-                Vector::new(0., -100.),
-            ),
-        ] {
-            let mut f = fixture(layer);
-            let mut project = f.app.project().clone();
-            project.elements.get_mut(&f.a).unwrap().name = name.into();
-            let diagram = project.diagrams.get_mut(&f.diagram).unwrap();
-            let target = diagram
-                .nodes
-                .values_mut()
-                .find(|n| n.element == f.a)
-                .unwrap();
-            target.collapsed = collapsed;
-            let target_id = target.id;
-            // At minimum size, keep the source in the visible canvas; preserve
-            // the same standard (40,35) name grab and original target geometry.
-            let source_y = if minimum { 210. } else { 500. };
-            diagram.nodes.get_mut(&f.node).unwrap().position.y = source_y;
-            replace(&mut f, project);
-            f.app.layer = layer;
-            f.app.window_size = if minimum {
-                iced::Size::new(1100., 700.)
-            } else {
-                iced::Size::new(2000., 1400.)
-            };
-            let _ = f.app.update(Message::Select(f.work));
-            let mut mounted = Mounted::new(&mut f.app).await;
-            f.app.zoom = zoom;
-            f.app.pan = pan;
-            f.app.fit_to_view = false;
-            mounted.settle(&mut f.app).await;
-            let canvas = canvas_bounds(&mut mounted, &f.app);
-            let slot = destination_bounds(&mut mounted, &f.app);
-            assert_on_screen(slot, &f.app);
-            assert!(slot.y + slot.height <= canvas.y);
-            let idle = mounted.pixels(&f.app);
-            let before = f.app.project().clone();
-            let source = f.app.document.bundle().clone();
-            let from = at(&mut mounted, &f, xy(140., source_y + 35.));
-            // Use the middle of the snap cell. Fractional App-layout origins
-            // can perturb an exact half-grid tie by one floating-point ULP.
-            // The packet/planner cases retain the original y140 counterexample.
-            let to = at(&mut mounted, &f, xy(160., 145.));
-            assert!(
-                canvas.contains(from) && canvas.contains(to),
-                "{canvas:?} {from:?} {to:?}"
-            );
-            mounted
-                .batch(
-                    &mut f.app,
-                    &[
-                        Input::Mouse(mouse::Event::CursorMoved { position: from }),
-                        Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                        Input::Mouse(mouse::Event::CursorMoved { position: to }),
-                    ],
-                    mouse::Cursor::Available(to),
-                )
-                .await;
-            let feedback = f
-                .app
-                .allocation_drag
-                .feedback
-                .as_ref()
-                .expect(&f.app.status);
-            assert!(!feedback.refused, "{}", feedback.text);
-            assert_eq!(feedback.destination_identity(), name);
-            let preview = f.app.allocation_drag.preview.as_ref().expect(&f.app.status);
-            assert_eq!(
-                preview.placement.diagram.nodes[&f.node].position,
-                xy(120., 110.),
-                "{layer:?}, minimum={minimum}, zoom={zoom}, pan={pan:?}, canvas={canvas:?}"
-            );
-            assert!(!preview.placement.diagram.nodes[&target_id].collapsed);
-            let selected = preview
-                .placement
-                .view
-                .nodes
-                .iter()
-                .find(|node| node.id == f.node)
-                .unwrap();
-            let selected_header = Rectangle::new(
-                Point::new(
-                    canvas.x + selected.position.x * zoom + pan.x,
-                    canvas.y + selected.position.y * zoom + pan.y,
-                ),
-                iced::Size::new(
-                    selected.size.width * zoom,
-                    selected.size.height.min(62.) * zoom,
-                ),
-            );
-            assert!(canvas.contains(Point::new(selected_header.x, selected_header.y)));
-            assert!(
-                selected_header.x + selected_header.width <= canvas.x + canvas.width
-                    && selected_header.y + selected_header.height <= canvas.y + canvas.height
-            );
-            let mut expected = preview.semantic.project().clone();
-            expected
-                .diagrams
-                .insert(f.diagram, preview.placement.diagram.clone());
-            assert_eq!(f.app.project(), &before);
-            assert_eq!(f.app.document.bundle(), &source);
-            assert!(!f.app.document.can_undo());
-            assert_eq!(canvas_bounds(&mut mounted, &f.app), canvas);
-            assert_eq!(destination_bounds(&mut mounted, &f.app), slot);
-            let active = mounted.pixels(&f.app);
-            if minimum {
-                record_render_evidence(
-                    &format!(
-                        "{layer:?}-minimum-{}",
-                        if pan.y < 0. { "top" } else { "normal" }
-                    ),
-                    &active,
-                    &f.app,
-                    slot,
-                    canvas,
-                );
-            }
-            let width = f.app.window_size.width as usize;
-            assert_ne!(
-                canvas_pixels(&idle, width, slot),
-                canvas_pixels(&active, width, slot),
-                "actual destination text is painted in its dedicated visible slot"
-            );
-            f.app.allocation_drag.feedback.as_mut().unwrap().text =
-                "Long refusal/status prose must not obscure work or destination. ".repeat(30);
-            let verbose = mounted.pixels(&f.app);
-            assert_ne!(active, verbose);
-            assert_eq!(
-                canvas_pixels(&active, width, canvas),
-                canvas_pixels(&verbose, width, canvas)
-            );
-            assert_eq!(
-                canvas_pixels(&active, width, slot),
-                canvas_pixels(&verbose, width, slot)
-            );
-            assert_eq!(canvas_bounds(&mut mounted, &f.app), canvas);
-            if pan.y == -100. {
-                // A genuine clipping refusal in the same held gesture, then
-                // recovery at the original exact point: no camera rebasing.
-                let clipped = at(&mut mounted, &f, xy(160., 110.));
-                mounted
-                    .batch(
-                        &mut f.app,
-                        &[Input::Mouse(mouse::Event::CursorMoved {
-                            position: clipped,
-                        })],
-                        mouse::Cursor::Available(clipped),
-                    )
-                    .await;
-                assert!(f.app.allocation_drag.feedback.as_ref().unwrap().refused);
-                assert!(f.app.allocation_drag.preview.is_none());
-                assert_eq!(canvas_bounds(&mut mounted, &f.app), canvas);
-                assert_eq!(destination_bounds(&mut mounted, &f.app), slot);
-                assert_eq!(f.app.project(), &before);
-                assert_eq!(f.app.document.bundle(), &source);
-                mounted
-                    .batch(
-                        &mut f.app,
-                        &[Input::Mouse(mouse::Event::CursorMoved { position: to })],
-                        mouse::Cursor::Available(to),
-                    )
-                    .await;
-                assert!(!f.app.allocation_drag.feedback.as_ref().unwrap().refused);
-            }
-            mounted
-                .batch(
-                    &mut f.app,
-                    &[Input::Mouse(mouse::Event::ButtonReleased(
-                        mouse::Button::Left,
-                    ))],
-                    mouse::Cursor::Available(to),
-                )
-                .await;
-            assert_eq!(f.app.project(), &expected, "{}", f.app.status);
-            assert_eq!(f.app.document.revision(), 1);
-            assert_eq!(canvas_bounds(&mut mounted, &f.app), canvas);
-            assert_eq!(destination_bounds(&mut mounted, &f.app), slot);
-            let after = f.app.document.bundle().clone();
-            let _ = f.app.update(Message::Undo);
-            assert_eq!(f.app.project(), &before);
-            assert_eq!(f.app.document.bundle(), &source);
-            assert!(!f.app.document.can_undo());
-            let _ = f.app.update(Message::Redo);
-            assert_eq!(f.app.project(), &expected);
-            assert_eq!(f.app.document.bundle(), &after);
-            assert!(!f.app.document.can_redo());
-        }
-    }
-}
-
-/// Optional reproducible visual evidence; normal test runs create no artifacts.
-fn record_render_evidence(
-    name: &str,
-    pixels: &[u8],
-    app: &App,
-    slot: Rectangle,
-    canvas: Rectangle,
-) {
-    let Some(path) = std::env::var_os("ARCADIA_RENDER_EVIDENCE_DIR") else {
-        return;
-    };
-    let path = std::path::PathBuf::from(path);
-    std::fs::create_dir_all(&path).unwrap();
-    let mut file = std::fs::OpenOptions::new()
-        .write(true)
-        .create_new(true)
-        .open(path.join(format!("{name}.rgba")))
-        .unwrap();
-    std::io::Write::write_all(&mut file, pixels).unwrap();
-    let metadata = serde_json::json!({
-        "width": app.window_size.width as u32, "height": app.window_size.height as u32,
-        "destination": [slot.x, slot.y, slot.width, slot.height],
-        "canvas": [canvas.x, canvas.y, canvas.width, canvas.height],
-        "identity": app.allocation_drag.feedback.as_ref().map(|f| f.destination_identity()),
-    });
-    let mut file = std::fs::OpenOptions::new()
-        .write(true)
-        .create_new(true)
-        .open(path.join(format!("{name}.json")))
-        .unwrap();
-    std::io::Write::write_all(&mut file, &serde_json::to_vec_pretty(&metadata).unwrap()).unwrap();
-}
-
-#[tokio::test]
-async fn actual_toolbar_hover_inspects_last_full_name_without_authorizing_an_outside_drop() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = fixture(layer);
-        let name = "Receiving subsystem with a long exact identity beyond the compact label";
-        let mut project = f.app.project().clone();
-        project.elements.get_mut(&f.a).unwrap().name = name.into();
-        project
-            .diagrams
-            .get_mut(&f.diagram)
-            .unwrap()
-            .nodes
-            .get_mut(&f.node)
-            .unwrap()
-            .position
-            .y = 210.;
-        replace(&mut f, project);
-        f.app.layer = layer;
-        f.app.window_size = iced::Size::new(1100., 700.);
-        let _ = f.app.update(Message::Select(f.work));
-        let mut mounted = Mounted::new(&mut f.app).await;
-        f.app.zoom = 1.;
-        f.app.pan = Vector::ZERO;
-        f.app.fit_to_view = false;
-        mounted.settle(&mut f.app).await;
-        let canvas = canvas_bounds(&mut mounted, &f.app);
-        let slot = destination_bounds(&mut mounted, &f.app);
-        let from = at(&mut mounted, &f, xy(140., 245.));
-        let to = at(&mut mounted, &f, xy(160., 145.));
-        let before = f.app.document.bundle().clone();
-        mounted
-            .batch(
-                &mut f.app,
-                &[
-                    Input::Mouse(mouse::Event::CursorMoved { position: from }),
-                    Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                    Input::Mouse(mouse::Event::CursorMoved { position: to }),
-                ],
-                mouse::Cursor::Available(to),
-            )
-            .await;
-        assert_eq!(
-            f.app
-                .allocation_drag
-                .feedback
-                .as_ref()
-                .unwrap()
-                .destination_identity(),
-            name
-        );
-        assert!(f.app.allocation_drag.preview.is_some());
-        let hover = Point::new(slot.x + 45., slot.y + 8.);
-        mounted
-            .batch(
-                &mut f.app,
-                &[Input::Mouse(mouse::Event::CursorMoved { position: hover })],
-                mouse::Cursor::Available(hover),
-            )
-            .await;
-        let feedback = f.app.allocation_drag.feedback.as_ref().unwrap();
-        assert!(feedback.refused);
-        assert!(feedback.targets.is_empty());
-        assert_eq!(feedback.destination_identity(), "No eligible destination");
-        assert!(
-            feedback
-                .inspection_identity()
-                .contains(&format!("Last target: {name}"))
-        );
-        assert!(f.app.allocation_drag.preview.is_none());
-        assert!(f.app.allocation_drag.active.is_some());
-        assert!(f.app.status.starts_with("Pointer outside canvas"));
-        let inspected = mounted.pixels_at(&f.app, mouse::Cursor::Available(hover));
-        // Iced's Tooltip overlay draws its child but exposes no Operation
-        // traversal. Compare the real rendered overlay instead of inventing
-        // container geometry that the installed widget cannot report.
-        let inspection = std::mem::take(
-            &mut f
-                .app
-                .allocation_drag
-                .feedback
-                .as_mut()
-                .unwrap()
-                .inspection_targets,
-        );
-        let without_name = mounted.pixels_at(&f.app, mouse::Cursor::Available(hover));
-        let width = f.app.window_size.width as usize;
-        assert_ne!(
-            inspected, without_name,
-            "full captured name changes the actual hovered tooltip"
-        );
-        assert_eq!(
-            canvas_pixels(&inspected, width, canvas),
-            canvas_pixels(&without_name, width, canvas)
-        );
-        assert_eq!(
-            canvas_pixels(&inspected, width, slot),
-            canvas_pixels(&without_name, width, slot)
-        );
-        f.app
-            .allocation_drag
-            .feedback
-            .as_mut()
-            .unwrap()
-            .inspection_targets = inspection;
-        assert_eq!(canvas_bounds(&mut mounted, &f.app), canvas);
-        record_render_evidence(
-            &format!("{layer:?}-name-inspection"),
-            &inspected,
-            &f.app,
-            slot,
-            canvas,
-        );
-        assert_eq!(f.app.document.bundle(), &before);
-        assert!(!f.app.document.can_undo());
-
-        // Inspection grants no mutation authority. Releasing over it cancels.
-        mounted
-            .batch(
-                &mut f.app,
-                &[Input::Mouse(mouse::Event::ButtonReleased(
-                    mouse::Button::Left,
-                ))],
-                mouse::Cursor::Available(hover),
-            )
-            .await;
-        assert!(f.app.allocation_drag.active.is_none());
-        assert!(f.app.allocation_drag.feedback.is_none());
-        assert_eq!(f.app.status, "Work drag canceled outside the canvas.");
-        assert_eq!(f.app.document.bundle(), &before);
-        assert!(!f.app.document.can_undo());
-        // A fresh gesture cannot inherit the previous inspection name.
-        mounted
-            .batch(
-                &mut f.app,
-                &[
-                    Input::Mouse(mouse::Event::CursorMoved { position: from }),
-                    Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                    Input::Mouse(mouse::Event::CursorMoved { position: hover }),
-                ],
-                mouse::Cursor::Available(hover),
-            )
-            .await;
-        let feedback = f.app.allocation_drag.feedback.as_ref().unwrap();
-        assert!(feedback.inspection_targets.is_empty());
-        assert!(!feedback.inspection_identity().contains(name));
-        mounted
-            .batch(
-                &mut f.app,
-                &[
-                    Input::Mouse(mouse::Event::CursorMoved { position: to }),
-                    Input::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
-                ],
-                mouse::Cursor::Available(to),
-            )
-            .await;
-        assert_eq!(
-            validation::effective_performer(f.app.project(), f.work),
-            Some(f.a)
-        );
-        assert_eq!(f.app.document.revision(), 1);
-        let _ = f.app.update(Message::Undo);
-        assert_eq!(f.app.document.bundle(), &before);
-    }
-}

crates/oa-desktop/src/app/allocation_drag_tests/navigation_union.rs

@@ -1,203 +0,0 @@
-//! Captured real canvas packets against a later navigation or live gesture.
-use super::*;
-use crate::diagram_usage::{self as usage, Target};
-
-fn navigate_work(f: &mut Fixture) -> usage::Usage {
-    let message = f.app.diagram_usage_message(f.work);
-    let _ = f.app.update(message);
-    let panel = f.app.diagram_usages.as_ref().unwrap();
-    let token = panel.token;
-    let context = panel.context;
-    let process = f.app.behavior.topology.usage_snapshot().into_query_state();
-    let completion = usage::Completion {
-        token,
-        context,
-        result: Ok(usage::collect(
-            f.app.project(),
-            f.work,
-            &process,
-            &crate::behavior::scenario::State::default(),
-        )),
-    };
-    let _ = f.app.update(Message::DiagramUsagesReady(completion));
-    let found = f
-        .app
-        .diagram_usages
-        .as_ref()
-        .unwrap()
-        .usages
-        .iter()
-        .find(|usage| usage.target == Target::Placement(f.node))
-        .unwrap()
-        .clone();
-    let _ = f.app.update(Message::DiagramUsage(usage::Event::Choose(
-        token,
-        found.clone(),
-    )));
-    assert!(f.app.pending_diagram_reveal.is_some());
-    assert!(f.app.diagram_focus(found.surface).is_some());
-    found
-}
-
-fn assert_stale_noop(app: &mut App, message: Message) {
-    let before = app.document.snapshot();
-    let selection = (app.selected, app.selected_node, app.active_diagram);
-    let camera = (app.zoom, app.pan, app.canvas_epoch, app.camera_epoch);
-    let pending = app.pending_diagram_reveal.clone();
-    let focus = app
-        .diagram_navigation_focus
-        .as_ref()
-        .map(|focus| (focus.context, focus.usage.clone(), focus.selected));
-    let allocation = (app.allocation_drag.epoch, app.allocation_drag.arrange_next);
-    let active = app
-        .allocation_drag
-        .active
-        .as_ref()
-        .map(|active| (active.press.token, active.cache.len()));
-    let interaction = app.source_symbols.interaction;
-    let status = app.status.clone();
-    let _ = app.update(message);
-    assert_eq!(
-        (app.selected, app.selected_node, app.active_diagram),
-        selection
-    );
-    assert_eq!(
-        (app.zoom, app.pan, app.canvas_epoch, app.camera_epoch),
-        camera
-    );
-    assert_eq!(app.pending_diagram_reveal, pending);
-    assert_eq!(
-        app.diagram_navigation_focus.as_ref().map(|focus| (
-            focus.context,
-            focus.usage.clone(),
-            focus.selected
-        )),
-        focus
-    );
-    assert_eq!(
-        (app.allocation_drag.epoch, app.allocation_drag.arrange_next),
-        allocation
-    );
-    assert_eq!(
-        app.allocation_drag
-            .active
-            .as_ref()
-            .map(|active| (active.press.token, active.cache.len())),
-        active
-    );
-    assert_eq!(app.source_symbols.interaction, interaction);
-    assert_eq!(app.status, status);
-    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
-    assert_eq!(app.source_workspace.bundle(), before.bundle);
-}
-
-fn stale_packets(press: &Press) -> Vec<Message> {
-    vec![
-        Message::WorkDrag(Event::Cancel(press.token)),
-        Message::WorkDrag(Event::Preview(press.stamp, press.token, Some(press.start))),
-        Message::WorkDrag(Event::Release(press.stamp, press.token, Some(press.start))),
-        Message::WorkDrag(Event::Refused(press.stamp.epoch, "old refusal".into())),
-    ]
-}
-
-#[test]
-fn stale_gesture_packets_preserve_navigation_and_a_new_live_cancel_still_works() {
-    let mut f = fixture(Layer::Oa);
-    let before = f.app.document.snapshot();
-    let old = press(&f);
-    let _ = f.app.update(Message::WorkDrag(Event::Press(old.clone())));
-    assert_eq!(
-        f.app.allocation_drag.active.as_ref().unwrap().press.token,
-        old.token
-    );
-    let found = navigate_work(&mut f);
-    assert!(f.app.allocation_drag.active.is_none());
-    assert_ne!(f.app.allocation_drag.epoch, old.stamp.epoch);
-    for message in stale_packets(&old) {
-        assert_stale_noop(&mut f.app, message);
-    }
-    // A rejected press still explains the invalid view, but cannot consume the
-    // new destination's pending first measurement.
-    let pending = f.app.pending_diagram_reveal.clone();
-    let epoch = f.app.allocation_drag.epoch;
-    let _ = f.app.update(Message::WorkDrag(Event::Press(old.clone())));
-    assert_eq!(f.app.pending_diagram_reveal, pending);
-    assert_eq!(f.app.allocation_drag.epoch, epoch);
-    assert!(f.app.diagram_focus(found.surface).is_some());
-    assert_eq!(f.app.status, "The view changed. Start this drag again.");
-    let (context, _, epoch) = f.app.pending_diagram_reveal.clone().unwrap();
-    let _ = f.app.update(Message::DiagramRevealViewport(
-        context,
-        epoch,
-        bounds().size(),
-    ));
-    assert!(f.app.pending_diagram_reveal.is_none());
-    assert!(f.app.diagram_focus(found.surface).is_some());
-
-    // Restore the fixture's camera through current App actions, then capture a
-    // fresh packet through the actual DiagramCanvas rather than seeding active.
-    let factor = 1. / f.app.zoom;
-    let _ = f.app.update(Message::Zoom(factor));
-    let delta = -f.app.pan;
-    let _ = f.app.update(Message::Pan(delta));
-    let current = press(&f);
-    let _ = f
-        .app
-        .update(Message::WorkDrag(Event::Press(current.clone())));
-    assert_eq!(
-        f.app.allocation_drag.active.as_ref().unwrap().press.token,
-        current.token
-    );
-    assert!(
-        f.app.diagram_navigation_focus.is_none(),
-        "live press retires navigation"
-    );
-    for message in stale_packets(&old) {
-        assert_stale_noop(&mut f.app, message);
-    }
-    let epoch = f.app.allocation_drag.epoch;
-    let _ = f
-        .app
-        .update(Message::WorkDrag(Event::Cancel(current.token)));
-    assert!(f.app.allocation_drag.active.is_none());
-    assert!(f.app.allocation_drag.epoch > epoch);
-    assert_eq!(f.app.status, "Work drag canceled");
-    assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
-    assert_eq!(f.app.source_workspace.bundle(), before.bundle);
-}
-
-#[test]
-fn old_chooser_envelopes_preserve_a_current_canvas_gesture() {
-    let mut previous = fixture(Layer::Oa);
-    let old_open = previous.app.diagram_usage_message(previous.work);
-    let _ = previous.app.update(old_open.clone());
-    let old_token = previous.app.diagram_usages.as_ref().unwrap().token;
-    let mut f = fixture(Layer::Oa);
-    let current = press(&f);
-    let _ = f
-        .app
-        .update(Message::WorkDrag(Event::Press(current.clone())));
-    assert_stale_noop(&mut f.app, old_open);
-    assert_stale_noop(
-        &mut f.app,
-        Message::DiagramUsage(usage::Event::Close(old_token)),
-    );
-    assert_stale_noop(
-        &mut f.app,
-        Message::DiagramUsage(usage::Event::Search(old_token, "old".into())),
-    );
-    assert_eq!(
-        f.app.allocation_drag.active.as_ref().unwrap().press.token,
-        current.token
-    );
-    let open = f.app.diagram_usage_message(f.work);
-    let _ = f.app.update(open);
-    assert!(
-        f.app.diagram_usages.is_some(),
-        "current chooser remains live"
-    );
-    assert!(
-        f.app.allocation_drag.active.is_none(),
-        "current chooser retires gesture"
-    );
-}

crates/oa-desktop/src/app/architecture_authoring.rs

@@ -138,7 +138,7 @@ pub fn validate_saved(p: &Project, s: &Saved) -> Result<(), String> {
         .diagrams
         .get(&s.diagram)
         .ok_or("The creation draft's diagram is missing.")?;
-    if matches!(d.projection, ProjectionKind::StateMachine { .. })
+    if !d.projection.is_architecture()
         || s.query.len() > 16384
         || s.page > 1_000_000
         || s.point
@@ -180,7 +180,7 @@ pub fn validate_saved(p: &Project, s: &Saved) -> Result<(), String> {
 }
 fn context_kinds(p: &Project, d: &Diagram) -> Vec<Kind> {
     let mut values = match (d.layer, d.projection) {
-        (_, ProjectionKind::StateMachine { .. }) => vec![],
+        (_, ProjectionKind::StateMachine { .. } | ProjectionKind::Scenario { .. }) => vec![],
         (Layer::Oa, ProjectionKind::FunctionalDataflow) => vec![Kind::Activity],
         (Layer::Sa, ProjectionKind::FunctionalDataflow) => vec![Kind::Function],
         (Layer::Oa, ProjectionKind::Capabilities) => vec![
@@ -208,11 +208,12 @@ pub fn kinds(app: &App) -> Vec<Kind> {
         .unwrap_or_default()
 }
 fn compatible(p: &Project, d: &Diagram, id: Id) -> bool {
-    p.elements.get(&id).is_some_and(|e| {
-        e.kind() != Kind::Port
-            && d.projection.includes(e.kind())
-            && (e.layer() == d.layer || d.projection == ProjectionKind::Traceability)
-    })
+    d.projection.is_architecture()
+        && p.elements.get(&id).is_some_and(|e| {
+            e.kind() != Kind::Port
+                && d.projection.includes(e.kind())
+                && (e.layer() == d.layer || d.projection == ProjectionKind::Traceability)
+        })
 }
 fn suggested(p: &Project, d: &Diagram, kind: Kind) -> bool {
     // Existing System remains a useful choice even when the singleton exists.
@@ -257,6 +258,17 @@ pub fn candidates(app: &App) -> Vec<(Id, String, bool)> {
 }
 impl App {
     pub(super) fn architecture_event(&mut self, event: Event) -> Task<Message> {
+        if matches!(
+            &event,
+            Event::Start(..) | Event::Allocate(..) | Event::Existing(..)
+        ) && !self
+            .active_diagram
+            .and_then(|id| self.project().diagrams.get(&id))
+            .is_some_and(|d| d.projection.is_architecture())
+        {
+            self.status = "Choose an architecture view before adding architecture content.".into();
+            return Task::none();
+        }
         match event {
             Event::Start(_, point) | Event::Allocate(_, _, point) | Event::Existing(point) => {
                 if self.architecture.is_some() {

crates/oa-desktop/src/app/architecture_authoring/tests.rs

@@ -78,7 +78,6 @@ fn architecture_f2_routes_selected_node_to_inline_rename_and_exact_undo() {
         editable: true,
         placing: false,
         connection: None,
-        allocation: None,
     };
     let mut state = crate::diagram::State::default();
     let key = CanvasEvent::Keyboard(keyboard::Event::KeyPressed {
@@ -90,8 +89,17 @@ fn architecture_f2_routes_selected_node_to_inline_rename_and_exact_undo() {
         text: None,
         repeat: false,
     });
-    // Program receives keys already admitted by diagram::focus::Owner. Real
-    // unfocused/Inspector refusal is covered by app::diagram_focus_tests.
+    assert!(
+        canvas
+            .update(&mut state, &key, bounds, mouse::Cursor::Unavailable)
+            .is_none()
+    );
+    let _ = canvas.update(
+        &mut state,
+        &CanvasEvent::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+        bounds,
+        mouse::Cursor::Available(iced::Point::new(150., 120.)),
+    );
     let action = canvas
         .update(&mut state, &key, bounds, mouse::Cursor::Unavailable)
         .unwrap();

crates/oa-desktop/src/app/architecture_authoring_tests.rs

@@ -233,7 +233,6 @@ fn architecture_canvas_left_click_uses_world_coordinate_once_at_zoom_and_pan() {
         editable: true,
         placing: true,
         connection: None,
-        allocation: None,
     };
     let mut state = crate::diagram::State::default();
     let action = canvas
@@ -309,7 +308,6 @@ fn architecture_f2_rename_preserves_identity_placement_and_atomic_history() {
         editable: true,
         placing: false,
         connection: None,
-        allocation: None,
     };
     let bounds = iced::Rectangle::with_size(iced::Size::new(800., 600.));
     let cursor = mouse::Cursor::Available(iced::Point::new(500., 400.));
@@ -323,11 +321,16 @@ fn architecture_f2_rename_preserves_identity_placement_and_atomic_history() {
         text: None,
         repeat: false,
     });
-    // Program receives keys already admitted by diagram::focus::Owner. Real
-    // unfocused/Inspector refusal is covered by app::diagram_focus_tests.
+    assert!(canvas.update(&mut state, &key, bounds, cursor).is_none());
+    let _ = canvas.update(
+        &mut state,
+        &iced::widget::canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+        bounds,
+        cursor,
+    );
     let message = canvas
         .update(&mut state, &key, bounds, cursor)
-        .expect("admitted F2 opens the selected semantic name")
+        .expect("focused F2 opens the selected semantic name")
         .into_inner()
         .0
         .unwrap();

crates/oa-desktop/src/app/behavior_lifecycle_tests.rs

@@ -291,7 +291,7 @@ fn pending_behavior_blocks_navigation_property_edits_and_model_history() {
         Message::BrowseGroup(crate::explorer::Group::Work),
         Message::Field("/name".into(), "Overwrite properties".into()),
         Message::Command(Command::Rename(fixture.source, "Overwrite model".into())),
-        Message::ConfirmDelete(0),
+        Message::ConfirmDelete,
         Message::Undo,
         Message::Redo,
         Message::ShortcutUndo(false),

crates/oa-desktop/src/app/behavior_removal_tests.rs

@@ -1,594 +0,0 @@
-//! Delete through the actual App widget tree, ordinary focus, and source history.
-use super::*;
-use crate::behavior::{
-    canvas_workspace::tests::{Mounted, focused, key},
-    scenario, topology,
-};
-use iced::{Event as Input, Point, Size, Vector, keyboard, mouse};
-
-fn app(p: Project, owner: Id) -> App {
-    let mut app = App::with_project(p);
-    let _ = app.update(Message::Select(owner));
-    let _ = app.update(Message::Page(Page::Behavior));
-    app.window_size = Size::new(1900., 1200.);
-    app
-}
-fn point(mounted: &mut Mounted, app: &App, id: Id) -> Point {
-    if let Some(context) = app.topology_context() {
-        let bounds = mounted.geometry(app).bounds("process-viewport");
-        let local = app
-            .behavior
-            .topology
-            .removal_test_point(app, context.owner, id, None);
-        bounds.position() + Vector::new(local.x, local.y)
-    } else {
-        let context = app.scenario_context().unwrap();
-        let bounds = mounted.geometry(app).bounds("scenario-viewport");
-        let local = scenario::removal_test_point(app, context.scenario, id);
-        bounds.position() + Vector::new(local.x, local.y)
-    }
-}
-async fn select(mounted: &mut Mounted, app: &mut App, id: Id) {
-    let target = point(mounted, app, id);
-    mounted.click(app, target).await;
-    assert_eq!(app.selected, id, "real pointer selects intended occurrence");
-}
-fn remove_key(shift: bool) -> Input {
-    let mut event = key(keyboard::key::Named::Delete);
-    if shift && let Input::Keyboard(keyboard::Event::KeyPressed { modifiers, .. }) = &mut event {
-        *modifiers = keyboard::Modifiers::SHIFT;
-    }
-    event
-}
-fn removal(message: &Message) -> bool {
-    matches!(
-        message,
-        Message::TopologyCanvas(topology::CanvasEvent::Remove(..))
-            | Message::ScenarioCanvas(scenario::CanvasEvent::Remove(..))
-    )
-}
-async fn delete(mounted: &mut Mounted, app: &mut App, shift: bool) -> u64 {
-    let messages = mounted
-        .batch(app, &[remove_key(shift)], mouse::Cursor::Unavailable)
-        .await;
-    assert!(
-        messages.iter().any(removal),
-        "focused viewport emits removal: {messages:?}"
-    );
-    let target = app.delete_target.as_ref().expect("captured confirmation");
-    assert_eq!(target.snapshot.request.object, app.selected);
-    assert_eq!(target.placement, None);
-    assert_eq!(target.snapshot.request.placement, None);
-    target.snapshot.token
-}
-async fn send(mounted: &mut Mounted, app: &mut App, message: Message) {
-    let task = app.update(message);
-    mounted.perform(app, task).await;
-}
-fn consistent(app: &App) {
-    assert_eq!(
-        source_project::compile_bundle(app.document.bundle(), LIMITS)
-            .unwrap()
-            .decoded
-            .project,
-        *app.project()
-    );
-    assert_eq!(
-        source_workspace::reachable(&app.source_workspace.bundle()).unwrap(),
-        *app.document.bundle()
-    );
-}
-
-#[tokio::test]
-async fn mounted_process_delete_occurrence_or_link_preserves_reusable_work_and_source_history() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        for link in [false, true] {
-            let f = topology::direct_tests::fixture(layer);
-            let target = if link { f.link } else { f.nodes[0] };
-            let mut app = app(f.p.clone(), f.owner);
-            let mut mounted = Mounted::new(&mut app).await;
-            let original = app.document.bundle().clone();
-            select(&mut mounted, &mut app, target).await;
-            // No extra redraw between release and first Delete.
-            let token = delete(&mut mounted, &mut app, link).await;
-            assert_eq!(
-                app.delete_target.as_ref().unwrap().behavior_owner,
-                Some(f.owner)
-            );
-            assert_eq!(app.document.bundle(), &original);
-            send(&mut mounted, &mut app, Message::ConfirmDelete(token)).await;
-            assert!(!app.project().contains(target));
-            assert!(f.work.iter().all(|id| app.project().contains(*id)));
-            assert!(app.project().contains(f.exchange));
-            assert!(app.project().contains(f.nodes[1]));
-            assert_eq!(app.project().contains(f.nodes[0]), link);
-            assert!(!app.project().contains(f.link));
-            consistent(&app);
-            let removed = app.document.bundle().clone();
-            send(&mut mounted, &mut app, Message::Undo).await;
-            assert_eq!(app.document.bundle(), &original);
-            consistent(&app);
-            send(&mut mounted, &mut app, Message::Redo).await;
-            assert_eq!(app.document.bundle(), &removed);
-            consistent(&app);
-        }
-    }
-}
-
-#[tokio::test]
-async fn mounted_scenario_delete_message_or_participant_preserves_reusable_targets() {
-    for participant in [false, true] {
-        let f = scenario::direct_tests::fixture();
-        let target = if participant { f.sender } else { f.call };
-        let mut app = app(f.project.clone(), f.owner);
-        let mut mounted = Mounted::new(&mut app).await;
-        let original = app.document.bundle().clone();
-        select(&mut mounted, &mut app, target).await;
-        let token = delete(&mut mounted, &mut app, participant).await;
-        send(&mut mounted, &mut app, Message::ConfirmDelete(token)).await;
-        assert!(!app.project().contains(target));
-        assert!(app.project().contains(f.exchange));
-        assert!(app.project().contains(f.receiver));
-        assert!(app.project().contains(f.reply));
-        for element in f
-            .project
-            .elements
-            .values()
-            .filter(|element| element.parent != Some(f.owner))
-        {
-            assert!(
-                app.project().contains(element.id),
-                "referenced definitions survive"
-            );
-        }
-        if participant {
-            assert!(app.project().contains(f.call));
-            for element in app.project().elements.values() {
-                if let Some(SharedBody::Occurrence {
-                    body:
-                        OccurrenceBody::Exchange {
-                            sender, receiver, ..
-                        },
-                    ..
-                }) = element.shared()
-                {
-                    assert_ne!(*sender, Some(target));
-                    assert_ne!(*receiver, Some(target));
-                }
-            }
-        }
-        consistent(&app);
-        send(&mut mounted, &mut app, Message::Undo).await;
-        assert_eq!(app.document.bundle(), &original);
-        consistent(&app);
-    }
-}
-
-#[tokio::test]
-async fn mounted_scenario_use_delete_keeps_definition_and_second_use_and_rejects_owner_replay() {
-    let (p, owners, uses) = scenario::direct_tests::navigation_fixture();
-    let mut app = app(p, owners[0]);
-    let mut mounted = Mounted::new(&mut app).await;
-    let original = app.document.bundle().clone();
-    select(&mut mounted, &mut app, uses[0]).await;
-    let stale = delete(&mut mounted, &mut app, false).await;
-    send(&mut mounted, &mut app, Message::CancelDelete).await;
-    send(&mut mounted, &mut app, Message::ConfirmDelete(stale)).await;
-    assert_eq!(app.document.bundle(), &original);
-    select(&mut mounted, &mut app, uses[0]).await;
-    let token = delete(&mut mounted, &mut app, true).await;
-    send(&mut mounted, &mut app, Message::ConfirmDelete(stale)).await;
-    assert!(app.delete_pending, "old token does not cancel new dialog");
-    // Keep selection and epoch deliberately unchanged: owner is an independent witness.
-    app.behavior.active_owner = Some(owners[1]);
-    send(&mut mounted, &mut app, Message::ConfirmDelete(token)).await;
-    assert_eq!(app.document.bundle(), &original);
-    app.behavior.active_owner = Some(owners[0]);
-    mounted.settle(&mut app).await;
-    select(&mut mounted, &mut app, uses[0]).await;
-    let token = delete(&mut mounted, &mut app, false).await;
-    send(&mut mounted, &mut app, Message::ConfirmDelete(token)).await;
-    assert!(!app.project().contains(uses[0]));
-    assert!(app.project().contains(uses[1]));
-    assert!(owners.iter().all(|id| app.project().contains(*id)));
-    consistent(&app);
-    send(&mut mounted, &mut app, Message::Undo).await;
-    assert_eq!(app.document.bundle(), &original);
-}
-
-#[tokio::test]
-async fn mounted_behavior_tab_and_f6_retire_same_batch_delete_and_window_focus() {
-    for process in [false, true] {
-        let (mut app, target) = if process {
-            let f = topology::direct_tests::fixture(Layer::Oa);
-            (app(f.p, f.owner), f.nodes[0])
-        } else {
-            let f = scenario::direct_tests::fixture();
-            (app(f.project, f.owner), f.call)
-        };
-        let mut mounted = Mounted::new(&mut app).await;
-        let original = app.document.bundle().clone();
-        for boundary in [
-            keyboard::key::Named::Tab,
-            keyboard::key::Named::F6,
-            keyboard::key::Named::Escape,
-        ] {
-            select(&mut mounted, &mut app, target).await;
-            let messages = mounted
-                .batch(
-                    &mut app,
-                    &[key(boundary), remove_key(false)],
-                    mouse::Cursor::Unavailable,
-                )
-                .await;
-            assert!(
-                !messages.iter().any(removal),
-                "{boundary:?} retires keyboard admission within the batch"
-            );
-            assert!(!app.delete_pending);
-            assert_eq!(app.document.bundle(), &original);
-            assert!(!focused(&mut mounted, &app, "viewport"));
-            if boundary == keyboard::key::Named::Tab {
-                assert_eq!(
-                    mounted
-                        .geometry(&app)
-                        .focused
-                        .iter()
-                        .filter(|(_, _, value)| *value)
-                        .count(),
-                    1,
-                    "Tab completes traversal to one real control"
-                );
-                let mut backwards = key(keyboard::key::Named::Tab);
-                if let Input::Keyboard(keyboard::Event::KeyPressed { modifiers, .. }) =
-                    &mut backwards
-                {
-                    *modifiers = keyboard::Modifiers::SHIFT;
-                }
-                mounted
-                    .batch(&mut app, &[backwards], mouse::Cursor::Unavailable)
-                    .await;
-            } else {
-                let messages = mounted
-                    .batch(
-                        &mut app,
-                        &[key(keyboard::key::Named::F6), remove_key(false)],
-                        mouse::Cursor::Unavailable,
-                    )
-                    .await;
-                assert!(
-                    !messages.iter().any(removal),
-                    "F6 entry completes after the batch, before a later Delete"
-                );
-            }
-            assert!(
-                focused(&mut mounted, &app, "viewport"),
-                "{boundary:?} supports keyboard-only return to the viewport"
-            );
-            delete(&mut mounted, &mut app, false).await;
-            send(&mut mounted, &mut app, Message::CancelDelete).await;
-            assert_eq!(app.document.bundle(), &original);
-        }
-        select(&mut mounted, &mut app, target).await;
-        let messages = mounted
-            .batch(
-                &mut app,
-                &[
-                    Input::Window(iced::window::Event::Unfocused),
-                    remove_key(false),
-                ],
-                mouse::Cursor::Unavailable,
-            )
-            .await;
-        assert!(!messages.iter().any(removal));
-        assert!(!app.delete_pending);
-        // A new actual click reacquires ownership after each boundary.
-        select(&mut mounted, &mut app, target).await;
-        delete(&mut mounted, &mut app, false).await;
-        send(&mut mounted, &mut app, Message::CancelDelete).await;
-        assert_eq!(app.document.bundle(), &original);
-    }
-}
-
-#[tokio::test]
-async fn mounted_behavior_clean_inspector_click_and_tab_own_delete_then_f6_returns_to_canvas() {
-    for process in [false, true] {
-        for tab_entry in [false, true] {
-            let (mut app, target) = if process {
-                let f = topology::direct_tests::fixture(Layer::Oa);
-                (app(f.p, f.owner), f.nodes[0])
-            } else {
-                let f = scenario::direct_tests::fixture();
-                (app(f.project, f.owner), f.call)
-            };
-            let mut mounted = Mounted::new(&mut app).await;
-            select(&mut mounted, &mut app, target).await;
-            let original = app.document.bundle().clone();
-            let original_name = app.draft.as_ref().unwrap().inputs["/name"].raw.clone();
-            // The first text input in the right-hand Inspector is the name.
-            // Verify its actual binding below, rather than seeding focus state.
-            let field = mounted
-                .geometry(&app)
-                .text_inputs
-                .into_iter()
-                .filter(|bounds| bounds.x > app.window_size.width - 320.)
-                .min_by(|a, b| a.y.total_cmp(&b.y))
-                .expect("visible Inspector name input");
-            if tab_entry {
-                // Canvas Tab stays within canvas controls. Escape then ordinary
-                // Tab follows the existing Inspector entry policy.
-                mounted
-                    .batch(
-                        &mut app,
-                        &[key(keyboard::key::Named::Escape)],
-                        mouse::Cursor::Unavailable,
-                    )
-                    .await;
-                mounted
-                    .batch(
-                        &mut app,
-                        &[key(keyboard::key::Named::Tab)],
-                        mouse::Cursor::Unavailable,
-                    )
-                    .await;
-            } else {
-                mounted.click(&mut app, field.center()).await;
-            }
-            assert!(
-                mounted
-                    .geometry(&app)
-                    .focused
-                    .iter()
-                    .any(|(_, bounds, value)| *bounds == field && *value),
-                "actual {} focuses the Inspector name",
-                if tab_entry { "Tab" } else { "click" }
-            );
-            assert!(!focused(&mut mounted, &app, "viewport"));
-            assert!(!app.draft_dirty());
-            let messages = mounted
-                .batch(
-                    &mut app,
-                    &[key(keyboard::key::Named::End), remove_key(true)],
-                    mouse::Cursor::Unavailable,
-                )
-                .await;
-            assert!(messages.iter().any(|message| matches!(
-                message,
-                Message::Field(path, value) if path == "/name" && *value == original_name
-            )));
-            assert!(!messages.iter().any(removal));
-            assert!(!app.delete_pending);
-            assert!(!app.draft_dirty(), "Delete at end keeps the field clean");
-            assert_eq!(app.document.bundle(), &original);
-            mounted
-                .batch(
-                    &mut app,
-                    &[key(keyboard::key::Named::F6)],
-                    mouse::Cursor::Unavailable,
-                )
-                .await;
-            assert!(focused(&mut mounted, &app, "viewport"));
-            assert_eq!(
-                mounted
-                    .geometry(&app)
-                    .focused
-                    .iter()
-                    .filter(|(_, _, value)| *value)
-                    .count(),
-                1,
-                "F6 releases actual Inspector focus"
-            );
-            delete(&mut mounted, &mut app, false).await;
-            send(&mut mounted, &mut app, Message::CancelDelete).await;
-            assert_eq!(app.document.bundle(), &original);
-        }
-    }
-}
-
-#[tokio::test]
-async fn mounted_behavior_clean_text_focus_and_modifiers_cannot_delete_selected_occurrence() {
-    use iced::advanced::widget::{Operation, operation};
-    struct FocusText(iced::Rectangle);
-    impl Operation for FocusText {
-        fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation)) {
-            visit(self);
-        }
-        fn focusable(
-            &mut self,
-            _: Option<&iced::advanced::widget::Id>,
-            bounds: iced::Rectangle,
-            state: &mut dyn operation::Focusable,
-        ) {
-            if bounds == self.0 {
-                state.focus();
-            } else {
-                state.unfocus();
-            }
-        }
-    }
-    for process in [false, true] {
-        let (mut app, target) = if process {
-            let f = topology::direct_tests::fixture(Layer::Oa);
-            (app(f.p, f.owner), f.nodes[0])
-        } else {
-            let f = scenario::direct_tests::fixture();
-            (app(f.project, f.owner), f.call)
-        };
-        let mut mounted = Mounted::new(&mut app).await;
-        select(&mut mounted, &mut app, target).await;
-        let original = app.document.bundle().clone();
-        for modifiers in [
-            keyboard::Modifiers::CTRL,
-            keyboard::Modifiers::ALT,
-            keyboard::Modifiers::LOGO,
-        ] {
-            let mut event = remove_key(false);
-            if let Input::Keyboard(keyboard::Event::KeyPressed {
-                modifiers: value, ..
-            }) = &mut event
-            {
-                *value = modifiers;
-            }
-            let messages = mounted
-                .batch(&mut app, &[event], mouse::Cursor::Unavailable)
-                .await;
-            assert!(!messages.iter().any(removal));
-        }
-        let field = mounted
-            .geometry(&app)
-            .text_inputs
-            .into_iter()
-            .find(|bounds| bounds.width > 40.)
-            .expect("real text field");
-        mounted.operate(&app, &mut FocusText(field));
-        assert!(!app.draft_dirty());
-        let messages = mounted
-            .batch(&mut app, &[remove_key(true)], mouse::Cursor::Unavailable)
-            .await;
-        assert!(!messages.iter().any(removal));
-        assert!(!app.delete_pending);
-        assert_eq!(app.document.bundle(), &original);
-    }
-}
-
-#[tokio::test]
-async fn mounted_scenario_fragment_and_branch_delete_only_owned_occurrences() {
-    for whole_fragment in [false, true] {
-        let (f, branch, anchor, state, reused, remote) =
-            scenario::direct_tests::placement_fixture();
-        let fragment = f.project.elements[&branch].parent.unwrap();
-        let target = if whole_fragment { fragment } else { branch };
-        let mut app = app(f.project.clone(), f.owner);
-        let mut mounted = Mounted::new(&mut app).await;
-        let original = app.document.bundle().clone();
-        select(&mut mounted, &mut app, target).await;
-        let token = delete(&mut mounted, &mut app, false).await;
-        send(&mut mounted, &mut app, Message::ConfirmDelete(token)).await;
-        assert!(!app.project().contains(target));
-        assert!(!app.project().contains(anchor));
-        assert!(!app.project().contains(branch));
-        assert_eq!(app.project().contains(fragment), !whole_fragment);
-        for id in [
-            f.call, f.reply, f.sender, f.receiver, f.exchange, state, reused, remote,
-        ] {
-            assert!(app.project().contains(id));
-        }
-        consistent(&app);
-        send(&mut mounted, &mut app, Message::Undo).await;
-        assert_eq!(app.document.bundle(), &original);
-    }
-}
-
-#[tokio::test]
-async fn mounted_qualified_process_child_delete_refuses_outer_reference_and_shared_definition() {
-    let f = topology::direct_tests::fixture(Layer::Oa);
-    let mut p = f.p;
-    let caller = p
-        .add_element(Kind::Process, Layer::Oa, "Caller", None)
-        .unwrap();
-    let references = ["First use", "Second use"].map(|name| {
-        let mut element = p
-            .make_element(Kind::Occurrence, Layer::Oa, name, Some(caller))
-            .unwrap();
-        *element.shared_mut().unwrap() = SharedBody::Occurrence {
-            body: OccurrenceBody::SequenceReference {
-                sequence: Some(f.owner),
-            },
-            precondition: String::new(),
-            postcondition: String::new(),
-        };
-        let id = element.id;
-        p = execute_batch(&p, &[Command::CreateElement(element)]).unwrap();
-        id
-    });
-    let mut app = app(p, caller);
-    let mut mounted = Mounted::new(&mut app).await;
-    let original = app.document.bundle().clone();
-    let endpoint = OccurrenceEndpoint {
-        references: vec![references[0]],
-        occurrence: f.nodes[0],
-    };
-    let bounds = mounted.geometry(&app).bounds("process-viewport");
-    let local =
-        app.behavior
-            .topology
-            .removal_test_point(&app, caller, references[0], Some(&endpoint));
-    let messages = mounted
-        .click(&mut app, bounds.position() + Vector::new(local.x, local.y))
-        .await;
-    assert!(messages.iter().any(|message| matches!(
-        message,
-        Message::TopologyCanvas(topology::CanvasEvent::SelectQualified(..))
-    )));
-    assert_eq!(app.selected, references[0]);
-    assert!(
-        app.behavior
-            .topology
-            .has_qualified_selection(app.project(), caller)
-    );
-    mounted
-        .batch(&mut app, &[remove_key(false)], mouse::Cursor::Unavailable)
-        .await;
-    assert!(!app.delete_pending);
-    assert_eq!(app.document.bundle(), &original);
-    assert!(app.status.contains("Open the referenced definition"));
-    select(&mut mounted, &mut app, references[0]).await;
-    assert!(
-        !app.behavior
-            .topology
-            .has_qualified_selection(app.project(), caller)
-    );
-    let token = delete(&mut mounted, &mut app, true).await;
-    send(&mut mounted, &mut app, Message::ConfirmDelete(token)).await;
-    assert!(!app.project().contains(references[0]));
-    assert!(app.project().contains(references[1]));
-    assert!(app.project().contains(f.owner));
-    assert!(f.nodes.iter().all(|id| app.project().contains(*id)));
-    consistent(&app);
-    send(&mut mounted, &mut app, Message::Undo).await;
-    assert_eq!(app.document.bundle(), &original);
-}
-
-#[tokio::test]
-async fn mounted_behavior_pan_and_stale_removal_intent_do_not_delete() {
-    for process in [false, true] {
-        let (mut app, target) = if process {
-            let f = topology::direct_tests::fixture(Layer::Oa);
-            (app(f.p, f.owner), f.nodes[0])
-        } else {
-            let f = scenario::direct_tests::fixture();
-            (app(f.project, f.owner), f.call)
-        };
-        let mut mounted = Mounted::new(&mut app).await;
-        select(&mut mounted, &mut app, target).await;
-        let original = app.document.bundle().clone();
-        let cursor = point(&mut mounted, &app, target);
-        let messages = mounted
-            .batch(
-                &mut app,
-                &[
-                    Input::Mouse(mouse::Event::CursorMoved { position: cursor }),
-                    Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Middle)),
-                    remove_key(false),
-                    Input::Mouse(mouse::Event::ButtonReleased(mouse::Button::Middle)),
-                ],
-                mouse::Cursor::Available(cursor),
-            )
-            .await;
-        assert!(
-            !messages.iter().any(removal),
-            "held pan never becomes an occurrence deletion"
-        );
-        assert!(!app.delete_pending);
-        select(&mut mounted, &mut app, target).await;
-        let messages = mounted.input(&app, &[remove_key(false)], mouse::Cursor::Unavailable);
-        let stale = messages
-            .into_iter()
-            .find(removal)
-            .expect("captured live removal");
-        app.canvas_epoch = app.canvas_epoch.wrapping_add(1);
-        send(&mut mounted, &mut app, stale).await;
-        assert!(!app.delete_pending);
-        assert_eq!(app.document.bundle(), &original);
-    }
-}

crates/oa-desktop/src/app/diagram_focus_tests.rs

@@ -1,156 +0,0 @@
-//! Keyboard ownership is exercised on the mounted App, not raw Canvas Program.
-use super::*;
-use crate::behavior::canvas_workspace::tests::{Mounted, key};
-use iced::advanced::widget::{Operation, operation};
-use iced::{Point, Rectangle, Size, Vector, keyboard::key::Named, mouse};
-
-struct FocusField(Rectangle);
-impl Operation for FocusField {
-    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation)) {
-        visit(self);
-    }
-    fn focusable(
-        &mut self,
-        _: Option<&iced::advanced::widget::Id>,
-        bounds: Rectangle,
-        state: &mut dyn operation::Focusable,
-    ) {
-        if bounds == self.0 {
-            state.focus();
-        } else {
-            state.unfocus();
-        }
-    }
-}
-
-async fn f2(mounted: &mut Mounted, app: &mut App) -> Vec<Message> {
-    mounted
-        .batch(app, &[key(Named::F2)], mouse::Cursor::Unavailable)
-        .await
-}
-
-fn rename_emitted(messages: &[Message]) -> bool {
-    messages.iter().any(|message| {
-        matches!(
-            message,
-            Message::Architecture(architecture_authoring::Event::Rename(..))
-        )
-    })
-}
-
-#[tokio::test]
-async fn mounted_f2_requires_canvas_focus_and_yields_to_clean_inspector() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        for programmatic in [true, false] {
-            let mut project = Project::empty();
-            let object = project
-                .add_element(
-                    if layer == Layer::Oa {
-                        Kind::Entity
-                    } else {
-                        Kind::System
-                    },
-                    layer,
-                    "Original team",
-                    None,
-                )
-                .unwrap();
-            let diagram = project.ensure_diagram(layer);
-            project.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Overview;
-            let node = project.place(diagram, object, Position { x: 80., y: 80. });
-            let mut app = App::with_project(project);
-            app.page = Page::Diagram;
-            app.layer = layer;
-            app.active_diagram = Some(diagram);
-            app.window_size = Size::new(2000., 1400.);
-            let _ = app.update(Message::Select(object));
-            let before = app.document.snapshot();
-            let mut mounted = Mounted::new(&mut app).await;
-            app.zoom = 1.;
-            app.pan = Vector::ZERO;
-            app.fit_to_view = false;
-            mounted.settle(&mut app).await;
-
-            // Selection alone does not grant the canvas keyboard ownership.
-            assert!(!rename_emitted(&f2(&mut mounted, &mut app).await));
-            assert!(app.architecture.is_none());
-            assert_eq!(app.document.bundle(), &before.bundle);
-
-            let bounds = mounted
-                .geometry(&app)
-                .bounds(crate::allocation_input::CANVAS_ID);
-            let projected = projection::project_view(app.project(), diagram)
-                .nodes
-                .into_iter()
-                .find(|item| item.id == node)
-                .unwrap();
-            let point = Point::new(
-                bounds.x + projected.position.x + 40.,
-                bounds.y + projected.position.y + 35.,
-            );
-            mounted.click(&mut app, point).await;
-            assert_eq!((app.selected, app.selected_node), (object, Some(node)));
-            assert!(rename_emitted(&f2(&mut mounted, &mut app).await));
-            let rename = app.architecture.as_ref().expect("canvas F2 opens rename");
-            assert!(rename.inline());
-            assert!(matches!(
-                &rename.saved.intent,
-                architecture_authoring::Intent::Rename { element, name }
-                    if *element == object && name == "Original team"
-            ));
-            assert_eq!(app.document.bundle(), &before.bundle);
-            assert!(
-                !app.document.can_undo(),
-                "opening rename is not a model edit"
-            );
-
-            let task = app.update(Message::Escape);
-            mounted.perform(&mut app, task).await;
-            assert!(app.architecture.is_none());
-            mounted.click(&mut app, point).await;
-            let field = mounted
-                .geometry(&app)
-                .text_inputs
-                .into_iter()
-                .filter(|bounds| bounds.x > app.window_size.width - 320.)
-                .min_by(|a, b| a.y.total_cmp(&b.y))
-                .expect("Inspector name field is mounted");
-            if programmatic {
-                mounted.operate(&app, &mut FocusField(field));
-            } else {
-                let messages = mounted
-                    .batch(
-                        &mut app,
-                        &[key(Named::Tab), key(Named::F2)],
-                        mouse::Cursor::Unavailable,
-                    )
-                    .await;
-                assert!(
-                    !rename_emitted(&messages),
-                    "Tab must retire F2 admission before its queued focus task"
-                );
-            }
-            let geometry = mounted.geometry(&app);
-            assert!(
-                geometry
-                    .focused
-                    .iter()
-                    .any(|(_, bounds, focused)| { *bounds == field && *focused })
-            );
-            assert!(geometry.focused.iter().any(|(id, _, focused)| {
-                id.as_ref() == Some(&iced::advanced::widget::Id::from("diagram-keyboard-owner"))
-                    && !*focused
-            }));
-            assert!(!app.draft_dirty(), "the Inspector is still clean");
-            assert!(!rename_emitted(&f2(&mut mounted, &mut app).await));
-            assert!(app.architecture.is_none());
-            assert_eq!(
-                app.draft.as_ref().unwrap().inputs["/name"].raw,
-                "Original team"
-            );
-            assert_eq!(app.project(), &before.decoded.project);
-            assert_eq!(app.document.bundle(), &before.bundle);
-            assert!(!app.document.can_undo());
-        }
-    }
-}

crates/oa-desktop/src/app/diagram_removal.rs

@@ -1,240 +0,0 @@
-//! Captured diagram removal and model-confirmation lifetimes.
-use super::*;
-use crate::{model_menu, route_edit::Context};
-
-#[derive(Debug, Clone)]
-pub struct Intent {
-    pub context: Context,
-    pub object: Id,
-    pub placement: Option<Id>,
-    pub model: bool,
-}
-
-pub struct Confirmation {
-    pub snapshot: model_menu::Opened,
-    pub selection: Id,
-    pub placement: Option<Id>,
-    pub behavior_owner: Option<Id>,
-}
-
-pub fn enabled(app: &App) -> bool {
-    !app.busy && focus_enabled(app)
-}
-
-pub(crate) fn focus_enabled(app: &App) -> bool {
-    crate::behavior::canvas_workspace::keyboard_owner_enabled(app)
-        && !app.draft_dirty()
-        && !app.source_dirty()
-        && !app.behavior.has_pending()
-        && app
-            .architecture
-            .as_ref()
-            .is_none_or(|state| !state.inline())
-}
-
-pub(crate) fn behavior_owner(app: &App) -> Option<Id> {
-    app.topology_context()
-        .map(|context| context.owner)
-        .or_else(|| app.scenario_context().map(|context| context.scenario))
-}
-
-fn placement(app: &App) -> Option<Id> {
-    if behavior_owner(app).is_some() {
-        None
-    } else if app.page == Page::Behavior {
-        app.behavior.diagram.placement
-    } else {
-        app.selected_node
-    }
-}
-
-/// The derived canvases remove semantic occurrences, not reusable definitions.
-/// Kept beside target capture so confirmation rendering uses the same meaning.
-pub(crate) fn explanation(app: &App, object: Id) -> &'static str {
-    if app
-        .project()
-        .diagrams
-        .values()
-        .any(|diagram| diagram.nodes.contains_key(&object))
-    {
-        return "Remove only this diagram placement. The model element and its placements in other diagrams remain. Undo restores this placement.";
-    }
-    if app
-        .project()
-        .relations
-        .get(&object)
-        .is_some_and(|relation| {
-            matches!(
-                relation.kind(),
-                RelationKind::StateAction | RelationKind::StateTransition
-            )
-        })
-    {
-        return "Remove this state relation. Its states and referenced activities or functions remain. Undo restores the relation.";
-    }
-    if app
-        .project()
-        .relations
-        .get(&object)
-        .is_some_and(|relation| {
-            matches!(
-                relation.kind(),
-                RelationKind::SequenceLink | RelationKind::ContextualLink
-            )
-        })
-    {
-        return "Remove this process link. Its endpoint occurrences and referenced reusable model elements are preserved. Undo restores the deletion.";
-    }
-    match app
-        .project()
-        .elements
-        .get(&object)
-        .and_then(|element| element.shared())
-    {
-        Some(SharedBody::Lifeline { .. }) => {
-            "Remove this participant from the scenario. Its represented model element is preserved. Messages and other occurrences remain with affected participant references cleared. Undo restores the deletion."
-        }
-        Some(SharedBody::Occurrence {
-            body: OccurrenceBody::Fragment { .. } | OccurrenceBody::Branch { .. },
-            ..
-        }) => {
-            "Remove this occurrence and its owned branches and steps. Referenced reusable model elements are preserved. Undo restores the deletion."
-        }
-        Some(SharedBody::Occurrence { .. }) => {
-            "Remove this occurrence and its dependent links. Referenced reusable model elements are preserved. Undo restores the deletion."
-        }
-        _ => {
-            "Owned children, incident relations, occurrences, placements and trace links will also be removed. The traced counterpart itself is preserved. Undo restores the deletion."
-        }
-    }
-}
-
-impl App {
-    pub(super) fn remove_from_diagram(&mut self, intent: Intent) {
-        if !enabled(self) || self.connection.is_some() || self.selected_bend.is_some() {
-            return;
-        }
-        let current = match self.page {
-            Page::Diagram if self.architecture.as_ref().is_none_or(|s| !s.saved.placing) => {
-                self.route_context()
-            }
-            Page::Behavior
-                if self.behavior.diagram.tool == crate::behavior::state_edit::Tool::Select =>
-            {
-                self.state_context()
-            }
-            _ => None,
-        };
-        let selected_object = self
-            .project()
-            .diagrams
-            .get(&intent.context.diagram)
-            .and_then(|diagram| diagram.nodes.get(&self.selected))
-            .map_or(self.selected, |node| node.element);
-        if current != Some(intent.context) || selected_object != intent.object {
-            return;
-        }
-        let view = projection::project_view(self.project(), intent.context.diagram);
-        let placement = if self.page == Page::Behavior {
-            self.behavior.diagram.placement
-        } else {
-            self.selected_node
-        };
-        if intent.placement != placement || intent.object == intent.context.diagram {
-            return;
-        }
-        let visible = if let Some(id) = intent.placement {
-            self.project().diagrams[&intent.context.diagram]
-                .nodes
-                .get(&id)
-                .is_some_and(|node| node.element == intent.object)
-                && view
-                    .nodes
-                    .iter()
-                    .any(|node| node.id == id && node.element == intent.object)
-        } else {
-            view.edges.iter().any(|edge| edge.id == intent.object)
-                || view.ports.iter().any(|port| port.element == intent.object)
-                || (self.page == Page::Behavior
-                    && crate::behavior::state_canvas::visible_row_relation(
-                        self.project(),
-                        intent.context.diagram,
-                        &view,
-                        intent.object,
-                    ))
-        };
-        if !visible {
-            return;
-        }
-        if !intent.model
-            && let Some(placement) = intent.placement
-        {
-            if self.execute(Command::Delete(placement)) {
-                self.selected_node = None;
-                self.behavior.diagram.placement = None;
-                self.selected_bend = None;
-                self.status = "Hidden from this diagram · Model element preserved · Undo restores the placement".into();
-            }
-        } else {
-            self.begin_model_delete_target(intent.object, Some(intent.context));
-        }
-    }
-
-    pub(super) fn begin_model_delete(&mut self, canvas: Option<Context>) {
-        self.begin_model_delete_target(self.selected, canvas);
-    }
-
-    fn begin_model_delete_target(&mut self, object: Id, canvas: Option<Context>) {
-        if object == self.project().id || self.behavior.has_pending() {
-            return;
-        }
-        let mut request = model_menu::Request::object(object, iced::Point::ORIGIN);
-        request.canvas = canvas;
-        request.placement = placement(self);
-        // Opening a modal retires any pending canvas intent before capturing
-        // the confirmation; every new dialog receives its own replay token.
-        self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
-        if canvas.is_some() {
-            request.canvas = if self.page == Page::Behavior {
-                self.state_context()
-            } else {
-                self.route_context()
-            };
-        }
-        self.menu_sequence = self.menu_sequence.wrapping_add(1);
-        self.delete_target =
-            model_menu::Opened::new(self, request, self.menu_sequence).map(|snapshot| {
-                Confirmation {
-                    snapshot,
-                    selection: self.selected,
-                    placement: placement(self),
-                    behavior_owner: behavior_owner(self),
-                }
-            });
-        self.delete_pending = self.delete_target.is_some();
-    }
-
-    pub(super) fn confirm_model_delete(&mut self, token: u64) {
-        let Some(target) = self.delete_target.as_ref() else {
-            return;
-        };
-        if target.snapshot.token != token {
-            return;
-        }
-        let valid = self.delete_pending
-            && target.snapshot.valid(self)
-            && target.selection == self.selected
-            && target.placement == placement(self)
-            && target.behavior_owner == behavior_owner(self)
-            && !self.behavior.has_pending()
-            && !self.source_dirty()
-            && !self.draft_dirty();
-        let id = target.snapshot.request.object;
-        self.delete_pending = false;
-        self.delete_target = None;
-        self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
-        if valid {
-            self.execute(Command::Delete(id));
-        }
-    }
-}

crates/oa-desktop/src/app/diagram_removal_tests/navigation_union.rs

@@ -1,146 +0,0 @@
-//! Navigate first, then remove through the mounted root canvas and history.
-use super::*;
-use crate::diagram_usage::{self as usage, Target};
-
-async fn navigate_then_remove(project: Project, subject: Id, owner: Id, row: bool) {
-    let mut app = App::with_project(project);
-    app.window_size = Size::new(2000., 1400.);
-    let before = app.document.snapshot();
-    let message = app.diagram_usage_message(subject);
-    let _ = app.update(message);
-    let panel = app.diagram_usages.as_ref().unwrap();
-    let token = panel.token;
-    let context = panel.context;
-    // Complete the same query independently without polling its worker Task.
-    let process = app.behavior.topology.usage_snapshot().into_query_state();
-    let completion = usage::Completion {
-        token,
-        context,
-        result: Ok(usage::collect(
-            app.project(),
-            subject,
-            &process,
-            &behavior::scenario::State::default(),
-        )),
-    };
-    let _ = app.update(Message::DiagramUsagesReady(completion));
-    let found = app
-        .diagram_usages
-        .as_ref()
-        .unwrap()
-        .usages
-        .iter()
-        .find(|usage| {
-            if row {
-                matches!(usage.target, Target::StateRow { relation, .. } if relation == subject)
-            } else {
-                matches!(usage.target, Target::Port { port, .. } if port == subject)
-            }
-        })
-        .unwrap()
-        .clone();
-    let _ = app.update(Message::DiagramUsage(usage::Event::Choose(
-        token,
-        found.clone(),
-    )));
-    assert_eq!(app.selected, subject);
-    // refresh_draft normalizes the owner's presentation placement; navigation
-    // must not leave it armed as a removal target.
-    assert!(app.selected_node.is_none());
-    assert!(app.behavior.diagram.placement.is_none());
-    assert_eq!(
-        app.diagram_focus(found.surface).unwrap().target,
-        found.target
-    );
-
-    let mut mounted = Mounted::new(&mut app).await;
-    assert_eq!(app.project(), &before.decoded.project);
-    assert_eq!(app.document.bundle(), &before.bundle);
-    assert!(app.pending_diagram_reveal.is_none());
-    for model in [false, true] {
-        mounted
-            .perform(
-                &mut app,
-                iced::widget::operation::focus(iced::advanced::widget::Id::from(
-                    "diagram-keyboard-owner",
-                )),
-            )
-            .await;
-        let messages = delete(&mut mounted, &mut app, model).await;
-        let request = messages
-            .iter()
-            .find_map(|message| match message {
-                Message::DiagramRemove(intent)
-                | Message::StateDiagram(behavior::state_edit::Event::Remove(intent)) => {
-                    Some(intent)
-                }
-                _ => None,
-            })
-            .expect("actual focused canvas emitted a removal intent");
-        assert_eq!(request.object, subject);
-        assert_eq!(request.placement, None);
-        assert_eq!(request.model, model);
-        assert_eq!(
-            app.delete_target.as_ref().unwrap().snapshot.request.object,
-            subject
-        );
-        assert_eq!(app.project(), &before.decoded.project);
-        assert_eq!(app.document.bundle(), &before.bundle);
-        if !model {
-            let task = app.update(Message::CancelDelete);
-            mounted.perform(&mut app, task).await;
-        }
-    }
-    let token = app.delete_target.as_ref().unwrap().snapshot.token;
-    let task = app.update(Message::ConfirmDelete(token));
-    mounted.perform(&mut app, task).await;
-    let expected = execute_batch(&before.decoded.project, &[Command::Delete(subject)]).unwrap();
-    assert_eq!(app.project(), &expected);
-    assert!(app.project().contains(owner));
-    consistent(&app);
-    let task = app.update(Message::Undo);
-    mounted.perform(&mut app, task).await;
-    assert_eq!(app.project(), &before.decoded.project);
-    assert_eq!(app.document.bundle(), &before.bundle);
-    assert!(!app.document.can_undo());
-}
-
-#[tokio::test]
-async fn port_navigation_then_canvas_delete_preserves_owner_and_restores_exact_history() {
-    let mut project = Project::empty();
-    let owner = project.add(Kind::Function, "Compute", 1200., 1500.);
-    let port = Id::new_v4();
-    let element = oa_core::ports::make_port(
-        &project,
-        port,
-        owner,
-        "Input",
-        oa_core::PortContract::FunctionInput {
-            incoming_items: vec![],
-        },
-    )
-    .unwrap();
-    project = execute_batch(&project, &[Command::CreateElement(element)]).unwrap();
-    navigate_then_remove(project, port, owner, false).await;
-}
-
-#[tokio::test]
-async fn state_row_navigation_then_canvas_delete_preserves_work_and_restores_exact_history() {
-    let mut project = Project::empty();
-    let machine = project
-        .add_element(Kind::StateMachine, Layer::Sa, "Modes", None)
-        .unwrap();
-    let region = project
-        .add_element(Kind::Region, Layer::Sa, "Main", Some(machine))
-        .unwrap();
-    let state = project
-        .add_element(Kind::State, Layer::Sa, "Running", Some(region))
-        .unwrap();
-    let work = project
-        .add_element(Kind::Function, Layer::Sa, "Monitor", None)
-        .unwrap();
-    let relation = project.relate(RelationKind::StateAction, "Entry", state, work);
-    let plan = crate::behavior::state_edit::create_view(&project, machine).unwrap();
-    project = execute_batch(&project, &[plan.command]).unwrap();
-    navigate_then_remove(project, relation, work, true).await;
-}

crates/oa-desktop/src/app/diagram_reveal.rs

@@ -86,8 +86,6 @@ impl App {
                 | Message::DiagramUsagesReady(_)
                 | Message::SourceSymbolsReady(_)
                 | Message::SourceRenameReady(_)
-                | Message::WorkDrag(allocation_drag::Event::KeyboardBoundary)
-                | Message::WorkDrag(allocation_drag::Event::Unfocused)
                 | Message::TopologyCanvas(behavior::topology::CanvasEvent::Viewport(..))
                 | Message::ScenarioCanvas(behavior::scenario::CanvasEvent::Viewport(..))
                 | Message::StateDiagram(behavior::state_edit::Event::Viewport(..))
@@ -112,11 +110,13 @@ impl App {
                     behavior::topology::CanvasEvent::Camera(..)
                         | behavior::topology::CanvasEvent::Zoom(..)
                         | behavior::topology::CanvasEvent::Scrolled(..)
+                        | behavior::topology::CanvasEvent::Focus(..)
                 )
                 | Message::ScenarioCanvas(
                     behavior::scenario::CanvasEvent::Camera(..)
                         | behavior::scenario::CanvasEvent::Zoom(..)
                         | behavior::scenario::CanvasEvent::Scrolled(..)
+                        | behavior::scenario::CanvasEvent::Focus(..)
                 )
                 | Message::StateDiagram(
                     behavior::state_edit::Event::Pan(..)

crates/oa-desktop/src/app/diagram_reveal/tests.rs

@@ -98,6 +98,7 @@ fn fixture(canvas: Canvas) -> (App, Usage) {
                     layer: Layer::Oa,
                     projection: ProjectionKind::StateMachine { machine },
                     nodes: BTreeMap::new(),
+                    layout: None,
                     routes: vec![],
                     view_options: Default::default(),
                 },

crates/oa-desktop/src/app/diagram_usages.rs

@@ -58,6 +58,10 @@ impl App {
                     let process = presentation.into_query_state();
                     let scenario = behavior::scenario::State::default();
                     usage::collect(&project, context.subject, &process, &scenario)
+                        .into_iter()
+                        .filter(|row| !matches!(row.surface, Surface::Saved(id)
+                            if project.diagrams.get(&id).is_some_and(|d| d.projection.scenario().is_some())))
+                        .collect()
                 })
                 .await
                 .map_err(|error| format!("Diagram lookup failed: {error}. Close and try again."));
@@ -144,31 +148,14 @@ impl App {
         }
     }
 
-    pub(super) fn diagram_usage_envelope(&self, event: &Event) -> bool {
-        match event {
-            Event::Open(context) => {
-                context.document == self.canvas_document
-                    && context.revision == self.document.revision()
-                    && self.project().contains(context.subject)
-            }
-            Event::Close(token)
-            | Event::Search(token, _)
-            | Event::Page(token, _)
-            | Event::Move(token, _)
-            | Event::Activate(token)
-            | Event::Destination(token, _)
-            | Event::Choose(token, _) => self
-                .diagram_usages
-                .as_ref()
-                .is_some_and(|panel| panel.token == *token),
-        }
-    }
-
     pub(super) fn diagram_usage_event(&mut self, event: Event) -> Task<Message> {
-        if !self.diagram_usage_envelope(&event) {
-            return Task::none();
-        }
         if let Event::Open(context) = event {
+            if context.document != self.canvas_document
+                || context.revision != self.document.revision()
+                || !self.project().contains(context.subject)
+            {
+                return Task::none();
+            }
             if !self.usage_navigation_available() {
                 self.status = "Apply or revert pending edits before opening diagram navigation. Your inputs are retained.".into();
                 return Task::none();
@@ -188,10 +175,22 @@ impl App {
                 iced::widget::operation::focus(filter_id),
             ]);
         }
-        let panel = self
-            .diagram_usages
-            .as_ref()
-            .expect("admitted chooser token");
+        let token = match &event {
+            Event::Open(_) => unreachable!(),
+            Event::Close(t)
+            | Event::Search(t, _)
+            | Event::Page(t, _)
+            | Event::Move(t, _)
+            | Event::Activate(t)
+            | Event::Destination(t, _)
+            | Event::Choose(t, _) => *t,
+        };
+        let Some(panel) = &self.diagram_usages else {
+            return Task::none();
+        };
+        if panel.token != token {
+            return Task::none();
+        }
         if matches!(event, Event::Close(_)) {
             self.diagram_usages = None;
             if self.page == Page::Text {
@@ -295,6 +294,9 @@ impl App {
         if !self.usage_navigation_available() {
             return false;
         }
+        if matches!(usage.surface, Surface::Saved(id) if self.saved_scenario_diagram(id)) {
+            return false;
+        }
         let previous_layer = self.layer;
         let p = self.document.project();
         let (selected, placement) = match &usage.target {
@@ -435,6 +437,7 @@ impl App {
         let current_surface = match surface {
             Surface::Saved(id) => {
                 self.active_diagram == Some(id)
+                    && !self.saved_scenario_diagram(id)
                     && matches!(self.page, Page::Diagram | Page::Behavior)
             }
             Surface::Process(owner) | Surface::Scenario(owner) => {

crates/oa-desktop/src/app/diagram_usages/tests.rs

@@ -1029,9 +1029,10 @@ fn repeated_preview_arrows_select_the_relation_and_highlight_the_exact_caller_li
         let camera = app.behavior.topology.camera_boundary();
         if call == calls[1]
             && let Some((previous_call, previous)) = &previous_camera
-            && *previous_call != call
         {
-            assert!(&camera != previous);
+            if *previous_call != call {
+                assert!(&camera != previous);
+            }
         }
         if let Some(epoch) = previous_epoch {
             assert_ne!(app.canvas_epoch, epoch);
@@ -1374,7 +1375,7 @@ fn whole_surface_camera_fits_huge_extent_while_target_camera_remains_readable()
     };
     let viewport = iced::Size::new(800., 500.);
     let (zoom, pan) = usage::camera_for(&Target::Whole, bounds, viewport);
-    assert!((0.0001..0.05).contains(&zoom));
+    assert!(zoom < 0.05 && zoom >= 0.0001);
     assert!(bounds.width * zoom <= viewport.width - 64. + 0.01);
     assert!(bounds.height * zoom <= viewport.height - 64. + 0.01);
     assert!((bounds.center_x() * zoom + pan.x - viewport.width / 2.).abs() < 0.01);

crates/oa-desktop/src/app/process_canvas.rs

@@ -74,7 +74,11 @@ impl App {
                 return Task::none();
             }
             match input {
-                Event::Traverse(_) | Event::ControlFocus(_) | Event::ToggleFocus | Event::Leave => {
+                Event::Focus
+                | Event::Traverse(_)
+                | Event::ControlFocus(_)
+                | Event::ToggleFocus
+                | Event::Leave => {
                     return canvas_workspace::focus_task(scope, input);
                 }
                 Event::CancelGesture => self.canvas_epoch = self.canvas_epoch.wrapping_add(1),
@@ -93,26 +97,6 @@ impl App {
             .topology
             .enter(context.document, context.owner);
         match event {
-            CanvasEvent::Remove(_, id) => {
-                if diagram_removal::enabled(self)
-                    && self.selected == id
-                    && self.behavior.topology.selecting()
-                {
-                    if self
-                        .behavior
-                        .topology
-                        .has_qualified_selection(self.project(), context.owner)
-                    {
-                        self.status = "Open the referenced definition to delete its contents, or select the outer reference to remove that use.".into();
-                    } else if self.behavior.topology.removal_target(
-                        self.project(),
-                        context.owner,
-                        id,
-                    ) {
-                        self.begin_model_delete(None);
-                    }
-                }
-            }
             CanvasEvent::ExpandQualified(_, endpoint) => {
                 let mut state = std::mem::take(&mut self.behavior.topology);
                 let changed = state.expand_context(self.project(), context.owner, endpoint);
@@ -159,6 +143,10 @@ impl App {
                     self.behavior.topology.select_context(resolved.address);
                 }
             }
+            CanvasEvent::Focus(_) => {
+                self.behavior.topology.focused = !self.behavior.topology.focused;
+                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+            }
             CanvasEvent::Select(_, id) => {
                 if !self.behavior.has_pending()
                     && crate::behavior::selected_behavior(self.project(), id) == Some(context.owner)
@@ -341,7 +329,7 @@ mod tests {
         }
     }
     #[test]
-    fn process_zoom_retains_rejected_draft_and_guards_selection() {
+    fn process_focus_retains_rejected_draft_and_guards_selection_until_panels_restore() {
         let (mut app, f) = setup();
         let original = app.document.snapshot();
         let initial = app.selected;
@@ -351,14 +339,9 @@ mod tests {
             &mut app,
             Event::Name("  unfinished contextual work  ".into()),
         );
-        let camera = app.behavior.topology.camera_boundary();
         let context = app.topology_context().unwrap();
-        let _ = app.update(Message::TopologyCanvas(CanvasEvent::Zoom(
-            context,
-            Some(0.75),
-        )));
-        assert_ne!(app.canvas_epoch, context.epoch);
-        assert!(app.behavior.topology.camera_boundary() != camera);
+        let _ = app.update(Message::TopologyCanvas(CanvasEvent::Focus(context)));
+        assert!(app.behavior.topology.focused);
         let raw = app.behavior.recovery_snapshot().unwrap();
         let context = app.topology_context().unwrap();
         let _ = app.update(Message::TopologyCanvas(CanvasEvent::Select(
@@ -370,8 +353,8 @@ mod tests {
         assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
         assert!(Arc::ptr_eq(&original, &app.document.snapshot()));
         let context = app.topology_context().unwrap();
-        let _ = app.update(Message::TopologyCanvas(CanvasEvent::Zoom(context, None)));
-        assert_ne!(app.canvas_epoch, context.epoch);
+        let _ = app.update(Message::TopologyCanvas(CanvasEvent::Focus(context)));
+        assert!(!app.behavior.topology.focused);
         assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
     }
     #[test]

crates/oa-desktop/src/app/source_rename/navigation_union_tests.rs

@@ -4,9 +4,6 @@ use super::*;
 use crate::diagram_usage::{self as usage, Surface, Target as UsageTarget, Usage};
 use iced::{Size, Vector};
 
-#[path = "navigation_union_tests/palette_union.rs"]
-mod palette_union;
-
 fn model_id(number: u8) -> Id {
     Id::parse_str(&format!("00000000-0000-0000-0000-{number:012}")).unwrap()
 }

crates/oa-desktop/src/app/source_rename/navigation_union_tests/palette_union.rs

@@ -1,166 +0,0 @@
-//! Interactions absent from the independently published navigation branch.
-use super::*;
-
-fn assert_stale_navigation_message(message: Message) {
-    let mut app = navigation_fixture();
-    let found = navigate(&mut app);
-    let destination = navigation(&app);
-    let allocation_epoch = app.allocation_drag.epoch;
-    let accepted = app.document.snapshot();
-    let status = app.status.clone();
-    send(&mut app, message);
-    assert_eq!(navigation(&app), destination);
-    assert_eq!(app.allocation_drag.epoch, allocation_epoch);
-    assert_eq!(app.status, status);
-    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-    assert_eq!(app.source_workspace.bundle(), accepted.bundle);
-    first_measurement(&mut app, &found);
-}
-
-#[test]
-fn captured_old_source_query_and_find_close_preserve_the_new_destination() {
-    let mut previous = navigation_fixture();
-    let query = previous.source_symbol_message(nav::SymbolEvent::Query(query::Action::Definition));
-    send(
-        &mut previous,
-        Message::SourceNavigation(nav::Event::Open(false)),
-    );
-    assert!(previous.source_navigation.open);
-    let close = previous.source_find_close_message();
-    assert!(previous.source_input_envelope(&close));
-    assert_stale_navigation_message(query);
-    assert_stale_navigation_message(close);
-}
-
-#[test]
-fn current_source_query_and_checked_find_close_remain_live() {
-    let mut app = navigation_fixture();
-    let before = app.document.snapshot();
-    send(&mut app, Message::SourceNavigation(nav::Event::Open(false)));
-    assert!(app.source_navigation.open);
-    let close = app.source_find_close_message();
-    send(&mut app, close.clone());
-    assert!(!app.source_navigation.open);
-    let epoch = app.allocation_drag.epoch;
-    send(&mut app, close);
-    assert_eq!(app.allocation_drag.epoch, epoch, "retired close is inert");
-    let message = app.source_symbol_message(nav::SymbolEvent::Query(query::Action::Definition));
-    send(&mut app, message);
-    assert!(app.source_symbols.in_flight.is_some());
-    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
-    assert_eq!(app.source_workspace.bundle(), before.bundle);
-}
-
-#[test]
-fn captured_old_chooser_context_and_every_token_variant_are_inert() {
-    let mut previous = navigation_fixture();
-    let open = previous.diagram_usage_message(model_id(2));
-    send(&mut previous, open.clone());
-    let (token, found) = finish_lookup(&mut previous);
-    assert_stale_navigation_message(open);
-    for event in [
-        usage::Event::Close(token),
-        usage::Event::Search(token, "old filter".into()),
-        usage::Event::Page(token, 1),
-        usage::Event::Move(token, 1),
-        usage::Event::Activate(token),
-        usage::Event::Destination(token, Some(found.surface)),
-        usage::Event::Choose(token, found),
-    ] {
-        assert_stale_navigation_message(Message::DiagramUsage(event));
-    }
-}
-
-#[test]
-fn current_chooser_open_and_close_keep_their_boundary_and_worker_semantics() {
-    let mut app = navigation_fixture();
-    navigate(&mut app);
-    let epoch = app.allocation_drag.epoch;
-    let message = app.diagram_usage_message(model_id(2));
-    send(&mut app, message);
-    assert!(app.diagram_usages.is_some());
-    assert!(app.pending_diagram_reveal.is_none());
-    assert!(app.diagram_navigation_focus.is_none());
-    assert!(app.allocation_drag.epoch > epoch);
-    let completion = diagram_completion(&app);
-    let token = completion.token;
-    send(&mut app, Message::DiagramUsage(usage::Event::Close(token)));
-    assert!(app.diagram_usages.is_none());
-    assert_eq!(app.diagram_lookup_in_flight, Some(token));
-    send(&mut app, Message::DiagramUsagesReady(completion));
-    assert!(app.diagram_lookup_in_flight.is_none());
-    assert!(
-        app.diagram_usages.is_none(),
-        "completion does not reopen a closed chooser"
-    );
-}
-
-#[test]
-fn allocation_keyboard_notification_preserves_navigation_and_first_measurement() {
-    let mut app = navigation_fixture();
-    let before = app.document.snapshot();
-    let notify = || Message::WorkDrag(crate::app::allocation_drag::Event::KeyboardBoundary);
-    send(&mut app, notify());
-    let found = navigate(&mut app);
-    let destination = navigation(&app);
-    let allocation_epoch = app.allocation_drag.epoch;
-    send(&mut app, notify());
-    assert_eq!(navigation(&app), destination);
-    assert_eq!(app.allocation_drag.epoch, allocation_epoch);
-    first_measurement(&mut app, &found);
-    send(&mut app, notify());
-    assert!(app.diagram_focus(found.surface).is_some());
-    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
-    assert_eq!(app.source_workspace.bundle(), before.bundle);
-}
-
-#[test]
-fn stale_rename_begin_cannot_retire_allocation_epoch_or_new_navigation() {
-    let mut app = navigation_fixture();
-    let captured = app.source_rename_begin();
-    let found = navigate(&mut app);
-    let destination = navigation(&app);
-    let allocation_epoch = app.allocation_drag.epoch;
-    let accepted = app.document.snapshot();
-    send(&mut app, Message::SourceRename(Event::Begin(captured)));
-    assert_eq!(navigation(&app), destination);
-    assert_eq!(app.allocation_drag.epoch, allocation_epoch);
-    assert!(!app.source_rename.open());
-    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-    first_measurement(&mut app, &found);
-}
-
-#[test]
-fn captured_behavior_toolbar_cannot_retire_a_new_documents_navigation() {
-    let mut project = Project::empty();
-    let scenario = project
-        .add_element(Kind::Scenario, Layer::Oa, "Prior scenario", None)
-        .unwrap();
-    let mut previous = App::with_project(project);
-    previous.page = Page::Behavior;
-    previous.behavior.active_owner = Some(scenario);
-    previous
-        .behavior
-        .scenario
-        .enter(previous.canvas_document, scenario);
-    let scope = behavior::canvas_workspace::Scope::input_owner(&previous).unwrap();
-    let captured = behavior::canvas_workspace::intent(
-        scope,
-        "Fit",
-        Message::ScenarioCanvas(behavior::scenario::CanvasEvent::Zoom(
-            previous.scenario_context().unwrap(),
-            None,
-        )),
-    );
-
-    let mut app = navigation_fixture();
-    let found = navigate(&mut app);
-    let destination = navigation(&app);
-    let allocation_epoch = app.allocation_drag.epoch;
-    let accepted = app.document.snapshot();
-    send(&mut app, captured);
-    assert_eq!(navigation(&app), destination);
-    assert_eq!(app.allocation_drag.epoch, allocation_epoch);
-    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-    first_measurement(&mut app, &found);
-}

crates/oa-desktop/src/app/source_rename/tests.rs

@@ -804,25 +804,13 @@ fn captured_escape(app: &App) -> Vec<Message> {
         .unwrap();
     let _entered = runtime.enter();
     let mut messages = Vec::new();
-    let mut keyboard_boundaries = 0;
     for recipe in subscription::into_recipes(app.subscription()) {
         let mut output = recipe.stream(Box::pin(stream::iter([event.clone()])));
         let mut context = PollContext::from_waker(noop_waker_ref());
         while let Poll::Ready(Some(message)) = output.poll_next_unpin(&mut context) {
-            if matches!(
-                &message,
-                Message::WorkDrag(crate::app::allocation_drag::Event::KeyboardBoundary)
-            ) {
-                keyboard_boundaries += 1;
-            } else {
-                messages.push(message);
-            }
+            messages.push(message);
         }
     }
-    assert_eq!(
-        keyboard_boundaries, 1,
-        "each key has exactly one passive allocation notification"
-    );
     messages
 }
 
@@ -855,13 +843,11 @@ fn actual_captured_escape_closes_only_its_priority_owner_and_retains_worker() {
             let before = evidence(&app);
             let mut messages = captured_escape(&app);
             assert_eq!(messages.len(), 1);
-            assert!(matches!(messages[0], Message::Escape));
             send(&mut app, messages.remove(0));
             if other_modal != 0 {
                 assert!(app.source_rename.open(), "existing modal has priority");
                 let mut messages = captured_escape(&app);
                 assert_eq!(messages.len(), 1);
-                assert!(matches!(messages[0], Message::Escape));
                 send(&mut app, messages.remove(0));
             }
             assert!(!app.source_rename.open());

crates/oa-desktop/src/app/source_symbols.rs

@@ -31,24 +31,6 @@ fn admission_notice(error: query::AdmissionError) -> String {
 }
 
 impl App {
-    pub(super) fn source_input_envelope(&self, message: &Message) -> bool {
-        match message {
-            Message::SourceSymbols(context, _) => {
-                context.session == self.source_workspace.session()
-                    && context.path == self.source_workspace.active
-            }
-            Message::SourceFindClose(context, instance) => {
-                context == &self.source_symbol_context()
-                    && *instance == self.source_find_instance
-                    && self.source_navigation.open
-                    && self.source_navigation_available()
-            }
-            // The checked Find-close envelope is mapped inside update_inner.
-            Message::SourceNavigation(nav::Event::Close) => false,
-            _ => true,
-        }
-    }
-
     pub fn source_symbol_context(&self) -> nav::SymbolContext {
         nav::SymbolContext {
             session: self.source_workspace.session(),
@@ -165,10 +147,6 @@ impl App {
             && nav::exact_cursor(self.source_workspace.text(), cursor)
         {
             self.queue_source_reveal(cursor, false);
-            // This ticket restores focus to the live editor, not a saved cursor.
-            // Iced's Cursor omits Word/Line selection kind; moving back to that
-            // lossy value would collapse an actual word/line selection.
-            self.source_jump = None;
         }
     }
 
@@ -198,14 +176,13 @@ impl App {
             if self.source_select_line && cursor.selection.is_none() {
                 self.source_editor.perform(text_editor::Action::SelectLine);
             }
+            return nav::interaction::guarded_focus(
+                self.source_editor_id(),
+                self.source_symbols.raw_interaction.clone(),
+                raw_interaction,
+            );
         }
-        // A valid ticket with no jump is focus-only. All intentional navigation
-        // still takes the cursor branch above, including explicit line selection.
-        nav::interaction::guarded_focus(
-            self.source_editor_id(),
-            self.source_symbols.raw_interaction.clone(),
-            raw_interaction,
-        )
+        Task::none()
     }
 
     pub(super) fn source_symbol_event(&mut self, event: nav::SymbolEvent) -> Task<Message> {
@@ -466,9 +443,6 @@ impl App {
                 Some("That source location is no longer available. Run navigation again.".into());
             return;
         }
-        // The destination is admitted. Capture effective Word/Line ranges only
-        // now, when this editor is actually about to leave its current position.
-        let departure = nav::selection::capture(&mut self.source_editor);
         if let Some(buffer) = self
             .source_workspace
             .files
@@ -478,7 +452,7 @@ impl App {
                 session: self.source_workspace.session(),
                 path: self.source_workspace.active.clone(),
                 generation: buffer.generation(),
-                cursor: departure,
+                cursor: self.source_editor.cursor(),
             };
             self.source_symbols
                 .back
@@ -488,7 +462,8 @@ impl App {
             }
             self.source_symbols.back.push(origin);
         }
-        self.source_workspace.switch(path, departure);
+        self.source_workspace
+            .switch(path, self.source_editor.cursor());
         self.show_source_file(false);
         self.queue_source_reveal(cursor, false);
     }
@@ -503,7 +478,7 @@ impl App {
                 return;
             };
             let unchanged = origin.generation == buffer.generation();
-            let mut cursor = if unchanged {
+            let cursor = if unchanged {
                 origin.cursor
             } else if origin.path == self.source_workspace.active {
                 self.source_editor.cursor()
@@ -517,11 +492,8 @@ impl App {
                 );
                 return;
             }
-            let departure = nav::selection::capture(&mut self.source_editor);
-            if !unchanged && origin.path == self.source_workspace.active {
-                cursor = departure;
-            }
-            self.source_workspace.switch(&origin.path, departure);
+            self.source_workspace
+                .switch(&origin.path, self.source_editor.cursor());
             self.show_source_file(false);
             self.queue_source_reveal(cursor, false);
             self.source_symbols.notice =
@@ -534,6 +506,3 @@ impl App {
 
 #[cfg(test)]
 mod tests;
-
-#[cfg(all(test, debug_assertions))]
-mod focus_selection_tests;

crates/oa-desktop/src/app/source_symbols/focus_selection_tests.rs

@@ -1,481 +0,0 @@
-//! The mounted CPU renderer and App use the same cosmic-text editor engine, but
-//! Iced's Content is parameterized by renderer and cannot be shared between them.
-//! We hit-test the initial click in the laid-out CPU widget, seed that raw caret
-//! in App, and relay the real subsequent SelectWord/SelectLine and editing actions.
-//! App's own Content is never replaced or cursor-normalized after selection. This
-//! tests the actual controller/content boundary without a window or GPU; native
-//! replay remains the check of the complete production renderer/layout path.
-use crate::app::Page;
-use crate::app::{App, Message};
-use crate::document::Document;
-use crate::source_navigation as nav;
-use crate::source_workspace::{LIMITS, Workspace};
-use crate::views::source_tests::FontLayout;
-use iced::advanced::{Layout, Shell, layout, widget as core_widget};
-use iced::futures::StreamExt;
-use iced::keyboard::{self, Key, Modifiers};
-use iced::widget::{button, container, row, text_editor, text_input};
-use iced::{Element, Event, Font, Size, mouse};
-use iced::{Point, Task, widget};
-use oa_core::{Project, source_project::SourceBundle};
-use std::{collections::BTreeMap, sync::Arc, sync::atomic::Ordering};
-
-const SOURCE: &str = concat!(
-    "// oa_contact tail\r\n",
-    "arcadia 7;\r\n",
-    "project model \"Selection\" id \"9e8f0000-0000-4000-8000-000000000091\" {}\r\n",
-);
-const HOST: Size = Size::new(620., 260.);
-
-fn fixture() -> App {
-    let bundle = SourceBundle {
-        entry: "project.arcadia".into(),
-        files: BTreeMap::from([("project.arcadia".into(), SOURCE.into())]),
-    };
-    let mut app = App::with_project(Project::empty());
-    app.document = Document::from_bundle(bundle, LIMITS).unwrap();
-    app.source_workspace = Workspace::new(app.document.bundle(), true);
-    app.selected = app.project().id;
-    app.refresh_draft();
-    app.page = Page::Text;
-    app.show_source_file(false);
-    app
-}
-
-fn ui<'a>(
-    app: &App,
-    content: &'a text_editor::Content<FontLayout>,
-) -> Element<'a, Message, iced::Theme, FontLayout> {
-    let find: Element<'a, Message, iced::Theme, FontLayout> = if app.source_navigation.open {
-        row![
-            text_input("Find", "")
-                .id("source-find")
-                .on_input(|s| Message::SourceNavigation(nav::Event::Query(s))),
-            container(button("Close").on_press(app.source_find_close_message()))
-                .id("selection-find-close"),
-        ]
-        .into()
-    } else {
-        widget::Space::new().into()
-    };
-    // Column::push drops zero-height children. Keep both paths mounted even
-    // while Find is hidden, as the production retained-slot layout does.
-    widget::Column::from_vec(vec![
-        container(find)
-            .height(if app.source_navigation.open { 32. } else { 0. })
-            .into(),
-        widget::text_editor(content)
-            .id(app.source_editor_id())
-            .font(Font::MONOSPACE)
-            .size(14)
-            .padding(16)
-            .height(iced::Fill)
-            .on_action(Message::SourceEdit)
-            .into(),
-    ])
-    .width(iced::Fill)
-    .height(iced::Fill)
-    .into()
-}
-
-struct Mounted {
-    content: text_editor::Content<FontLayout>,
-    tree: core_widget::Tree,
-}
-
-// Operations follow widget-provided traversal instead of assuming a fixed
-// relationship between layout nodes, transparent containers and state trees.
-struct Inspection {
-    editor: core_widget::Id,
-    focused: Option<bool>,
-    close_bounds: Option<iced::Rectangle>,
-}
-
-impl core_widget::Operation for Inspection {
-    fn traverse(&mut self, operate: &mut dyn FnMut(&mut dyn core_widget::Operation)) {
-        operate(self);
-    }
-
-    fn focusable(
-        &mut self,
-        id: Option<&core_widget::Id>,
-        _: iced::Rectangle,
-        state: &mut dyn core_widget::operation::Focusable,
-    ) {
-        if id == Some(&self.editor) {
-            assert!(
-                self.focused.replace(state.is_focused()).is_none(),
-                "duplicate editor ID"
-            );
-        }
-    }
-
-    fn container(&mut self, id: Option<&core_widget::Id>, bounds: iced::Rectangle) {
-        if id == Some(&core_widget::Id::new("selection-find-close")) {
-            assert!(
-                self.close_bounds.replace(bounds).is_none(),
-                "duplicate Close target ID"
-            );
-        }
-    }
-}
-
-impl Mounted {
-    fn new() -> Self {
-        Self {
-            content: text_editor::Content::with_text(SOURCE),
-            tree: core_widget::Tree::empty(),
-        }
-    }
-
-    fn events(&mut self, app: &App, events: &[(Event, mouse::Cursor)]) -> Vec<Message> {
-        let mut view = ui(app, &self.content);
-        self.tree.diff(view.as_widget());
-        let node = view.as_widget_mut().layout(
-            &mut self.tree,
-            &FontLayout,
-            &layout::Limits::new(Size::ZERO, HOST),
-        );
-        let mut messages = Vec::new();
-        for (event, cursor) in events {
-            let mut shell = Shell::new(&mut messages);
-            view.as_widget_mut().update(
-                &mut self.tree,
-                event,
-                Layout::new(&node),
-                *cursor,
-                &FontLayout,
-                &mut iced::advanced::clipboard::Null,
-                &mut shell,
-                &iced::Rectangle::with_size(HOST),
-            );
-            if !matches!(event, Event::Mouse(mouse::Event::ButtonReleased(_))) {
-                assert!(
-                    shell.is_event_captured(),
-                    "mounted input must be handled: {event:?}"
-                );
-            }
-        }
-        messages
-    }
-
-    fn operation(&mut self, app: &App, mut op: Box<dyn core_widget::Operation>) {
-        let mut view = ui(app, &self.content);
-        self.tree.diff(view.as_widget());
-        let node = view.as_widget_mut().layout(
-            &mut self.tree,
-            &FontLayout,
-            &layout::Limits::new(Size::ZERO, HOST),
-        );
-        loop {
-            view.as_widget_mut().operate(
-                &mut self.tree,
-                Layout::new(&node),
-                &FontLayout,
-                op.as_mut(),
-            );
-            match op.finish() {
-                core_widget::operation::Outcome::Chain(next) => op = next,
-                core_widget::operation::Outcome::None => break,
-                core_widget::operation::Outcome::Some(()) => panic!("focus does not emit messages"),
-            }
-        }
-    }
-
-    async fn task(&mut self, app: &App, task: Task<Message>) {
-        if let Some(mut actions) = iced_runtime::task::into_stream(task) {
-            while let Some(action) = actions.next().await {
-                let iced_runtime::Action::Widget(op) = action else {
-                    panic!("expected a widget operation")
-                };
-                self.operation(app, op);
-            }
-        }
-    }
-
-    fn inspect(&mut self, app: &App) -> Inspection {
-        let mut inspection = Inspection {
-            editor: app.source_editor_id(),
-            focused: None,
-            close_bounds: None,
-        };
-        let mut view = ui(app, &self.content);
-        self.tree.diff(view.as_widget());
-        let node = view.as_widget_mut().layout(
-            &mut self.tree,
-            &FontLayout,
-            &layout::Limits::new(Size::ZERO, HOST),
-        );
-        view.as_widget_mut().operate(
-            &mut self.tree,
-            Layout::new(&node),
-            &FontLayout,
-            &mut inspection,
-        );
-        inspection
-    }
-
-    fn editor_focused(&mut self, app: &App) -> bool {
-        self.inspect(app)
-            .focused
-            .expect("exactly one editor with the requested ID")
-    }
-
-    fn close_message(&mut self, app: &App, escape: bool) -> Message {
-        if escape {
-            let event = Event::Keyboard(keyboard::Event::KeyPressed {
-                key: Key::Named(keyboard::key::Named::Escape),
-                modified_key: Key::Named(keyboard::key::Named::Escape),
-                physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-                location: keyboard::Location::Standard,
-                modifiers: Modifiers::empty(),
-                text: None,
-                repeat: false,
-            });
-            assert!(
-                self.events(app, &[(event, mouse::Cursor::Unavailable)])
-                    .is_empty()
-            );
-            // The existing subscription tests cover the captured-Escape bridge.
-            // Deliver its App message after this actual input captured the key.
-            Message::Escape
-        } else {
-            let center = self
-                .inspect(app)
-                .close_bounds
-                .expect("the mounted Find Close target exists")
-                .center();
-            let cursor = mouse::Cursor::Available(center);
-            let mut messages = self.events(
-                app,
-                &[
-                    (
-                        Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                        cursor,
-                    ),
-                    (
-                        Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
-                        cursor,
-                    ),
-                ],
-            );
-            assert_eq!(messages.len(), 1);
-            let close = messages.remove(0);
-            assert!(matches!(close, Message::SourceFindClose(..)));
-            close
-        }
-    }
-
-    fn select(&mut self, app: &mut App, line: bool) {
-        // One mounted update batch avoids delays between Iced's consecutive-click
-        // timestamps; content actions are applied in their emitted order below.
-        let at = mouse::Cursor::Available(Point::new(65., 25.));
-        let events = (0..if line { 3 } else { 2 })
-            .flat_map(|_| {
-                [
-                    (
-                        Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                        at,
-                    ),
-                    (
-                        Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
-                        at,
-                    ),
-                ]
-            })
-            .collect::<Vec<_>>();
-        let messages = self.events(app, &events);
-        assert_eq!(messages.len(), if line { 3 } else { 2 });
-        for (index, message) in messages.into_iter().enumerate() {
-            let Message::SourceEdit(action) = message else {
-                panic!("editor action")
-            };
-            if index == 0 {
-                assert!(matches!(action, text_editor::Action::Click(_)));
-                self.content.perform(action);
-                let caret = self.content.cursor();
-                assert_eq!(caret.position.line, 0);
-                assert!(
-                    (4..13).contains(&caret.position.column),
-                    "click must hit inside oa_contact: {caret:?}"
-                );
-                // App's GPU-typed Content has no public layout API. Copy only the
-                // initial hit-tested caret before any Word/Line selection exists.
-                app.source_editor.move_to(caret);
-            } else {
-                assert_eq!(
-                    action,
-                    if index == 1 {
-                        text_editor::Action::SelectWord
-                    } else {
-                        text_editor::Action::SelectLine
-                    }
-                );
-                self.content.perform(action.clone());
-                let _ = app.update(Message::SourceEdit(action));
-            }
-        }
-        assert_eq!(
-            self.content.selection().as_deref(),
-            Some(if line {
-                "// oa_contact tail"
-            } else {
-                "oa_contact"
-            })
-        );
-        assert_eq!(app.source_editor.selection(), self.content.selection());
-        assert!(self.editor_focused(app));
-    }
-
-    fn type_replacement(&mut self, app: &mut App) {
-        let event = Event::Keyboard(keyboard::Event::KeyPressed {
-            key: Key::Character("x".into()),
-            modified_key: Key::Character("x".into()),
-            physical_key: keyboard::key::Physical::Code(keyboard::key::Code::KeyX),
-            location: keyboard::Location::Standard,
-            modifiers: Modifiers::empty(),
-            text: Some("x".into()),
-            repeat: false,
-        });
-        let messages = self.events(app, &[(event, mouse::Cursor::Unavailable)]);
-        assert_eq!(messages.len(), 1);
-        let Message::SourceEdit(action) = messages.into_iter().next().unwrap() else {
-            panic!("typed edit")
-        };
-        assert_eq!(
-            action,
-            text_editor::Action::Edit(text_editor::Edit::Insert('x'))
-        );
-        self.content.perform(action.clone());
-        let _ = app.update(Message::SourceEdit(action));
-    }
-}
-
-#[tokio::test]
-async fn word_and_line_selection_survive_find_close_and_escape_then_replace_exact_bytes() {
-    for line in [false, true] {
-        for escape in [false, true] {
-            let mut app = fixture();
-            let accepted = app.document.snapshot();
-            let mut mounted = Mounted::new();
-            mounted.select(&mut app, line);
-            let selected = app.source_editor.selection();
-            let cursor = app.source_editor.cursor();
-            // Word/Line selection has coincident raw endpoints. Merely checking
-            // cursor equality after a move_to roundtrip cannot detect the defect.
-            assert_eq!(cursor.selection, Some(cursor.position));
-            let task = app.update(Message::SourceNavigation(nav::Event::Open(false)));
-            mounted.task(&app, task).await;
-            assert!(!mounted.editor_focused(&app));
-            assert_eq!(app.source_editor.selection(), selected);
-            let close = mounted.close_message(&app, escape);
-            let _ = app.update(close);
-            let ticket = app
-                .source_reveal_ticket()
-                .expect("guarded restoration ticket");
-            let task = app.update(Message::SourceViewport(Some(ticket)));
-            mounted.task(&app, task).await;
-            assert!(mounted.editor_focused(&app));
-            assert_eq!(app.source_editor.cursor(), cursor);
-            assert_eq!(
-                app.source_editor.selection(),
-                selected,
-                "selected bytes must survive focus restoration"
-            );
-            assert_eq!(app.source_editor.text(), SOURCE);
-            mounted.type_replacement(&mut app);
-            let expected = SOURCE.replacen(selected.as_deref().unwrap(), "x", 1);
-            assert_eq!(app.source_editor.text(), expected);
-            assert_eq!(app.source_workspace.text(), expected);
-            assert_eq!(mounted.content.text(), expected);
-            assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-            assert!(!app.document.can_undo() && !app.document.can_redo());
-        }
-    }
-}
-
-#[test]
-fn mounted_direct_typing_control_and_old_cursor_roundtrip_discriminate_selection_loss() {
-    for line in [false, true] {
-        for old_roundtrip in [false, true] {
-            let mut app = fixture();
-            let mut mounted = Mounted::new();
-            mounted.select(&mut app, line);
-            let selected = app.source_editor.selection().unwrap();
-            let interior = app.source_editor.cursor();
-            if old_roundtrip {
-                app.source_editor.move_to(interior);
-                assert_ne!(
-                    app.source_editor.selection().as_deref(),
-                    Some(selected.as_str())
-                );
-            }
-            mounted.type_replacement(&mut app);
-            let expected = if old_roundtrip {
-                let mut text = SOURCE.to_owned();
-                text.insert(interior.position.column, 'x');
-                text
-            } else {
-                SOURCE.replacen(&selected, "x", 1)
-            };
-            assert_eq!(app.source_editor.text(), expected);
-            assert_eq!(app.source_workspace.text(), expected);
-            assert_eq!(mounted.content.text(), SOURCE.replacen(&selected, "x", 1));
-        }
-    }
-}
-
-#[tokio::test]
-async fn stale_focus_ticket_and_later_raw_input_cannot_steal_focus_or_change_selected_bytes() {
-    for later_raw_input in [false, true] {
-        let mut app = fixture();
-        let mut mounted = Mounted::new();
-        mounted.select(&mut app, false);
-        let selected = app.source_editor.selection();
-        let open = app.update(Message::SourceNavigation(nav::Event::Open(false)));
-        mounted.task(&app, open).await;
-        let close = app.source_find_close_message();
-        let _ = app.update(close);
-        let ticket = app.source_reveal_ticket().unwrap();
-        let focus = if later_raw_input {
-            app.update(Message::SourceViewport(Some(ticket)))
-        } else {
-            Task::none()
-        };
-        let reopen = app.update(Message::SourceNavigation(nav::Event::Open(false)));
-        mounted.task(&app, reopen).await;
-        if later_raw_input {
-            app.source_symbols
-                .raw_interaction
-                .fetch_add(1, Ordering::SeqCst);
-            mounted.task(&app, focus).await;
-        } else {
-            let stale = app.update(Message::SourceViewport(Some(ticket)));
-            mounted.task(&app, stale).await;
-        }
-        assert!(app.source_navigation.open);
-        assert!(!mounted.editor_focused(&app));
-        assert_eq!(app.source_editor.selection(), selected);
-        assert_eq!(app.source_editor.text(), SOURCE);
-    }
-}
-
-#[tokio::test]
-async fn explicit_cursor_navigation_still_moves_and_selects_requested_line() {
-    let mut app = fixture();
-    let mut mounted = Mounted::new();
-    mounted.select(&mut app, false);
-    let target = text_editor::Cursor {
-        position: text_editor::Position { line: 1, column: 3 },
-        selection: None,
-    };
-    // Clear the previous semantic selection as actual show_source_file does when
-    // moving to another source buffer, then exercise intentional navigation.
-    app.show_source_file(false);
-    app.queue_source_reveal(target, true);
-    let ticket = app.source_reveal_ticket().unwrap();
-    let task = app.update(Message::SourceViewport(Some(ticket)));
-    mounted.task(&app, task).await;
-    assert_eq!(app.source_editor.cursor().position, target.position);
-    assert_eq!(app.source_editor.selection().as_deref(), Some("arcadia 7;"));
-}

crates/oa-desktop/src/app/source_symbols/tests.rs

@@ -4,8 +4,6 @@ use oa_core::source_project::SourceBundle;
 use std::collections::BTreeMap;
 use std::time::Instant;
 
-mod departure_selection;
-
 const DEFINITIONS: &str = "defs/活動.arcadia";
 const USES: &str = "uses.arcadia";
 
@@ -432,17 +430,8 @@ fn escape_dismisses_results_and_cancels_busy_navigation_without_changing_sources
             send(&mut app, Message::SourceSymbolsReady(ready.clone()));
             assert!(app.source_symbols.results.is_some());
         }
-        let results = app.source_symbols.results.clone();
         app.source_navigation.open = true;
         send(&mut app, Message::Escape);
-        assert!(app.source_symbols.open && !app.source_navigation.open);
-        match (&results, &app.source_symbols.results) {
-            (Some(before), Some(after)) => assert!(Arc::ptr_eq(before, after)),
-            (None, None) => {}
-            _ => panic!("Find Escape must retain underlying results"),
-        }
-        assert!(app.source_symbols.request.is_none());
-        send(&mut app, Message::Escape);
         assert!(!app.source_symbols.open && !app.source_navigation.open);
         assert!(app.source_symbols.results.is_none());
         assert!(app.source_symbols.notice.is_none());
@@ -787,8 +776,7 @@ async fn find_close_releases_removed_input_and_guarded_focus_respects_later_inpu
 
 /// Feed the real App subscription recipes the status produced by a mounted
 /// TextInput. Poll only immediately available output: no timer wait, worker,
-/// file dialog or App task is executed by this helper. Require the canvas keyboard
-/// notification separately, then return every command routed to an Escape owner.
+/// file dialog or App task is executed by this helper.
 fn captured_input_subscription_messages(app: &App) -> Vec<Message> {
     use iced::advanced::{Layout, Shell, layout, subscription, widget};
     use iced::futures::{StreamExt, stream, task::noop_waker_ref};
@@ -848,7 +836,6 @@ fn captured_input_subscription_messages(app: &App) -> Vec<Message> {
         .unwrap();
     let _entered = runtime.enter();
     let mut messages = Vec::new();
-    let mut keyboard_boundaries = 0;
     for recipe in subscription::into_recipes(app.subscription()) {
         let mut output = recipe.stream(Box::pin(stream::iter([event.clone()])));
         let mut context = Context::from_waker(noop_waker_ref());
@@ -857,20 +844,9 @@ fn captured_input_subscription_messages(app: &App) -> Vec<Message> {
                 !matches!(message, Message::CheckpointTick),
                 "timer must remain pending"
             );
-            if matches!(
-                &message,
-                Message::WorkDrag(crate::app::allocation_drag::Event::KeyboardBoundary)
-            ) {
-                keyboard_boundaries += 1;
-            } else {
-                messages.push(message);
-            }
+            messages.push(message);
         }
     }
-    assert_eq!(
-        keyboard_boundaries, 1,
-        "each key has exactly one passive allocation notification"
-    );
     messages
 }
 
@@ -919,16 +895,6 @@ fn captured_find_and_modal_escape_use_one_actual_subscription_and_preserve_pendi
                 assert!(matches!(messages[0], Message::Escape));
                 send(&mut app, messages.remove(0));
             }
-            assert!(app.source_symbols.open && !app.source_navigation.open);
-            match (&results, &app.source_symbols.results) {
-                (Some(before), Some(after)) => assert!(Arc::ptr_eq(before, after)),
-                (None, None) => {}
-                _ => panic!("Find Escape must retain underlying results"),
-            }
-            let mut messages = captured_input_subscription_messages(&app);
-            assert_eq!(messages.len(), 1, "references still own the next Escape");
-            assert!(matches!(messages[0], Message::Escape));
-            send(&mut app, messages.remove(0));
             assert!(!app.source_symbols.open && !app.source_navigation.open);
             assert!(app.source_symbols.results.is_none() && app.source_symbols.request.is_none());
             if pending {

crates/oa-desktop/src/app/source_symbols/tests/departure_selection.rs

@@ -1,279 +0,0 @@
-use super::*;
-
-#[test]
-fn scoped_escape_retains_references_then_closes_them_without_losing_effective_selection() {
-    for line in [false, true] {
-        let mut app = fixture();
-        let selected = select_effective_pump(&mut app, line);
-        let results = finish(&mut app, query::Action::References);
-        app.source_symbols.notice = Some("Keep this reference notice".into());
-        send(&mut app, Message::SourceNavigation(nav::Event::Open(false)));
-        app.source_navigation.query = "retain 雪".into();
-        let cursor = app.source_editor.cursor();
-        let accepted = app.document.snapshot();
-        let raw = app.source_workspace.bundle();
-        let revision = app.source_workspace.revision();
-
-        let mut messages = captured_input_subscription_messages(&app);
-        assert_eq!(messages.len(), 1);
-        assert!(matches!(messages[0], Message::Escape));
-        send(&mut app, messages.remove(0));
-        assert!(!app.source_navigation.open);
-        assert_eq!(app.source_navigation.query, "retain 雪");
-        assert!(app.source_symbols.open);
-        assert!(Arc::ptr_eq(
-            app.source_symbols.results.as_ref().unwrap(),
-            &results
-        ));
-        assert_eq!(
-            app.source_symbols.notice.as_deref(),
-            Some("Keep this reference notice")
-        );
-        reveal(&mut app);
-        assert_eq!(app.source_editor.cursor(), cursor);
-        assert_eq!(
-            app.source_editor.selection().as_deref(),
-            Some(selected.as_str())
-        );
-
-        let mut messages = captured_input_subscription_messages(&app);
-        assert_eq!(messages.len(), 1);
-        assert!(matches!(messages[0], Message::Escape));
-        send(&mut app, messages.remove(0));
-        assert!(!app.source_symbols.open);
-        assert!(app.source_symbols.results.is_none() && app.source_symbols.notice.is_none());
-        reveal(&mut app);
-        assert_eq!(app.source_editor.cursor(), cursor);
-        assert_eq!(
-            app.source_editor.selection().as_deref(),
-            Some(selected.as_str())
-        );
-        assert!(captured_input_subscription_messages(&app).is_empty());
-        assert_eq!(app.source_workspace.bundle(), raw);
-        assert_eq!(app.source_workspace.revision(), revision);
-        assert!(app.source_symbols.back.is_empty());
-        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-        assert!(!app.document.can_undo() && !app.document.can_redo());
-
-        let expected = if line {
-            raw.files[USES].replacen(&selected, "x", 1)
-        } else {
-            raw.files[USES].replacen("source @pump", "source @x", 1)
-        };
-        send(
-            &mut app,
-            Message::SourceEdit(text_editor::Action::Edit(text_editor::Edit::Insert('x'))),
-        );
-        assert_eq!(app.source_editor.text(), expected);
-        assert_eq!(app.source_workspace.text(), expected);
-        send(&mut app, Message::SourceUndo);
-        assert_eq!(app.source_workspace.bundle(), raw);
-        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-    }
-}
-
-fn select_effective_pump(app: &mut App, line: bool) -> String {
-    let source = app.source_workspace.text();
-    let offset = source.find("source @pump").unwrap() + "source @pu".len();
-    app.source_editor.move_to(text_editor::Cursor {
-        position: position(source, offset),
-        selection: None,
-    });
-    send(
-        app,
-        Message::SourceEdit(if line {
-            text_editor::Action::SelectLine
-        } else {
-            text_editor::Action::SelectWord
-        }),
-    );
-    let selected = app.source_editor.selection().unwrap();
-    assert!(selected.contains("pump"));
-    let raw = app.source_editor.cursor();
-    assert_eq!(raw.selection, Some(raw.position));
-    selected
-}
-
-#[test]
-fn effective_selection_survives_file_roundtrip_and_definition_back() {
-    for line in [false, true] {
-        for definition in [false, true] {
-            let mut app = fixture();
-            let selected = select_effective_pump(&mut app, line);
-            let accepted = app.document.snapshot();
-            let bundle = app.source_workspace.bundle();
-            let revision = app.source_workspace.revision();
-            if definition {
-                let results = finish(&mut app, query::Action::Definition);
-                assert_eq!(results.disposition, query::Disposition::Direct);
-                reveal(&mut app);
-                assert_eq!(app.source_workspace.active, DEFINITIONS);
-                symbol(&mut app, nav::SymbolEvent::Back);
-                reveal(&mut app);
-                assert!(app.source_symbols.back.is_empty());
-            } else {
-                show(&mut app, DEFINITIONS);
-                show(&mut app, USES);
-            }
-            assert_eq!(app.source_workspace.active, USES);
-            assert_eq!(
-                app.source_editor.selection().as_deref(),
-                Some(selected.as_str())
-            );
-            assert_eq!(app.source_workspace.bundle(), bundle);
-            assert_eq!(app.source_workspace.revision(), revision);
-            assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-            assert!(!app.source_workspace.undo(false) && !app.source_workspace.undo(true));
-            assert!(!app.document.can_undo() && !app.document.can_redo());
-            let expected = if line {
-                bundle.files[USES].replacen(&selected, "x", 1)
-            } else {
-                bundle.files[USES].replacen("source @pump", "source @x", 1)
-            };
-            send(
-                &mut app,
-                Message::SourceEdit(text_editor::Action::Edit(text_editor::Edit::Insert('x'))),
-            );
-            assert_eq!(app.source_workspace.text(), expected);
-            assert_eq!(app.source_editor.text(), expected);
-            assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-        }
-    }
-}
-
-#[test]
-fn effective_selection_is_untouched_by_noop_missing_invalid_or_cancelled_navigation() {
-    for variant in 0..4 {
-        let mut app = fixture();
-        let selected = select_effective_pump(&mut app, false);
-        let raw_cursor = app.source_editor.cursor();
-        let bundle = app.source_workspace.bundle();
-        let revision = app.source_workspace.revision();
-        let accepted = app.document.snapshot();
-        match variant {
-            0 => send(&mut app, Message::SourceFile(USES.into())),
-            1 => send(&mut app, Message::SourceFile("missing.arcadia".into())),
-            2 => app.source_symbol_jump(
-                DEFINITIONS,
-                query::Position {
-                    line: 999,
-                    byte_column: 0,
-                },
-                query::Position {
-                    line: 999,
-                    byte_column: 1,
-                },
-            ),
-            _ => {
-                let request = begin(&mut app, query::Action::Definition);
-                let ready = completion(&app, request);
-                assert_eq!(
-                    app.source_editor.selection().as_deref(),
-                    Some(selected.as_str())
-                );
-                send(&mut app, Message::SourceFile(USES.into()));
-                send(&mut app, Message::SourceSymbolsReady(ready));
-                reveal(&mut app);
-            }
-        }
-        assert_eq!(app.source_workspace.active, USES);
-        assert_eq!(
-            app.source_editor.cursor(),
-            raw_cursor,
-            "live selection mode must not normalize"
-        );
-        assert_eq!(
-            app.source_editor.selection().as_deref(),
-            Some(selected.as_str())
-        );
-        assert_eq!(app.source_workspace.bundle(), bundle);
-        assert_eq!(app.source_workspace.revision(), revision);
-        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-    }
-}
-
-#[test]
-fn changed_active_origin_back_keeps_current_effective_selection() {
-    let mut app = fixture();
-    let old_generation = app.source_workspace.files[USES].generation();
-    let old_cursor = app.source_editor.cursor();
-    let original = app.source_workspace.text().to_owned();
-    app.source_editor
-        .perform(text_editor::Action::Move(text_editor::Motion::Left));
-    app.source_editor.move_to(text_editor::Cursor {
-        position: text_editor::Position { line: 0, column: 3 },
-        selection: None,
-    });
-    send(
-        &mut app,
-        Message::SourceEdit(text_editor::Action::Edit(text_editor::Edit::Insert('x'))),
-    );
-    let mut expected_edit = original;
-    expected_edit.insert(3, 'x');
-    assert_eq!(app.source_workspace.text(), expected_edit);
-    let selected = select_effective_pump(&mut app, true);
-    let bundle = app.source_workspace.bundle();
-    let revision = app.source_workspace.revision();
-    app.source_symbols.back.push(nav::HistoryEntry {
-        session: app.source_workspace.session(),
-        path: USES.into(),
-        generation: old_generation,
-        cursor: old_cursor,
-    });
-    symbol(&mut app, nav::SymbolEvent::Back);
-    reveal(&mut app);
-    assert_eq!(
-        app.source_editor.selection().as_deref(),
-        Some(selected.as_str())
-    );
-    assert!(
-        app.source_symbols
-            .notice
-            .as_deref()
-            .unwrap()
-            .contains("draft changed")
-    );
-    assert_eq!(app.source_workspace.bundle(), bundle);
-    assert_eq!(app.source_workspace.revision(), revision);
-}
-
-#[test]
-fn source_creation_preserves_outgoing_selection_and_undisplayed_entry_cursor() {
-    let mut app = fixture();
-    let selected = select_effective_pump(&mut app, true);
-    let bundle = app.source_workspace.bundle();
-    let entry_cursor = app.source_workspace.files[&bundle.entry].cursor;
-    let accepted = app.document.snapshot();
-    send(&mut app, Message::SourceNewPath("new.arcadia".into()));
-    send(&mut app, Message::SourceCreateFile);
-    assert_eq!(app.source_workspace.active, "new.arcadia");
-    assert_eq!(
-        app.source_workspace.files[&bundle.entry].cursor,
-        entry_cursor
-    );
-    assert_eq!(app.source_workspace.files[USES].text, bundle.files[USES]);
-    assert!(
-        app.source_workspace.files[&bundle.entry]
-            .text
-            .contains("include \"new.arcadia\";")
-    );
-    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-    show(&mut app, USES);
-    assert_eq!(
-        app.source_editor.selection().as_deref(),
-        Some(selected.as_str())
-    );
-    select_effective_pump(&mut app, true);
-    let raw = app.source_editor.cursor();
-    send(
-        &mut app,
-        Message::SourceNewPath("../invalid.arcadia".into()),
-    );
-    send(&mut app, Message::SourceCreateFile);
-    assert_eq!(app.source_workspace.active, USES);
-    assert_eq!(app.source_editor.cursor(), raw);
-    assert_eq!(
-        app.source_editor.selection().as_deref(),
-        Some(selected.as_str())
-    );
-}

crates/oa-desktop/src/app/state_diagram.rs

@@ -114,7 +114,6 @@ impl App {
             }
         }
         match event {
-            Event::Remove(intent) => self.remove_from_diagram(intent),
             Event::Viewport(_, size) => {
                 if size.width.is_finite()
                     && size.height.is_finite()

crates/oa-desktop/src/behavior.rs

@@ -20,7 +20,6 @@ mod contextual_source_tests;
 pub(crate) mod creation;
 mod form_session;
 pub(crate) mod scenario;
-mod scenario_activation;
 mod scenario_lifecycle;
 pub(crate) mod source_draft;
 pub(crate) mod state_canvas;
@@ -1180,10 +1179,9 @@ struct Scene {
     lanes: BTreeMap<Id, f32>,
     slots: Vec<SequenceSlot>,
     rows: BTreeMap<Id, (Id, f32)>,
-    activations: Vec<scenario_activation::Segment>,
-    lifecycle: scenario_lifecycle::render::Rendering,
     open_calls: Vec<Point>,
     sequence_bounds: BTreeMap<Id, (f32, f32)>,
+    lifecycle: scenario_lifecycle::render::Rendering,
 }
 struct SequenceSlot {
     slot: scenario::Slot,
@@ -1227,11 +1225,6 @@ impl SequenceInput {
     }
 }
 impl Scene {
-    fn removal_target(&self, owner: Id, id: Id) -> bool {
-        id != owner
-            && (self.boxes.iter().any(|item| item.id == id)
-                || self.lines.iter().any(|item| item.id == id))
-    }
     fn sequence(p: &Project, owner: Id, selected: Id) -> Self {
         let mut scene = Self {
             scale: 1.,
@@ -1245,10 +1238,9 @@ impl Scene {
             lanes: BTreeMap::new(),
             slots: vec![],
             rows: BTreeMap::new(),
-            activations: vec![],
-            lifecycle: scenario_lifecycle::render::Rendering::default(),
             open_calls: vec![],
             sequence_bounds: BTreeMap::new(),
+            lifecycle: scenario_lifecycle::render::Rendering::default(),
         };
         let mut lanes = p
             .children(owner)
@@ -1346,7 +1338,29 @@ impl Scene {
                 scene.size.height,
             );
             scene.lifecycle.align_messages(&mut scene.lines);
-            scene.layout_activations(p, &lane_x);
+            let calls: Vec<_> = scene
+                .rows
+                .keys()
+                .filter_map(|&id| {
+                    if let Some(SharedBody::Occurrence {
+                        body:
+                            OccurrenceBody::Exchange {
+                                message_kind: MessageKind::Call,
+                                receiver: Some(receiver),
+                                ..
+                            },
+                        ..
+                    }) = p.elements[&id].shared()
+                    {
+                        Some((id, *lane_x.get(receiver)?))
+                    } else {
+                        None
+                    }
+                })
+                .collect();
+            for (call, x) in calls {
+                scene.activation_sequence(p, p.elements[&call].parent.unwrap(), call, x, None);
+            }
         }
         for (id, name, detail) in lanes {
             let x = lane_x[&id];
@@ -1365,7 +1379,11 @@ impl Scene {
             scene.boxes.push(BoxItem {
                 id,
                 rect: Rectangle::new(Point::new(x - 102., 15.), Size::new(204., 70.)),
-                title: name,
+                title: if scenario {
+                    format!("Lane · {name}")
+                } else {
+                    name
+                },
                 detail,
                 marker: None,
             });
@@ -1409,16 +1427,14 @@ impl Scene {
             };
             if scenario
                 && matches!(body, OccurrenceBody::Exchange {
-                    sender: Some(sender), receiver: Some(receiver),
-                    message_kind: MessageKind::Create | MessageKind::Delete, ..
-                } if sender == receiver)
+                sender: Some(sender), receiver: Some(receiver),
+                message_kind: MessageKind::Create | MessageKind::Delete, ..
+            } if sender == receiver)
             {
-                // Record the lifecycle receive row only after making room for
-                // the self-message elbow and caption above its marker.
+                // Self lifecycle elbows and their caption need clearance from
+                // the preceding action/state/reference box, before recording rows.
                 *y += 16.;
             }
-            #[cfg(test)]
-            scenario_lifecycle::render::apply_test_row_offset(*id, y);
             if ordered {
                 let slot = scenario::Slot {
                     parent: owner,
@@ -1638,6 +1654,148 @@ impl Scene {
             });
         }
     }
+    fn activation_segment(
+        &mut self,
+        call: Id,
+        scope: Id,
+        receiver: Id,
+        x: f32,
+        top: f32,
+        bottom: f32,
+    ) {
+        for span in self.lifecycle.alive_spans(receiver, scope, top, bottom) {
+            self.boxes.push(BoxItem {
+                id: call,
+                rect: Rectangle::new(
+                    Point::new(x - 4., span.start),
+                    Size::new(8., span.end - span.start),
+                ),
+                title: String::new(),
+                detail: String::new(),
+                marker: None,
+            });
+        }
+    }
+    /// Follow a single correlation through the ordered tree. Branches are drawn
+    /// as independent segments, never as one chronological stretch through ALT
+    /// operands. The result says whether a path can leave this sequence open.
+    fn activation_sequence(
+        &mut self,
+        p: &Project,
+        owner: Id,
+        call: Id,
+        x: f32,
+        mut start: Option<f32>,
+    ) -> bool {
+        let Some(SharedBody::Occurrence {
+            body:
+                OccurrenceBody::Exchange {
+                    receiver: Some(receiver),
+                    ..
+                },
+            ..
+        }) = p.elements[&call].shared()
+        else {
+            return false;
+        };
+        let receiver = *receiver;
+        let entered_open = start.is_some();
+        let mut split = false;
+        for id in p.elements[&owner].steps().into_iter().flatten() {
+            let Some(&(_, y)) = self.rows.get(id) else {
+                continue;
+            };
+            if *id == call {
+                start = Some(y);
+            }
+            let Some(top) = start else {
+                continue;
+            };
+            match p.elements[id].shared() {
+                Some(SharedBody::Occurrence {
+                    body:
+                        OccurrenceBody::Exchange {
+                            message_kind: MessageKind::Delete,
+                            receiver: Some(deleted),
+                            ..
+                        },
+                    ..
+                }) if *deleted == receiver => {
+                    // This path cannot show activation beyond its local death.
+                    // Keep the unresolved-call cue; a Delete is not a Reply.
+                    self.activation_segment(call, owner, receiver, x, top, y);
+                    self.open_calls.push(Point::new(x + 12., y - 16.));
+                    start = None;
+                }
+                Some(SharedBody::Occurrence {
+                    body:
+                        OccurrenceBody::Exchange {
+                            message_kind: MessageKind::Reply,
+                            reply_to: Some(correlation),
+                            ..
+                        },
+                    ..
+                }) if *correlation == call => {
+                    self.activation_segment(call, owner, receiver, x, top, y);
+                    for span in self.lifecycle.alive_spans(receiver, owner, y - 1., y + 1.) {
+                        self.boxes.push(BoxItem {
+                            id: call,
+                            rect: Rectangle::new(
+                                Point::new(x - 7., span.start),
+                                Size::new(14., span.end - span.start),
+                            ),
+                            title: String::new(),
+                            detail: String::new(),
+                            marker: None,
+                        });
+                    }
+                    start = None;
+                }
+                Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Fragment { operator, branches },
+                    ..
+                }) => {
+                    split = true;
+                    self.activation_segment(call, owner, receiver, x, top, y);
+                    let bottom = self
+                        .boxes
+                        .iter()
+                        .find(|b| b.id == *id && !b.title.is_empty())
+                        .map(|b| b.rect.y + b.rect.height)
+                        .unwrap_or(y);
+                    let outcomes: Vec<_> = branches
+                        .iter()
+                        .filter_map(|branch| {
+                            let &(top, _) = self.sequence_bounds.get(branch)?;
+                            Some(self.activation_sequence(p, *branch, call, x, Some(top)))
+                        })
+                        .collect();
+                    let open = match operator {
+                        FragmentOperator::Alternative => {
+                            outcomes.is_empty() || outcomes.iter().any(|open| *open)
+                        }
+                        FragmentOperator::Parallel => outcomes.iter().all(|open| *open),
+                        // Optional/repeated bodies do not guarantee execution.
+                        FragmentOperator::Optional | FragmentOperator::Loop => true,
+                    };
+                    start = open.then_some(bottom);
+                }
+                _ => {}
+            }
+        }
+        if let Some(top) = start {
+            let bottom = if entered_open || split {
+                self.sequence_bounds
+                    .get(&owner)
+                    .map_or(top + 26., |(_, bottom)| (*bottom).max(top + 26.))
+            } else {
+                top + 26.
+            };
+            self.activation_segment(call, owner, receiver, x, top, bottom);
+            self.open_calls.push(Point::new(x + 8., bottom - 7.));
+        }
+        start.is_some()
+    }
     fn slot_at(&self, point: Point, parent: Option<Id>) -> Option<&SequenceSlot> {
         self.slots
             .iter()
@@ -1681,33 +1839,20 @@ impl Scene {
                     && (b.marker != Some(Kind::Occurrence) || point.y < b.rect.y + 38.)
             })
             .map(|b| b.id)
-            .or_else(|| {
-                self.lines
-                    .iter()
-                    .find(|line| {
-                        !line.label.is_empty()
-                            && line.points.windows(2).any(|p| {
-                                crate::diagram::distance_to_segment(point, p[0], p[1]) < 1.5
-                            })
-                    })
-                    .map(|line| line.id)
-            })
-            .or_else(|| {
-                self.activations
-                    .iter()
-                    .rev()
-                    .find(|b| b.rect.contains(point))
-                    .map(|b| b.call)
-            })
             .or_else(|| {
                 self.lines
                     .iter()
                     .find(|line| !line.label.is_empty() && line.label_bounds().contains(point))
                     .map(|line| line.id)
             })
-            // The generous message tolerance must not steal the exposed
-            // shoulder of another call's execution when the view is zoomed out.
             .or_else(|| self.near_sequence_item(point))
+            .or_else(|| {
+                self.boxes
+                    .iter()
+                    .rev()
+                    .find(|b| b.rect.contains(point) && b.title.is_empty())
+                    .map(|b| b.id)
+            })
             .or_else(|| self.lifecycle.lane_at(point, self.scale))
             .or_else(|| self.lane_at(point))
             .or_else(|| {
@@ -1740,8 +1885,9 @@ impl Scene {
                     .fold(f32::INFINITY, f32::min);
                 (line.id, distance)
             });
-        // Compare broad message and lifecycle-marker tolerance together after
-        // exact shapes, so dense minimum-Fit rows choose the nearer item.
+        // One distance comparison for both kinds of screen-sized hit tolerance.
+        // Dense minimum-Fit rows must not give the first message or last marker
+        // a larger hit priority than the visibly nearer item. UUID breaks ties.
         self.lifecycle
             .nearest_marker(point)
             .into_iter()
@@ -1823,29 +1969,6 @@ impl canvas::Program<Message> for Scene {
                 state.pointer = cursor.position();
                 cursor
             }
-            canvas::Event::Keyboard(iced::keyboard::Event::KeyPressed {
-                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Delete),
-                modifiers,
-                repeat: false,
-                ..
-            }) if editable
-                && tool == CanvasTool::Select
-                && (modifiers.is_empty() || *modifiers == iced::keyboard::Modifiers::SHIFT)
-                && state.press.is_none()
-                && state.source.is_none() =>
-            {
-                let context = context?;
-                if self.removal_target(context.scenario, self.selected) {
-                    return Some(
-                        Action::publish(Message::ScenarioCanvas(CanvasEvent::Remove(
-                            context,
-                            self.selected,
-                        )))
-                        .and_capture(),
-                    );
-                }
-                return None;
-            }
             canvas::Event::Keyboard(iced::keyboard::Event::KeyPressed {
                 key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
                 ..
@@ -2035,55 +2158,6 @@ impl canvas::Program<Message> for Scene {
         f.translate(self.camera_pan);
         f.scale(self.scale);
         self.lifecycle.draw_lanes(&mut f, self.selected);
-        // Guides belong behind execution fills and cards. In particular, a
-        // lifeline must not cut through the middle of its activation rectangle.
-        for guide in self.lines.iter().filter(|line| line.label.is_empty()) {
-            f.stroke(
-                &Path::new(|path| {
-                    path.move_to(guide.points[0]);
-                    for point in &guide.points[1..] {
-                        path.line_to(*point);
-                    }
-                }),
-                Stroke::default()
-                    .with_color(if guide.id == self.selected {
-                        style::TEAL
-                    } else {
-                        style::MUTED
-                    })
-                    .with_width(if guide.id == self.selected { 2.5 } else { 1.2 }),
-            );
-        }
-        // Label backplates clear guides, but must not erase execution borders
-        // or message geometry. Their text remains in the foreground below.
-        for line in self.lines.iter().filter(|line| !line.label.is_empty()) {
-            f.fill_rectangle(
-                line.label_at,
-                Size::new(
-                    (line.label.chars().count() as f32 * 6.8 + 8.).min(225.),
-                    22.,
-                ),
-                Color::WHITE,
-            );
-        }
-        for activation in &self.activations {
-            let path = Path::rectangle(activation.rect.position(), activation.rect.size());
-            f.fill(&path, Color::from_rgb8(243, 248, 248));
-            f.stroke(
-                &path,
-                Stroke::default()
-                    .with_color(if activation.call == self.selected {
-                        style::TEAL
-                    } else {
-                        style::BOUNDARY
-                    })
-                    .with_width(if activation.call == self.selected {
-                        2.5
-                    } else {
-                        1.
-                    }),
-            );
-        }
         for b in &self.boxes {
             let outline = matches!(
                 b.marker,
@@ -2092,7 +2166,7 @@ impl canvas::Program<Message> for Scene {
             let color = if b.id == self.selected {
                 style::TEAL
             } else {
-                style::BOUNDARY
+                style::LINE
             };
             if outline {
                 f.stroke(
@@ -2110,7 +2184,7 @@ impl canvas::Program<Message> for Scene {
                 );
             }
         }
-        for l in self.lines.iter().filter(|line| !line.label.is_empty()) {
+        for l in &self.lines {
             let color = if l.id == self.selected {
                 style::TEAL
             } else {
@@ -2147,6 +2221,11 @@ impl canvas::Program<Message> for Scene {
                     }),
                     Stroke::default().with_color(color),
                 );
+                f.fill_rectangle(
+                    l.label_at,
+                    Size::new((l.label.chars().count() as f32 * 6.8 + 8.).min(225.), 22.),
+                    Color::WHITE,
+                );
                 f.fill_text(Text {
                     content: short(&l.label, 32),
                     position: l.label_at,
@@ -2158,8 +2237,8 @@ impl canvas::Program<Message> for Scene {
         }
         for b in &self.boxes {
             if let Some(clip) = box_text_clip(self.camera_pan, b.rect, self.scale, f.size()) {
-                // WGPU child clips start with an identity transform, as in
-                // the lifecycle capsule label painter.
+                // Clipped child frames start with an identity transform. Match
+                // the card's pan and scale, as for lifecycle Create labels.
                 f.with_clip(clip, |label| {
                     label.translate(self.camera_pan);
                     label.scale(self.scale);
@@ -2946,9 +3025,9 @@ mod direct_canvas_tests {
         p = execute_batch(&p, &commands).unwrap();
         let scene = Scene::sequence(&p, f.owner, f.call);
         let bars: Vec<_> = scene
-            .activations
+            .boxes
             .iter()
-            .filter(|b| b.call == f.call)
+            .filter(|b| b.id == f.call && b.rect.width == 8.)
             .map(|b| b.rect)
             .collect();
         for reply in &replies {
@@ -2986,7 +3065,11 @@ mod direct_canvas_tests {
     #[test]
     fn direct_execution_span_ends_at_its_correlated_reply_and_marks_an_open_call() {
         let (f, scene) = scene();
-        let bar = scene.activations.iter().find(|b| b.call == f.call).unwrap();
+        let bar = scene
+            .boxes
+            .iter()
+            .find(|b| b.id == f.call && b.rect.width == 8.)
+            .unwrap();
         assert_eq!(bar.rect.y + bar.rect.height, scene.rows[&f.reply].1);
         assert!(scene.open_calls.is_empty());
         let p = execute_batch(&f.project, &[Command::Delete(f.reply)]).unwrap();
@@ -2994,9 +3077,9 @@ mod direct_canvas_tests {
         assert_eq!(scene.open_calls.len(), 1);
         assert_eq!(
             scene
-                .activations
+                .boxes
                 .iter()
-                .find(|b| b.call == f.call)
+                .find(|b| b.id == f.call && b.rect.width == 8.)
                 .unwrap()
                 .rect
                 .height,

crates/oa-desktop/src/behavior/canvas_workspace.rs

@@ -10,12 +10,8 @@ pub use control::Control;
 pub use viewport::Viewport;
 
 pub fn keyboard_enabled(app: &crate::app::App) -> bool {
-    !app.busy && keyboard_owner_enabled(app)
-}
-
-/// Passive I/O suspends commands without changing the logical input owner.
-pub(crate) fn keyboard_owner_enabled(app: &crate::app::App) -> bool {
-    !app.hosted.visible
+    !app.busy
+        && !app.hosted.visible
         && app.workflow.is_none()
         && app.file_prompt.is_none()
         && !app.delete_pending
@@ -30,6 +26,7 @@ pub fn controls<'a>(
     keyboard: bool,
     scale: f32,
     details: Message,
+    focus: Option<Message>,
     zoom: impl Fn(Option<f32>) -> Message,
     publish: impl Fn(Event) -> Message + Copy + 'a,
 ) -> Element<'a, Message> {
@@ -46,21 +43,17 @@ pub fn controls<'a>(
             publish,
         )
     };
-    let controls = row![
+    row![
         control("Details", "Details", Some(details)),
+        tooltip(control("Canvas", "Canvas", focus),
+            container(text("F6: enter/leave canvas controls · Tab: next · Enter/Space: activate · Esc: leave").size(12)).padding(7).style(crate::style::card),
+            tooltip::Position::Bottom),
         control("Fit", "Fit", Some(zoom(None))),
         control("ZoomOut", "−", Some(zoom(Some(scale / 1.25)))),
         text(format!("{:.0}%", scale * 100.)).size(12),
         control("ZoomIn", "+", Some(zoom(Some(scale * 1.25)))),
         control("ActualSize", "100%", Some(zoom(Some(1.)))),
-    ]
-    .spacing(4)
-    .align_y(iced::Center);
-    tooltip(
-        controls,
-        container(text("F6: enter/leave canvas keyboard controls · Tab: next · Enter/Space: activate · Esc: leave").size(12)).padding(7).style(crate::style::card),
-        tooltip::Position::Bottom,
-    ).into()
+    ].spacing(4).align_y(iced::Center).into()
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -128,6 +121,7 @@ pub enum Event {
     CancelGesture,
     Pan(Vector),
     Zoom { factor: f32, at: Point, base: f32 },
+    Focus,
     Traverse(bool),
     ControlFocus(&'static str),
     ToggleFocus,

crates/oa-desktop/src/behavior/canvas_workspace/focus.rs

@@ -70,6 +70,7 @@ impl<T: Send + 'static> Operation<T> for Collect {
             return operation::Outcome::None;
         }
         let target = match self.event {
+            Event::Focus => Some(canvas),
             Event::ControlFocus(name) => Some(self.scope.control_id(name)),
             Event::ToggleFocus if self.focused.is_none() => Some(canvas),
             Event::ToggleFocus | Event::Leave if self.focused.is_some() => None,

crates/oa-desktop/src/behavior/canvas_workspace/tests.rs

@@ -236,9 +236,6 @@ impl Mounted {
         }
     }
     pub fn pixels(&mut self, app: &App) -> Vec<u8> {
-        self.pixels_at(app, mouse::Cursor::Unavailable)
-    }
-    pub fn pixels_at(&mut self, app: &App, cursor: mouse::Cursor) -> Vec<u8> {
         use iced::advanced::renderer::Headless;
         let mut ui = UserInterface::build(
             app.view(),
@@ -250,7 +247,7 @@ impl Mounted {
         let mut messages = vec![];
         let _ = ui.update(
             &[],
-            cursor,
+            mouse::Cursor::Unavailable,
             &mut self.renderer,
             &mut iced::advanced::clipboard::Null,
             &mut messages,
@@ -265,7 +262,7 @@ impl Mounted {
             &iced::advanced::renderer::Style {
                 text_color: crate::style::INK,
             },
-            cursor,
+            mouse::Cursor::Unavailable,
         );
         self.cache = ui.into_cache();
         Headless::screenshot(
@@ -628,7 +625,7 @@ pub(crate) async fn retained_toolbar_boundaries(
     use iced::keyboard::key::Named;
     for boundary in ["Chooser", "Dirty", "Picker"] {
         let mut packets = vec![];
-        for name in ["Fit", tool, "Details"] {
+        for name in ["Fit", tool, "Details", "Panels", "Canvas"] {
             packets.push(capture_toolbar(mounted, app, name));
         }
         let lifetime = app.camera_epoch;

crates/oa-desktop/src/behavior/canvas_workspace/viewport.rs

@@ -10,7 +10,6 @@ use iced::{keyboard, mouse};
 struct Input {
     scope: Option<Scope>,
     focused: bool,
-    focus_pending: bool,
     pointer: Option<Point>,
     pan: Option<(mouse::Button, Point)>,
     space: bool,
@@ -22,11 +21,9 @@ impl operation::Focusable for Input {
     }
     fn focus(&mut self) {
         self.focused = true;
-        self.focus_pending = false;
     }
     fn unfocus(&mut self) {
         self.focused = false;
-        self.focus_pending = false;
         self.pan = None;
         self.space = false;
     }
@@ -95,7 +92,6 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
         }
         if !self.keyboard {
             state.focused = false;
-            state.focus_pending = false;
         }
         state.scope = Some(self.scope);
         tree.diff_children(std::slice::from_ref(&self.content));
@@ -147,11 +143,6 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
             return;
         }
         let state = tree.state.downcast_mut::<Input>();
-        // A traversal operation is applied after this Iced event batch. Keep
-        // its focus witness, but retire keyboard admission immediately.
-        if state.focus_pending && matches!(event, Event::Keyboard(_)) {
-            return;
-        }
         let changed_bounds = state.bounds.is_some_and(|bounds| bounds != layout.bounds());
         state.bounds = Some(layout.bounds());
         if changed_bounds || !self.keyboard {
@@ -160,7 +151,6 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
         }
         if !self.keyboard {
             state.focused = false;
-            state.focus_pending = false;
         }
         if let Event::Mouse(mouse::Event::CursorMoved { position }) = event {
             state.pointer = Some(*position);
@@ -188,7 +178,6 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
                 state.pan = None;
                 state.space = false;
                 state.focused = false;
-                state.focus_pending = false;
             }
             Event::Mouse(mouse::Event::CursorLeft) => {
                 state.pan = None;
@@ -201,7 +190,6 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
                     cancel = true;
                 }
                 state.focused = inside && self.keyboard;
-                state.focus_pending = false;
                 if inside
                     && self.keyboard
                     && (*button == mouse::Button::Middle
@@ -254,7 +242,6 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
                 repeat: false,
                 ..
             }) if self.keyboard && modifiers.is_empty() => {
-                state.focus_pending = true;
                 camera = Some(CameraEvent::ToggleFocus);
                 capture = true;
                 cancel = true;
@@ -271,14 +258,12 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
                         capture = true;
                     }
                     Key::Named(Named::Tab) => {
-                        state.focus_pending = true;
                         camera = Some(CameraEvent::Traverse(modifiers.shift()));
                         capture = true;
                     }
                     Key::Named(Named::Escape) => {
                         state.pan = None;
                         state.space = false;
-                        state.focus_pending = true;
                         camera = Some(CameraEvent::Leave);
                         capture = true;
                     }
@@ -324,9 +309,7 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
             shell.request_redraw();
             return;
         }
-        if matches!(event, Event::Keyboard(_))
-            && (!state.focused || !self.keyboard || state.pan.is_some() || state.space)
-        {
+        if matches!(event, Event::Keyboard(_)) && (!state.focused || !self.keyboard) {
             return;
         }
         let child_cursor = if inside {

crates/oa-desktop/src/behavior/creation.rs

@@ -694,7 +694,9 @@ fn picker_view<'a, R: iced::advanced::text::Renderer + 'a>(
         Picker::Owner => d.owner,
         Picker::Context => d.context,
     };
+    let staged_owner = picker == Picker::Owner && d.source.label(selected).is_some();
     let title = match picker {
+        Picker::Owner if staged_owner => "Or choose an existing participant",
         Picker::Owner => "Owned by participant",
         Picker::Context => "Scenario context · optional",
     };
@@ -705,13 +707,16 @@ fn picker_view<'a, R: iced::advanced::text::Renderer + 'a>(
             .padding(6)
     ]
     .spacing(5);
-    if let Some(id) = selected {
+    if let Some(id) = selected
+        && !staged_owner
+    {
         out = out.push(text(format!("Selected: {}", reference_label(p, id))).size(12));
     } else if picker == Picker::Context {
         out = out.push(text("No context selected").size(12));
     }
     if options.is_empty() {
         out = out.push(text(match picker {
+            Picker::Owner if staged_owner => "No existing participants match this search. The new owner above remains selected.",
             Picker::Owner => "No matching participant. Refine the search or choose Create new owner.",
             Picker::Context => "No matching context. Refine the search, or leave this optional reference empty.",
         }).size(12));

crates/oa-desktop/src/behavior/scenario.rs

@@ -67,34 +67,6 @@ impl std::fmt::Display for MessageStyle {
         })
     }
 }
-#[cfg(test)]
-pub(crate) fn removal_test_point(app: &App, owner: Id, id: Id) -> Point {
-    let scene = super::Scene::sequence(app.project(), owner, id);
-    let point = scene
-        .boxes
-        .iter()
-        .rev()
-        .find(|item| item.id == id && !item.title.is_empty())
-        .map(|item| Point::new(item.rect.x + 20., item.rect.y + 20.))
-        .or_else(|| {
-            scene
-                .lines
-                .iter()
-                .find(|line| line.id == id && !line.label.is_empty())
-                .map(|line| line.label_at + iced::Vector::new(6., 8.))
-        })
-        .expect("rendered scenario target");
-    let presentation = &app.behavior.scenario.presentation;
-    Point::ORIGIN
-        + presentation.pan
-        + iced::Vector::new(point.x, point.y) * presentation.scale(scene.size)
-}
-
-pub(crate) fn removal_target(p: &Project, owner: Id, id: Id) -> bool {
-    super::selected_behavior(p, id) == Some(owner)
-        && super::Scene::sequence(p, owner, id).removal_target(owner, id)
-}
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct Context {
     pub document: Id,
@@ -131,12 +103,12 @@ pub enum CanvasEvent {
     FormShown(Context, Id),
     Zoom(Context, Option<f32>),
     Camera(Context, u64, super::canvas_workspace::Event),
+    Focus(Context),
     Shelf(Context, Shelf),
     OpenUse(Context, Id),
     Back(Context),
     Choose(Context, CanvasTool),
     Select(Context, Id),
-    Remove(Context, Id),
     Begin {
         context: Context,
         slot: Slot,
@@ -170,12 +142,12 @@ impl CanvasEvent {
             | Self::FormShown(context, _)
             | Self::Zoom(context, _)
             | Self::Camera(context, ..)
+            | Self::Focus(context)
             | Self::Shelf(context, _)
             | Self::OpenUse(context, _)
             | Self::Back(context)
             | Self::Choose(context, _)
             | Self::Select(context, _)
-            | Self::Remove(context, _)
             | Self::Begin { context, .. }
             | Self::BeginOccurrence { context, .. }
             | Self::Reorder { context, .. } => *context,
@@ -319,6 +291,7 @@ impl State {
     pub(crate) fn camera_boundary(&self) -> impl PartialEq + use<> {
         (
             self.canvas_tool,
+            self.presentation.focused,
             self.presentation.shelf,
             self.presentation.viewport,
             self.presentation.pan,
@@ -357,6 +330,7 @@ impl State {
         if self.presentation.identity != Some((document, owner)) {
             self.presentation = workspace::Presentation {
                 identity: Some((document, owner)),
+                focused: self.presentation.focused,
                 ..Default::default()
             };
             self.details_offset = iced::Vector::ZERO;
@@ -391,6 +365,12 @@ impl State {
             true
         }
     }
+    pub(crate) fn focused(&self) -> bool {
+        self.presentation.focused
+    }
+    pub(crate) fn toggle_focus(&mut self) {
+        self.presentation.focused = !self.presentation.focused;
+    }
     pub(crate) fn toggle_shelf(&mut self, shelf: Shelf) {
         self.presentation.shelf = (self.presentation.shelf != Some(shelf)).then_some(shelf);
     }
@@ -586,7 +566,7 @@ impl State {
         }
         created(command, draft.parent)
     }
-    pub(crate) fn canvas_tool(&self, owner: Id) -> CanvasTool {
+    pub(super) fn canvas_tool(&self, owner: Id) -> CanvasTool {
         self.canvas_tool
             .filter(|(id, _)| *id == owner)
             .map(|(_, tool)| tool)
@@ -1955,7 +1935,7 @@ pub(crate) mod direct_tests {
             epoch: 0,
         }
     }
-    pub(crate) fn placement_fixture() -> (Fixture, Id, Id, Id, Id, Id) {
+    pub(super) fn placement_fixture() -> (Fixture, Id, Id, Id, Id, Id) {
         let mut f = fixture();
         let p = &mut f.project;
         let machine = p
@@ -3254,45 +3234,12 @@ mod tests {
                 .iter()
                 .any(|l| l.id == steps[1] && l.dashed && l.label.contains("reply"))
         );
-        assert_eq!(scene.activations.len(), 1);
-        let activation = &scene.activations[0];
-        assert_eq!(activation.call, steps[0]);
-        assert_eq!(activation.receiver, receiver);
-        assert_eq!(activation.scope, owner);
-        assert_eq!(
-            activation.finish,
-            scenario_activation::Finish::Reply(steps[1])
-        );
-        // Scene::draw paints this typed rectangle directly. Check its extent
-        // against the actual message endpoints, without fixing a style width.
-        let rect = activation.rect;
         assert!(
-            [rect.x, rect.y, rect.width, rect.height]
+            scene
+                .boxes
                 .iter()
-                .all(|v| v.is_finite())
+                .any(|b| b.id == steps[0] && b.rect.width == 8.)
         );
-        assert!(rect.width > 0. && rect.height > 0.);
-        let call_line = scene.lines.iter().find(|l| l.id == steps[0]).unwrap();
-        let reply_line = scene.lines.iter().find(|l| l.id == steps[1]).unwrap();
-        let received = *call_line.points.last().unwrap();
-        let returned = reply_line.points[0];
-        assert_eq!(rect.y, received.y);
-        assert_eq!(rect.y + rect.height, returned.y);
-        assert_eq!(received.x, returned.x);
-        assert!(received.x == rect.x || received.x == rect.x + rect.width);
-        assert!(!scene.boxes.iter().any(|b| b.id == steps[0]));
-        assert!(scene.open_calls.is_empty());
-        let interior = rect.center();
-        assert!(scene.lines.iter().filter(|l| !l.label.is_empty()).all(|l| {
-            l.points.windows(2).all(|p| {
-                crate::diagram::distance_to_segment(interior, p[0], p[1]) > 8. / scene.scale
-            }) && !Rectangle::new(
-                l.label_at,
-                Size::new((l.label.chars().count() as f32 * 6.8 + 8.).min(225.), 25.),
-            )
-            .contains(interior)
-        }));
-        assert_eq!(scene.hit(interior), Some(steps[0]));
         let mut reply = State::default();
         reply
             .update(result, Event::Start(owner, Tool::Message))

crates/oa-desktop/src/behavior/scenario/usage/tests.rs

@@ -10,10 +10,10 @@ fn add_occurrence(p: &mut Project, owner: Id, name: &str, body: OccurrenceBody)
         precondition: String::new(),
         postcondition: String::new(),
     };
-    if let Some(steps) = p.elements.get_mut(&owner).unwrap().steps_mut()
-        && !steps.contains(&id)
-    {
-        steps.push(id);
+    if let Some(steps) = p.elements.get_mut(&owner).unwrap().steps_mut() {
+        if !steps.contains(&id) {
+            steps.push(id);
+        }
     }
     id
 }

crates/oa-desktop/src/behavior/scenario/workspace.rs

@@ -14,6 +14,7 @@ pub enum Shelf {
 pub(super) struct Presentation {
     pub(super) identity: Option<(Id, Id)>,
     pub(super) viewport: Option<Size>,
+    pub(super) focused: bool,
     pub(super) shelf: Option<Shelf>,
     pub(super) pan: iced::Vector,
     pub(super) zoom: Option<f32>,
@@ -105,7 +106,35 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
     .height(Fill)
     .style(style::card)
     .into();
-    let mut navigation = row![out.width(Fill)].spacing(6);
+    let mut navigation = row![
+        out.width(Fill),
+        super::super::canvas_workspace::Control::new(
+            button(
+                text(if presentation.focused {
+                    "Restore panels"
+                } else {
+                    "Focus canvas"
+                })
+                .size(12)
+            )
+            .padding(6)
+            .on_press(super::super::canvas_workspace::intent(
+                scope,
+                "Panels",
+                Message::ScenarioCanvas(CanvasEvent::Focus(context))
+            )),
+            scope,
+            "Panels",
+            keyboard,
+            Some(super::super::canvas_workspace::intent(
+                scope,
+                "Panels",
+                Message::ScenarioCanvas(CanvasEvent::Focus(context))
+            )),
+            camera
+        )
+    ]
+    .spacing(6);
     if state.can_back(p, context) {
         navigation =
             navigation.push(button(text("Back").size(12)).padding(6).on_press_maybe(
@@ -119,6 +148,11 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
             keyboard,
             scale,
             Message::ScenarioCanvas(CanvasEvent::Shelf(context, Shelf::Selection)),
+            clean.then_some(Message::ScenarioCanvas(CanvasEvent::Camera(
+                context,
+                scope.epoch,
+                super::super::canvas_workspace::Event::Focus
+            ))),
             move |zoom| Message::ScenarioCanvas(CanvasEvent::Zoom(context, zoom)),
             camera
         )

crates/oa-desktop/src/behavior/scenario/workspace/tests.rs

@@ -12,15 +12,6 @@ async fn production_scenario_canvas_keeps_bounds_draft_identity_and_camera_throu
     let _ = app.update(Message::Page(crate::app::Page::Behavior));
     app.window_size = Size::new(1100., 700.);
     let mut mounted = Mounted::new(&mut app).await;
-    let geometry = mounted.geometry(&app);
-    let scope = canvas_workspace::tests::scope(&app);
-    for removed in ["Canvas", "Panels"] {
-        assert!(!geometry.containers.contains_key(&scope.control_id(removed)));
-    }
-    assert!(
-        !canvas_workspace::tests::focused(&mut mounted, &app, "viewport"),
-        "direct editing needs no activation or initial keyboard focus grab"
-    );
     for size in [Size::new(1100., 700.), Size::new(1440., 900.)] {
         app.window_size = size;
         mounted.settle(&mut app).await;
@@ -1040,9 +1031,7 @@ fn scenario_workspace_viewport_events_are_passive_guarded_and_do_not_apply_raw_f
     }
     app.busy = false;
     navigation_event(&mut app, |ctx| CanvasEvent::Shelf(ctx, Shelf::Selection));
-    let epoch = app.canvas_epoch;
-    navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, Some(0.8)));
-    assert_ne!(app.canvas_epoch, epoch);
+    navigation_event(&mut app, CanvasEvent::Focus);
     navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, None));
     assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
     assert!(std::sync::Arc::ptr_eq(&accepted, &app.document.snapshot()));
@@ -1343,7 +1332,7 @@ async fn production_scenario_camera_external_controls_bounds_and_retained_deltas
     let mut mounted = Mounted::new(&mut app).await;
     let snapshot = app.document.snapshot();
     let source = app.document.bundle().clone();
-    for boundary in ["Fit", "A", "Details", "ZoomIn", "Bounds"] {
+    for boundary in ["Fit", "A", "Details", "Panels", "Bounds"] {
         let toolbar = capture_toolbar(&mut mounted, &app, "Fit");
         let bounds = mounted.geometry(&app).bounds("scenario-viewport");
         let point = bounds.position() + iced::Vector::new(95., 90.);
@@ -1542,7 +1531,10 @@ async fn production_scenario_keyboard_enters_activates_draws_focus_and_returns_t
     )));
     assert_eq!(app.behavior.scenario.presentation.pan, iced::Vector::ZERO);
     assert!(focused(&mut mounted, &app, "Fit"));
-    tab_to(&mut mounted, &mut app, "viewport").await;
+    tab_to(&mut mounted, &mut app, "Canvas").await;
+    mounted
+        .batch(&mut app, &[key(Named::Enter)], mouse::Cursor::Unavailable)
+        .await;
     assert!(focused(&mut mounted, &app, "viewport"));
     mounted
         .batch(&mut app, &[key(Named::Escape)], mouse::Cursor::Unavailable)
@@ -1857,6 +1849,7 @@ async fn scenario_workspace_open_and_back_restore_owner_and_mounted_camera_after
         CanvasEvent::Choose(ctx, CanvasTool::Message(MessageStyle::Timer))
     });
     navigation_event(&mut app, |ctx| CanvasEvent::Shelf(ctx, Shelf::Selection));
+    navigation_event(&mut app, CanvasEvent::Focus);
     let mut mounted = Mounted::new(&mut app).await;
     navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, Some(0.75)));
     let canvas = mounted.geometry(&app).bounds("scenario-viewport");
@@ -1899,13 +1892,7 @@ async fn scenario_workspace_open_and_back_restore_owner_and_mounted_camera_after
     mounted.settle(&mut app).await;
     assert_eq!(app.behavior.scenario.presentation.pan, Vector::ZERO);
     navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, Some(2.)));
-    navigation_event(&mut app, |ctx| {
-        CanvasEvent::Choose(ctx, CanvasTool::Add(Tool::Action))
-    });
-    assert_eq!(
-        app.behavior.scenario.canvas_tool(b),
-        CanvasTool::Add(Tool::Action)
-    );
+    navigation_event(&mut app, CanvasEvent::Focus);
     let _ = app.update(Message::Command(Command::Rename(
         reference,
         "Renamed caller use".into(),
@@ -1923,6 +1910,7 @@ async fn scenario_workspace_open_and_back_restore_owner_and_mounted_camera_after
         app.behavior.scenario.canvas_tool(a),
         CanvasTool::Message(MessageStyle::Timer)
     );
+    assert!(app.behavior.scenario.focused());
     assert_eq!(
         app.behavior.scenario.presentation.shelf,
         Some(Shelf::Selection)

crates/oa-desktop/src/behavior/scenario_activation.rs

@@ -1,492 +0,0 @@
-//! Derived call geometry. Correlation and branch ownership come from the model;
-//! columns separate overlapping drawings and do not assert an execution thread.
-use super::*;
-
-const WIDTH: f32 = 12.;
-const OFFSET: f32 = 6.;
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(super) enum Finish {
-    Reply(Id),
-    Boundary,
-    /// Still open at this scope boundary; the visible span is not an isolated stub.
-    Continuation,
-    Open,
-    /// The receiver was deleted without answering this call.
-    Terminated(Id),
-    /// Lifetime clipping ended this visible piece before its logical terminal.
-    Clipped,
-}
-
-#[derive(Clone, Debug, PartialEq)]
-pub(super) struct Segment {
-    pub call: Id,
-    pub receiver: Id,
-    pub scope: Id,
-    pub rect: Rectangle,
-    pub column: usize,
-    pub finish: Finish,
-}
-impl Segment {
-    fn bottom(&self) -> f32 {
-        self.rect.y + self.rect.height
-    }
-    fn overlaps(&self, other: &Self) -> bool {
-        self.receiver == other.receiver
-            && self.scope == other.scope
-            && self.rect.y < other.bottom()
-            && other.rect.y < self.bottom()
-    }
-    fn edge(&self, right: bool) -> f32 {
-        self.rect.x + if right { self.rect.width } else { 0. }
-    }
-}
-
-impl Scene {
-    pub(super) fn layout_activations(&mut self, p: &Project, lanes: &BTreeMap<Id, f32>) {
-        // Logical endpoints precede clipping and remain available even when a
-        // lifetime hides a whole execution or terminates it before its Reply.
-        let correlations = logical_correlations(p, &self.rows, &self.lines);
-        let mut calls: Vec<_> = self
-            .rows
-            .iter()
-            .filter_map(|(&call, &(scope, y))| {
-                let Some(SharedBody::Occurrence {
-                    body:
-                        OccurrenceBody::Exchange {
-                            message_kind: MessageKind::Call,
-                            receiver: Some(receiver),
-                            ..
-                        },
-                    ..
-                }) = p.elements.get(&call).and_then(|e| e.shared())
-                else {
-                    return None;
-                };
-                Some((call, *receiver, scope, y, *lanes.get(receiver)?))
-            })
-            .collect();
-        // Rows are laid out in semantic order. UUID order must not choose which
-        // rectangle obscures another (especially after source reidentification).
-        calls.sort_by(|a, b| a.3.total_cmp(&b.3).then_with(|| a.0.cmp(&b.0)));
-        for &(call, receiver, scope, _, x) in &calls {
-            let first = self.activations.len();
-            let first_cue = self.open_calls.len();
-            self.activation_sequence(p, scope, call, receiver, x, None);
-            let column = self.activations[first..]
-                .iter()
-                .flat_map(|segment| {
-                    self.activations[..first]
-                        .iter()
-                        .filter(move |other| segment.overlaps(other))
-                })
-                .map(|other| other.column + 1)
-                .max()
-                .unwrap_or(0);
-            for segment in &mut self.activations[first..] {
-                segment.column = column;
-                segment.rect.x += column as f32 * OFFSET;
-            }
-            for cue in &mut self.open_calls[first_cue..] {
-                cue.x += column as f32 * OFFSET;
-            }
-        }
-        // Shallow executions paint first; columns cannot collide within a scope.
-        self.activations.sort_by(|a, b| {
-            a.column
-                .cmp(&b.column)
-                .then_with(|| a.rect.y.total_cmp(&b.rect.y))
-                .then_with(|| a.call.cmp(&b.call))
-        });
-        self.anchor_activation_messages(p, lanes, &correlations);
-    }
-
-    fn activation_segment(
-        &mut self,
-        call: Id,
-        receiver: Id,
-        scope: Id,
-        x: f32,
-        span: std::ops::Range<f32>,
-        finish: Finish,
-    ) {
-        // Cues describe unanswered logical paths, including wholly invisible
-        // ones. Never derive them only from the surviving paint rectangles.
-        if matches!(
-            finish,
-            Finish::Open | Finish::Continuation | Finish::Terminated(_)
-        ) {
-            self.open_calls
-                .push(Point::new(x + WIDTH / 2. + 4., span.end - 7.));
-        }
-        for alive in self
-            .lifecycle
-            .alive_spans(receiver, scope, span.start, span.end)
-        {
-            self.activations.push(Segment {
-                call,
-                receiver,
-                scope,
-                rect: Rectangle::new(
-                    Point::new(x - WIDTH / 2., alive.start),
-                    Size::new(WIDTH, alive.end - alive.start),
-                ),
-                column: 0,
-                finish: if alive.end == span.end {
-                    finish
-                } else {
-                    Finish::Clipped
-                },
-            });
-        }
-    }
-
-    /// Follow one exact correlation. A segment belongs to one ordered scope;
-    /// vertically stacked operands must not become a single chronological span.
-    fn activation_sequence(
-        &mut self,
-        p: &Project,
-        owner: Id,
-        call: Id,
-        receiver: Id,
-        x: f32,
-        mut start: Option<f32>,
-    ) -> Outcome {
-        let entered_open = start.is_some();
-        let mut split = false;
-        let mut may_be_terminated = false;
-        for id in p.elements[&owner].steps().into_iter().flatten() {
-            let Some(&(_, y)) = self.rows.get(id) else {
-                continue;
-            };
-            if *id == call {
-                // A reflective call is received at the lower end of its loop.
-                start = Some(
-                    self.lines
-                        .iter()
-                        .find(|line| line.id == call)
-                        .and_then(|line| line.points.last())
-                        .map_or(y, |point| point.y),
-                );
-            }
-            let Some(top) = start else {
-                continue;
-            };
-            match p.elements[id].shared() {
-                Some(SharedBody::Occurrence {
-                    body:
-                        OccurrenceBody::Exchange {
-                            message_kind: MessageKind::Delete,
-                            receiver: Some(deleted),
-                            ..
-                        },
-                    ..
-                }) if *deleted == receiver => {
-                    self.activation_segment(
-                        call,
-                        receiver,
-                        owner,
-                        x,
-                        top..y,
-                        Finish::Terminated(*id),
-                    );
-                    start = None;
-                    may_be_terminated = true;
-                }
-                Some(SharedBody::Occurrence {
-                    body:
-                        OccurrenceBody::Exchange {
-                            message_kind: MessageKind::Reply,
-                            reply_to: Some(correlation),
-                            ..
-                        },
-                    ..
-                }) if *correlation == call => {
-                    // Execution ends when its reply is sent, including a self reply.
-                    self.activation_segment(call, receiver, owner, x, top..y, Finish::Reply(*id));
-                    start = None;
-                }
-                Some(SharedBody::Occurrence {
-                    body: OccurrenceBody::Fragment { operator, branches },
-                    ..
-                }) => {
-                    split = true;
-                    self.activation_segment(call, receiver, owner, x, top..y, Finish::Boundary);
-                    let bottom = self
-                        .boxes
-                        .iter()
-                        .find(|b| b.id == *id && !b.title.is_empty())
-                        .map(|b| b.rect.y + b.rect.height)
-                        .unwrap_or(y);
-                    let outcomes: Vec<_> = branches
-                        .iter()
-                        .filter_map(|branch| {
-                            let &(top, _) = self.sequence_bounds.get(branch)?;
-                            Some(self.activation_sequence(p, *branch, call, receiver, x, Some(top)))
-                        })
-                        .collect();
-                    let open = match operator {
-                        FragmentOperator::Alternative => {
-                            outcomes.is_empty() || outcomes.iter().any(|outcome| outcome.open)
-                        }
-                        FragmentOperator::Parallel => outcomes.iter().all(|outcome| outcome.open),
-                        FragmentOperator::Optional | FragmentOperator::Loop => true,
-                    };
-                    if outcomes.iter().any(|outcome| outcome.may_be_terminated) {
-                        // Sibling bars retain their own entry paths, but a
-                        // conditional death cannot become a definite parent
-                        // execution again after a later Create.
-                        self.open_calls
-                            .push(Point::new(x + WIDTH / 2. + 4., bottom - 7.));
-                        may_be_terminated = true;
-                        start = None;
-                    } else {
-                        start = open.then_some(bottom);
-                    }
-                }
-                _ => {}
-            }
-        }
-        if let Some(top) = start {
-            let bottom = if entered_open || split {
-                self.sequence_bounds
-                    .get(&owner)
-                    .map_or(top + 26., |(_, bottom)| (*bottom).max(top + 26.))
-            } else {
-                top + 26.
-            };
-            let finish = if entered_open || split {
-                Finish::Continuation
-            } else {
-                Finish::Open
-            };
-            self.activation_segment(call, receiver, owner, x, top..bottom, finish);
-        }
-        Outcome {
-            open: start.is_some(),
-            may_be_terminated,
-        }
-    }
-
-    fn anchor_activation_messages(
-        &mut self,
-        p: &Project,
-        lanes: &BTreeMap<Id, f32>,
-        correlations: &BTreeMap<Id, Correlation>,
-    ) {
-        let segments = &self.activations;
-        for line in &mut self.lines {
-            let Some(SharedBody::Occurrence {
-                body:
-                    OccurrenceBody::Exchange {
-                        sender: Some(sender),
-                        receiver: Some(receiver),
-                        message_kind,
-                        reply_to,
-                        ..
-                    },
-                ..
-            }) = p.elements.get(&line.id).and_then(|e| e.shared())
-            else {
-                continue;
-            };
-            if !matches!(
-                message_kind,
-                MessageKind::Call | MessageKind::Reply | MessageKind::Asynchronous
-            ) {
-                continue;
-            }
-            let (Some(&from), Some(&to), Some(&(scope, _))) = (
-                lanes.get(sender),
-                lanes.get(receiver),
-                self.rows.get(&line.id),
-            ) else {
-                continue;
-            };
-            let send_y = line.points[0].y;
-            let receive_y = line.points.last().unwrap().y;
-            let reflective = sender == receiver;
-            let source = if *message_kind == MessageKind::Reply {
-                reply_to.and_then(|call| {
-                    segments.iter().find(|a| {
-                        a.call == call
-                            && a.scope == scope
-                            && a.finish == Finish::Reply(line.id)
-                            && a.bottom() == send_y
-                    })
-                })
-            } else {
-                active_segment(
-                    p,
-                    segments,
-                    correlations,
-                    *sender,
-                    scope,
-                    send_y,
-                    Some(line.id),
-                )
-            };
-            let target = if *message_kind == MessageKind::Call {
-                segments
-                    .iter()
-                    .find(|a| a.call == line.id && a.scope == scope && a.rect.y == receive_y)
-            } else {
-                active_segment(
-                    p,
-                    segments,
-                    correlations,
-                    *receiver,
-                    scope,
-                    receive_y,
-                    *reply_to,
-                )
-            };
-            let start = source.map_or(from, |a| a.edge(reflective || to > from));
-            let end = target.map_or(to, |a| a.edge(reflective || from > to));
-            if reflective {
-                let outside = start.max(end) + 60.;
-                line.points = vec![
-                    Point::new(start, send_y),
-                    Point::new(outside, send_y),
-                    Point::new(outside, receive_y),
-                    Point::new(end, receive_y),
-                ];
-            } else {
-                line.points = vec![Point::new(start, send_y), Point::new(end, receive_y)];
-            }
-            line.label_at.x = start.min(end) + 12.;
-        }
-    }
-}
-
-struct Outcome {
-    open: bool,
-    may_be_terminated: bool,
-}
-
-fn logical_correlations(
-    p: &Project,
-    rows: &BTreeMap<Id, (Id, f32)>,
-    lines: &[Line],
-) -> BTreeMap<Id, Correlation> {
-    let mut result = BTreeMap::new();
-    let points: BTreeMap<_, _> = lines.iter().map(|line| (line.id, &line.points)).collect();
-    for (&id, &(_, y)) in rows {
-        if matches!(
-            p.elements.get(&id).and_then(|e| e.shared()),
-            Some(SharedBody::Occurrence {
-                body: OccurrenceBody::Exchange {
-                    message_kind: MessageKind::Call,
-                    ..
-                },
-                ..
-            })
-        ) {
-            result.insert(
-                id,
-                Correlation {
-                    start: points.get(&id).and_then(|p| p.last()).map_or(y, |p| p.y),
-                    replies: vec![],
-                },
-            );
-        }
-    }
-    for (&id, &(scope, y)) in rows {
-        if let Some(SharedBody::Occurrence {
-            body:
-                OccurrenceBody::Exchange {
-                    message_kind: MessageKind::Reply,
-                    reply_to: Some(call),
-                    ..
-                },
-            ..
-        }) = p.elements.get(&id).and_then(|e| e.shared())
-            && let Some(correlation) = result.get_mut(call)
-        {
-            let sent = points.get(&id).and_then(|p| p.first()).map_or(y, |p| p.y);
-            correlation.replies.push((scope, sent));
-        }
-    }
-    result
-}
-
-/// A caller has no implicit execution just because it sent a message. Only an
-/// actually drawn, known-duration execution can supply its anchor. Crossed
-/// intervals provide no unambiguous innermost execution, so fall back to the lane.
-fn active_segment<'a>(
-    p: &Project,
-    segments: &'a [Segment],
-    correlations: &BTreeMap<Id, Correlation>,
-    receiver: Id,
-    scope: Id,
-    y: f32,
-    exclude: Option<Id>,
-) -> Option<&'a Segment> {
-    let candidates: Vec<_> = segments
-        .iter()
-        .filter(|a| {
-            a.receiver == receiver
-                && a.scope == scope
-                && Some(a.call) != exclude
-                && a.rect.y <= y
-                && y < a.bottom()
-                && a.finish != Finish::Open
-        })
-        .collect();
-    let inner = candidates.iter().max_by_key(|a| a.column).copied()?;
-    candidates
-        .iter()
-        .all(|a| {
-            a.call == inner.call
-                || correlations[&a.call].contains(p, scope, &correlations[&inner.call])
-        })
-        .then_some(inner)
-}
-
-struct Correlation {
-    start: f32,
-    replies: Vec<(Id, f32)>,
-}
-impl Correlation {
-    fn contains(&self, p: &Project, scope: Id, inner: &Self) -> bool {
-        // Segment clipping at a fragment can make crossed calls appear nested.
-        // Compare actual correlated replies on compatible scope paths instead.
-        let relevant = |&(reply_scope, _): &(Id, f32)| {
-            ancestor(p, scope, reply_scope) || ancestor(p, reply_scope, scope)
-        };
-        let mut compared = false;
-        for &(inner_scope, inner_end) in inner.replies.iter().filter(|reply| relevant(reply)) {
-            let mut matched = false;
-            for &(outer_scope, outer_end) in self.replies.iter().filter(|reply| relevant(reply)) {
-                if ancestor(p, inner_scope, outer_scope) || ancestor(p, outer_scope, inner_scope) {
-                    // Alternative operands are not chronological. Compare only
-                    // returns that can belong to the same enclosing branch path.
-                    if outer_end < inner_end {
-                        return false;
-                    }
-                    matched = true;
-                }
-            }
-            if !matched {
-                return false;
-            }
-            compared = true;
-        }
-        self.start <= inner.start && compared
-    }
-}
-fn ancestor(p: &Project, expected: Id, mut scope: Id) -> bool {
-    for _ in 0..=p.elements.len() {
-        if scope == expected {
-            return true;
-        }
-        let Some(parent) = p.elements.get(&scope).and_then(|e| e.parent) else {
-            return false;
-        };
-        scope = parent;
-    }
-    false
-}
-
-#[cfg(test)]
-mod tests;

crates/oa-desktop/src/behavior/scenario_activation/tests.rs

@@ -1,842 +0,0 @@
-use super::*;
-
-fn id(n: u128) -> Id {
-    Id::from_u128(0x21ca1100000040008000000000000000 + n)
-}
-struct Fixture {
-    project: Project,
-    owner: Id,
-    caller: Id,
-    callee: Id,
-    call: Id,
-    inner: Id,
-    reply: Id,
-    inner_reply: Id,
-}
-fn seed(p: &mut Project, layer: Layer, n: u128, kind: Kind, parent: Option<Id>) -> Id {
-    let mut e = p
-        .make_element(kind, layer, &format!("Element {n}"), parent)
-        .unwrap();
-    e.id = id(n);
-    e.alias = format!("element_{n}");
-    p.elements.insert(e.id, e);
-    id(n)
-}
-fn message(
-    p: &mut Project,
-    layer: Layer,
-    n: u128,
-    parent: Id,
-    endpoints: (Id, Id),
-    reply: Option<Id>,
-) -> Id {
-    let e = seed(p, layer, n, Kind::Occurrence, Some(parent));
-    *p.elements.get_mut(&e).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
-        body: OccurrenceBody::Exchange {
-            operation: None,
-            exchange: None,
-            sender: Some(endpoints.0),
-            receiver: Some(endpoints.1),
-            message_kind: if reply.is_some() {
-                MessageKind::Reply
-            } else {
-                MessageKind::Call
-            },
-            reply_to: reply,
-            values: vec![],
-        },
-        precondition: String::new(),
-        postcondition: String::new(),
-    };
-    e
-}
-fn fixture(layer: Layer, reverse_uuid_order: bool) -> Fixture {
-    let mut p = Project::empty();
-    let work = if layer == Layer::Oa {
-        Kind::Activity
-    } else {
-        Kind::Function
-    };
-    let a = seed(&mut p, layer, 1, work, None);
-    let b = seed(&mut p, layer, 2, work, None);
-    let owner = seed(&mut p, layer, 3, Kind::Scenario, None);
-    if let SharedBody::Scenario { viewpoint, .. } =
-        p.elements.get_mut(&owner).unwrap().shared_mut().unwrap()
-    {
-        *viewpoint = if layer == Layer::Oa {
-            ScenarioViewpoint::OperationalActivity
-        } else {
-            ScenarioViewpoint::Functional
-        };
-    }
-    let caller = seed(&mut p, layer, 4, Kind::Lifeline, Some(owner));
-    let callee = seed(&mut p, layer, 5, Kind::Lifeline, Some(owner));
-    for (line, represented) in [(caller, a), (callee, b)] {
-        *p.elements.get_mut(&line).unwrap().shared_mut().unwrap() = SharedBody::Lifeline {
-            represented: Some(represented),
-        };
-    }
-    let (first, second) = if reverse_uuid_order {
-        (40, 30)
-    } else {
-        (30, 40)
-    };
-    let call = message(&mut p, layer, first, owner, (caller, callee), None);
-    let inner = message(&mut p, layer, second, owner, (caller, callee), None);
-    let reply = message(&mut p, layer, 50, owner, (callee, caller), Some(call));
-    let inner_reply = message(&mut p, layer, 60, owner, (callee, caller), Some(inner));
-    *p.elements.get_mut(&owner).unwrap().steps_mut().unwrap() =
-        vec![call, inner, inner_reply, reply];
-    Fixture {
-        project: p,
-        owner,
-        caller,
-        callee,
-        call,
-        inner,
-        reply,
-        inner_reply,
-    }
-}
-fn scene(f: &Fixture) -> Scene {
-    let errors: Vec<_> = validation::validate(&f.project)
-        .into_iter()
-        .filter(|i| i.severity == validation::Severity::Error)
-        .collect();
-    assert!(errors.is_empty(), "Actual core fixture: {errors:#?}");
-    let source = language::format(&f.project);
-    let reparsed = language::parse(&source).unwrap();
-    assert_eq!(language::format(&reparsed), source);
-    let result = Scene::sequence(&reparsed, f.owner, f.owner);
-    assert_eq!(
-        language::format(&reparsed),
-        source,
-        "Projection must not write geometry into the model"
-    );
-    result
-}
-fn bar(scene: &Scene, call: Id) -> &Segment {
-    scene.activations.iter().find(|a| a.call == call).unwrap()
-}
-
-fn long_labels(f: &mut Fixture) {
-    for occurrence in [f.call, f.inner, f.inner_reply, f.reply] {
-        f.project.elements.get_mut(&occurrence).unwrap().name =
-            "Pressure verification with a descriptive operation label".into();
-    }
-}
-
-#[test]
-fn activation_shoulders_under_label_backplates_select_their_call() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = fixture(layer, true);
-        long_labels(&mut f);
-        let scene = scene(&f);
-        let outer = bar(&scene, f.call);
-        for occurrence in [f.inner, f.inner_reply, f.reply] {
-            let message = line(&scene, occurrence);
-            let shoulder = Point::new(outer.rect.x + 1., message.label_at.y + 11.);
-            assert!(outer.rect.contains(shoulder));
-            assert!(Rectangle::new(message.label_at, Size::new(225., 22.)).contains(shoulder));
-            assert!(message.label.chars().count() > 32);
-            assert!(message.points.windows(2).all(|p| {
-                crate::diagram::distance_to_segment(shoulder, p[0], p[1]) > 8. / scene.scale
-            }));
-            assert_eq!(scene.hit(shoulder), Some(f.call));
-            assert_eq!(
-                scene.hit(message.label_at + iced::Vector::new(4., 4.)),
-                Some(occurrence),
-                "Label text outside activations remains selectable"
-            );
-        }
-        for occurrence in [f.call, f.inner, f.inner_reply, f.reply] {
-            let message = line(&scene, occurrence);
-            for endpoint in [message.points[0], *message.points.last().unwrap()] {
-                assert_eq!(scene.hit(endpoint), Some(occurrence));
-            }
-        }
-    }
-}
-
-#[tokio::test]
-async fn long_message_backplates_do_not_erase_selected_activation_border_pixels() {
-    use iced::advanced::renderer::Headless;
-    use iced_runtime::user_interface::{Cache, UserInterface};
-
-    let mut mounted = crate::behavior::canvas_workspace::tests::Mounted::unshown().await;
-    let mut f = fixture(Layer::Oa, true);
-    long_labels(&mut f);
-    let mut scene = scene(&f);
-    scene.selected = f.call;
-    let border_x = bar(&scene, f.call).rect.x;
-    let label_spans: Vec<_> = [f.inner, f.inner_reply, f.reply]
-        .into_iter()
-        .map(|id| {
-            let message = line(&scene, id);
-            assert!(
-                Rectangle::new(message.label_at, Size::new(225., 22.))
-                    .contains(Point::new(border_x, message.label_at.y + 11.))
-            );
-            (message.label_at.y + 3.) as usize..(message.label_at.y + 20.) as usize
-        })
-        .collect();
-    let dimensions = Size::new(800., 700.);
-    let content: Element<'_, Message> = canvas::Canvas::new(scene)
-        .width(dimensions.width)
-        .height(dimensions.height)
-        .into();
-    let mut ui = UserInterface::build(content, dimensions, Cache::new(), &mut mounted.renderer);
-    ui.draw(
-        &mut mounted.renderer,
-        &style::theme(),
-        &iced::advanced::renderer::Style {
-            text_color: style::INK,
-        },
-        mouse::Cursor::Unavailable,
-    );
-    let pixels = Headless::screenshot(&mut mounted.renderer, Size::new(800, 700), 1., Color::WHITE);
-    let expected = [style::TEAL.r, style::TEAL.g, style::TEAL.b].map(|v| v * 255.);
-    for span in label_spans {
-        for y in span {
-            assert!(
-                ((border_x as usize - 2)..=(border_x as usize + 2)).any(|x| {
-                    let offset = (y * 800 + x) * 4;
-                    pixels[offset..offset + 3]
-                        .iter()
-                        .zip(expected)
-                        .all(|(actual, target)| (*actual as f32 - target).abs() < 30.)
-                }),
-                "Selected activation border was erased at y={y}"
-            );
-        }
-    }
-}
-fn line(scene: &Scene, occurrence: Id) -> &super::super::Line {
-    scene.lines.iter().find(|a| a.id == occurrence).unwrap()
-}
-fn endpoints(p: &mut Project, occurrence: Id, from: Id, to: Id) {
-    if let SharedBody::Occurrence {
-        body: OccurrenceBody::Exchange {
-            sender, receiver, ..
-        },
-        ..
-    } = p
-        .elements
-        .get_mut(&occurrence)
-        .unwrap()
-        .shared_mut()
-        .unwrap()
-    {
-        *sender = Some(from);
-        *receiver = Some(to);
-    }
-}
-
-#[test]
-fn nested_calls_expose_both_bars_and_end_at_their_exact_replies_in_both_directions() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        for reverse in [false, true] {
-            let mut f = fixture(layer, true);
-            if reverse {
-                for occurrence in [f.call, f.inner] {
-                    endpoints(&mut f.project, occurrence, f.callee, f.caller);
-                }
-                for occurrence in [f.reply, f.inner_reply] {
-                    endpoints(&mut f.project, occurrence, f.caller, f.callee);
-                }
-            }
-            let scene = scene(&f);
-            let outer = bar(&scene, f.call);
-            let inner = bar(&scene, f.inner);
-            assert!(outer.rect.y < inner.rect.y && outer.bottom() > inner.bottom());
-            assert_eq!(outer.column, 0);
-            assert_eq!(inner.column, 1);
-            assert!(outer.rect.x < inner.rect.x && outer.edge(true) < inner.edge(true));
-            for (call, reply) in [(f.call, f.reply), (f.inner, f.inner_reply)] {
-                let execution = bar(&scene, call);
-                let received = *line(&scene, call).points.last().unwrap();
-                let returned = line(&scene, reply).points[0];
-                assert_eq!(execution.rect.y, received.y);
-                assert_eq!(execution.bottom(), returned.y);
-                assert_eq!(received.x, execution.edge(reverse));
-                assert_eq!(returned.x, execution.edge(reverse));
-                assert_eq!(execution.finish, Finish::Reply(reply));
-            }
-            assert!(scene.open_calls.is_empty());
-        }
-    }
-}
-
-#[test]
-fn call_uuid_order_does_not_choose_activation_columns_or_message_anchors() {
-    let f = fixture(Layer::Oa, false);
-    let g = fixture(Layer::Oa, true);
-    let a = scene(&f);
-    let b = scene(&g);
-    for (x, y) in [
-        (f.call, g.call),
-        (f.inner, g.inner),
-        (f.reply, g.reply),
-        (f.inner_reply, g.inner_reply),
-    ] {
-        assert_eq!(line(&a, x).points, line(&b, y).points);
-    }
-    for (x, y) in [(f.call, g.call), (f.inner, g.inner)] {
-        assert_eq!(bar(&a, x).rect, bar(&b, y).rect);
-    }
-}
-
-#[test]
-fn sequential_calls_reuse_column_and_crossed_replies_keep_their_correlations() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = fixture(layer, true);
-        *f.project
-            .elements
-            .get_mut(&f.owner)
-            .unwrap()
-            .steps_mut()
-            .unwrap() = vec![f.call, f.reply, f.inner, f.inner_reply];
-        let sequential = scene(&f);
-        assert_eq!(
-            bar(&sequential, f.call).rect.x,
-            bar(&sequential, f.inner).rect.x
-        );
-        *f.project
-            .elements
-            .get_mut(&f.owner)
-            .unwrap()
-            .steps_mut()
-            .unwrap() = vec![f.call, f.inner, f.reply, f.inner_reply];
-        let crossed = scene(&f);
-        assert!(bar(&crossed, f.call).bottom() < bar(&crossed, f.inner).bottom());
-        assert!(bar(&crossed, f.call).rect.x < bar(&crossed, f.inner).rect.x);
-        assert_eq!(
-            line(&crossed, f.reply).points[0].x,
-            bar(&crossed, f.call).edge(false)
-        );
-        assert_eq!(
-            line(&crossed, f.inner_reply).points[0].x,
-            bar(&crossed, f.inner).edge(false)
-        );
-    }
-}
-
-#[test]
-fn self_call_receives_at_lower_loop_end_and_self_reply_returns_to_the_parent() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = fixture(layer, true);
-        endpoints(&mut f.project, f.inner, f.callee, f.callee);
-        endpoints(&mut f.project, f.inner_reply, f.callee, f.callee);
-        let scene = scene(&f);
-        let parent = bar(&scene, f.call);
-        let child = bar(&scene, f.inner);
-        let call = line(&scene, f.inner);
-        let reply = line(&scene, f.inner_reply);
-        assert_eq!(call.points[0].x, parent.edge(true));
-        assert_eq!(call.points[3], Point::new(child.edge(true), child.rect.y));
-        assert_eq!(child.rect.y, scene.rows[&f.inner].1 + 24.);
-        assert_eq!(
-            reply.points[0],
-            Point::new(child.edge(true), child.bottom())
-        );
-        assert_eq!(reply.points[3].x, parent.edge(true));
-        assert!(call.points[1].x > child.edge(true));
-        assert!(reply.points[1].x > child.edge(true));
-    }
-}
-
-#[test]
-fn an_inactive_self_call_has_no_fabricated_parent_and_three_nested_calls_expose_three_columns() {
-    let mut f = fixture(Layer::Oa, true);
-    endpoints(&mut f.project, f.inner, f.callee, f.callee);
-    endpoints(&mut f.project, f.inner_reply, f.callee, f.callee);
-    f.project.elements.remove(&f.call);
-    f.project.elements.remove(&f.reply);
-    *f.project
-        .elements
-        .get_mut(&f.owner)
-        .unwrap()
-        .steps_mut()
-        .unwrap() = vec![f.inner, f.inner_reply];
-    let isolated = scene(&f);
-    assert_eq!(isolated.activations.len(), 1);
-    assert_eq!(bar(&isolated, f.inner).column, 0);
-    assert_eq!(
-        line(&isolated, f.inner).points[0].x,
-        isolated.lanes[&f.callee]
-    );
-    assert_eq!(
-        line(&isolated, f.inner_reply).points[3].x,
-        isolated.lanes[&f.callee]
-    );
-    assert_eq!(
-        bar(&isolated, f.inner).rect.y,
-        line(&isolated, f.inner).points[3].y
-    );
-
-    let mut f = fixture(Layer::Oa, true);
-    let third = message(
-        &mut f.project,
-        Layer::Oa,
-        20,
-        f.owner,
-        (f.caller, f.callee),
-        None,
-    );
-    let third_reply = message(
-        &mut f.project,
-        Layer::Oa,
-        21,
-        f.owner,
-        (f.callee, f.caller),
-        Some(third),
-    );
-    *f.project
-        .elements
-        .get_mut(&f.owner)
-        .unwrap()
-        .steps_mut()
-        .unwrap() = vec![f.call, f.inner, third, third_reply, f.inner_reply, f.reply];
-    let scene = scene(&f);
-    let calls: Vec<_> = scene.activations.iter().map(|a| a.call).collect();
-    assert_eq!(
-        calls,
-        vec![f.call, f.inner, third],
-        "Paint order is shallow to deep"
-    );
-    for (column, call) in [f.call, f.inner, third].into_iter().enumerate() {
-        let execution = bar(&scene, call);
-        assert_eq!(execution.column, column);
-        let y = (bar(&scene, third).rect.y + bar(&scene, third).bottom()) / 2.;
-        assert_eq!(
-            scene.hit(Point::new(execution.rect.x + OFFSET / 2., y)),
-            Some(call)
-        );
-    }
-}
-
-#[test]
-fn reentrant_call_uses_the_other_receiver_without_inventing_a_caller_execution() {
-    let mut f = fixture(Layer::Oa, true);
-    endpoints(&mut f.project, f.inner, f.callee, f.caller);
-    endpoints(&mut f.project, f.inner_reply, f.caller, f.callee);
-    let scene = scene(&f);
-    assert_eq!(bar(&scene, f.call).column, 0);
-    assert_eq!(bar(&scene, f.inner).column, 0);
-    assert_eq!(bar(&scene, f.inner).receiver, f.caller);
-    assert_eq!(line(&scene, f.call).points[0].x, scene.lanes[&f.caller]);
-    assert_eq!(
-        line(&scene, f.inner).points[0].x,
-        bar(&scene, f.call).edge(false)
-    );
-}
-
-#[test]
-fn actual_canvas_pointer_selects_each_exposed_shoulder_under_zoom_and_pan() {
-    let f = fixture(Layer::Oa, true);
-    let mut scene = scene(&f);
-    let context = scenario::direct_tests::context(f.owner);
-    scene.interaction = Some((context, scenario::CanvasTool::Select, true));
-    let y = (bar(&scene, f.inner).rect.y + bar(&scene, f.inner).bottom()) / 2.;
-    let outer = Point::new(bar(&scene, f.call).rect.x + OFFSET / 2., y);
-    let inner = Point::new(bar(&scene, f.inner).edge(true) - OFFSET / 2., y);
-    for scale in [1., 0.25, 0.05] {
-        scene.scale = scale;
-        scene.camera_pan = iced::Vector::new(50., 25.);
-        let bounds = Rectangle::new(Point::new(30., 40.), Size::new(1000., 700.));
-        for (point, call) in [(outer, f.call), (inner, f.inner)] {
-            assert_eq!(scene.hit(point), Some(call));
-            let cursor = bounds.position()
-                + scene.camera_pan
-                + iced::Vector::new(point.x * scale, point.y * scale);
-            let mut state = SequenceInput::default();
-            let _ = canvas::Program::update(
-                &scene,
-                &mut state,
-                &canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                bounds,
-                mouse::Cursor::Available(cursor),
-            );
-            let action = canvas::Program::update(
-                &scene,
-                &mut state,
-                &canvas::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
-                bounds,
-                mouse::Cursor::Available(cursor),
-            )
-            .unwrap();
-            assert!(matches!(action.into_inner().0,
-                Some(Message::ScenarioCanvas(scenario::CanvasEvent::Select(_, selected))) if selected == call));
-        }
-    }
-}
-
-#[test]
-fn missing_reply_is_a_short_explicit_open_span_and_an_uncorrelated_reply_closes_nothing() {
-    let mut f = fixture(Layer::Oa, true);
-    if let SharedBody::Occurrence {
-        body: OccurrenceBody::Exchange { reply_to, .. },
-        ..
-    } = f
-        .project
-        .elements
-        .get_mut(&f.reply)
-        .unwrap()
-        .shared_mut()
-        .unwrap()
-    {
-        *reply_to = None;
-    }
-    let scene = scene(&f);
-    assert_eq!(bar(&scene, f.call).finish, Finish::Open);
-    assert_eq!(bar(&scene, f.call).rect.height, 26.);
-    assert_eq!(scene.open_calls.len(), 1);
-    assert_eq!(
-        bar(&scene, f.inner).column,
-        0,
-        "Unknown duration does not prove later nesting"
-    );
-    assert_eq!(bar(&scene, f.inner).finish, Finish::Reply(f.inner_reply));
-}
-
-#[test]
-fn alternative_and_parallel_operand_local_calls_do_not_nest_from_screen_order() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        for operator in [FragmentOperator::Alternative, FragmentOperator::Parallel] {
-            let mut f = fixture(layer, true);
-            let fragment = seed(&mut f.project, layer, 70, Kind::Occurrence, Some(f.owner));
-            let branches = [id(71), id(72)];
-            *f.project
-                .elements
-                .get_mut(&fragment)
-                .unwrap()
-                .shared_mut()
-                .unwrap() = SharedBody::Occurrence {
-                body: OccurrenceBody::Fragment {
-                    operator,
-                    branches: branches.to_vec(),
-                },
-                precondition: String::new(),
-                postcondition: String::new(),
-            };
-            for (index, occurrences) in [vec![f.call, f.reply], vec![f.inner, f.inner_reply]]
-                .into_iter()
-                .enumerate()
-            {
-                let branch = seed(
-                    &mut f.project,
-                    layer,
-                    71 + index as u128,
-                    Kind::Occurrence,
-                    Some(fragment),
-                );
-                for occurrence in &occurrences {
-                    f.project.elements.get_mut(occurrence).unwrap().parent = Some(branch);
-                }
-                *f.project
-                    .elements
-                    .get_mut(&branch)
-                    .unwrap()
-                    .shared_mut()
-                    .unwrap() = SharedBody::Occurrence {
-                    body: OccurrenceBody::Branch {
-                        guard: format!("condition_{index}"),
-                        occurrences,
-                    },
-                    precondition: String::new(),
-                    postcondition: String::new(),
-                };
-            }
-            *f.project
-                .elements
-                .get_mut(&f.owner)
-                .unwrap()
-                .steps_mut()
-                .unwrap() = vec![fragment];
-            let scene = scene(&f);
-            assert_eq!(bar(&scene, f.call).column, 0);
-            assert_eq!(bar(&scene, f.inner).column, 0);
-            assert_ne!(bar(&scene, f.call).scope, bar(&scene, f.inner).scope);
-            assert!(scene.open_calls.is_empty());
-        }
-    }
-}
-
-#[test]
-fn inherited_execution_anchors_a_self_call_inside_an_operand_before_returning_after_the_fragment() {
-    let mut f = fixture(Layer::Oa, true);
-    endpoints(&mut f.project, f.inner, f.callee, f.callee);
-    endpoints(&mut f.project, f.inner_reply, f.callee, f.callee);
-    let fragment = seed(
-        &mut f.project,
-        Layer::Oa,
-        70,
-        Kind::Occurrence,
-        Some(f.owner),
-    );
-    *f.project
-        .elements
-        .get_mut(&fragment)
-        .unwrap()
-        .shared_mut()
-        .unwrap() = SharedBody::Occurrence {
-        body: OccurrenceBody::Fragment {
-            operator: FragmentOperator::Alternative,
-            branches: vec![id(71), id(72)],
-        },
-        precondition: String::new(),
-        postcondition: String::new(),
-    };
-    for (index, occurrences) in [vec![f.inner, f.inner_reply], vec![]]
-        .into_iter()
-        .enumerate()
-    {
-        let branch = seed(
-            &mut f.project,
-            Layer::Oa,
-            71 + index as u128,
-            Kind::Occurrence,
-            Some(fragment),
-        );
-        for occurrence in &occurrences {
-            f.project.elements.get_mut(occurrence).unwrap().parent = Some(branch);
-        }
-        *f.project
-            .elements
-            .get_mut(&branch)
-            .unwrap()
-            .shared_mut()
-            .unwrap() = SharedBody::Occurrence {
-            body: OccurrenceBody::Branch {
-                guard: format!("condition_{index}"),
-                occurrences,
-            },
-            precondition: String::new(),
-            postcondition: String::new(),
-        };
-    }
-    *f.project
-        .elements
-        .get_mut(&f.owner)
-        .unwrap()
-        .steps_mut()
-        .unwrap() = vec![f.call, fragment, f.reply];
-    let scene = scene(&f);
-    let parent = scene
-        .activations
-        .iter()
-        .find(|a| a.call == f.call && a.scope == id(71))
-        .unwrap();
-    assert_eq!(parent.finish, Finish::Continuation);
-    assert_eq!(bar(&scene, f.inner).column, parent.column + 1);
-    assert_eq!(line(&scene, f.inner).points[0].x, parent.edge(true));
-    assert_eq!(line(&scene, f.inner_reply).points[3].x, parent.edge(true));
-    assert!(
-        scene
-            .activations
-            .iter()
-            .any(|a| a.call == f.call && a.finish == Finish::Reply(f.reply))
-    );
-}
-
-#[test]
-fn a_fragment_cannot_make_crossed_calls_an_unambiguous_caller_execution() {
-    for placement in ["plain", "before_fragment", "in_operand"] {
-        let mut f = fixture(Layer::Oa, true);
-        let outgoing = message(
-            &mut f.project,
-            Layer::Oa,
-            80,
-            f.owner,
-            (f.callee, f.caller),
-            None,
-        );
-        if let SharedBody::Occurrence {
-            body: OccurrenceBody::Exchange { message_kind, .. },
-            ..
-        } = f
-            .project
-            .elements
-            .get_mut(&outgoing)
-            .unwrap()
-            .shared_mut()
-            .unwrap()
-        {
-            *message_kind = MessageKind::Asynchronous;
-        }
-        let mut ordered = vec![f.call, f.inner];
-        if placement != "in_operand" {
-            ordered.push(outgoing);
-        }
-        if placement != "plain" {
-            let fragment = seed(
-                &mut f.project,
-                Layer::Oa,
-                70,
-                Kind::Occurrence,
-                Some(f.owner),
-            );
-            *f.project
-                .elements
-                .get_mut(&fragment)
-                .unwrap()
-                .shared_mut()
-                .unwrap() = SharedBody::Occurrence {
-                body: OccurrenceBody::Fragment {
-                    operator: FragmentOperator::Alternative,
-                    branches: vec![id(71), id(72)],
-                },
-                precondition: String::new(),
-                postcondition: String::new(),
-            };
-            for index in 0..2u128 {
-                let branch = seed(
-                    &mut f.project,
-                    Layer::Oa,
-                    71 + index,
-                    Kind::Occurrence,
-                    Some(fragment),
-                );
-                let occurrences = if index == 0 && placement == "in_operand" {
-                    f.project.elements.get_mut(&outgoing).unwrap().parent = Some(branch);
-                    vec![outgoing]
-                } else {
-                    vec![]
-                };
-                *f.project
-                    .elements
-                    .get_mut(&branch)
-                    .unwrap()
-                    .shared_mut()
-                    .unwrap() = SharedBody::Occurrence {
-                    body: OccurrenceBody::Branch {
-                        guard: format!("condition_{index}"),
-                        occurrences,
-                    },
-                    precondition: String::new(),
-                    postcondition: String::new(),
-                };
-            }
-            ordered.push(fragment);
-        }
-        ordered.extend([f.reply, f.inner_reply]);
-        *f.project
-            .elements
-            .get_mut(&f.owner)
-            .unwrap()
-            .steps_mut()
-            .unwrap() = ordered;
-        let scene = scene(&f);
-        assert_eq!(
-            line(&scene, outgoing).points[0].x,
-            scene.lanes[&f.callee],
-            "{placement}"
-        );
-    }
-}
-
-#[test]
-fn nested_correlations_returning_in_alternative_operands_remain_nested_before_the_fragment() {
-    let mut f = fixture(Layer::Oa, true);
-    let outgoing = message(
-        &mut f.project,
-        Layer::Oa,
-        80,
-        f.owner,
-        (f.callee, f.caller),
-        None,
-    );
-    if let SharedBody::Occurrence {
-        body: OccurrenceBody::Exchange { message_kind, .. },
-        ..
-    } = f
-        .project
-        .elements
-        .get_mut(&outgoing)
-        .unwrap()
-        .shared_mut()
-        .unwrap()
-    {
-        *message_kind = MessageKind::Asynchronous;
-    }
-    let fragment = seed(
-        &mut f.project,
-        Layer::Oa,
-        70,
-        Kind::Occurrence,
-        Some(f.owner),
-    );
-    *f.project
-        .elements
-        .get_mut(&fragment)
-        .unwrap()
-        .shared_mut()
-        .unwrap() = SharedBody::Occurrence {
-        body: OccurrenceBody::Fragment {
-            operator: FragmentOperator::Alternative,
-            branches: vec![id(71), id(72)],
-        },
-        precondition: String::new(),
-        postcondition: String::new(),
-    };
-    for index in 0..2u128 {
-        let branch = seed(
-            &mut f.project,
-            Layer::Oa,
-            71 + index,
-            Kind::Occurrence,
-            Some(fragment),
-        );
-        let occurrences = if index == 0 {
-            for reply in [f.inner_reply, f.reply] {
-                f.project.elements.get_mut(&reply).unwrap().parent = Some(branch);
-            }
-            vec![f.inner_reply, f.reply]
-        } else {
-            vec![
-                message(
-                    &mut f.project,
-                    Layer::Oa,
-                    90,
-                    branch,
-                    (f.callee, f.caller),
-                    Some(f.inner),
-                ),
-                message(
-                    &mut f.project,
-                    Layer::Oa,
-                    91,
-                    branch,
-                    (f.callee, f.caller),
-                    Some(f.call),
-                ),
-            ]
-        };
-        *f.project
-            .elements
-            .get_mut(&branch)
-            .unwrap()
-            .shared_mut()
-            .unwrap() = SharedBody::Occurrence {
-            body: OccurrenceBody::Branch {
-                guard: format!("condition_{index}"),
-                occurrences,
-            },
-            precondition: String::new(),
-            postcondition: String::new(),
-        };
-    }
-    *f.project
-        .elements
-        .get_mut(&f.owner)
-        .unwrap()
-        .steps_mut()
-        .unwrap() = vec![f.call, f.inner, outgoing, fragment];
-    let scene = scene(&f);
-    let inner = scene
-        .activations
-        .iter()
-        .find(|a| a.call == f.inner && a.scope == f.owner)
-        .unwrap();
-    assert_eq!(line(&scene, outgoing).points[0].x, inner.edge(false));
-}

crates/oa-desktop/src/behavior/scenario_label.rs

@@ -0,0 +1,430 @@
+//! Unwired single-line scenario label experiment. No renderer or schema is changed.
+//!
+//! Iced 0.14.0 WGPU `geometry::Frame::fill_text` shapes positive uniform-scale
+//! canvas text at `size * zoom`; its `text::prepare` uses graphics text::Cache.
+//! This adapter uses that same allocator/font system/attributes, not a character
+//! width estimate. Canvas Text::max_width is wrapping, so it stays infinite.
+//! Experimental parity requires settled fonts and a fresh renderer/cache after
+//! font loading. Iced's WGPU text cache key omits FontSystem::Version, so merely
+//! remeasuring here cannot repair its cached glyph buffers after dynamic loading.
+//! A RenderSession is caller attestation of that lifecycle, not its enforcement.
+//! No fonts may be loaded between measurement, guarded access and actual draw.
+//!
+//! Integration seam: after lifecycle/activation endpoint alignment, a caller
+//! supplies a usable text width in world units and retains one cache per live
+//! labelled occurrence across Scene rebuilds. Paint, hit testing, navigation and extents
+//! consume the returned Label. Position/color do not invalidate measurement.
+//! This does NOT choose a self-call, reversed-arrow or obstacle corridor policy.
+//! It measures layout advances, not raster ink; overhang/clip/activation-border
+//! acceptance still requires the real WGPU evaluator. The old 32-grapheme/225px
+//! renderer is deliberately untouched for a later baseline comparison.
+use iced::advanced::{
+    graphics::text as graphics_text,
+    text::{Alignment, LineHeight, Shaping},
+};
+use iced::{Color, Font, Pixels, Point, Rectangle, Size, widget::canvas::Text};
+use std::{collections::VecDeque, ops::Range, sync::Arc};
+use unicode_segmentation::UnicodeSegmentation;
+
+const MAX_SOURCE_BYTES: usize = 64 * 1024;
+const MAX_GRAPHEMES: usize = 4096;
+const MAX_ENTRIES: usize = 2;
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) struct Style {
+    pub font: Font,
+    pub size: Pixels,
+    pub line_height: LineHeight,
+    pub shaping: Shaping,
+}
+
+impl Default for Style {
+    fn default() -> Self {
+        let text = Text::default();
+        Self {
+            font: text.font,
+            size: Pixels(12.),
+            line_height: text.line_height,
+            shaping: text.shaping,
+        }
+    }
+}
+
+impl Style {
+    fn scaled(self, zoom: f32) -> (f32, f32) {
+        let size = Pixels(self.size.0 * zoom);
+        let line_height = match self.line_height {
+            LineHeight::Absolute(value) => LineHeight::Absolute(Pixels(value.0 * zoom)),
+            LineHeight::Relative(value) => LineHeight::Relative(value),
+        };
+        (size.0, line_height.to_absolute(size).0)
+    }
+}
+
+/// Explicit experimental contract: the caller finishes loading fonts and starts
+/// a fresh renderer/cache BEFORE capturing this session, then keeps fonts fixed.
+/// This module cannot inspect or reset the actual renderer's text cache.
+#[derive(Clone, Debug)]
+pub(super) struct RenderSession {
+    version: graphics_text::Version,
+    identity: Arc<()>,
+}
+
+impl RenderSession {
+    pub fn after_fonts_settled_and_renderer_reset() -> Result<Self, Error> {
+        let fonts = graphics_text::font_system()
+            .read()
+            .map_err(|_| Error::FontSystemUnavailable)?;
+        Ok(Self {
+            version: fonts.version(),
+            identity: Arc::new(()),
+        })
+    }
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct Label {
+    source: String,
+    displayed: String,
+    /// Original-label bytes represented before any added ellipsis. Includes
+    /// collapsed whitespace, but `retains_any` never counts whitespace as text.
+    retained_source: Range<usize>,
+    /// World-space layout advances, at origin; not glyph-ink containment.
+    bounds: Rectangle,
+    style: Style,
+    measured_session: RenderSession,
+    measured_zoom: f32,
+}
+
+impl Label {
+    fn check(&self, session: &RenderSession, zoom: f32) -> Result<(), Error> {
+        if !Arc::ptr_eq(&self.measured_session.identity, &session.identity) {
+            return Err(Error::StaleRenderSession);
+        }
+        if !zoom.is_finite() || zoom != self.measured_zoom {
+            return Err(Error::StaleZoom);
+        }
+        let fonts = graphics_text::font_system()
+            .read()
+            .map_err(|_| Error::FontSystemUnavailable)?;
+        if fonts.version() != self.measured_session.version || fonts.version() != session.version {
+            return Err(Error::FontSetChanged);
+        }
+        Ok(())
+    }
+
+    pub fn displayed(&self, session: &RenderSession, zoom: f32) -> Result<&str, Error> {
+        self.check(session, zoom)?;
+        Ok(&self.displayed)
+    }
+
+    pub fn retained_source(
+        &self,
+        session: &RenderSession,
+        zoom: f32,
+    ) -> Result<Range<usize>, Error> {
+        self.check(session, zoom)?;
+        Ok(self.retained_source.clone())
+    }
+
+    pub fn retains_any(
+        &self,
+        session: &RenderSession,
+        zoom: f32,
+        field: Range<usize>,
+    ) -> Result<bool, Error> {
+        self.check(session, zoom)?;
+        if field.start > field.end || self.source.get(field.clone()).is_none() {
+            return Ok(false);
+        }
+        let end = field.end.min(self.retained_source.end);
+        Ok(field.start < end
+            && self
+                .source
+                .get(field.start..end)
+                .is_some_and(|text| text.chars().any(|c| !c.is_whitespace())))
+    }
+
+    /// Validate finite world position and rectangle endpoints only. Camera
+    /// transforms and raster bounds remain a separate integration contract.
+    pub fn bounds_at(
+        &self,
+        session: &RenderSession,
+        zoom: f32,
+        position: Point,
+    ) -> Result<Rectangle, Error> {
+        self.check(session, zoom)?;
+        translated_bounds(position, self.bounds.size())
+    }
+
+    /// Paint under the same positive uniform zoom used for `Cache::resolve`.
+    /// No per-label wrapping or implicit text maximum is introduced.
+    /// The returned Text must be consumed immediately in this session/zoom;
+    /// retaining raw Text past another font load/zoom change bypasses the guard.
+    pub fn canvas_text(
+        &self,
+        session: &RenderSession,
+        zoom: f32,
+        position: Point,
+        color: Color,
+    ) -> Result<Text, Error> {
+        self.bounds_at(session, zoom, position)?;
+        Ok(Text {
+            content: self.displayed.clone(),
+            position,
+            color,
+            size: self.style.size,
+            line_height: self.style.line_height,
+            font: self.style.font,
+            shaping: self.style.shaping,
+            max_width: f32::INFINITY,
+            ..Text::default()
+        })
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum Error {
+    InvalidMetrics,
+    SourceBudget,
+    GraphemeBudget,
+    FontSystemUnavailable,
+    InvalidMeasurement,
+    InvalidPosition,
+    StaleZoom,
+    StaleRenderSession,
+    FontSetChanged,
+}
+
+struct Entry {
+    source: String,
+    style: Style,
+    zoom: f32,
+    width: f32,
+    label: Arc<Label>,
+}
+
+#[derive(Default)]
+/// Two recent resolutions for ONE live labelled occurrence. A global small LRU
+/// would thrash when a larger Scene is rebuilt in order. The integration owner
+/// must retain these by occurrence identity and prune on removal/document change.
+pub(super) struct Cache {
+    version: Option<graphics_text::Version>,
+    session: Option<Arc<()>>,
+    entries: VecDeque<Entry>,
+    #[cfg(test)]
+    allocations: usize,
+}
+
+impl Cache {
+    /// `width` excludes any caller-chosen backplate padding. Zero is valid.
+    /// Cache ownership must survive redraws; constructing one per Scene defeats
+    /// reuse. Changed fonts invalidate the SESSION: the caller must establish
+    /// a fresh renderer and a new settled session, not just remeasure this cache.
+    /// Error handling/fallback for these explicit experiment budgets is an
+    /// integration decision; never silently paint the old truncated contract.
+    pub fn resolve(
+        &mut self,
+        session: &RenderSession,
+        source: &str,
+        width: f32,
+        zoom: f32,
+        style: Style,
+    ) -> Result<Arc<Label>, Error> {
+        let (size, line_height) = style.scaled(zoom);
+        if !width.is_finite()
+            || width < 0.
+            || !zoom.is_finite()
+            || zoom <= 0.
+            || !size.is_finite()
+            || size <= 0.
+            || !line_height.is_finite()
+            || line_height <= 0.
+            || !(width * zoom).is_finite()
+            || !(size / zoom).is_finite()
+            || !(line_height / zoom).is_finite()
+        {
+            return Err(Error::InvalidMetrics);
+        }
+        if source.len() > MAX_SOURCE_BYTES {
+            return Err(Error::SourceBudget);
+        }
+        let mut fonts = graphics_text::font_system()
+            .write()
+            .map_err(|_| Error::FontSystemUnavailable)?;
+        if session.version != fonts.version() {
+            return Err(Error::FontSetChanged);
+        }
+        if self.version != Some(fonts.version())
+            || self
+                .session
+                .as_ref()
+                .is_none_or(|identity| !Arc::ptr_eq(identity, &session.identity))
+        {
+            self.entries.clear();
+            self.version = Some(fonts.version());
+            self.session = Some(session.identity.clone());
+        }
+        if let Some(index) = self.entries.iter().position(|entry| {
+            entry.source == source
+                && entry.style == style
+                && entry.zoom == zoom
+                && entry.width == width
+        }) {
+            let entry = self.entries.remove(index).unwrap();
+            let label = entry.label.clone();
+            self.entries.push_back(entry);
+            return Ok(label);
+        }
+        let normalized = Normalized::new(source);
+        let cuts: Vec<usize> = normalized
+            .text
+            .grapheme_indices(true)
+            .map(|(i, _)| i)
+            .chain(std::iter::once(normalized.text.len()))
+            .collect();
+        if cuts.len().saturating_sub(1) > MAX_GRAPHEMES {
+            return Err(Error::GraphemeBudget);
+        }
+        // Candidate buffers are temporary. Only the resolved strings/metrics
+        // survive, bounded by MAX_ENTRIES; renderer caching remains independent.
+        let mut shapes = graphics_text::Cache::new();
+        let mut measure = |content: &str| -> Result<Size, Error> {
+            if content.is_empty() {
+                return Ok(Size::ZERO);
+            }
+            #[cfg(test)]
+            {
+                self.allocations += 1;
+            }
+            let (_, entry) = shapes.allocate(
+                fonts.raw(),
+                graphics_text::cache::Key {
+                    content,
+                    size,
+                    line_height,
+                    font: style.font,
+                    bounds: Size::INFINITE,
+                    shaping: style.shaping,
+                    align_x: Alignment::Default,
+                },
+            );
+            if entry.buffer.layout_runs().count() != 1
+                || !entry.min_bounds.width.is_finite()
+                || !entry.min_bounds.height.is_finite()
+            {
+                return Err(Error::InvalidMeasurement);
+            }
+            world_size(entry.min_bounds, zoom)
+        };
+        let full = measure(&normalized.text)?;
+        let (displayed, retained, measured) = if full.width <= width {
+            (normalized.text.clone(), normalized.text.len(), full)
+        } else {
+            let ellipsis = measure("…")?;
+            if ellipsis.width > width {
+                (String::new(), 0, Size::ZERO)
+            } else {
+                // Every accepted candidate is actually shaped and fits. Search
+                // is bounded/logarithmic; contextual shaping is not universally
+                // monotone, so this does NOT promise the globally longest prefix.
+                // Full content is always checked first and never needlessly cut.
+                let mut best = ("…".to_owned(), 0, ellipsis);
+                let (mut low, mut high) = (1, cuts.len().saturating_sub(1));
+                while low < high {
+                    let middle = low + (high - low) / 2;
+                    let candidate = format!("{}…", &normalized.text[..cuts[middle]]);
+                    let measured = measure(&candidate)?;
+                    if measured.width <= width {
+                        best = (candidate, cuts[middle], measured);
+                        low = middle + 1;
+                    } else {
+                        high = middle;
+                    }
+                }
+                best
+            }
+        };
+        let label = Arc::new(Label {
+            source: source.into(),
+            displayed,
+            retained_source: 0..normalized.source_end(retained),
+            bounds: Rectangle::with_size(measured),
+            style,
+            measured_session: session.clone(),
+            measured_zoom: zoom,
+        });
+        if self.entries.len() == MAX_ENTRIES {
+            self.entries.pop_front();
+        }
+        self.entries.push_back(Entry {
+            source: source.into(),
+            style,
+            zoom,
+            width,
+            label: label.clone(),
+        });
+        Ok(label)
+    }
+}
+
+fn world_size(scaled: Size, zoom: f32) -> Result<Size, Error> {
+    let world = Size::new(scaled.width / zoom, scaled.height / zoom);
+    if !world.width.is_finite()
+        || !world.height.is_finite()
+        || world.width < 0.
+        || world.height < 0.
+    {
+        return Err(Error::InvalidMeasurement);
+    }
+    Ok(world)
+}
+
+fn translated_bounds(position: Point, size: Size) -> Result<Rectangle, Error> {
+    if !position.x.is_finite()
+        || !position.y.is_finite()
+        || !(position.x + size.width).is_finite()
+        || !(position.y + size.height).is_finite()
+    {
+        return Err(Error::InvalidPosition);
+    }
+    Ok(Rectangle::new(position, size))
+}
+
+struct Normalized {
+    text: String,
+    ends: Vec<(usize, usize)>,
+}
+impl Normalized {
+    fn new(source: &str) -> Self {
+        let mut result = Self {
+            text: String::new(),
+            ends: vec![(0, 0)],
+        };
+        let mut separator = false;
+        for (start, c) in source.char_indices() {
+            if c.is_whitespace() {
+                separator = !result.text.is_empty();
+                continue;
+            }
+            if separator {
+                result.text.push(' ');
+                result.ends.push((result.text.len(), start));
+                separator = false;
+            }
+            result.text.push(c);
+            result.ends.push((result.text.len(), start + c.len_utf8()));
+        }
+        result
+    }
+    fn source_end(&self, normalized_end: usize) -> usize {
+        self.ends
+            .binary_search_by_key(&normalized_end, |(end, _)| *end)
+            .map(|index| self.ends[index].1)
+            .expect("grapheme cuts are character boundaries")
+    }
+}
+
+#[cfg(test)]
+#[path = "scenario_label/tests.rs"]
+mod tests;

crates/oa-desktop/src/behavior/scenario_label/corridor.rs

@@ -0,0 +1,231 @@
+//! Unwired corridor-policy candidate for the measured scenario-label experiment.
+//!
+//! The caller supplies a finite structural label band AFTER endpoint/activation
+//! alignment, with padding already removed from its edges. Blockers include
+//! padded activation/card/header bounds over the complete text band, including
+//! stroke/ink clearance. This function does not infer a self-message corridor,
+//! alter scene extents, change zoom, or establish raster-ink containment.
+use iced::Rectangle;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) struct InvalidGeometry;
+
+fn edges(rect: Rectangle) -> Result<(f32, f32, f32, f32), InvalidGeometry> {
+    let right = rect.x + rect.width;
+    let bottom = rect.y + rect.height;
+    if [rect.x, rect.y, rect.width, rect.height, right, bottom]
+        .into_iter()
+        .any(|value| !value.is_finite())
+        || rect.width < 0.
+        || rect.height < 0.
+    {
+        return Err(InvalidGeometry);
+    }
+    Ok((rect.x, right, rect.y, bottom))
+}
+
+/// Select one connected clear interval; never assemble text across blockers.
+/// Prefer greater width, then proximity to the previous label anchor, then the
+/// leftmost interval. Input order has no influence. A zero-area band has no
+/// corridor. Touching the padded vertical band is conservatively obstructing;
+/// a zero-area blocker has no area and must receive stroke padding upstream.
+pub(super) fn widest_clear(
+    band: Rectangle,
+    blockers: &[Rectangle],
+    preferred_anchor: f32,
+) -> Result<Option<Rectangle>, InvalidGeometry> {
+    let (left, right, top, bottom) = edges(band)?;
+    if !preferred_anchor.is_finite() {
+        return Err(InvalidGeometry);
+    }
+    let mut blocked = Vec::new();
+    for &blocker in blockers {
+        let (x0, x1, y0, y1) = edges(blocker)?;
+        if blocker.width > 0. && blocker.height > 0. && y1 >= top && y0 <= bottom {
+            let interval = (x0.max(left), x1.min(right));
+            if interval.0 < interval.1 {
+                blocked.push(interval);
+            }
+        }
+    }
+    if band.width == 0. || band.height == 0. {
+        return Ok(None);
+    }
+    blocked.sort_by(|a, b| a.0.total_cmp(&b.0).then(a.1.total_cmp(&b.1)));
+    let mut best: Option<Rectangle> = None;
+    let mut consider = |start: f32, end: f32| {
+        if start >= end {
+            return;
+        }
+        let candidate = Rectangle {
+            x: start,
+            width: contained_width(start, end),
+            ..band
+        };
+        // Use f64 only for comparison distance: subtracting two admitted f32
+        // world coordinates can overflow even though each rectangle is finite.
+        let distance = |x: f32| (f64::from(x) - f64::from(preferred_anchor)).abs();
+        if best.is_none_or(|old| {
+            candidate.width > old.width
+                || (candidate.width == old.width
+                    && (distance(candidate.x) < distance(old.x)
+                        || (distance(candidate.x) == distance(old.x) && candidate.x < old.x)))
+        }) {
+            best = Some(candidate);
+        }
+    };
+    let mut cursor = left;
+    for (start, end) in blocked {
+        consider(cursor, start);
+        cursor = cursor.max(end);
+    }
+    consider(cursor, right);
+    Ok(best)
+}
+
+/// Finite f32 endpoints can subtract to infinity or round across a blocker.
+/// Compute in f64, cap to finite f32, and round inward if nearest rounding
+/// overshot the admitted interval's end.
+fn contained_width(start: f32, end: f32) -> f32 {
+    let exact = f64::from(end) - f64::from(start);
+    let mut width = exact.min(f64::from(f32::MAX)) as f32;
+    if f64::from(start) + f64::from(width) > f64::from(end) {
+        width = width.next_down();
+    }
+    width
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn rect(x: f32, y: f32, width: f32, height: f32) -> Rectangle {
+        Rectangle {
+            x,
+            y,
+            width,
+            height,
+        }
+    }
+
+    #[test]
+    fn long_message_does_not_cross_an_intermediate_execution() {
+        let band = rect(20., 100., 700., 22.);
+        let blockers = [rect(250., 80., 16., 80.), rect(490., 90., 28., 140.)];
+        let result = widest_clear(band, &blockers, band.x).unwrap().unwrap();
+        assert_eq!(result, rect(20., 100., 230., 22.));
+        for blocker in blockers {
+            assert!(result.x + result.width <= blocker.x || result.x >= blocker.x + blocker.width);
+        }
+        assert_eq!(widest_clear(band, &[], band.x).unwrap(), Some(band));
+    }
+
+    #[test]
+    fn overlapping_unsorted_blockers_merge_and_widest_gap_wins() {
+        let band = rect(-100., 10., 600., 20.);
+        let blockers = [
+            rect(50., 0., 80., 60.),
+            rect(0., 5., 70., 30.),
+            rect(450., 0., 100., 60.),
+        ];
+        let expected = Some(rect(130., 10., 320., 20.));
+        assert_eq!(widest_clear(band, &blockers, -100.).unwrap(), expected);
+        let mut reversed = blockers;
+        reversed.reverse();
+        assert_eq!(widest_clear(band, &reversed, -100.).unwrap(), expected);
+    }
+
+    #[test]
+    fn complete_padded_band_and_touching_boundaries_are_obstructed() {
+        let band = rect(0., 100., 200., 20.);
+        // The first blocker ends at the band top: checking only a baseline
+        // would miss it. The second starts at the band bottom.
+        let blockers = [rect(0., 70., 60., 30.), rect(150., 120., 50., 30.)];
+        assert_eq!(
+            widest_clear(band, &blockers, 0.).unwrap(),
+            Some(rect(60., 100., 90., 20.))
+        );
+        let outside = [rect(0., 70., 200., 29.), rect(0., 121., 200., 30.)];
+        assert_eq!(widest_clear(band, &outside, 0.).unwrap(), Some(band));
+    }
+
+    #[test]
+    fn ties_keep_the_nearest_anchor_then_choose_leftmost() {
+        let band = rect(0., 0., 300., 20.);
+        let blockers = [rect(100., 0., 100., 20.)];
+        assert_eq!(
+            widest_clear(band, &blockers, 190.).unwrap(),
+            Some(rect(200., 0., 100., 20.))
+        );
+        assert_eq!(
+            widest_clear(band, &blockers, 100.).unwrap(),
+            Some(rect(0., 0., 100., 20.))
+        );
+    }
+
+    #[test]
+    fn caller_defined_self_and_reversed_corridors_keep_their_geometry() {
+        // Direction and self-loop policy are explicit caller inputs. Neither
+        // a zero endpoint gap nor screen width can silently supply a corridor.
+        for band in [rect(420., 40., 180., 22.), rect(-400., 90., 350., 22.)] {
+            assert_eq!(widest_clear(band, &[], band.x).unwrap(), Some(band));
+        }
+        assert_eq!(
+            widest_clear(rect(420., 40., 0., 22.), &[], 420.).unwrap(),
+            None
+        );
+        assert_eq!(
+            widest_clear(rect(420., 40., 180., 0.), &[], 420.).unwrap(),
+            None
+        );
+        assert_eq!(
+            widest_clear(rect(0., 0., 100., 20.), &[rect(-10., -10., 200., 50.)], 0.).unwrap(),
+            None
+        );
+    }
+
+    #[test]
+    fn invalid_or_overflowing_geometry_never_enters_a_corridor() {
+        let band = rect(0., 0., 100., 20.);
+        for invalid in [
+            rect(f32::NAN, 0., 10., 20.),
+            rect(0., 0., -1., 20.),
+            rect(f32::MAX, 0., f32::MAX, 20.),
+            rect(0., f32::MAX, 10., f32::MAX),
+        ] {
+            assert_eq!(widest_clear(invalid, &[], 0.), Err(InvalidGeometry));
+            assert_eq!(widest_clear(band, &[invalid], 0.), Err(InvalidGeometry));
+        }
+        assert_eq!(widest_clear(band, &[], f32::INFINITY), Err(InvalidGeometry));
+    }
+
+    #[test]
+    fn finite_band_cannot_reconstruct_an_infinite_width() {
+        let band = rect(f32::from_bits(0xfe79636e), 0., f32::MAX, 20.);
+        let right = band.x + band.width;
+        assert!(right.is_finite());
+        assert!(
+            (right - band.x).is_infinite(),
+            "counterexample must exercise f32 subtraction overflow"
+        );
+        let result = widest_clear(band, &[], 0.).unwrap().unwrap();
+        assert!(result.width.is_finite() && result.width > 0.);
+        assert!(result.x + result.width <= right);
+        assert!(f64::from(result.x) + f64::from(result.width) <= f64::from(right));
+    }
+
+    #[test]
+    fn reconstructed_width_rounds_inward_at_a_blocker() {
+        let band = rect(-999_948.562_5, 0., 1_000_000., 20.);
+        let blocker = rect(2.1, 0., 10., 20.);
+        assert!(
+            band.x + (blocker.x - band.x) > blocker.x,
+            "counterexample must cross the blocker under naive reconstruction"
+        );
+        let result = widest_clear(band, &[blocker], 0.).unwrap().unwrap();
+        assert_eq!(result.x, band.x);
+        assert!(result.width > 999_000.);
+        assert!(result.x + result.width <= blocker.x);
+        assert!(f64::from(result.x) + f64::from(result.width) <= f64::from(blocker.x));
+    }
+}

crates/oa-desktop/src/behavior/scenario_label/tests.rs

@@ -0,0 +1,487 @@
+//! Unexecuted evaluator candidates; the module is intentionally not wired yet.
+use super::*;
+use iced::advanced::{
+    graphics::text::Paragraph,
+    text::{Paragraph as _, Text as ParagraphText, Wrapping},
+};
+
+// Independent paragraph construction: no candidate cache, normalization, search,
+// or character-width estimate is used by this measurement oracle.
+fn paragraph_size(content: &str, zoom: f32, style: Style) -> Size {
+    let size = Pixels(style.size.0 * zoom);
+    let line_height = match style.line_height {
+        LineHeight::Relative(factor) => LineHeight::Relative(factor),
+        LineHeight::Absolute(pixels) => LineHeight::Absolute(Pixels(pixels.0 * zoom)),
+    };
+    let paragraph = Paragraph::with_text(ParagraphText {
+        content,
+        bounds: Size::INFINITE,
+        size,
+        line_height,
+        font: style.font,
+        align_x: Alignment::Default,
+        align_y: iced::alignment::Vertical::Top,
+        shaping: style.shaping,
+        wrapping: Wrapping::default(),
+    });
+    assert_eq!(paragraph.buffer().layout_runs().count(), 1);
+    Size::new(paragraph.min_width() / zoom, paragraph.min_height() / zoom)
+}
+
+#[test]
+fn adequate_corridor_reveals_full_realistic_names_and_distinguishing_suffixes() {
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let style = Style::default();
+    for text in [
+        "1. call · Request valve repair · Technician service conversation",
+        "2. reply · Return pressure after repair · Technician service conversation",
+        "1. call · Request redundant hydraulic pressure calibration channel A",
+        "1. call · Request redundant hydraulic pressure calibration channel B",
+    ] {
+        let wide = cache.resolve(&session, text, 1600., 1., style).unwrap();
+        assert_eq!(wide.displayed(&session, 1.).unwrap(), text);
+        assert_eq!(wide.retained_source(&session, 1.).unwrap(), 0..text.len());
+        assert_eq!(wide.bounds.size(), paragraph_size(text, 1., style));
+        let narrow = cache.resolve(&session, text, 80., 1., style).unwrap();
+        assert_ne!(narrow.displayed, text);
+        assert!(narrow.bounds.width <= 80.);
+        assert_eq!(
+            narrow.bounds.size(),
+            paragraph_size(&narrow.displayed, 1., style)
+        );
+    }
+}
+
+#[test]
+fn normalized_visible_prefix_maps_to_original_bytes_without_claiming_hidden_operation() {
+    let raw = " \t1.  call · Pump\r\n  · Operation: Need\u{301}le  ";
+    let expected = "1. call · Pump · Operation: Need\u{301}le";
+    let n = Normalized::new(raw);
+    assert_eq!(n.text, expected);
+    let prefix = "1. call · Pump ";
+    assert_eq!(n.source_end(prefix.len()), raw.find("· Operation").unwrap());
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let wide = cache
+        .resolve(&session, raw, 1600., 1., Style::default())
+        .unwrap();
+    assert_eq!(wide.displayed, expected);
+    assert_eq!(wide.retained_source.end, raw.trim_end().len());
+    let field = raw.find("Need").unwrap()..raw.trim_end().len();
+    assert!(wide.retains_any(&session, 1., field.clone()).unwrap());
+    assert!(
+        !wide.retains_any(&session, 1., 0..2).unwrap(),
+        "normalized whitespace is not a visible field"
+    );
+    let small = cache
+        .resolve(&session, raw, 70., 1., Style::default())
+        .unwrap();
+    assert!(!small.retains_any(&session, 1., field).unwrap());
+    assert!(small.retained_source.end < raw.find("Operation").unwrap());
+}
+
+#[test]
+fn grapheme_prefixes_and_zoom_match_actual_paragraph_layout() {
+    let text = "call · 戻り値 圧力 e\u{301} 👩‍🔬 safety valve verification";
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    for zoom in [0.66, 1., 1.75] {
+        let label = cache
+            .resolve(&session, text, 105., zoom, Style::default())
+            .unwrap();
+        assert!(label.bounds.width <= 105.);
+        assert_eq!(
+            label.bounds.size(),
+            paragraph_size(&label.displayed, zoom, Style::default())
+        );
+        assert!(
+            text.grapheme_indices(true)
+                .any(|(i, _)| i == label.retained_source.end)
+                || label.retained_source.end == text.len()
+        );
+        let painted = label
+            .canvas_text(&session, zoom, Point::new(400., 90.), Color::BLACK)
+            .unwrap();
+        assert_eq!(painted.content, label.displayed);
+        assert!(painted.max_width.is_infinite());
+        assert_eq!(
+            label
+                .bounds_at(&session, zoom, painted.position)
+                .unwrap()
+                .size(),
+            label.bounds.size()
+        );
+    }
+}
+
+#[test]
+fn empty_and_too_narrow_labels_never_claim_source_visibility() {
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    for text in ["", " \t\n", "Operation: Pump"] {
+        let label = cache
+            .resolve(&session, text, 0., 1., Style::default())
+            .unwrap();
+        assert_eq!(label.displayed, "");
+        assert_eq!(label.retained_source, 0..0);
+        assert_eq!(label.bounds.size(), Size::ZERO);
+        assert!(!label.retains_any(&session, 1., 0..text.len()).unwrap());
+    }
+}
+
+#[test]
+fn redraws_reuse_resolution_but_width_zoom_and_style_are_dependencies() {
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let text = "call · Pressure verification with a descriptive operation label";
+    let style = Style::default();
+    let a = cache.resolve(&session, text, 100., 1., style).unwrap();
+    let measured = cache.allocations;
+    let b = cache.resolve(&session, text, 100., 1., style).unwrap();
+    assert!(Arc::ptr_eq(&a, &b));
+    assert_eq!(cache.allocations, measured);
+    for (width, zoom, style) in [
+        (120., 1., style),
+        (100., 0.66, style),
+        (
+            100.,
+            1.,
+            Style {
+                size: Pixels(14.),
+                ..style
+            },
+        ),
+    ] {
+        let other = cache.resolve(&session, text, width, zoom, style).unwrap();
+        assert!(!Arc::ptr_eq(&a, &other));
+    }
+}
+
+#[test]
+fn resident_entry_is_remeasured_for_a_fresh_settled_render_session() {
+    let mut cache = Cache::default();
+    let old_session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let text = "call · Pressure verification";
+    let a = cache
+        .resolve(&old_session, text, 100., 1., Style::default())
+        .unwrap();
+    assert_eq!(cache.entries.len(), 1);
+    assert!(Arc::ptr_eq(&cache.entries.front().unwrap().label, &a));
+    let measured = cache.allocations;
+    assert!(measured > 0);
+    assert!(Arc::ptr_eq(
+        &a,
+        &cache
+            .resolve(&old_session, text, 100., 1., Style::default())
+            .unwrap()
+    ));
+    assert_eq!(cache.allocations, measured);
+    // A fresh renderer session invalidates a still-resident entry. This does
+    // not mutate global fonts or purport to test dynamic WGPU font loading.
+    let new_session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let refreshed = cache
+        .resolve(&new_session, text, 100., 1., Style::default())
+        .unwrap();
+    assert!(!Arc::ptr_eq(&a, &refreshed));
+    assert!(cache.allocations > measured);
+    assert_eq!(cache.entries.len(), 1);
+    assert!(Arc::ptr_eq(
+        &cache.entries.front().unwrap().label,
+        &refreshed
+    ));
+}
+
+#[test]
+fn resident_entry_remeasures_after_local_font_epoch_invalidation() {
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let text = "call · Resident pressure label";
+    let a = cache
+        .resolve(&session, text, 100., 1., Style::default())
+        .unwrap();
+    assert_eq!(cache.entries.len(), 1);
+    assert!(Arc::ptr_eq(&cache.entries.front().unwrap().label, &a));
+    let measured = cache.allocations;
+    assert!(measured > 0);
+    // Exercise the local memo epoch branch while a is still resident. No
+    // intervening width/zoom/style resolution can cause incidental eviction.
+    // This is not an actual font-load or renderer-cache acceptance test.
+    cache.version = None;
+    let refreshed = cache
+        .resolve(&session, text, 100., 1., Style::default())
+        .unwrap();
+    assert!(!Arc::ptr_eq(&a, &refreshed));
+    assert!(cache.allocations > measured);
+    assert_eq!(cache.entries.len(), 1);
+    assert!(Arc::ptr_eq(
+        &cache.entries.front().unwrap().label,
+        &refreshed
+    ));
+}
+
+#[test]
+fn retained_artifact_rejects_other_zoom_and_render_session_for_every_consumer() {
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let label = cache
+        .resolve(&session, "Operation: Pressure", 200., 1., Style::default())
+        .unwrap();
+    let other = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    for (context, zoom, expected) in [
+        (&session, 0.66, Error::StaleZoom),
+        (&other, 1., Error::StaleRenderSession),
+    ] {
+        assert_eq!(label.displayed(context, zoom).unwrap_err(), expected);
+        assert_eq!(label.retained_source(context, zoom).unwrap_err(), expected);
+        assert_eq!(
+            label.retains_any(context, zoom, 0..9).unwrap_err(),
+            expected
+        );
+        assert_eq!(
+            label.bounds_at(context, zoom, Point::ORIGIN).unwrap_err(),
+            expected
+        );
+        assert_eq!(
+            label
+                .canvas_text(context, zoom, Point::ORIGIN, Color::BLACK)
+                .unwrap_err(),
+            expected
+        );
+    }
+    assert!(
+        label
+            .canvas_text(&session, 1., Point::ORIGIN, Color::BLACK)
+            .is_ok()
+    );
+}
+
+#[test]
+fn finite_scaled_metrics_cannot_escape_as_infinite_world_dimensions() {
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let style = Style {
+        size: Pixels(2.),
+        line_height: LineHeight::Relative(f32::MAX),
+        ..Style::default()
+    };
+    // At zoom 0.5 the scaled size=1 and line height=MAX are finite. The
+    // required world line height is not; reject before passing it to shaping.
+    let scaled = style.scaled(0.5);
+    assert!(scaled.0.is_finite() && scaled.1.is_finite());
+    assert_eq!(
+        cache
+            .resolve(&session, "call", 100., 0.5, style)
+            .unwrap_err(),
+        Error::InvalidMetrics
+    );
+    assert_eq!(cache.allocations, 0);
+    assert!(cache.entries.is_empty());
+    // Independently exercise validation after division for actual measured
+    // dimensions: finite scaled width/height do not imply finite world values.
+    assert_eq!(
+        world_size(Size::new(f32::MAX, 1.), 0.5),
+        Err(Error::InvalidMeasurement)
+    );
+    assert_eq!(
+        world_size(Size::new(1., f32::MAX), 0.5),
+        Err(Error::InvalidMeasurement)
+    );
+    assert_eq!(
+        world_size(Size::new(20., 8.), 0.5).unwrap(),
+        Size::new(40., 16.)
+    );
+}
+
+#[test]
+fn malformed_metrics_and_explicit_experiment_budgets_fail_without_a_cached_candidate() {
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    for (width, zoom) in [(f32::NAN, 1.), (-1., 1.), (100., 0.), (100., f32::INFINITY)] {
+        assert_eq!(
+            cache
+                .resolve(&session, "call", width, zoom, Style::default())
+                .unwrap_err(),
+            Error::InvalidMetrics
+        );
+    }
+    assert_eq!(
+        cache
+            .resolve(
+                &session,
+                &"x".repeat(MAX_SOURCE_BYTES + 1),
+                100.,
+                1.,
+                Style::default()
+            )
+            .unwrap_err(),
+        Error::SourceBudget
+    );
+    assert_eq!(
+        cache
+            .resolve(
+                &session,
+                &"x".repeat(MAX_GRAPHEMES + 1),
+                100.,
+                1.,
+                Style::default()
+            )
+            .unwrap_err(),
+        Error::GraphemeBudget
+    );
+    assert!(cache.entries.is_empty());
+}
+
+#[test]
+fn bounds_translation_rejects_nonfinite_world_positions_and_endpoints() {
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let label = cache
+        .resolve(&session, "call", 100., 1., Style::default())
+        .unwrap();
+    for position in [Point::new(f32::NAN, 0.), Point::new(0., f32::INFINITY)] {
+        assert_eq!(
+            label.bounds_at(&session, 1., position).unwrap_err(),
+            Error::InvalidPosition
+        );
+        assert_eq!(
+            label
+                .canvas_text(&session, 1., position, Color::BLACK)
+                .unwrap_err(),
+            Error::InvalidPosition
+        );
+    }
+    assert_eq!(
+        translated_bounds(Point::new(f32::MAX, 0.), Size::new(f32::MAX, 1.)),
+        Err(Error::InvalidPosition)
+    );
+    assert_eq!(
+        translated_bounds(Point::new(0., f32::MAX), Size::new(1., f32::MAX)),
+        Err(Error::InvalidPosition)
+    );
+    assert_eq!(
+        label
+            .bounds_at(&session, 1., Point::new(-20., -10.))
+            .unwrap()
+            .position(),
+        Point::new(-20., -10.)
+    );
+}
+
+/// Must run as the ONLY selected test in a dedicated, fresh test process.
+/// The ignored marker keeps this global-font mutation out of normal parallel
+/// desktop tests. See the evidence directory's exact executable runner.
+#[test]
+#[ignore = "mutates the global font database; run only this exact test in a fresh process"]
+fn actual_font_load_rejects_retained_label_and_old_session() {
+    use graphics_text::cosmic_text::fontdb;
+    use std::borrow::Cow;
+
+    let mut cache = Cache::default();
+    let session = RenderSession::after_fonts_settled_and_renderer_reset().unwrap();
+    let source = "Operation: Pressure";
+    let label = cache
+        .resolve(&session, source, 200., 1., Style::default())
+        .unwrap();
+    assert_eq!(label.displayed(&session, 1.).unwrap(), source);
+    assert!(
+        label
+            .canvas_text(&session, 1., Point::ORIGIN, Color::BLACK)
+            .is_ok()
+    );
+    let measured = cache.allocations;
+    assert!(measured > 0);
+    assert!(Arc::ptr_eq(&cache.entries.front().unwrap().label, &label));
+
+    let (version_before, version_after, faces_before, faces_after) = {
+        let mut fonts = graphics_text::font_system().write().unwrap();
+        let face = fonts
+            .raw()
+            .db()
+            .faces()
+            .find(|face| {
+                face.families
+                    .iter()
+                    .any(|(family, _)| family == "Iced-Icons")
+            })
+            .expect("Iced 0.14 embeds and loads its known Iced-Icons.ttf face")
+            .id;
+        let bytes = fonts
+            .raw()
+            .db()
+            .with_face_data(face, |data, _| data.to_vec())
+            .expect("the built-in binary font has accessible bytes");
+        assert!(!bytes.is_empty());
+        // load_font increments Version even for invalid bytes. Independently
+        // establish actual face admission so this cannot pass with invalid data.
+        let mut probe = fontdb::Database::new();
+        probe.load_font_data(bytes.clone());
+        let admitted = probe
+            .faces()
+            .filter(|face| {
+                face.families
+                    .iter()
+                    .any(|(family, _)| family == "Iced-Icons")
+            })
+            .count();
+        assert!(
+            admitted > 0,
+            "the extracted bytes parse as the expected real font"
+        );
+        let before = fonts.version();
+        assert_eq!(before, session.version);
+        let count = fonts.raw().db().faces().count();
+        // Owned bytes intentionally bypass Borrowed-address deduplication.
+        // This is an actual valid duplicate-face load, not a claim the chosen
+        // face or rendered metrics change; the stale-epoch rule is the oracle.
+        fonts.load_font(Cow::Owned(bytes));
+        (
+            before,
+            fonts.version(),
+            count,
+            fonts.raw().db().faces().count(),
+        )
+    };
+    assert_ne!(version_before, version_after);
+    assert!(
+        faces_after > faces_before,
+        "actual font admission must accompany the version increment"
+    );
+    assert_eq!(
+        label.displayed(&session, 1.).unwrap_err(),
+        Error::FontSetChanged
+    );
+    assert_eq!(
+        label.retained_source(&session, 1.).unwrap_err(),
+        Error::FontSetChanged
+    );
+    assert_eq!(
+        label.retains_any(&session, 1., 0..9).unwrap_err(),
+        Error::FontSetChanged
+    );
+    assert_eq!(
+        label.bounds_at(&session, 1., Point::ORIGIN).unwrap_err(),
+        Error::FontSetChanged
+    );
+    assert_eq!(
+        label
+            .canvas_text(&session, 1., Point::ORIGIN, Color::BLACK)
+            .unwrap_err(),
+        Error::FontSetChanged
+    );
+    assert_eq!(
+        cache
+            .resolve(&session, source, 200., 1., Style::default())
+            .unwrap_err(),
+        Error::FontSetChanged
+    );
+    assert_eq!(
+        cache.allocations, measured,
+        "an invalid session must not remeasure and imply renderer repair"
+    );
+    println!(
+        "Valid Iced-Icons load: faces {faces_before}->{faces_after}, font Version {version_before:?}->{version_after:?}; old label and session rejected"
+    );
+    // Do not create a fresh session or claim dynamic WGPU cache recovery here.
+    // Process exit is the isolation boundary; no other test may run afterward.
+}

crates/oa-desktop/src/behavior/scenario_lifecycle/render.rs

@@ -8,21 +8,6 @@ use iced::{
 use oa_core::{Id, OccurrenceBody, Project, SharedBody};
 use std::collections::BTreeMap;
 
-// Test-only geometry input, deliberately upstream of rows, scopes, lifecycle
-// and activations. This is not an authored placement or drag policy.
-#[cfg(test)]
-thread_local! {
-    static TEST_ROW_OFFSETS: std::cell::RefCell<BTreeMap<Id, f32>> = Default::default();
-}
-#[cfg(test)]
-pub(in crate::behavior) fn apply_test_row_offset(id: Id, y: &mut f32) {
-    TEST_ROW_OFFSETS.with(|offsets| {
-        if let Some(offset) = offsets.borrow().get(&id) {
-            *y += offset;
-        }
-    });
-}
-
 #[derive(Debug, Clone, PartialEq)]
 struct EventMarker {
     event: Marker,
@@ -240,9 +225,9 @@ impl Rendering {
                     ..Stroke::default()
                         .with_width(1.)
                         .with_color(if id == selected {
-                            style::TEAL
+                            Color::from_rgb8(148, 190, 187)
                         } else {
-                            style::BOUNDARY
+                            Color::from_rgb8(214, 222, 222)
                         })
                 },
             );
@@ -262,7 +247,7 @@ impl Rendering {
                             if lifetime.lifeline == selected {
                                 style::TEAL
                             } else {
-                                style::BOUNDARY
+                                Color::from_rgb8(91, 113, 113)
                             },
                         ),
                     ),

crates/oa-desktop/src/behavior/scenario_lifecycle/render_tests.rs

@@ -3,9 +3,6 @@ use crate::{behavior::Scene, document::Document};
 use iced::Size;
 use oa_core::*;
 
-#[path = "union_tests.rs"]
-mod union_tests;
-
 struct Fixture {
     project: Project,
     owner: Id,
@@ -103,21 +100,6 @@ impl Fixture {
             },
         )
     }
-    fn reply(&mut self, parent: Id, call: Id) -> Id {
-        self.occurrence(
-            parent,
-            "Reply",
-            OccurrenceBody::Exchange {
-                exchange: Some(self.exchange),
-                sender: Some(self.receiver),
-                receiver: Some(self.sender),
-                message_kind: MessageKind::Reply,
-                operation: None,
-                reply_to: Some(call),
-                values: vec![],
-            },
-        )
-    }
     fn fragment(&mut self, parent: Id, operator: FragmentOperator) -> Id {
         self.occurrence(
             parent,
@@ -205,7 +187,7 @@ fn real_scene_long_header_title_and_detail_keep_names_and_have_bounded_clips() {
             f.project.elements.get_mut(&f.work).unwrap().name = name.clone();
             let scene = f.scene();
             let header = scene.boxes.iter().find(|b| b.id == f.receiver).unwrap();
-            assert_eq!(header.title, name);
+            assert_eq!(header.title, format!("Lane · {name}"));
             assert_eq!(header.detail, name);
             assert_eq!(header.rect.size(), Size::new(204., 70.));
             assert_eq!(scene.hit(header.rect.center()), Some(f.receiver));
@@ -506,9 +488,9 @@ fn real_scene_branch_delete_clips_only_its_activation_and_keeps_unanswered_call_
         let (left_start, left_end) = scene.sequence_bounds[&left];
         let (right_start, _) = scene.sequence_bounds[&right];
         let bars: Vec<_> = scene
-            .activations
+            .boxes
             .iter()
-            .filter(|b| b.call == call && b.receiver == f.receiver)
+            .filter(|b| b.id == call && b.rect.width == 8.)
             .map(|b| b.rect)
             .collect();
         assert!(

crates/oa-desktop/src/behavior/scenario_lifecycle/union_tests.rs

@@ -1,489 +0,0 @@
-use super::*;
-use crate::behavior::scenario_activation::{Finish, Segment};
-
-fn line(scene: &Scene, id: Id) -> &crate::behavior::Line {
-    scene.lines.iter().find(|line| line.id == id).unwrap()
-}
-fn segments(scene: &Scene, call: Id) -> Vec<&Segment> {
-    scene
-        .activations
-        .iter()
-        .filter(|a| a.call == call)
-        .collect()
-}
-fn assert_visible_lifetime(scene: &Scene) {
-    for a in &scene.activations {
-        assert_eq!(
-            scene
-                .lifecycle
-                .alive_spans(a.receiver, a.scope, a.rect.y, a.rect.y + a.rect.height),
-            vec![Span {
-                start: a.rect.y,
-                end: a.rect.y + a.rect.height
-            }]
-        );
-        if let Finish::Reply(reply) = a.finish {
-            assert_eq!(a.rect.y + a.rect.height, line(scene, reply).points[0].y);
-        }
-    }
-}
-
-#[test]
-fn admitted_delayed_create_nested_calls_replies_delete_share_one_geometry_pipeline() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = Fixture::new(layer);
-        let birth = f.message(f.owner, MessageKind::Create);
-        let c1 = f.message(f.owner, MessageKind::Call);
-        let c2 = f.message(f.owner, MessageKind::Call);
-        let r2 = f.reply(f.owner, c2);
-        let r1 = f.reply(f.owner, c1);
-        let death = f.message(f.owner, MessageKind::Delete);
-        let scene = f.scene();
-        assert_eq!(scene.activations.len(), 2);
-        for (call, reply, column) in [(c1, r1, 0), (c2, r2, 1)] {
-            let a = segments(&scene, call)[0];
-            assert_eq!(
-                (a.receiver, a.scope, a.column, a.finish),
-                (f.receiver, f.owner, column, Finish::Reply(reply))
-            );
-            let received = *line(&scene, call).points.last().unwrap();
-            let sent = line(&scene, reply).points[0];
-            assert_eq!((a.rect.y, a.rect.y + a.rect.height), (received.y, sent.y));
-            assert_eq!(received.x, sent.x);
-            assert!(
-                a.rect.y > scene.rows[&birth].1 && a.rect.y + a.rect.height < scene.rows[&death].1
-            );
-        }
-        assert_visible_lifetime(&scene);
-        assert!(scene.open_calls.is_empty());
-        for event in [birth, death] {
-            assert_eq!(
-                scene.hit(Point::new(scene.lanes[&f.receiver], scene.rows[&event].1)),
-                Some(event)
-            );
-        }
-    }
-}
-
-#[test]
-fn admitted_death_and_incomplete_later_reply_do_not_fabricate_an_answered_execution() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = Fixture::new(layer);
-        let call = f.message(f.owner, MessageKind::Call);
-        let death = f.message(f.owner, MessageKind::Delete);
-        let reply = f.reply(f.owner, call);
-        if let SharedBody::Occurrence {
-            body: OccurrenceBody::Exchange {
-                sender, exchange, ..
-            },
-            ..
-        } = f
-            .project
-            .elements
-            .get_mut(&reply)
-            .unwrap()
-            .shared_mut()
-            .unwrap()
-        {
-            *sender = None;
-            *exchange = None;
-        }
-        let scene = f.scene();
-        let a = segments(&scene, call)[0];
-        assert_eq!(a.finish, Finish::Terminated(death));
-        assert_eq!(a.rect.y + a.rect.height, scene.rows[&death].1);
-        assert!(
-            scene.boxes.iter().any(|b| b.id == reply),
-            "The incomplete reply remains a repairable card"
-        );
-        assert_eq!(scene.open_calls.len(), 1);
-        assert_visible_lifetime(&scene);
-    }
-}
-
-#[test]
-fn admitted_self_lifecycle_and_self_call_keep_distinct_send_receive_rows() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = Fixture::new(layer);
-        let action = f.occurrence(
-            f.owner,
-            "Sender preparation",
-            OccurrenceBody::Action {
-                action: None,
-                lifeline: Some(f.sender),
-            },
-        );
-        let birth = f.message(f.owner, MessageKind::Create);
-        let call = f.message(f.owner, MessageKind::Call);
-        let reply = f.reply(f.owner, call);
-        let death = f.message(f.owner, MessageKind::Delete);
-        for event in [birth, call, reply, death] {
-            if let SharedBody::Occurrence {
-                body:
-                    OccurrenceBody::Exchange {
-                        sender,
-                        receiver,
-                        exchange,
-                        ..
-                    },
-                ..
-            } = f
-                .project
-                .elements
-                .get_mut(&event)
-                .unwrap()
-                .shared_mut()
-                .unwrap()
-            {
-                *sender = Some(f.receiver);
-                *receiver = Some(f.receiver);
-                *exchange = None;
-            }
-        }
-        let scene = f.scene();
-        let preparation = scene.boxes.iter().find(|b| b.id == action).unwrap();
-        assert!(line(&scene, birth).label_at.y > preparation.rect.y + preparation.rect.height);
-        for event in [birth, death] {
-            let message = line(&scene, event);
-            assert_eq!(message.points[0].y, scene.rows[&event].1 - 24.);
-            assert_eq!(message.points.last().unwrap().y, scene.rows[&event].1);
-            assert_eq!(
-                scene.hit(Point::new(scene.lanes[&f.receiver], scene.rows[&event].1)),
-                Some(event)
-            );
-        }
-        let activation = segments(&scene, call)[0];
-        assert_eq!(activation.rect.y, scene.rows[&call].1 + 24.);
-        assert_eq!(
-            activation.rect.y,
-            line(&scene, call).points.last().unwrap().y
-        );
-        assert_eq!(
-            activation.rect.y + activation.rect.height,
-            line(&scene, reply).points[0].y
-        );
-        assert_eq!(activation.finish, Finish::Reply(reply));
-        assert_visible_lifetime(&scene);
-    }
-}
-
-#[test]
-fn admitted_unresolved_operand_keeps_unanswered_cue_without_any_visible_segment() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = Fixture::new(layer);
-        let fragment = f.fragment(f.owner, FragmentOperator::Alternative);
-        let left = f.branch(fragment);
-        f.message(left, MessageKind::Create);
-        let right = f.branch(fragment);
-        let call = f.message(right, MessageKind::Call);
-        let scene = f.scene();
-        assert!(segments(&scene, call).is_empty());
-        assert!(
-            intervals(&scene, f.receiver, right)
-                .iter()
-                .all(|i| i.2 == Life::Unresolved)
-        );
-        assert_eq!(scene.open_calls.len(), 1);
-        assert!(scene.open_calls[0].y > scene.rows[&call].1);
-        assert_eq!(
-            line(&scene, call).points.last().unwrap().x,
-            scene.lanes[&f.receiver]
-        );
-    }
-}
-
-#[test]
-fn admitted_calls_without_sender_polylines_still_have_logical_correlation_metadata() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = Fixture::new(layer);
-        let c1 = f.message(f.owner, MessageKind::Call);
-        let c2 = f.message(f.owner, MessageKind::Call);
-        for call in [c1, c2] {
-            if let SharedBody::Occurrence {
-                body:
-                    OccurrenceBody::Exchange {
-                        sender, exchange, ..
-                    },
-                ..
-            } = f
-                .project
-                .elements
-                .get_mut(&call)
-                .unwrap()
-                .shared_mut()
-                .unwrap()
-            {
-                *sender = None;
-                *exchange = None;
-            }
-        }
-        let outgoing = f.occurrence(
-            f.owner,
-            "Outgoing",
-            OccurrenceBody::Exchange {
-                exchange: None,
-                sender: Some(f.receiver),
-                receiver: Some(f.sender),
-                message_kind: MessageKind::Asynchronous,
-                operation: None,
-                reply_to: None,
-                values: vec![],
-            },
-        );
-        f.reply(f.owner, c2);
-        f.reply(f.owner, c1);
-        let scene = f.scene();
-        assert!(scene.boxes.iter().any(|b| b.id == c1));
-        assert!(scene.boxes.iter().any(|b| b.id == c2));
-        let inner = segments(&scene, c2)[0];
-        let expected = if scene.lanes[&f.sender] > scene.lanes[&f.receiver] {
-            inner.rect.x + inner.rect.width
-        } else {
-            inner.rect.x
-        };
-        assert_eq!(line(&scene, outgoing).points[0].x, expected);
-    }
-}
-
-fn lifetime_rejected(f: &Fixture) {
-    assert!(validate_candidate(&f.project).is_err());
-    assert!(
-        validation::validate(&f.project)
-            .iter()
-            .any(|issue| issue.severity == validation::Severity::Error
-                && issue.code == "lifeline_lifetime")
-    );
-}
-
-#[test]
-fn invalid_prebirth_call_and_postdeath_reply_remain_rejected_with_defensive_scene_clipping() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        for later_birth in [false, true] {
-            let mut f = Fixture::new(layer);
-            let call = f.message(f.owner, MessageKind::Call);
-            let death = f.message(f.owner, MessageKind::Delete);
-            if later_birth {
-                f.message(f.owner, MessageKind::Create);
-            }
-            let reply = f.reply(f.owner, call);
-            lifetime_rejected(&f);
-            // Deliberately bypass Document only for defensive renderer coverage
-            // of rejected data. This is not an admitted editing workflow.
-            let scene = Scene::sequence(&f.project, f.owner, f.owner);
-            assert!(
-                scene
-                    .activations
-                    .iter()
-                    .all(|a| a.rect.y + a.rect.height <= scene.rows[&death].1)
-            );
-            assert!(
-                scene
-                    .activations
-                    .iter()
-                    .all(|a| a.finish != Finish::Reply(reply))
-            );
-            assert_eq!(line(&scene, reply).points[0].x, scene.lanes[&f.receiver]);
-            assert!(!scene.open_calls.is_empty());
-            assert_visible_lifetime(&scene);
-        }
-        let mut f = Fixture::new(layer);
-        let call = f.message(f.owner, MessageKind::Call);
-        let birth = f.message(f.owner, MessageKind::Create);
-        let reply = f.reply(f.owner, call);
-        lifetime_rejected(&f);
-        let scene = Scene::sequence(&f.project, f.owner, f.owner);
-        assert_eq!(segments(&scene, call)[0].rect.y, scene.rows[&birth].1);
-        assert_eq!(segments(&scene, call)[0].finish, Finish::Reply(reply));
-        assert_eq!(
-            line(&scene, call).points.last().unwrap().x,
-            scene.lanes[&f.receiver]
-        );
-        assert_visible_lifetime(&scene);
-    }
-}
-
-#[test]
-fn conditional_death_then_recreate_never_revives_call_but_keeps_open_sibling() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = Fixture::new(layer);
-        f.message(f.owner, MessageKind::Create);
-        let call = f.message(f.owner, MessageKind::Call);
-        let fragment = f.fragment(f.owner, FragmentOperator::Alternative);
-        let left = f.branch(fragment);
-        let death = f.message(left, MessageKind::Delete);
-        let right = f.branch(fragment);
-        let rebirth = f.message(f.owner, MessageKind::Create);
-        let reply = f.reply(f.owner, call);
-        lifetime_rejected(&f);
-        let scene = Scene::sequence(&f.project, f.owner, f.owner);
-        let bars = segments(&scene, call);
-        assert!(
-            bars.iter()
-                .any(|a| a.scope == left && a.finish == Finish::Terminated(death))
-        );
-        assert!(
-            bars.iter().any(|a| a.scope == right
-                && a.rect.height == 26.
-                && a.finish == Finish::Continuation)
-        );
-        assert!(
-            bars.iter()
-                .all(|a| a.rect.y + a.rect.height < scene.rows[&rebirth].1)
-        );
-        assert!(!bars.iter().any(|a| a.finish == Finish::Reply(reply)));
-        assert_eq!(line(&scene, reply).points[0].x, scene.lanes[&f.receiver]);
-        assert_eq!(
-            scene.open_calls.len(),
-            3,
-            "Terminated, open sibling and uncertain parent cues survive"
-        );
-        assert_visible_lifetime(&scene);
-    }
-}
-
-#[test]
-fn clipped_operand_preserves_original_nested_or_crossed_correlation_distinction() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        for nested in [false, true] {
-            let mut f = Fixture::new(layer);
-            f.message(f.owner, MessageKind::Create);
-            let c1 = f.message(f.owner, MessageKind::Call);
-            let c2 = f.message(f.owner, MessageKind::Call);
-            let fragment = f.fragment(f.owner, FragmentOperator::Alternative);
-            let left = f.branch(fragment);
-            f.message(left, MessageKind::Delete);
-            let right = f.branch(fragment);
-            let outgoing = f.occurrence(
-                right,
-                "Outgoing",
-                OccurrenceBody::Exchange {
-                    exchange: None,
-                    sender: Some(f.receiver),
-                    receiver: Some(f.sender),
-                    message_kind: MessageKind::Asynchronous,
-                    operation: None,
-                    reply_to: None,
-                    values: vec![],
-                },
-            );
-            let r1 = f.reply(f.owner, if nested { c2 } else { c1 });
-            let r2 = f.reply(f.owner, if nested { c1 } else { c2 });
-            lifetime_rejected(&f);
-            let scene = Scene::sequence(&f.project, f.owner, f.owner);
-            let send = line(&scene, outgoing).points[0];
-            let expected = if nested {
-                let inner = segments(&scene, c2)
-                    .into_iter()
-                    .find(|a| a.scope == right)
-                    .unwrap();
-                if scene.lanes[&f.sender] > scene.lanes[&f.receiver] {
-                    inner.rect.x + inner.rect.width
-                } else {
-                    inner.rect.x
-                }
-            } else {
-                scene.lanes[&f.receiver]
-            };
-            assert_eq!(send.x, expected);
-            for call in [c1, c2] {
-                assert!(segments(&scene, call).iter().any(|a| a.scope == right
-                    && a.rect.y <= send.y
-                    && send.y < a.rect.y + a.rect.height));
-            }
-            assert!(scene.rows[&r1].1 < scene.rows[&r2].1);
-            assert_visible_lifetime(&scene);
-        }
-    }
-}
-
-fn with_offset<T>(id: Id, offset: f32, f: impl FnOnce() -> T) -> T {
-    struct Restore(BTreeMap<Id, f32>);
-    impl Drop for Restore {
-        fn drop(&mut self) {
-            TEST_ROW_OFFSETS.with(|current| *current.borrow_mut() = std::mem::take(&mut self.0));
-        }
-    }
-    let _restore =
-        Restore(TEST_ROW_OFFSETS.with(|current| current.replace(BTreeMap::from([(id, offset)]))));
-    f()
-}
-fn snapshot(scene: &Scene) -> String {
-    format!(
-        "{:?}",
-        (
-            &scene.lifecycle,
-            &scene.activations,
-            &scene.open_calls,
-            &scene.rows,
-            &scene.sequence_bounds,
-            scene
-                .lines
-                .iter()
-                .map(|l| (l.id, &l.points, &l.label, l.label_at, l.dashed))
-                .collect::<Vec<_>>(),
-            scene
-                .boxes
-                .iter()
-                .map(|b| (b.id, b.rect, &b.title, &b.detail, b.marker))
-                .collect::<Vec<_>>(),
-            scene
-                .slots
-                .iter()
-                .map(|s| (s.slot, s.y, &s.label))
-                .collect::<Vec<_>>(),
-            scene.size,
-        )
-    )
-}
-
-#[test]
-fn test_only_upstream_row_offsets_update_lifetime_segments_and_endpoints_without_authoring() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let mut f = Fixture::new(layer);
-        let birth = f.message(f.owner, MessageKind::Create);
-        let c1 = f.message(f.owner, MessageKind::Call);
-        let c2 = f.message(f.owner, MessageKind::Call);
-        f.reply(f.owner, c2);
-        f.reply(f.owner, c1);
-        let death = f.message(f.owner, MessageKind::Delete);
-        let document = f.document();
-        let before = document.snapshot();
-        let baseline = Scene::sequence(document.project(), f.owner, c1);
-        let moved = with_offset(birth, 60., || {
-            Scene::sequence(document.project(), f.owner, c1)
-        });
-        assert_eq!(moved.rows[&birth].1, baseline.rows[&birth].1 + 60.);
-        assert_eq!(moved.rows[&death].1, baseline.rows[&death].1 + 60.);
-        for (a, b) in baseline.activations.iter().zip(&moved.activations) {
-            assert_eq!(
-                (a.call, a.receiver, a.scope, a.column, a.finish),
-                (b.call, b.receiver, b.scope, b.column, b.finish)
-            );
-            assert_eq!(
-                b.rect,
-                Rectangle::new(
-                    a.rect.position() + iced::Vector::new(0., 60.),
-                    a.rect.size()
-                )
-            );
-        }
-        assert_eq!(baseline.activations.len(), moved.activations.len());
-        assert_visible_lifetime(&moved);
-        let reparsed = language::parse(&language::format(document.project())).unwrap();
-        assert_eq!(reparsed, *document.project());
-        assert_eq!(
-            snapshot(&moved),
-            with_offset(birth, 60., || snapshot(&Scene::sequence(
-                &reparsed, f.owner, c1
-            )))
-        );
-        assert_eq!(
-            snapshot(&baseline),
-            snapshot(&Scene::sequence(document.project(), f.owner, c1))
-        );
-        assert_eq!(document.project(), &before.decoded.project);
-        assert_eq!(document.bundle(), &before.bundle);
-        assert_eq!(document.revision(), 0);
-        assert!(!document.dirty() && !document.can_undo() && !document.can_redo());
-    }
-}

crates/oa-desktop/src/behavior/source_draft.rs

@@ -325,50 +325,73 @@ impl State {
     ) -> Option<UiElement<'a, Event, iced::Theme, R>> {
         let d = self.editing.as_ref()?;
         let event = move |edit| Event::Edit(d.token, edit);
+        let kinds = d.scope.kinds(d.layer);
+        let determined = kinds.len() == 1 && d.kind == kinds.first().copied();
         let mut fields = column![
-            text(format!("New source · {}", d.layer)).size(18),
-            text(match d.scope {
-                Scope::Lifeline { owner, viewpoint } =>
-                    format!("For a lifeline in {} · {:?}", p.named(owner), viewpoint),
-                Scope::Work { owner } => format!("For a contribution in {}", p.named(owner)),
-                Scope::Machine { .. } => "Owner for the pending state machine".into(),
+            text(if determined {
+                format!("New {} · {}", kinds[0], d.layer)
+            } else {
+                format!("New source · {}", d.layer)
             })
-            .size(12),
-            text("The parent form is retained. This source is created only with its consumer.")
-                .size(12)
-        ]
-        .spacing(8);
-        for kind in d.scope.kinds(d.layer) {
-            fields = fields.push(
-                button(text(kind.to_string()))
-                    .on_press(event(Edit::Kind(kind)))
-                    .style(if d.kind == Some(kind) {
-                        button::primary
-                    } else {
-                        button::secondary
-                    }),
-            );
-        }
-        fields = fields.push(
+            .size(14),
             text_input("Source name (independent of the consumer name)", &d.name)
                 .id(NAME_INPUT)
                 .on_input(move |v| event(Edit::Name(v)))
-                .padding(8),
-        );
+                .size(14)
+                .padding(6),
+        ]
+        .spacing(4);
+        if !determined {
+            let mut choices = row![].spacing(6);
+            for kind in kinds {
+                choices = choices.push(
+                    container(
+                        button(text(kind.to_string()).size(14))
+                            .padding(4)
+                            .on_press(event(Edit::Kind(kind)))
+                            .style(if d.kind == Some(kind) {
+                                button::primary
+                            } else {
+                                button::secondary
+                            }),
+                    )
+                    .id(format!("behavior-source-kind-{kind:?}")),
+                );
+            }
+            fields = fields.push(choices.wrap());
+        }
         fields = fields.push(
-            text(format!(
-                "Semantic parent: {}",
-                d.parent
-                    .as_ref()
-                    .map_or(format!("{} layer root", d.layer), |e| format!(
-                        "{} · {} · @{}",
-                        e.name,
-                        e.kind(),
-                        e.alias
-                    ))
-            ))
-            .size(12),
+            container(
+                text(format!(
+                    "Semantic parent: {}",
+                    d.parent
+                        .as_ref()
+                        .map_or(format!("{} layer root", d.layer), |e| format!(
+                            "{} · {} · @{}",
+                            e.name,
+                            e.kind(),
+                            e.alias
+                        ))
+                ))
+                .size(12),
+            )
+            .id("behavior-source-parent"),
         );
+        fields = fields
+            .push(
+                text(match d.scope {
+                    Scope::Lifeline { owner, viewpoint } => {
+                        format!("For a lifeline in {} · {:?}", p.named(owner), viewpoint)
+                    }
+                    Scope::Work { owner } => format!("For a contribution in {}", p.named(owner)),
+                    Scope::Machine { .. } => "Owner for the pending state machine".into(),
+                })
+                .size(12),
+            )
+            .push(
+                text("The parent form is retained. This source is created only with its consumer.")
+                    .size(12),
+            );
         if let Some(kind) = d.kind {
             fields = fields.push(button("Use layer root").on_press_maybe(
                 validation::can_parent(p, kind, d.layer, None).then(|| event(Edit::Parent(None))),
@@ -486,3 +509,526 @@ impl Draft {
         Ok(command)
     }
 }
+
+#[cfg(all(test, debug_assertions))]
+mod layout_tests {
+    use super::*;
+    use iced::advanced::{Layout, Shell, graphics, layout, renderer, text as shaped, widget};
+    use iced::{Background, Color, Font, Pixels, Point, Rectangle, Size, Transformation, Vector};
+
+    // Use Iced's real paragraph shaping/measurement without a window or GPU.
+    // The unit renderer's zero-size paragraphs cannot detect this regression.
+    struct FontLayout;
+    impl renderer::Renderer for FontLayout {
+        fn start_layer(&mut self, _: Rectangle) {}
+        fn end_layer(&mut self) {}
+        fn start_transformation(&mut self, _: Transformation) {}
+        fn end_transformation(&mut self) {}
+        fn reset(&mut self, _: Rectangle) {}
+        fn fill_quad(&mut self, _: renderer::Quad, _: impl Into<Background>) {}
+        fn allocate_image(
+            &mut self,
+            handle: &iced::advanced::image::Handle,
+            callback: impl FnOnce(
+                Result<iced::advanced::image::Allocation, iced::advanced::image::Error>,
+            ) + Send
+            + 'static,
+        ) {
+            renderer::Renderer::allocate_image(&mut (), handle, callback);
+        }
+    }
+    impl shaped::Renderer for FontLayout {
+        type Font = Font;
+        type Paragraph = graphics::text::Paragraph;
+        type Editor = ();
+        const ICON_FONT: Font = Font::DEFAULT;
+        const CHECKMARK_ICON: char = '0';
+        const ARROW_DOWN_ICON: char = '0';
+        const SCROLL_UP_ICON: char = '0';
+        const SCROLL_DOWN_ICON: char = '0';
+        const SCROLL_LEFT_ICON: char = '0';
+        const SCROLL_RIGHT_ICON: char = '0';
+        const ICED_LOGO: char = '0';
+        fn default_font(&self) -> Font {
+            Font::DEFAULT
+        }
+        fn default_size(&self) -> Pixels {
+            Pixels(16.)
+        }
+        fn fill_paragraph(&mut self, _: &Self::Paragraph, _: Point, _: Color, _: Rectangle) {}
+        fn fill_editor(&mut self, _: &Self::Editor, _: Point, _: Color, _: Rectangle) {}
+        fn fill_text(&mut self, _: shaped::Text, _: Point, _: Color, _: Rectangle) {}
+    }
+    #[derive(Default)]
+    struct Geometry {
+        fields: Option<Rectangle>,
+        content: Option<Rectangle>,
+        name: Option<Rectangle>,
+        parent: Option<Rectangle>,
+        actions: Option<Rectangle>,
+        kinds: BTreeMap<String, Rectangle>,
+        text: Vec<(String, Rectangle)>,
+        focus_name: bool,
+    }
+    impl widget::Operation for Geometry {
+        fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+            visit(self);
+        }
+        fn container(&mut self, id: Option<&widget::Id>, bounds: Rectangle) {
+            if id == Some(&widget::Id::new("behavior-source-actions")) {
+                self.actions = Some(bounds);
+            }
+            if id == Some(&widget::Id::new("behavior-source-parent")) {
+                self.parent = Some(bounds);
+            }
+            for kind in [
+                Kind::Entity,
+                Kind::Actor,
+                Kind::Role,
+                Kind::System,
+                Kind::SystemActor,
+                Kind::Activity,
+                Kind::Function,
+            ] {
+                if id == Some(&widget::Id::from(format!("behavior-source-kind-{kind:?}"))) {
+                    self.kinds.insert(kind.to_string(), bounds);
+                }
+            }
+        }
+        fn scrollable(
+            &mut self,
+            id: Option<&widget::Id>,
+            bounds: Rectangle,
+            content: Rectangle,
+            offset: Vector,
+            _: &mut dyn widget::operation::Scrollable,
+        ) {
+            if id == Some(&widget::Id::new("behavior-source-fields")) {
+                assert_eq!(
+                    offset,
+                    Vector::ZERO,
+                    "Initial fields must be visible without scrolling"
+                );
+                self.fields = Some(bounds);
+                self.content = Some(content);
+            }
+        }
+        fn text_input(
+            &mut self,
+            id: Option<&widget::Id>,
+            bounds: Rectangle,
+            _: &mut dyn widget::operation::TextInput,
+        ) {
+            if id == Some(&widget::Id::new(NAME_INPUT)) {
+                self.name = Some(bounds);
+            }
+        }
+        fn focusable(
+            &mut self,
+            id: Option<&widget::Id>,
+            _: Rectangle,
+            state: &mut dyn widget::operation::Focusable,
+        ) {
+            if self.focus_name && id == Some(&widget::Id::new(NAME_INPUT)) {
+                state.focus();
+            }
+        }
+        fn text(&mut self, _: Option<&widget::Id>, bounds: Rectangle, text: &str) {
+            self.text.push((text.into(), bounds));
+        }
+    }
+    fn contains(outer: Rectangle, inner: Rectangle) -> bool {
+        inner.width > 0.
+            && inner.height > 0.
+            && inner.x >= outer.x - 0.1
+            && inner.y >= outer.y - 0.1
+            && inner.x + inner.width <= outer.x + outer.width + 0.1
+            && inner.y + inner.height <= outer.y + outer.height + 0.1
+    }
+    fn host<'a>(
+        state: &'a State,
+        p: &'a Project,
+        caption: &str,
+    ) -> UiElement<'a, Event, iced::Theme, FontLayout> {
+        iced::widget::column![text(caption.to_owned()).size(12), state.view(p).unwrap()]
+            .spacing(6)
+            .height(Fill)
+            .width(Fill)
+            .into()
+    }
+    fn geometry(
+        view: &mut UiElement<'_, Event, iced::Theme, FontLayout>,
+        tree: &mut widget::Tree,
+        size: Size,
+    ) -> (layout::Node, Geometry) {
+        let node =
+            view.as_widget_mut()
+                .layout(tree, &FontLayout, &layout::Limits::new(Size::ZERO, size));
+        let mut geometry = Geometry::default();
+        view.as_widget_mut()
+            .operate(tree, Layout::new(&node), &FontLayout, &mut geometry);
+        (node, geometry)
+    }
+    fn fixture(layer: Layer, viewpoint: Option<ScenarioViewpoint>, work: bool) -> (Project, State) {
+        let mut p = Project::empty();
+        let scope = if work {
+            let owner = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Process
+                    } else {
+                        Kind::FunctionalChain
+                    },
+                    layer,
+                    "Consumer",
+                    None,
+                )
+                .unwrap();
+            Scope::Work { owner }
+        } else if let Some(viewpoint) = viewpoint {
+            let owner = p
+                .add_element(
+                    Kind::Scenario,
+                    layer,
+                    "Incident coordination with a long contextual heading 雨 Ω",
+                    None,
+                )
+                .unwrap();
+            if let Some(SharedBody::Scenario { viewpoint: v, .. }) =
+                p.elements.get_mut(&owner).unwrap().shared_mut()
+            {
+                *v = viewpoint;
+            }
+            Scope::Lifeline { owner, viewpoint }
+        } else {
+            Scope::Machine { layer }
+        };
+        let mut state = State::default();
+        let invocation = Id::new_v4();
+        state
+            .update(&p, scope, invocation, Event::Open(invocation))
+            .unwrap();
+        (p, state)
+    }
+    #[test]
+    fn contextual_source_layout_initial_essentials_fit_short_composed_host_with_real_paragraphs() {
+        for (layer, viewpoint, work) in [
+            (
+                Layer::Oa,
+                Some(ScenarioViewpoint::OperationalActivity),
+                false,
+            ),
+            (Layer::Sa, Some(ScenarioViewpoint::Functional), false),
+            (
+                Layer::Oa,
+                Some(ScenarioViewpoint::ParticipantInteraction),
+                false,
+            ),
+            (Layer::Sa, Some(ScenarioViewpoint::BoundaryInterface), false),
+            (Layer::Oa, None, false),
+            (Layer::Sa, None, false),
+            (Layer::Oa, None, true),
+            (Layer::Sa, None, true),
+        ] {
+            let (p, state) = fixture(layer, viewpoint, work);
+            let raw = serde_json::to_value(&state).unwrap();
+            for width in [340., 500.] {
+                // The retained caption + 6px gap leaves approximately the observed 194px card.
+                let size = Size::new(width, 215.);
+                let mut view = host(&state, &p, "Consumer name: Assessment lifeline");
+                let mut tree = widget::Tree::new(view.as_widget());
+                let (_, g) = geometry(&mut view, &mut tree, size);
+                let fields = g.fields.unwrap();
+                assert!(
+                    (125. ..=132.).contains(&fields.height),
+                    "Measured field viewport: {fields:?}"
+                );
+                assert!(
+                    contains(fields, g.name.unwrap()),
+                    "Name clipped: {layer:?}/{viewpoint:?}/{work}/{width}"
+                );
+                assert!(
+                    contains(fields, g.parent.unwrap()),
+                    "Parent clipped: {layer:?}/{viewpoint:?}/{work}/{width}"
+                );
+                assert!(contains(
+                    Rectangle::new(Point::ORIGIN, size),
+                    g.actions.unwrap()
+                ));
+                assert!(fields.y + fields.height <= g.actions.unwrap().y);
+                let expected = state.editing.as_ref().unwrap().scope.kinds(layer);
+                assert_eq!(
+                    g.kinds.len(),
+                    if expected.len() == 1 {
+                        0
+                    } else {
+                        expected.len()
+                    }
+                );
+                for bounds in g.kinds.values() {
+                    assert!(
+                        contains(fields, *bounds),
+                        "Kind clipped: {bounds:?} in {fields:?}"
+                    );
+                }
+                let parent_text = g
+                    .text
+                    .iter()
+                    .find(|(s, _)| s.starts_with("Semantic parent:"))
+                    .unwrap();
+                assert_eq!(
+                    parent_text.0,
+                    format!("Semantic parent: {layer} layer root")
+                );
+                assert!(
+                    parent_text.1.height > 0.,
+                    "Paragraph measurement must not be null"
+                );
+                let explanation = g
+                    .text
+                    .iter()
+                    .find(|(s, _)| s.starts_with("The parent form"))
+                    .unwrap();
+                assert!(explanation.1.y >= g.parent.unwrap().y + g.parent.unwrap().height);
+            }
+            assert_eq!(
+                serde_json::to_value(&state).unwrap(),
+                raw,
+                "Layout must not choose a kind or mutate the draft"
+            );
+            if state.editing.as_ref().unwrap().scope.kinds(layer).len() == 1 {
+                let mut incomplete = state.clone();
+                incomplete.editing.as_mut().unwrap().kind = None;
+                let mut view = host(&incomplete, &p, "Consumer name: Assessment lifeline");
+                let mut tree = widget::Tree::new(view.as_widget());
+                let (_, g) = geometry(&mut view, &mut tree, Size::new(340., 215.));
+                assert_eq!(
+                    g.kinds.len(),
+                    1,
+                    "An incomplete recovery still needs an explicit repair choice"
+                );
+                assert!(contains(
+                    g.fields.unwrap(),
+                    *g.kinds.values().next().unwrap()
+                ));
+                assert!(contains(g.fields.unwrap(), g.name.unwrap()));
+                assert_eq!(incomplete.editing.as_ref().unwrap().kind, None);
+            }
+        }
+    }
+    #[test]
+    fn contextual_source_layout_long_parent_wraps_after_visible_name_without_losing_raw_data() {
+        let (mut p, mut state) = fixture(Layer::Oa, None, true);
+        let parent = p
+            .add_element(
+                Kind::Activity,
+                Layer::Oa,
+                "Northern operations coordination — exact parent 雨",
+                None,
+            )
+            .unwrap();
+        let d = state.editing.as_ref().unwrap();
+        let token = d.token;
+        let scope = d.scope;
+        let invocation = Id::new_v4();
+        state
+            .update(
+                &p,
+                scope,
+                invocation,
+                Event::Edit(token, Edit::Parent(Some(parent))),
+            )
+            .unwrap();
+        state
+            .update(
+                &p,
+                scope,
+                invocation,
+                Event::Edit(token, Edit::Name("  Distinct source 雨  ".into())),
+            )
+            .unwrap();
+        let raw = serde_json::to_value(&state).unwrap();
+        for width in [340., 500.] {
+            let size = Size::new(width, 235.);
+            let mut view = host(
+                &state,
+                &p,
+                "Consumer name: Coordination with a long independent label 雨 Ω",
+            );
+            let mut tree = widget::Tree::new(view.as_widget());
+            let (_, g) = geometry(&mut view, &mut tree, size);
+            assert!(contains(g.fields.unwrap(), g.name.unwrap()));
+            assert!(contains(g.fields.unwrap(), g.parent.unwrap()));
+            assert!(contains(
+                Rectangle::new(Point::ORIGIN, size),
+                g.actions.unwrap()
+            ));
+            let summary = g
+                .text
+                .iter()
+                .find(|(s, _)| s.starts_with("Semantic parent:"))
+                .unwrap();
+            assert!(summary.0.contains(&p.elements[&parent].name));
+            assert!(summary.0.contains(&p.elements[&parent].alias));
+            assert!(
+                summary.1.height > 15.,
+                "Long parent should exercise real wrapping"
+            );
+        }
+        assert_eq!(serde_json::to_value(&state).unwrap(), raw);
+        assert_eq!(
+            state.editing.as_ref().unwrap().name,
+            "  Distinct source 雨  "
+        );
+
+        let (mut p, mut state) = fixture(
+            Layer::Oa,
+            Some(ScenarioViewpoint::ParticipantInteraction),
+            false,
+        );
+        let parent = p
+            .add_element(
+                Kind::Entity,
+                Layer::Oa,
+                // Eight repetitions need not exceed a whole viewport with the
+                // platform's measured font. Exercise substantial real overflow.
+                &"Northern operational responsibility 雨 ".repeat(32),
+                None,
+            )
+            .unwrap();
+        let d = state.editing.as_ref().unwrap();
+        let token = d.token;
+        let scope = d.scope;
+        state
+            .update(
+                &p,
+                scope,
+                Id::new_v4(),
+                Event::Edit(token, Edit::Kind(Kind::Actor)),
+            )
+            .unwrap();
+        state
+            .update(
+                &p,
+                scope,
+                Id::new_v4(),
+                Event::Edit(token, Edit::Parent(Some(parent))),
+            )
+            .unwrap();
+        let raw = serde_json::to_value(&state).unwrap();
+        let recovered: State = serde_json::from_value(raw.clone()).unwrap();
+        let mut view = host(&recovered, &p, "Consumer name: Assessment lifeline");
+        let mut tree = widget::Tree::new(view.as_widget());
+        let (_, g) = geometry(&mut view, &mut tree, Size::new(340., 215.));
+        let fields = g.fields.unwrap();
+        assert!(contains(fields, g.name.unwrap()));
+        assert_eq!(g.kinds.len(), 3);
+        for bounds in g.kinds.values() {
+            assert!(
+                contains(fields, *bounds),
+                "Long parent must not hide a semantic choice"
+            );
+            assert!(bounds.y + bounds.height <= g.parent.unwrap().y);
+        }
+        // Arbitrary authored detail may scroll, but its label and first line are
+        // visible after the required kind controls, never in front of them.
+        let parent_bounds = g.parent.unwrap();
+        assert!(parent_bounds.y + 16. <= fields.y + fields.height);
+        assert!(
+            parent_bounds.height > fields.height,
+            "Exercise genuinely overflowing parent text: {parent_bounds:?} in {fields:?}"
+        );
+        let content = g.content.unwrap();
+        assert!(
+            content.height > fields.height && contains(content, parent_bounds),
+            "Full parent must remain in scrollable content: {parent_bounds:?}, {content:?}, {fields:?}"
+        );
+        let summary = g
+            .text
+            .iter()
+            .find(|(s, _)| s.starts_with("Semantic parent:"))
+            .unwrap();
+        assert!(summary.0.contains(&p.elements[&parent].name));
+        assert!(summary.0.contains(&p.elements[&parent].alias));
+        assert!(contains(
+            Rectangle::new(Point::ORIGIN, Size::new(340., 215.)),
+            g.actions.unwrap()
+        ));
+        assert_eq!(serde_json::to_value(&recovered).unwrap(), raw);
+    }
+    #[test]
+    fn contextual_source_layout_visible_kind_click_keeps_choice_explicit_and_name_input_works() {
+        let (p, mut state) = fixture(
+            Layer::Oa,
+            Some(ScenarioViewpoint::ParticipantInteraction),
+            false,
+        );
+        let original = p.clone();
+        let token = state.editing.as_ref().unwrap().token;
+        let scope = state.editing.as_ref().unwrap().scope;
+        assert_eq!(state.editing.as_ref().unwrap().kind, None);
+        let size = Size::new(340., 215.);
+        let mut view = host(&state, &p, "Consumer name: Assessment lifeline");
+        let mut tree = widget::Tree::new(view.as_widget());
+        let (node, g) = geometry(&mut view, &mut tree, size);
+        let mut messages = Vec::new();
+        for kind in [Kind::Entity, Kind::Actor, Kind::Role] {
+            let bounds = g.kinds[&kind.to_string()];
+            assert!(contains(g.fields.unwrap(), bounds));
+            for action in [
+                iced::mouse::Event::ButtonPressed(iced::mouse::Button::Left),
+                iced::mouse::Event::ButtonReleased(iced::mouse::Button::Left),
+            ] {
+                view.as_widget_mut().update(
+                    &mut tree,
+                    &iced::Event::Mouse(action),
+                    Layout::new(&node),
+                    iced::mouse::Cursor::Available(bounds.center()),
+                    &FontLayout,
+                    &mut iced::advanced::clipboard::Null,
+                    &mut Shell::new(&mut messages),
+                    &Rectangle::new(Point::ORIGIN, size),
+                );
+            }
+            assert!(
+                matches!(messages.pop(), Some(Event::Edit(id, Edit::Kind(k))) if id == token && k == kind)
+            );
+        }
+        let mut focus = Geometry {
+            focus_name: true,
+            ..Geometry::default()
+        };
+        view.as_widget_mut()
+            .operate(&mut tree, Layout::new(&node), &FontLayout, &mut focus);
+        let event = iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
+            key: iced::keyboard::Key::Character("Ω".into()),
+            modified_key: iced::keyboard::Key::Character("Ω".into()),
+            physical_key: iced::keyboard::key::Physical::Code(iced::keyboard::key::Code::KeyA),
+            location: iced::keyboard::Location::Standard,
+            modifiers: iced::keyboard::Modifiers::empty(),
+            text: Some("Ω".into()),
+            repeat: false,
+        });
+        view.as_widget_mut().update(
+            &mut tree,
+            &event,
+            Layout::new(&node),
+            iced::mouse::Cursor::Unavailable,
+            &FontLayout,
+            &mut iced::advanced::clipboard::Null,
+            &mut Shell::new(&mut messages),
+            &Rectangle::new(Point::ORIGIN, size),
+        );
+        let edit = messages.pop().unwrap();
+        assert!(matches!(&edit, Event::Edit(id, Edit::Name(name)) if *id == token && name == "Ω"));
+        drop(view);
+        state.update(&p, scope, Id::new_v4(), edit).unwrap();
+        assert_eq!(
+            state.editing.as_ref().unwrap().kind,
+            None,
+            "Rendering/click event production must not silently adopt a kind"
+        );
+        assert_eq!(state.editing.as_ref().unwrap().name, "Ω");
+        assert_eq!(p, original);
+    }
+}

crates/oa-desktop/src/behavior/state_canvas.rs

@@ -40,6 +40,7 @@ pub struct State {
     context: Option<Context>,
     tool: Option<Tool>,
     pointer: Option<Point>,
+    focused: bool,
     press: Option<Press>,
     source: Option<Id>,
     preview: Option<(Id, Position)>,
@@ -404,48 +405,6 @@ fn state_action_rows<'a>(
         .collect()
 }
 
-/// Action and internal-transition rows are selectable relations, not edges or
-/// placements. Match the exact rows rendered in this dedicated machine view.
-pub(crate) fn visible_row_relation(
-    project: &Project,
-    diagram: Id,
-    view: &ProjectedView,
-    id: Id,
-) -> bool {
-    let Some(machine) = project
-        .diagrams
-        .get(&diagram)
-        .and_then(|d| d.projection.state_machine())
-    else {
-        return false;
-    };
-    let Some(relation) = project.relations.get(&id) else {
-        return false;
-    };
-    let source = match relation.body {
-        RelationBody::StateAction { source, .. } => source,
-        RelationBody::StateTransition {
-            source,
-            target,
-            transition_kind: TransitionKind::Internal,
-            ..
-        } if projection::state_machine_contains(project, machine, target) => source,
-        _ => return false,
-    };
-    if !projection::state_machine_contains(project, machine, source) {
-        return false;
-    }
-    view.nodes
-        .iter()
-        .filter(|node| node.element == source)
-        .any(|node| {
-            state_action_rows(project, node)
-                .into_iter()
-                .chain(internal_rows(project, node))
-                .any(|(row, _)| row.id == id)
-        })
-}
-
 fn state_action_label(project: &Project, relation: &Relation) -> String {
     let RelationBody::StateAction { target, phase, .. } = relation.body else {
         return String::new();
@@ -979,6 +938,7 @@ impl canvas::Program<Event> for StateCanvas<'_> {
             }
             canvas::Event::Window(iced::window::Event::Unfocused) => {
                 state.reset();
+                state.focused = false;
                 return None;
             }
             _ => cursor,
@@ -986,43 +946,14 @@ impl canvas::Program<Event> for StateCanvas<'_> {
         let window = cursor.position();
         let local = window.map(|p| Point::new(p.x - bounds.x, p.y - bounds.y));
         let inside = local.is_some_and(|p| Self::content(bounds).contains(p));
-        if let canvas::Event::Keyboard(keyboard::Event::KeyPressed { key, modifiers, .. }) = event {
+        if let canvas::Event::Keyboard(keyboard::Event::KeyPressed { key, modifiers, .. }) = event
+            && state.focused
+        {
             use keyboard::{Key, key::Named};
             if *key == Key::Named(Named::Escape) {
                 state.reset();
                 return Some(Action::publish(Event::Choose(Tool::Select)).and_capture());
             }
-            if *key == Key::Named(Named::Delete)
-                && self.editable
-                && self.tool == Tool::Select
-                && state.press.is_none()
-                && state.pan_from.is_none()
-                && state.source.is_none()
-                && (modifiers.is_empty() || *modifiers == keyboard::Modifiers::SHIFT)
-            {
-                let scene = self.scene(state)?;
-                let placement = scene
-                    .view
-                    .nodes
-                    .iter()
-                    .find(|node| node.element == self.selected || node.id == self.selected);
-                let object = placement.map_or(self.selected, |node| node.element);
-                if placement.is_none()
-                    && !scene.view.edges.iter().any(|edge| edge.id == object)
-                    && !visible_row_relation(self.project, self.diagram, &scene.view, object)
-                {
-                    return None;
-                }
-                return Some(
-                    Action::publish(Event::Remove(crate::app::diagram_removal::Intent {
-                        context: self.context,
-                        object,
-                        placement: placement.map(|node| node.id),
-                        model: modifiers.shift(),
-                    }))
-                    .and_capture(),
-                );
-            }
             if modifiers.is_empty() {
                 let pan = match key.as_ref() {
                     Key::Named(Named::ArrowLeft) => Some(Vector::new(60., 0.)),
@@ -1040,6 +971,7 @@ impl canvas::Program<Event> for StateCanvas<'_> {
         let scene = self.scene(state)?;
         match event {
             canvas::Event::Mouse(mouse::Event::ButtonPressed(button)) => {
+                state.focused = inside;
                 if !inside {
                     return None;
                 }
@@ -1689,7 +1621,7 @@ fn paint_node(
     }
     for (relation, row) in state_action_rows(project, node) {
         if relation.id == selected {
-            paint_selected_row(frame, row);
+            frame.fill_rectangle(row.position(), row.size(), Color::from_rgb8(224, 247, 242));
         }
         label_text(
             frame,
@@ -1705,7 +1637,7 @@ fn paint_node(
     }
     for (relation, row) in internal_rows(project, node) {
         if relation.id == selected {
-            paint_selected_row(frame, row);
+            frame.fill_rectangle(row.position(), row.size(), Color::from_rgb8(224, 247, 242));
         }
         frame.stroke(
             &line(row.position(), Point::new(row.x + row.width, row.y)),
@@ -1740,22 +1672,6 @@ fn paint_node(
     }
 }
 
-fn paint_selected_row(frame: &mut Frame, row: Rectangle) {
-    frame.fill_rectangle(row.position(), row.size(), Color::from_rgb8(224, 247, 242));
-    if row.width <= 2. || row.height <= 2. {
-        return;
-    }
-    // Selection remains visible without hue. Keep the outline inside the
-    // existing row so it cannot cover its separator or change its hit bounds.
-    frame.stroke(
-        &Path::rectangle(
-            row.position() + Vector::new(1., 1.),
-            Size::new(row.width - 2., row.height - 2.),
-        ),
-        Stroke::default().with_color(style::TEAL).with_width(1.5),
-    );
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1796,6 +1712,7 @@ mod tests {
                 layer: Layer::Sa,
                 projection: ProjectionKind::StateMachine { machine },
                 nodes: BTreeMap::new(),
+                layout: None,
                 routes: vec![],
                 view_options: Default::default(),
             },

crates/oa-desktop/src/behavior/state_edit.rs

@@ -24,7 +24,6 @@ pub enum Tool {
 
 #[derive(Debug, Clone)]
 pub enum Event {
-    Remove(crate::app::diagram_removal::Intent),
     Choose(Tool),
     CreateView(Id),
     Select(Context, Id),
@@ -71,7 +70,6 @@ pub enum Event {
 impl Event {
     pub fn context(&self) -> Option<Context> {
         match self {
-            Self::Remove(intent) => Some(intent.context),
             Self::Choose(_) | Self::CreateView(_) => None,
             Self::Select(c, _)
             | Self::Pan(c, _)
@@ -294,6 +292,7 @@ pub fn create_view(project: &Project, machine: Id) -> Result<Plan, ModelError> {
             layer: owner.layer(),
             projection: ProjectionKind::StateMachine { machine },
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
             view_options: Default::default(),
         },

crates/oa-desktop/src/behavior/state_menu.rs

@@ -139,14 +139,11 @@ pub fn popup(app: &App, opened: &Opened, clean: bool) -> Option<Menu<Message>> {
                         true,
                     ));
                 }
-                entries.push(
-                    item(
-                        "Hide from this diagram",
-                        Message::Command(Command::Delete(node.id)),
-                        true,
-                    )
-                    .shortcut("Delete"),
-                );
+                entries.push(item(
+                    "Hide from this diagram",
+                    Message::Command(Command::Delete(node.id)),
+                    true,
+                ));
             }
         }
         if let Some(relation) = project.relations.get(&id)
@@ -187,30 +184,7 @@ pub fn popup(app: &App, opened: &Opened, clean: bool) -> Option<Menu<Message>> {
         }
         if id != project.id {
             entries.push(Entry::separator());
-            entries.push(item("Delete from model…", Message::Delete, true).shortcut(
-                if context.is_some_and(|context| {
-                    context.diagram != id
-                        && (request.placement.is_some()
-                            || projection::project_view(project, context.diagram)
-                                .edges
-                                .iter()
-                                .any(|edge| edge.id == id)
-                            || super::state_canvas::visible_row_relation(
-                                project,
-                                context.diagram,
-                                &projection::project_view(project, context.diagram),
-                                id,
-                            ))
-                }) {
-                    if request.placement.is_some() {
-                        "Shift+Delete"
-                    } else {
-                        "Delete / Shift+Delete"
-                    }
-                } else {
-                    ""
-                },
-            ));
+            entries.push(item("Delete from model…", Message::Delete, true));
         }
     }
     Some(Menu {

crates/oa-desktop/src/behavior/state_view.rs

@@ -141,16 +141,12 @@ pub fn view<'a>(app: &'a App, machine: Id, mut out: Column<'a, Message>) -> Elem
             label: format!("{} · {}", p.named(element), p.elements[&element].kind()),
         })
         .collect::<Vec<_>>();
-    // Keep the optional picker in its own stable slot. Inserting it as a
-    // sibling before the canvas would replace the positional Iced focus tree.
-    let missing_spacing = if missing.is_empty() { 0.0_f32 } else { 8.0 };
-    let mut missing_controls = Column::new();
     if !missing.is_empty() {
         let position = Position {
             x: (48. - state.pan.x) / state.zoom,
             y: (90. - state.pan.y) / state.zoom,
         };
-        missing_controls = missing_controls.push(
+        out = out.push(
             pick_list(missing, None::<Choice>, move |c| {
                 event(Event::Place {
                     context,
@@ -180,20 +176,7 @@ pub fn view<'a>(app: &'a App, machine: Id, mut out: Column<'a, Message>) -> Elem
     .width(Fill)
     .height(Fill)
     .into();
-    out = out.push(
-        column![
-            missing_controls,
-            crate::diagram::focus::wrap(
-                canvas.map(event),
-                context,
-                crate::app::diagram_removal::focus_enabled(app),
-                app.busy,
-                Message::DiagramTraverse,
-            )
-        ]
-        .spacing(missing_spacing)
-        .height(Fill),
-    );
+    out = out.push(canvas.map(event));
     let base: Element<'_, Message> = container(out.spacing(8))
         .padding(14)
         .width(Fill)

crates/oa-desktop/src/behavior/topology.rs

@@ -87,6 +87,7 @@ pub struct State {
     pan: iced::Vector,
     zoom: Option<f32>,
     fit: bool,
+    pub(crate) focused: bool,
     contextual_expanded: BTreeSet<OccurrenceEndpoint>,
     selected_context: Option<oa_core::topology_context::ContextAddress>,
     shelf: Option<Shelf>,
@@ -128,6 +129,7 @@ impl State {
     pub(crate) fn camera_boundary(&self) -> impl PartialEq + use<> {
         (
             self.tool,
+            self.focused,
             self.shelf,
             self.viewport,
             self.pan,
@@ -1554,7 +1556,7 @@ impl canvas::Program<Message> for Graph<'_> {
                                 .with_color(if n.id == self.selected {
                                     style::TEAL
                                 } else {
-                                    style::BOUNDARY
+                                    style::LINE
                                 })
                                 .with_width(if n.id == self.selected { 2.5 } else { 1. }),
                         );
@@ -1661,7 +1663,7 @@ impl canvas::Program<Message> for Graph<'_> {
                                         .with_color(if selected {
                                             style::TEAL
                                         } else {
-                                            style::BOUNDARY
+                                            style::LINE
                                         })
                                         .with_width(if selected { 2.5 } else { 1. }),
                                 );
@@ -2231,7 +2233,7 @@ mod tests {
     }
 
     #[test]
-    fn process_zoom_and_disclosures_preserve_rejected_raw_draft_and_accepted_source() {
+    fn process_fit_disclosures_and_focus_preserve_rejected_raw_draft_and_accepted_source() {
         let (p, owner, _, _, _, _) = fixture();
         let mut app = App::with_project(p);
         let _ = app.update(Message::Select(owner));
@@ -2246,19 +2248,16 @@ mod tests {
         let before = app.behavior.recovery_snapshot().unwrap();
         let accepted = app.document.snapshot();
         assert!(app.behavior.prepare_pending(app.project()).is_err());
-        for (shelf, expected, zoom) in [
-            (Shelf::Selection, Some(Shelf::Selection), 0.6),
-            (Shelf::Selection, None, 1.2),
+        for (shelf, expected) in [
+            (Shelf::Selection, Some(Shelf::Selection)),
+            (Shelf::Selection, None),
         ] {
+            let focused = app.behavior.topology.focused;
             let _ = app.update(event(Event::Shelf(shelf)));
             assert_eq!(app.behavior.topology.shelf, expected);
             let context = app.topology_context().unwrap();
-            let _ = app.update(Message::TopologyCanvas(CanvasEvent::Zoom(
-                context,
-                Some(zoom),
-            )));
-            assert_ne!(app.canvas_epoch, context.epoch);
-            assert_eq!(app.behavior.topology.zoom, Some(zoom));
+            let _ = app.update(Message::TopologyCanvas(CanvasEvent::Focus(context)));
+            assert_eq!(app.behavior.topology.focused, !focused);
             assert_eq!(app.behavior.recovery_snapshot().unwrap(), before);
             assert!(app.behavior.prepare_pending(app.project()).is_err());
             assert!(std::sync::Arc::ptr_eq(&app.document.snapshot(), &accepted));

crates/oa-desktop/src/behavior/topology/direct.rs

@@ -30,7 +30,6 @@ pub enum CanvasEvent {
     Scrolled(Context, scenario::ScrollArea, iced::Vector),
     Choose(Context, CanvasTool),
     Select(Context, Id),
-    Remove(Context, Id),
     SelectQualified(Context, OccurrenceEndpoint),
     ExpandQualified(Context, OccurrenceEndpoint),
     OpenQualified(Context, OccurrenceEndpoint),
@@ -62,6 +61,7 @@ pub enum CanvasEvent {
     Back(Context),
     Zoom(Context, Option<f32>),
     Camera(Context, u64, super::super::canvas_workspace::Event),
+    Focus(Context),
     Viewport(Context, Size),
 }
 impl CanvasEvent {
@@ -70,7 +70,6 @@ impl CanvasEvent {
             Self::Scrolled(c, ..)
             | Self::Choose(c, ..)
             | Self::Select(c, ..)
-            | Self::Remove(c, ..)
             | Self::SelectQualified(c, ..)
             | Self::ExpandQualified(c, ..)
             | Self::OpenQualified(c, ..)
@@ -80,6 +79,7 @@ impl CanvasEvent {
             | Self::AppendExchange(c)
             | Self::Zoom(c, ..)
             | Self::Camera(c, ..)
+            | Self::Focus(c)
             | Self::Viewport(c, ..) => *c,
             Self::Begin { context, .. }
             | Self::Connect { context, .. }
@@ -507,12 +507,6 @@ impl Input {
     }
 }
 impl Graph<'_> {
-    fn removal_target(&self, owner: Id, id: Id) -> bool {
-        id != owner
-            && super::super::selected_behavior(self.project, id) == Some(owner)
-            && (self.nodes.iter().any(|node| node.id == id)
-                || self.edges.iter().any(|edge| edge.id == id))
-    }
     fn ordered_path_at(&self, point: Point) -> Option<&OrderedPath> {
         self.ordered_paths.iter().find(|path| {
             path.points.windows(2).any(|pair| {
@@ -641,29 +635,6 @@ impl Graph<'_> {
                 state.pointer = None;
                 return Some(Action::request_redraw());
             }
-            canvas::Event::Keyboard(iced::keyboard::Event::KeyPressed {
-                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Delete),
-                modifiers,
-                repeat: false,
-                ..
-            }) if editable
-                && tool == CanvasTool::Select
-                && (modifiers.is_empty() || *modifiers == iced::keyboard::Modifiers::SHIFT)
-                && state.press.is_none()
-                && state.source.is_none() =>
-            {
-                let context = context?;
-                if self.removal_target(context.owner, self.selected) {
-                    return Some(
-                        Action::publish(Message::TopologyCanvas(CanvasEvent::Remove(
-                            context,
-                            self.selected,
-                        )))
-                        .and_capture(),
-                    );
-                }
-                return None;
-            }
             canvas::Event::Keyboard(iced::keyboard::Event::KeyPressed {
                 key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
                 ..
@@ -981,55 +952,6 @@ impl Graph<'_> {
 }
 
 impl State {
-    pub(crate) fn selecting(&self) -> bool {
-        self.tool == CanvasTool::Select
-    }
-    pub(crate) fn removal_target(&self, p: &Project, owner: Id, id: Id) -> bool {
-        self.qualified_selection(p, owner).is_none()
-            && Graph::expanded_qualified(p, owner, id, &self.expanded, &self.contextual_expanded)
-                .removal_target(owner, id)
-    }
-    pub(crate) fn has_qualified_selection(&self, p: &Project, owner: Id) -> bool {
-        self.qualified_selection(p, owner).is_some()
-    }
-    #[cfg(test)]
-    pub(crate) fn removal_test_point(
-        &self,
-        app: &App,
-        owner: Id,
-        id: Id,
-        qualified: Option<&OccurrenceEndpoint>,
-    ) -> Point {
-        let graph = Graph::expanded_qualified(
-            app.project(),
-            owner,
-            id,
-            &self.expanded,
-            &self.contextual_expanded,
-        );
-        let point = graph
-            .nodes
-            .iter()
-            .find(|node| node.id == id)
-            .map(|node| {
-                qualified.map_or(
-                    Point::new(node.rect.x + 20., node.rect.y + 25.),
-                    |endpoint| node.endpoint_rect(endpoint).center(),
-                )
-            })
-            .or_else(|| {
-                graph
-                    .edges
-                    .iter()
-                    .find(|edge| edge.id == id)
-                    .map(|edge| edge.label.center())
-            })
-            .expect("rendered process target");
-        Point::ORIGIN
-            + self.pan
-            + iced::Vector::new(point.x, point.y)
-                * self.scale(graph.size, (app.window_size.width - 600.).max(200.))
-    }
     pub(crate) fn reveal_selection(&mut self, p: &Project, owner: Id, id: Id) -> bool {
         let graph =
             Graph::expanded_qualified(p, owner, id, &self.expanded, &self.contextual_expanded);

crates/oa-desktop/src/behavior/topology/layout_tests.rs

@@ -18,15 +18,6 @@ async fn production_process_canvas_scaled_path_creation_preserves_source_and_edi
             let _ = app.update(Message::Page(crate::app::Page::Behavior));
             app.window_size = size;
             mounted.settle(&mut app).await;
-            let geometry = mounted.geometry(&app);
-            let scope = canvas_workspace::tests::scope(&app);
-            for removed in ["Canvas", "Panels"] {
-                assert!(!geometry.containers.contains_key(&scope.control_id(removed)));
-            }
-            assert!(
-                !canvas_workspace::tests::focused(&mut mounted, &app, "viewport"),
-                "direct editing needs no activation or initial keyboard focus grab"
-            );
             for scale in [0.5, 1., 2.] {
                 let context = app.topology_context().unwrap();
                 let _ = app.update(Message::TopologyCanvas(CanvasEvent::Zoom(
@@ -218,7 +209,7 @@ async fn production_process_camera_external_controls_bounds_and_retained_deltas_
     let mut mounted = Mounted::new(&mut app).await;
     let snapshot = app.document.snapshot();
     let source = app.document.bundle().clone();
-    for boundary in ["Fit", "OR", "Details", "ZoomIn", "Bounds"] {
+    for boundary in ["Fit", "OR", "Details", "Panels", "Bounds"] {
         let toolbar = capture_toolbar(&mut mounted, &app, "Fit");
         let bounds = mounted.geometry(&app).bounds("process-viewport");
         let point = bounds.position() + iced::Vector::new(95., 90.);
@@ -408,7 +399,10 @@ async fn production_process_keyboard_enters_activates_draws_focus_and_returns_to
     )));
     assert_eq!(app.behavior.topology.pan, iced::Vector::ZERO);
     assert!(focused(&mut mounted, &app, "Fit"));
-    tab_to(&mut mounted, &mut app, "viewport").await;
+    tab_to(&mut mounted, &mut app, "Canvas").await;
+    mounted
+        .batch(&mut app, &[key(Named::Enter)], mouse::Cursor::Unavailable)
+        .await;
     assert!(focused(&mut mounted, &app, "viewport"));
     mounted
         .batch(&mut app, &[key(Named::Escape)], mouse::Cursor::Unavailable)
@@ -602,17 +596,6 @@ async fn production_canvas_keyboard_and_delayed_tasks_respect_real_chooser_and_r
     let snapshot = app.document.snapshot();
     let raw = serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap();
     let mut retained_apply = retained_focus_apply(&mut mounted, &mut app).await;
-    assert!(
-        mounted
-            .input(&app, &[key(Named::F6)], mouse::Cursor::Unavailable)
-            .is_empty(),
-        "a second F6 cannot enter while the first focus operation is pending"
-    );
-    // Native Iced completes the Chain synchronously. Complete it before a new
-    // keyboard request, retaining the same Apply to challenge its ownership
-    // guard again after it has already observed a valid owner.
-    mounted.operate(&app, &mut *retained_apply);
-    assert!(focused(&mut mounted, &app, "viewport"));
     let entry = mounted.input(&app, &[key(Named::F6)], mouse::Cursor::Unavailable);
     assert_eq!(entry.len(), 1);
     let delayed = app.update(entry[0].clone());
@@ -722,8 +705,6 @@ async fn production_canvas_keyboard_and_delayed_tasks_respect_real_chooser_and_r
     );
 
     let mut retained_apply = retained_focus_apply(&mut mounted, &mut app).await;
-    mounted.operate(&app, &mut *retained_apply);
-    assert!(focused(&mut mounted, &app, "viewport"));
     let entry = mounted.input(&app, &[key(Named::F6)], mouse::Cursor::Unavailable);
     let delayed = app.update(
         entry

crates/oa-desktop/src/behavior/topology/view.rs

@@ -247,12 +247,45 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
     .style(style::card)
     .into();
     let header = column![
-        out.width(Fill),
+        row![
+            out.width(Fill),
+            super::super::canvas_workspace::Control::new(
+                button(
+                    text(if state.focused {
+                        "Restore panels"
+                    } else {
+                        "Focus canvas"
+                    })
+                    .size(12)
+                )
+                .padding(6)
+                .on_press(super::super::canvas_workspace::intent(
+                    scope,
+                    "Panels",
+                    Message::TopologyCanvas(CanvasEvent::Focus(context))
+                )),
+                scope,
+                "Panels",
+                keyboard,
+                Some(super::super::canvas_workspace::intent(
+                    scope,
+                    "Panels",
+                    Message::TopologyCanvas(CanvasEvent::Focus(context))
+                )),
+                camera
+            )
+        ]
+        .spacing(6),
         super::super::canvas_workspace::controls(
             scope,
             keyboard,
             scale,
             event(Event::Shelf(Shelf::Selection)),
+            clean.then_some(Message::TopologyCanvas(CanvasEvent::Camera(
+                context,
+                scope.epoch,
+                super::super::canvas_workspace::Event::Focus
+            ))),
             move |zoom| Message::TopologyCanvas(CanvasEvent::Zoom(context, zoom)),
             camera
         )

crates/oa-desktop/src/context_menu.rs

@@ -737,25 +737,6 @@ impl<Message: Clone> overlay::Overlay<Message, Theme, Renderer> for MenuOverlay<
                                 },
                                 Color::from_rgb8(218, 238, 235),
                             );
-                            if row.width > 2. && row.height > 2. {
-                                renderer.fill_quad(
-                                    renderer::Quad {
-                                        bounds: Rectangle {
-                                            x: row.x + 1.,
-                                            y: row.y + 1.,
-                                            width: row.width - 2.,
-                                            height: row.height - 2.,
-                                        },
-                                        border: Border {
-                                            color: style::TEAL,
-                                            width: 1.5,
-                                            radius: 4.into(),
-                                        },
-                                        ..Default::default()
-                                    },
-                                    Color::TRANSPARENT,
-                                );
-                            }
                         }
                         let color = if message.is_some() {
                             style::INK
@@ -811,7 +792,7 @@ impl<Message: Clone> overlay::Overlay<Message, Theme, Renderer> for MenuOverlay<
                         },
                         ..Default::default()
                     },
-                    style::BOUNDARY,
+                    style::LINE,
                 );
             }
         });
@@ -1122,145 +1103,6 @@ impl<'a, Message: 'a> From<Area<'a, Message>> for Element<'a, Message> {
 mod tests {
     use super::*;
 
-    fn pixel_contrast_on_white(pixel: &[u8]) -> f32 {
-        let linear = |byte: u8| {
-            let value = f32::from(byte) / 255.;
-            if value <= 0.04045 {
-                value / 12.92
-            } else {
-                ((value + 0.055) / 1.055).powf(2.4)
-            }
-        };
-        1.05 / (0.2126 * linear(pixel[0])
-            + 0.7152 * linear(pixel[1])
-            + 0.0722 * linear(pixel[2])
-            + 0.05)
-    }
-
-    fn target_rule_coverage(pixels: &[u8], width: usize, row: Rectangle) -> f32 {
-        // Only the lower padding, away from text, corners and scroll thumb.
-        // A pale fill or scattered text pixels cannot satisfy a continuous cue.
-        let left = (row.x + 14.).ceil() as usize;
-        let right = (row.x + row.width - 20.).floor() as usize;
-        let count = (left..right)
-            .filter(|x| {
-                ((row.y + row.height - 4.).ceil() as usize
-                    ..(row.y + row.height - 1.).ceil() as usize)
-                    .any(|y| {
-                        let index = (y * width + x) * 4;
-                        pixel_contrast_on_white(&pixels[index..index + 4]) >= 3.
-                    })
-            })
-            .count();
-        count as f32 / (right - left) as f32
-    }
-
-    #[tokio::test]
-    async fn mounted_keyboard_menu_paints_target_and_scroll_thumb_then_invokes_that_action() {
-        use iced::advanced::{overlay::Overlay as _, renderer::Headless};
-        use iced_runtime::user_interface::{Cache, UserInterface};
-        let mut renderer = <Renderer as Headless>::new(iced::Font::DEFAULT, 13.into(), None)
-            .await
-            .expect("custom menu paint test requires WGPU headless rendering");
-        let mut menu = menu();
-        menu.anchor = Point::new(20., 20.);
-        menu.entries
-            .extend((30..70).map(|id| Entry::action(format!("Other action {id}"), id)));
-        let size = Size::new(480., 420.);
-        let mut measured_state = State::default();
-        let mut measured = MenuOverlay {
-            menu: &menu,
-            state: &mut measured_state,
-        };
-        let node = measured.layout(&renderer, size);
-        let geometry = measured.geometry(Layout::new(&node));
-        let row = |index: usize| {
-            geometry.row(
-                menu.entries[..index].iter().map(Entry::height).sum(),
-                menu.entries[index].height(),
-                0.,
-            )
-        };
-        let thumb = geometry.scroll_thumb(0.).expect("fixture must overflow");
-        let mut ui = UserInterface::build(
-            Popup::new(
-                iced::widget::Space::new()
-                    .width(Length::Fill)
-                    .height(Length::Fill),
-                Some(menu.clone()),
-            ),
-            size,
-            Cache::new(),
-            &mut renderer,
-        );
-        let cursor = mouse::Cursor::Unavailable;
-        let mut messages = vec![];
-        let theme = style::theme();
-        let paint_style = renderer::Style {
-            text_color: style::INK,
-        };
-        for (movement, active, inactive) in
-            [(None, 1, 4), (Some(keyboard::key::Named::ArrowDown), 4, 1)]
-        {
-            if let Some(movement) = movement {
-                let _ = ui.update(
-                    &[key(movement)],
-                    cursor,
-                    &mut renderer,
-                    &mut iced::advanced::clipboard::Null,
-                    &mut messages,
-                );
-                assert!(
-                    messages.is_empty(),
-                    "moving the target must not invoke an action"
-                );
-            }
-            // Building an Iced UI does not lay out its overlay. The normal
-            // update pass must initialize it before draw can paint the menu.
-            let _ = ui.update(
-                &[],
-                cursor,
-                &mut renderer,
-                &mut iced::advanced::clipboard::Null,
-                &mut messages,
-            );
-            assert!(messages.is_empty(), "layout cannot invoke an action");
-            ui.draw(&mut renderer, &theme, &paint_style, cursor);
-            let pixels = Headless::screenshot(&mut renderer, Size::new(480, 420), 1., Color::WHITE);
-            assert!(
-                target_rule_coverage(&pixels, 480, row(active)) > 0.8,
-                "the keyboard target needs a continuous high-contrast shape cue"
-            );
-            for index in [inactive, 2, 5] {
-                assert!(
-                    target_rule_coverage(&pixels, 480, row(index)) < 0.2,
-                    "ordinary and disabled rows must not acquire the target cue"
-                );
-            }
-            let point = thumb.center();
-            let index = (point.y.floor() as usize * 480 + point.x.floor() as usize) * 4;
-            assert!(
-                pixel_contrast_on_white(&pixels[index..index + 4]) >= 3.,
-                "the actual overflow thumb must be visible without hover"
-            );
-        }
-        let _ = ui.update(
-            &[
-                key(keyboard::key::Named::Enter),
-                key(keyboard::key::Named::Enter),
-            ],
-            cursor,
-            &mut renderer,
-            &mut iced::advanced::clipboard::Null,
-            &mut messages,
-        );
-        assert_eq!(
-            messages,
-            [22],
-            "Enter invokes exactly the painted Properties target once"
-        );
-    }
-
     #[test]
     fn actions_area_does_not_swallow_first_independent_click_after_overlay_consumed_its_release() {
         let release = Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left));

crates/oa-desktop/src/diagram.rs

@@ -34,15 +34,9 @@ mod view_options_tests;
 #[path = "diagram/port_labels.rs"]
 mod port_labels;
 pub use port_labels::PortLabels;
-#[path = "diagram/focus.rs"]
-pub(crate) mod focus;
-#[path = "diagram/work_drag.rs"]
-mod work_drag;
-pub use work_drag::WorkFeedback;
 
 #[derive(Clone, Copy)]
 pub struct DiagramCanvas<'a> {
-    pub allocation: Option<crate::app::allocation_drag::Capability<'a>>,
     pub project: &'a Project,
     pub view_index: Option<&'a oa_core::view_options::ViewIndex>,
     pub diagram: Id,
@@ -59,9 +53,8 @@ pub struct DiagramCanvas<'a> {
 }
 #[derive(Default)]
 pub struct State {
-    work: Option<Arc<crate::app::allocation_drag::Press>>,
-    work_cache: RefCell<Option<Arc<Scene>>>,
     pointer: Option<Point>,
+    keyboard_focus: bool,
     drag: Option<(Id, Point, Position)>,
     preview: Option<Position>,
     pan_start: Option<(mouse::Button, Point)>,
@@ -73,7 +66,6 @@ pub struct State {
     cache: RefCell<Option<CachedScene>>,
 }
 struct Scene {
-    work: Option<Arc<crate::app::allocation_drag::Preview>>,
     view: ProjectedView,
     routed: Arc<RoutedView>,
 }
@@ -460,26 +452,6 @@ impl DiagramCanvas<'_> {
         }
     }
     fn scene(&self, state: &State) -> Arc<Scene> {
-        if let Some(preview) = self.work_preview()
-            && state
-                .work
-                .as_ref()
-                .is_some_and(|p| p.token == preview.token)
-        {
-            if let Some(scene) = state.work_cache.borrow().as_ref()
-                && scene.work.as_ref().is_some_and(|p| Arc::ptr_eq(p, preview))
-            {
-                return scene.clone();
-            }
-            let scene = Arc::new(Scene {
-                work: Some(preview.clone()),
-                view: preview.placement.view.clone(),
-                routed: preview.routed.clone(),
-            });
-            *state.work_cache.borrow_mut() = Some(scene.clone());
-            return scene;
-        }
-        *state.work_cache.borrow_mut() = None;
         let preview = if state.context == Some(self.context) {
             state.preview
         } else {
@@ -526,11 +498,7 @@ impl DiagramCanvas<'_> {
                 route_diagram(self.project, &diagram, &view)
             },
         );
-        let scene = Arc::new(Scene {
-            work: None,
-            view,
-            routed,
-        });
+        let scene = Arc::new(Scene { view, routed });
         *state.cache.borrow_mut() = Some(CachedScene {
             context: self.context,
             preview,
@@ -561,26 +529,7 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
         bounds: Rectangle,
         cursor: mouse::Cursor,
     ) -> Option<Action<Message>> {
-        // A completed work click retires App's allocation epoch before the
-        // retained canvas sees a redraw. Its already-idle press must not eat
-        // the first Delete. A live or not-yet-dispatched press stays guarded.
-        if matches!(event, canvas::Event::Keyboard(iced::keyboard::Event::KeyPressed { key, .. })
-            if *key == iced::keyboard::Key::Named(iced::keyboard::key::Named::Delete))
-            && self.allocation.is_some_and(|capability| {
-                capability.clean
-                    && state
-                        .work
-                        .as_ref()
-                        .is_some_and(|press| press.stamp.epoch != capability.state.epoch)
-            })
-        {
-            state.work = None;
-        }
-        if let Some(action) = self.work_lifetime(state, event, bounds) {
-            return Some(action);
-        }
         if state.context != Some(self.context) {
-            state.work = None;
             state.pointer = None;
             state.port_drag = None;
             state.connection_press = None;
@@ -646,6 +595,9 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
         let local = cursor
             .position()
             .map(|p| Point::new(p.x - bounds.x, p.y - bounds.y));
+        if matches!(event, canvas::Event::Mouse(mouse::Event::ButtonPressed(_))) {
+            state.keyboard_focus = cursor.is_over(bounds);
+        }
         match event {
             canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Right))
                 if cursor.is_over(bounds) =>
@@ -665,8 +617,7 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
             }
             canvas::Event::Keyboard(iced::keyboard::Event::KeyPressed {
                 key, modifiers, ..
-            }) => {
-                // The mounted focus::Owner is the sole keyboard admission gate.
+            }) if state.keyboard_focus => {
                 use iced::keyboard::{Key, key::Named};
                 match key.as_ref() {
                     Key::Named(Named::F2)
@@ -721,37 +672,10 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                     Key::Named(Named::Delete)
                         if self.editable
                             && self.connection.is_none()
-                            && !self.placing
-                            && state.drag.is_none()
-                            && state.route_drag.is_none()
-                            && state.port_drag.is_none()
-                            && state.pan_start.is_none()
-                            && state.work.is_none()
-                            && (modifiers.is_empty()
-                                || *modifiers == iced::keyboard::Modifiers::SHIFT) =>
+                            && modifiers.is_empty()
+                            && self.selected_bend.is_some() =>
                     {
-                        // An invalid/stale bend never falls through to whole-item removal.
-                        if self.selected_bend.is_some() {
-                            return modifiers.is_empty().then(|| {
-                                Action::publish(Message::Route(RouteEvent::RemoveBend))
-                                    .and_capture()
-                            });
-                        }
-                        let request = self.selection_context_request(state, bounds);
-                        if request.object == self.diagram {
-                            return None;
-                        }
-                        Some(
-                            Action::publish(Message::DiagramRemove(
-                                crate::app::diagram_removal::Intent {
-                                    context: self.context,
-                                    object: request.object,
-                                    placement: request.placement,
-                                    model: modifiers.shift(),
-                                },
-                            ))
-                            .and_capture(),
-                        )
+                        Some(Action::publish(Message::Route(RouteEvent::RemoveBend)).and_capture())
                     }
                     _ => None,
                 }
@@ -792,22 +716,6 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                 let scene = self.scene(state);
                 let view = &scene.view;
                 let world = self.world(p);
-                if self.work_dirty_press(view, &scene.routed, p) {
-                    state.work = None;
-                    state.drag = None;
-                    state.preview = None;
-                    state.port_drag = None;
-                    state.route_drag = None;
-                    return Some(
-                        Action::publish(Message::WorkDrag(
-                            crate::app::allocation_drag::Event::Refused(
-                                self.allocation.unwrap().state.epoch,
-                                crate::app::allocation_drag::FINISH_EDIT.into(),
-                            ),
-                        ))
-                        .and_capture(),
-                    );
-                }
                 if self.placing && self.editable {
                     return Some(
                         Action::publish(Message::Architecture(
@@ -889,16 +797,6 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                     return Some(Action::publish(Message::Select(port.element)).and_capture());
                 }
                 if let Some(id) = self.hit(view, p) {
-                    if self.work_eligible(id) {
-                        return Some(self.begin_work(
-                            state,
-                            id,
-                            cursor.position()?,
-                            bounds,
-                            view,
-                            &scene.routed,
-                        ));
-                    }
                     let position = self
                         .project
                         .diagrams
@@ -937,18 +835,6 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                 }
             }
             canvas::Event::Mouse(mouse::Event::CursorMoved { .. }) => {
-                if let Some(press) = &state.work {
-                    return Some(
-                        Action::publish(Message::WorkDrag(
-                            crate::app::allocation_drag::Event::Preview(
-                                press.stamp,
-                                press.token,
-                                cursor.position(),
-                            ),
-                        ))
-                        .and_capture(),
-                    );
-                }
                 let p = local?;
                 if let Some((button, start)) = state.pan_start {
                     state.pan_start = Some((button, p));
@@ -981,18 +867,6 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                 None
             }
             canvas::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)) => {
-                if let Some(press) = state.work.take() {
-                    return Some(
-                        Action::publish(Message::WorkDrag(
-                            crate::app::allocation_drag::Event::Release(
-                                press.stamp,
-                                press.token,
-                                cursor.position(),
-                            ),
-                        ))
-                        .and_capture(),
-                    );
-                }
                 if let Some((button, start)) = state.pan_start {
                     if button == mouse::Button::Middle {
                         return Some(Action::capture());
@@ -1139,10 +1013,6 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
         f.translate(self.pan);
         f.scale(self.zoom);
         let scene = self.scene(state);
-        let project = scene
-            .work
-            .as_ref()
-            .map_or(self.project, |p| p.semantic.project());
         let view = &scene.view;
         let containers = view
             .nodes
@@ -1151,10 +1021,10 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
             .collect::<BTreeSet<_>>();
         for n in &view.nodes {
             if containers.contains(&n.id) {
-                paint_node(&mut f, project, n, self.selected, true);
+                paint_node(&mut f, self.project, n, self.selected, true);
             }
         }
-        let highlighted = highlighted_exchanges(project, self.selected);
+        let highlighted = highlighted_exchanges(self.project, self.selected);
         for edge in &view.edges {
             let Some(routed) = scene.routed.edges.get(&edge.id) else {
                 continue;
@@ -1175,9 +1045,9 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
             } else if edge.trace {
                 Color::from_rgb8(134, 107, 168)
             } else {
-                style::BOUNDARY
+                Color::from_rgb8(144, 158, 173)
             };
-            let capability_label = relationship_stereotype(project, edge.id);
+            let capability_label = relationship_stereotype(self.project, edge.id);
             let mut stroke =
                 Stroke::default()
                     .with_color(color)
@@ -1225,7 +1095,7 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                     ..Default::default()
                 });
             }
-            if let Some(relation) = project.relations.get(&edge.id) {
+            if let Some(relation) = self.project.relations.get(&edge.id) {
                 for end in routing::association_end_geometry(relation, routed) {
                     if end.navigable {
                         let [a, tip, b] = navigation_mark(end.tip, end.inward);
@@ -1259,13 +1129,13 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
         }
         for n in &view.nodes {
             if !containers.contains(&n.id) {
-                paint_node(&mut f, project, n, self.selected, false);
+                paint_node(&mut f, self.project, n, self.selected, false);
             } else {
                 // Container headers stay readable when relationships traverse
                 // the allocation enclosure. Children remain on top.
                 let mut header = n.clone();
                 header.size.height = 62.;
-                paint_node(&mut f, project, &header, self.selected, true);
+                paint_node(&mut f, self.project, &header, self.selected, true);
             }
         }
         for port in &view.ports {
@@ -1273,17 +1143,17 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                 style::TEAL
             } else {
                 style::kind_color(
-                    project.elements[&port.element]
+                    self.project.elements[&port.element]
                         .parent
-                        .and_then(|id| project.elements.get(&id))
+                        .and_then(|id| self.project.elements.get(&id))
                         .map(|e| e.kind())
                         .unwrap_or(Kind::Port),
                 )
             };
             let origin = Point::new(port.position.x - 7., port.position.y - 7.);
-            let glyph = port_glyph(&project.elements[&port.element]);
+            let glyph = port_glyph(&self.project.elements[&port.element]);
             let path = if glyph == PortGlyph::Function {
-                let corners = port_triangle(&project.elements[&port.element], port);
+                let corners = port_triangle(&self.project.elements[&port.element], port);
                 Path::new(|p| {
                     p.move_to(corners[0]);
                     p.line_to(corners[1]);
@@ -1313,7 +1183,7 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
             if matches!(glyph, PortGlyph::Flow(_)) {
                 f.stroke(
                     &Path::new(|p| {
-                        for [a, b] in flow_mark(&project.elements[&port.element], port) {
+                        for [a, b] in flow_mark(&self.project.elements[&port.element], port) {
                             p.move_to(a);
                             p.line_to(b);
                         }
@@ -1483,8 +1353,7 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
     ) -> mouse::Interaction {
         if (self.connection.is_some() || self.placing) && cursor.is_over(bounds) {
             mouse::Interaction::Crosshair
-        } else if state.work.is_some()
-            || state.drag.is_some()
+        } else if state.drag.is_some()
             || state.pan_start.is_some()
             || state.route_drag.is_some()
             || state.port_drag.is_some()
@@ -1606,11 +1475,7 @@ fn paint_node(f: &mut Frame, p: &Project, n: &ProjectedNode, selected: Id, conta
     };
     f.fill(&path, if container { tint } else { Color::WHITE });
     let mut stroke = Stroke::default()
-        .with_color(if e.id == selected {
-            color
-        } else {
-            style::BOUNDARY
-        })
+        .with_color(if e.id == selected { color } else { style::LINE })
         .with_width(if e.id == selected { 2.6 } else { 1.2 });
     if n.allocation_summary {
         stroke.line_dash = canvas::LineDash {
@@ -1729,11 +1594,32 @@ fn hex(c: Color) -> String {
         (c.b * 255.) as u8
     )
 }
-pub fn export_svg(p: &Project, diagram: Id) -> String {
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ExportError {
+    MissingDiagram(Id),
+    UnsupportedScenario(Id),
+}
+impl std::fmt::Display for ExportError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::MissingDiagram(id) => write!(f, "Cannot export: diagram {id} no longer exists."),
+            Self::UnsupportedScenario(_) => {
+                f.write_str("SVG export of saved Scenario views is not available yet.")
+            }
+        }
+    }
+}
+impl std::error::Error for ExportError {}
+
+pub fn export_svg(p: &Project, diagram: Id) -> Result<String, ExportError> {
+    let d = p
+        .diagrams
+        .get(&diagram)
+        .ok_or(ExportError::MissingDiagram(diagram))?;
+    if d.projection.scenario().is_some() {
+        return Err(ExportError::UnsupportedScenario(diagram));
+    }
     let view = project_view(p, diagram);
-    let Some(d) = p.diagrams.get(&diagram) else {
-        return String::new();
-    };
     let routed = route_diagram(p, d, &view);
     let left = routed.bounds.position.x - 30.;
     let top = routed.bounds.position.y - 30.;
@@ -1872,7 +1758,7 @@ pub fn export_svg(p: &Project, diagram: Id) -> String {
         svg.push_str("</g>");
     }
     svg.push_str("</svg>");
-    svg
+    Ok(svg)
 }
 
 #[cfg(test)]
@@ -1882,6 +1768,83 @@ mod pointer_tests;
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn svg_rejects_saved_scenario_with_absent_or_authored_layout_without_mutation() {
+        let f = crate::behavior::scenario::direct_tests::fixture();
+        let mut p = f.project;
+        let diagram = p.ensure_diagram(Layer::Oa);
+        let d = p.diagrams.get_mut(&diagram).unwrap();
+        d.projection = ProjectionKind::Scenario { scenario: f.owner };
+        d.nodes.clear();
+        d.routes.clear();
+        for layout in [
+            None,
+            Some(DiagramLayout::Scenario(ScenarioLayout {
+                lanes: vec![ScenarioLanePosition {
+                    lifeline: f.sender,
+                    x: 240.,
+                }],
+                messages: vec![ScenarioMessagePosition {
+                    address: OccurrenceEndpoint {
+                        references: vec![],
+                        occurrence: f.call,
+                    },
+                    send_y: 180.,
+                }],
+            })),
+        ] {
+            p.diagrams.get_mut(&diagram).unwrap().layout = layout;
+            let admitted = execute_batch(&p, &[]).expect("valid saved Scenario fixture");
+            assert_eq!(admitted, p);
+            let before = p.clone();
+            assert_eq!(
+                export_svg(&p, diagram),
+                Err(ExportError::UnsupportedScenario(diagram))
+            );
+            assert_eq!(p, before);
+        }
+    }
+
+    #[test]
+    fn svg_rejects_missing_diagram_without_mutation() {
+        let p = Project::demo();
+        let missing = Id::new_v4();
+        let before = p.clone();
+        assert_eq!(
+            export_svg(&p, missing),
+            Err(ExportError::MissingDiagram(missing))
+        );
+        assert_eq!(p, before);
+    }
+
+    #[test]
+    fn svg_accepts_populated_and_empty_architecture_views() {
+        let mut p = Project::demo();
+        let diagram = p
+            .diagrams
+            .values()
+            .find(|d| d.projection.is_architecture() && !d.nodes.is_empty())
+            .unwrap()
+            .id;
+        let before = p.clone();
+        let svg = export_svg(&p, diagram).expect("populated architecture");
+        assert!(svg.starts_with("<svg "));
+        assert!(svg.contains("<text "));
+        assert!(svg.ends_with("</svg>"));
+        assert_eq!(p, before);
+        let d = p.diagrams.get_mut(&diagram).unwrap();
+        d.projection = ProjectionKind::Overview;
+        d.nodes.clear();
+        d.routes.clear();
+        assert_eq!(execute_batch(&p, &[]).expect("valid empty architecture"), p);
+        let before = p.clone();
+        let svg = export_svg(&p, diagram).expect("empty architecture is supported");
+        assert!(svg.contains("viewBox=\"-30 -30 60 60\""));
+        assert!(svg.ends_with("</svg>"));
+        assert_eq!(p, before);
+    }
+
     #[test]
     fn typed_function_glyphs_and_unoriented_standard_connections_have_distinct_svg() {
         let p = Project::demo();
@@ -1915,7 +1878,7 @@ mod tests {
             .find(|d| d.layer == Layer::Sa && d.projection == ProjectionKind::Allocation)
             .unwrap()
             .id;
-        let svg = export_svg(&p, diagram);
+        let svg = export_svg(&p, diagram).expect("supported diagram");
         let title = format!("<title>{}</title>", escape(&boundary.name));
         let edge_path = svg
             .split(&title)
@@ -1989,7 +1952,7 @@ mod tests {
                 p.place(diagram, id, Position { x: 60., y: 60. });
             }
             let p = execute_batch(&p, &[Command::Layout(diagram)]).unwrap();
-            let svg = export_svg(&p, diagram);
+            let svg = export_svg(&p, diagram).expect("supported diagram");
             let group = svg
                 .split("<g>")
                 .find(|g| g.contains(">Grouped work</text>"))
@@ -2045,7 +2008,6 @@ mod tests {
             editable: true,
             placing: false,
             connection: None,
-            allocation: None,
             diagram,
             selected: p.id,
             navigation_focus: None,
@@ -2080,7 +2042,7 @@ mod tests {
             .unwrap()
             .id;
         let view = project_view(&p, diagram);
-        let svg = export_svg(&p, diagram);
+        let svg = export_svg(&p, diagram).expect("supported diagram");
         for edge in &view.edges {
             assert!(svg.contains(&format!(">{}</text>", escape(&short(p.named(edge.id), 32)))));
         }
@@ -2095,7 +2057,7 @@ mod tests {
         p.place(d, a, Position { x: 0., y: 0. });
         p.place(d, b, Position { x: 400., y: 0. });
         p.relate(RelationKind::CapabilityInclude, "Uses", a, b);
-        let svg = export_svg(&p, d);
+        let svg = export_svg(&p, d).expect("supported diagram");
         assert!(svg.contains("«include»</text>"));
         assert!(svg.contains("stroke-dasharray=\"6 4\""));
     }
@@ -2121,7 +2083,6 @@ mod tests {
             editable: true,
             placing: false,
             connection: None,
-            allocation: None,
             diagram,
             selected: p.id,
             navigation_focus: None,
@@ -2183,7 +2144,7 @@ mod tests {
             .unwrap();
         assert_eq!(moved.position.x, port.position.x + 100.);
         assert_eq!(moved.position.y, port.position.y + 70.);
-        let svg = export_svg(&p, diagram);
+        let svg = export_svg(&p, diagram).expect("supported diagram");
         for port in &view.ports {
             assert!(svg.contains(&format!("<title>{}</title>", escape(p.named(port.element)))));
         }
@@ -2248,7 +2209,6 @@ mod tests {
                 editable: true,
                 placing: false,
                 connection: Some(&session),
-                allocation: None,
             };
             let bounds = Rectangle::new(Point::new(260., 300.), Size::new(2400., 1600.));
             let at = |port: &oa_core::projection::ProjectedPort| {
@@ -2322,7 +2282,6 @@ mod tests {
             armed.start(&p, &view, source.element);
             let armed_canvas = DiagramCanvas {
                 connection: Some(&armed),
-                allocation: None,
                 ..canvas
             };
             // Winit updates cursor coordinates through CursorMoved, not the
@@ -2352,7 +2311,6 @@ mod tests {
             // A tool cancellation or navigation invalidates a queued release.
             let cancelled = DiagramCanvas {
                 connection: None,
-                allocation: None,
                 context: Context {
                     epoch: 1,
                     ..context
@@ -2425,7 +2383,6 @@ mod tests {
                 editable: true,
                 placing: false,
                 connection: None,
-                allocation: None,
             };
             let mut state = State::default();
             let pin = Point::new(400. * zoom + 150., -100. * zoom + 300.);
@@ -2502,7 +2459,6 @@ mod tests {
             editable: true,
             placing: false,
             connection: None,
-            allocation: None,
         };
         let mut state = State::default();
         let pin = Point::new(350., 250.);
@@ -2600,7 +2556,6 @@ mod tests {
             editable: true,
             placing: false,
             connection: None,
-            allocation: None,
         };
         let mut state = State::default();
         let first = canvas.scene(&state);
@@ -2646,7 +2601,7 @@ mod tests {
         });
         let view = project_view(&p, diagram);
         let geometry = route_diagram(&p, &p.diagrams[&diagram], &view);
-        let svg = export_svg(&p, diagram);
+        let svg = export_svg(&p, diagram).expect("supported diagram");
         let route = &geometry.edges[&edge];
         let path = route
             .points
@@ -2706,7 +2661,7 @@ mod tests {
             let routed = route_diagram(&p, &p.diagrams[&diagram], &projected);
             let ends = routing::association_end_geometry(&p.relations[&edge], &routed.edges[&edge]);
             assert_eq!(ends.len(), 2);
-            let svg = export_svg(&p, diagram);
+            let svg = export_svg(&p, diagram).expect("supported diagram");
             assert!(svg.contains("parent [0..1]</text>"));
             assert!(svg.contains("children [0..*]</text>"));
             assert!(!svg.contains("data-navigation=\"source\""));
@@ -2729,7 +2684,6 @@ mod tests {
                 editable: true,
                 placing: false,
                 connection: None,
-                allocation: None,
             };
             for end in ends {
                 assert!(svg.contains(&format!(
@@ -2784,7 +2738,6 @@ mod tests {
             editable: true,
             placing: false,
             connection: None,
-            allocation: None,
         };
         let mut state = State::default();
         let scene = canvas.scene(&state);
@@ -2859,7 +2812,6 @@ mod tests {
             editable: true,
             placing: false,
             connection: None,
-            allocation: None,
         };
         assert!(
             matches!(pointer(&canvas,&mut state,mouse::Event::ButtonPressed(mouse::Button::Left),point(cover)+canvas.pan),Some(Message::SelectNode(id)) if id==node.id)
@@ -2893,7 +2845,6 @@ mod tests {
             editable: true,
             placing: false,
             connection: None,
-            allocation: None,
         };
         let span = &routed.edges[&edge].points;
         let pick = point(oa_core::routing::point_along_polyline(span, 0.4).unwrap());

crates/oa-desktop/src/diagram/focus.rs

@@ -1,280 +0,0 @@
-//! Iced focus ownership shared by architecture and persisted state canvases.
-//! Focus operations (including clean Inspector focus) unfocus this widget.
-use crate::route_edit::Context;
-use iced::advanced::widget::{Operation, Tree, operation};
-use iced::advanced::{Clipboard, Layout, Shell, Widget, layout, overlay, renderer};
-use iced::{Element, Event as InputEvent, Length, Point, Rectangle, Size, Theme, Vector, mouse};
-#[derive(Default)]
-struct Input {
-    context: Option<Context>,
-    focused: bool,
-    can_focus: bool,
-    suspended: bool,
-    traversing: bool,
-    pointer: Option<Point>,
-}
-impl operation::Focusable for Input {
-    fn is_focused(&self) -> bool {
-        self.focused
-    }
-    fn focus(&mut self) {
-        if self.can_focus {
-            self.focused = true;
-            self.traversing = false;
-        }
-    }
-    fn unfocus(&mut self) {
-        self.focused = false;
-        self.traversing = false;
-    }
-}
-struct Owner<'a, Message, R: renderer::Renderer> {
-    context: Context,
-    enabled: bool,
-    suspended: bool,
-    traverse: Box<dyn Fn(bool) -> Message + 'a>,
-    content: Element<'a, Message, Theme, R>,
-}
-pub fn wrap<'a, Message: 'a, R: renderer::Renderer + 'a>(
-    content: impl Into<Element<'a, Message, Theme, R>>,
-    context: Context,
-    enabled: bool,
-    suspended: bool,
-    traverse: impl Fn(bool) -> Message + 'a,
-) -> Element<'a, Message, Theme, R> {
-    Element::new(Owner {
-        context,
-        enabled,
-        suspended,
-        traverse: Box::new(traverse),
-        content: content.into(),
-    })
-}
-impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Owner<'_, Message, R> {
-    fn tag(&self) -> iced::advanced::widget::tree::Tag {
-        iced::advanced::widget::tree::Tag::of::<Input>()
-    }
-    fn state(&self) -> iced::advanced::widget::tree::State {
-        iced::advanced::widget::tree::State::new(Input {
-            context: Some(self.context),
-            can_focus: self.enabled && !self.suspended,
-            suspended: self.suspended,
-            ..Default::default()
-        })
-    }
-    fn children(&self) -> Vec<Tree> {
-        vec![Tree::new(self.content.as_widget())]
-    }
-
-    fn diff(&self, tree: &mut Tree) {
-        let state = tree.state.downcast_mut::<Input>();
-        let suspend_started = self.suspended && !state.suspended;
-        state.suspended = self.suspended;
-        state.can_focus = self.enabled && !self.suspended;
-        // A new model revision retires pointer intent, not keyboard ownership
-        // of the same canvas. Ordinary edits and Undo/Redo keep that focus.
-        if state.context != Some(self.context) {
-            state.pointer = None;
-        }
-        if state.context.is_none_or(|previous| {
-            (previous.document, previous.diagram, previous.epoch)
-                != (self.context.document, self.context.diagram, self.context.epoch)
-        }) || !self.enabled
-        {
-            state.focused = false;
-            state.traversing = false;
-            state.pointer = None;
-        }
-        state.context = Some(self.context);
-        if suspend_started {
-            // A release may arrive while I/O owns commands. Retire the wrapped
-            // canvas's transient gestures without retiring this focus owner.
-            state.pointer = None;
-            tree.children[0] = Tree::new(self.content.as_widget());
-        } else {
-            tree.diff_children(std::slice::from_ref(&self.content));
-        }
-    }
-
-    fn size(&self) -> Size<Length> {
-        self.content.as_widget().size()
-    }
-
-    fn layout(&mut self, tree: &mut Tree, renderer: &R, limits: &layout::Limits) -> layout::Node {
-        self.content
-            .as_widget_mut()
-            .layout(&mut tree.children[0], renderer, limits)
-    }
-
-    fn operate(
-        &mut self,
-        tree: &mut Tree,
-        layout: Layout<'_>,
-        renderer: &R,
-        operation: &mut dyn Operation,
-    ) {
-        // Suspended focus can still be revoked by another field's operation.
-        // Input::focus denies acquiring it until the passive task completes.
-        if self.enabled {
-            operation.focusable(
-                Some(&iced::advanced::widget::Id::from("diagram-keyboard-owner")),
-                layout.bounds(),
-                tree.state.downcast_mut::<Input>(),
-            );
-        }
-        self.content
-            .as_widget_mut()
-            .operate(&mut tree.children[0], layout, renderer, operation);
-    }
-
-    fn update(
-        &mut self,
-        tree: &mut Tree,
-        event: &InputEvent,
-        layout: Layout<'_>,
-        cursor: mouse::Cursor,
-        renderer: &R,
-        clipboard: &mut dyn Clipboard,
-        shell: &mut Shell<'_, Message>,
-        viewport: &Rectangle,
-    ) {
-        let state = tree.state.downcast_mut::<Input>();
-        if let InputEvent::Mouse(mouse::Event::CursorMoved { position }) = event {
-            state.pointer = Some(*position);
-        }
-        if matches!(
-            event,
-            InputEvent::Window(iced::window::Event::Unfocused | iced::window::Event::Resized(_))
-        ) || !self.enabled
-        {
-            state.focused = false;
-            state.traversing = false;
-            state.pointer = None;
-        }
-        if matches!(event, InputEvent::Mouse(mouse::Event::ButtonPressed(_))) {
-            state.traversing = false;
-            let pointer = state.pointer.or_else(|| cursor.position());
-            state.focused = (state.focused || !self.suspended)
-                && self.enabled
-                && !shell.is_event_captured()
-                && cursor.position().is_some()
-                && pointer.is_some_and(|p| {
-                    layout
-                        .bounds()
-                        .intersection(viewport)
-                        .is_some_and(|b| b.contains(p))
-                });
-        }
-        // Save/export I/O denies commands and acquisition, while real focus
-        // operations and outside clicks can still revoke the retained owner.
-        if self.suspended && matches!(event, InputEvent::Keyboard(_) | InputEvent::Mouse(_)) {
-            return;
-        }
-        if let InputEvent::Keyboard(iced::keyboard::Event::KeyPressed {
-            key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Tab),
-            modifiers,
-            ..
-        }) = event
-            && state.focused
-            && !state.traversing
-            && self.enabled
-            && !shell.is_event_captured()
-            && (*modifiers == iced::keyboard::Modifiers::SHIFT || modifiers.is_empty())
-        {
-            // The focus task runs after the native batch. Retain focus for its
-            // traversal count, but reject later keys in this same batch now.
-            state.traversing = true;
-            shell.publish((self.traverse)(modifiers.shift()));
-            shell.capture_event();
-            return;
-        }
-        if matches!(event, InputEvent::Keyboard(_))
-            && (!state.focused || state.traversing || !self.enabled)
-        {
-            return;
-        }
-        if shell.is_event_captured() {
-            return;
-        }
-        self.content.as_widget_mut().update(
-            &mut tree.children[0],
-            event,
-            layout,
-            cursor,
-            renderer,
-            clipboard,
-            shell,
-            viewport,
-        );
-    }
-
-    fn draw(
-        &self,
-        tree: &Tree,
-        renderer: &mut R,
-        theme: &Theme,
-        style: &renderer::Style,
-        layout: Layout<'_>,
-        cursor: mouse::Cursor,
-        viewport: &Rectangle,
-    ) {
-        self.content.as_widget().draw(
-            &tree.children[0],
-            renderer,
-            theme,
-            style,
-            layout,
-            cursor,
-            viewport,
-        );
-        let state = tree.state.downcast_ref::<Input>();
-        if state.focused && !state.traversing && self.enabled && !self.suspended {
-            renderer.fill_quad(
-                renderer::Quad {
-                    bounds: layout.bounds(),
-                    border: iced::Border {
-                        color: crate::style::TEAL,
-                        width: 1.,
-                        ..Default::default()
-                    },
-                    ..Default::default()
-                },
-                iced::Color::TRANSPARENT,
-            );
-        }
-    }
-
-    fn mouse_interaction(
-        &self,
-        tree: &Tree,
-        layout: Layout<'_>,
-        cursor: mouse::Cursor,
-        viewport: &Rectangle,
-        renderer: &R,
-    ) -> mouse::Interaction {
-        self.content.as_widget().mouse_interaction(
-            &tree.children[0],
-            layout,
-            cursor,
-            viewport,
-            renderer,
-        )
-    }
-
-    fn overlay<'b>(
-        &'b mut self,
-        tree: &'b mut Tree,
-        layout: Layout<'b>,
-        renderer: &R,
-        viewport: &Rectangle,
-        translation: Vector,
-    ) -> Option<overlay::Element<'b, Message, Theme, R>> {
-        self.content.as_widget_mut().overlay(
-            &mut tree.children[0],
-            layout,
-            renderer,
-            viewport,
-            translation,
-        )
-    }
-}

crates/oa-desktop/src/diagram/lifecycle_tests.rs

@@ -65,7 +65,6 @@ fn canvas(app: &App) -> DiagramCanvas<'_> {
         editable: true,
         placing: false,
         connection: app.connection.as_ref(),
-        allocation: None,
     }
 }
 fn screen(app: &App, id: Id) -> Point {

crates/oa-desktop/src/diagram/pointer_tests.rs

@@ -73,7 +73,6 @@ fn canvas(app: &App, zoom: f32) -> DiagramCanvas<'_> {
         editable: true,
         placing: false,
         connection: app.connection.as_ref(),
-        allocation: None,
     }
 }
 fn event(

crates/oa-desktop/src/diagram/port_hit_tests.rs

@@ -19,7 +19,6 @@ fn canvas(project: &Project, diagram: Id, zoom: f32) -> DiagramCanvas<'_> {
         editable: true,
         placing: false,
         connection: None,
-        allocation: None,
     }
 }
 

crates/oa-desktop/src/diagram/port_labels.rs

@@ -58,9 +58,6 @@ impl canvas::Program<Message> for PortLabels<'_> {
         bounds: Rectangle,
         cursor: mouse::Cursor,
     ) -> Vec<canvas::Geometry> {
-        if self.0.work_preview().is_some() {
-            return vec![]; // The candidate canvas already paints its own ports.
-        }
         if state.context == Some(self.0.context) && state.held_buttons != 0 {
             return vec![];
         }
@@ -189,7 +186,6 @@ mod tests {
             editable: true,
             placing: false,
             connection: None,
-            allocation: None,
         })
     }
 

crates/oa-desktop/src/diagram/view_options_tests.rs

@@ -27,7 +27,7 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
     validate_candidate(&p).unwrap();
     let initial = p.clone();
     let path_key = format!("<path data-edge=\"{edge}\"");
-    let svg = export_svg(&p, diagram);
+    let svg = export_svg(&p, diagram).expect("supported diagram");
     let edge_path = svg
         .split(&path_key)
         .nth(1)
@@ -46,7 +46,7 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
         .unwrap()
         .view_options
         .exchange_labels = ExchangeLabels::Items;
-    let items_svg = export_svg(&p, diagram);
+    let items_svg = export_svg(&p, diagram).expect("supported diagram");
     assert!(items_svg.contains("Data &amp; status"));
     let RelationBody::CommunicationMean { oriented, .. } =
         &mut p.relations.get_mut(&edge).unwrap().body
@@ -54,7 +54,7 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
         unreachable!()
     };
     *oriented = true;
-    let svg = export_svg(&p, diagram);
+    let svg = export_svg(&p, diagram).expect("supported diagram");
     assert!(
         svg.split(&path_key)
             .nth(1)
@@ -71,7 +71,11 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
         .view_options
         .hidden_edges
         .push(edge);
-    assert!(!export_svg(&p, diagram).contains(&path_key));
+    assert!(
+        !export_svg(&p, diagram)
+            .expect("supported diagram")
+            .contains(&path_key)
+    );
     p.diagrams
         .get_mut(&diagram)
         .unwrap()
@@ -83,7 +87,11 @@ fn communication_svg_uses_saved_visibility_labels_and_direction() {
         .unwrap()
         .view_options
         .relation_kinds = RelationKinds::Only(vec![]);
-    assert!(!export_svg(&p, diagram).contains(&path_key));
+    assert!(
+        !export_svg(&p, diagram)
+            .expect("supported diagram")
+            .contains(&path_key)
+    );
     assert_eq!(p.diagrams[&diagram].nodes, placements);
     assert_eq!(language::parse(&language::format(&p)).unwrap(), p);
 }

crates/oa-desktop/src/diagram/work_drag.rs

@@ -1,185 +0,0 @@
-use super::*;
-use crate::app::allocation_drag::{self as input, Event, Press, Stamp};
-
-impl DiagramCanvas<'_> {
-    pub(crate) fn work_dirty_point(&self, bounds: Rectangle, screen: Point) -> bool {
-        let diagram = &self.project.diagrams[&self.diagram];
-        let view = self.projected(diagram);
-        let routed = routing::route_diagram(self.project, diagram, &view);
-        self.work_dirty_press(
-            &view,
-            &routed,
-            Point::new(screen.x - bounds.x, screen.y - bounds.y),
-        )
-    }
-    pub(super) fn work_preview(&self) -> Option<&Arc<input::Preview>> {
-        let capability = self.allocation?;
-        let feedback = capability.state.feedback.as_ref()?;
-        (capability.clean
-            && feedback.press.stamp.context == self.context
-            && feedback.press.stamp.epoch == capability.state.epoch
-            && feedback.press.stamp.pan == self.pan
-            && feedback.press.stamp.zoom == self.zoom)
-            .then_some(capability.state.preview.as_ref())
-            .flatten()
-    }
-    pub(super) fn work_eligible(&self, placement: Id) -> bool {
-        self.allocation.is_some()
-            && self.project.diagrams[&self.diagram].projection == ProjectionKind::Allocation
-            && self.project.diagrams[&self.diagram]
-                .nodes
-                .get(&placement)
-                .and_then(|n| self.project.elements.get(&n.element))
-                .is_some_and(|e| e.kind().is_work())
-    }
-    pub(super) fn work_dirty_press(
-        &self,
-        view: &ProjectedView,
-        routed: &RoutedView,
-        local: Point,
-    ) -> bool {
-        self.allocation.is_some_and(|c| !c.clean)
-            && !self.placing
-            && self.connection.is_none()
-            && self.project.diagrams[&self.diagram].projection == ProjectionKind::Allocation
-            && (self.hit(view, local).is_some()
-                || self.hit_port(view, local).is_some()
-                || self.hit_edge(routed, local).is_some()
-                || self.hit_label(routed, local).is_some()
-                || self.hit_association_label(routed, local).is_some())
-    }
-    pub(super) fn begin_work(
-        &self,
-        state: &mut State,
-        node: Id,
-        screen: Point,
-        bounds: Rectangle,
-        view: &ProjectedView,
-        routed: &RoutedView,
-    ) -> Action<Message> {
-        let capability = self.allocation.unwrap();
-        state.drag = None;
-        state.preview = None;
-        state.port_drag = None;
-        state.route_drag = None;
-        if !capability.clean {
-            return Action::publish(Message::WorkDrag(Event::Refused(
-                capability.state.epoch,
-                input::FINISH_EDIT.into(),
-            )))
-            .and_capture();
-        }
-        let work = self.project.diagrams[&self.diagram].nodes[&node].element;
-        let scope = match crate::allocation_drag::capture(self.project, self.diagram, work, node) {
-            Ok(scope) => scope,
-            Err(reason) => {
-                return Action::publish(Message::WorkDrag(Event::Refused(
-                    capability.state.epoch,
-                    input::refusal(&reason),
-                )))
-                .and_capture();
-            }
-        };
-        let frozen = input::Frozen::capture(self.project, &scope, view, routed, self.zoom);
-        let press = Arc::new(Press {
-            stamp: Stamp {
-                context: self.context,
-                epoch: capability.state.epoch,
-                snapshot: capability.snapshot,
-                bounds,
-                pan: self.pan,
-                zoom: self.zoom,
-            },
-            token: Id::new_v4(),
-            start: screen,
-            scope,
-            frozen,
-            arrange: capability.state.arrange_next,
-        });
-        state.work = Some(press.clone());
-        Action::publish(Message::WorkDrag(Event::Press(press))).and_capture()
-    }
-    pub(super) fn work_lifetime(
-        &self,
-        state: &mut State,
-        event: &canvas::Event,
-        bounds: Rectangle,
-    ) -> Option<Action<Message>> {
-        let press = state.work.as_ref()?;
-        let cancel = self
-            .allocation
-            .is_none_or(|c| !c.clean || c.state.epoch != press.stamp.epoch)
-            || press.stamp.context != self.context
-            || press.stamp.bounds != bounds
-            || press.stamp.pan != self.pan
-            || press.stamp.zoom != self.zoom
-            || matches!(
-                event,
-                canvas::Event::Window(iced::window::Event::Unfocused)
-                    | canvas::Event::Mouse(mouse::Event::CursorLeft)
-                    | canvas::Event::Mouse(mouse::Event::ButtonPressed(
-                        mouse::Button::Middle | mouse::Button::Right
-                    ))
-                    | canvas::Event::Mouse(mouse::Event::WheelScrolled { .. })
-            )
-            || matches!(event, canvas::Event::Keyboard(iced::keyboard::Event::KeyPressed { key, .. })
-                if *key == iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape));
-        if cancel {
-            let token = press.token;
-            state.work = None;
-            state.pointer = None;
-            return Some(Action::publish(Message::WorkDrag(Event::Cancel(token))).and_capture());
-        }
-        None
-    }
-}
-
-/// Passive frozen target outlines. Destination identity is in the toolbar so
-/// feedback cannot cover candidate text or change the target hit geometry.
-pub struct WorkFeedback<'a>(pub DiagramCanvas<'a>);
-impl canvas::Program<Message> for WorkFeedback<'_> {
-    type State = ();
-    fn draw(
-        &self,
-        _: &(),
-        renderer: &Renderer,
-        _: &Theme,
-        bounds: Rectangle,
-        _: mouse::Cursor,
-    ) -> Vec<canvas::Geometry> {
-        let Some(capability) = self.0.allocation else {
-            return vec![];
-        };
-        let Some(feedback) = &capability.state.feedback else {
-            return vec![];
-        };
-        if feedback.press.stamp.epoch != capability.state.epoch
-            || feedback.press.stamp.context != self.0.context
-            || feedback.press.stamp.bounds != bounds
-        {
-            return vec![];
-        }
-        let mut frame = Frame::new(renderer, bounds.size());
-        let color = if feedback.refused {
-            Color::from_rgb8(173, 66, 41)
-        } else {
-            style::TEAL
-        };
-        for index in &feedback.targets {
-            let target = &feedback.press.frozen.targets[*index];
-            let region = target.region;
-            let top = Point::new(
-                region.x * self.0.zoom + self.0.pan.x,
-                region.y * self.0.zoom + self.0.pan.y,
-            );
-            frame.stroke(
-                &Path::rectangle(
-                    top,
-                    iced::Size::new(region.width * self.0.zoom, region.height * self.0.zoom),
-                ),
-                Stroke::default().with_color(color).with_width(3.),
-            );
-        }
-        vec![frame.into_geometry()]
-    }
-}

crates/oa-desktop/src/forms.rs

@@ -1535,7 +1535,8 @@ fn group_label(path: &str) -> Option<&'static str> {
 }
 
 fn placement_allowed(project: &Project, diagram: &Diagram, element: &Element, current: Id) -> bool {
-    (diagram.projection == ProjectionKind::Traceability || diagram.layer == element.layer())
+    diagram.projection.scenario().is_none()
+        && (diagram.projection == ProjectionKind::Traceability || diagram.layer == element.layer())
         && diagram
             .projection
             .state_machine()
@@ -2683,6 +2684,7 @@ mod tests {
                 description: String::new(),
                 layer: Layer::Oa,
                 projection: ProjectionKind::Overview,
+                layout: None,
                 routes: Vec::new(),
                 view_options: Default::default(),
                 nodes: BTreeMap::new(),

crates/oa-desktop/src/forms/reference_chooser/trigger.rs

@@ -295,7 +295,7 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Field<'_, Mes
                         color: if focus || cursor.is_over(layout.bounds()) {
                             style::TEAL
                         } else {
-                            style::BOUNDARY
+                            style::LINE
                         },
                         width: if focus { 2. } else { 1. },
                         radius: 5.into(),

crates/oa-desktop/src/forms/reference_chooser/widget.rs

@@ -708,7 +708,7 @@ impl<Message: Clone, R: text::Renderer<Font = Font>> overlay::Overlay<Message, T
             renderer::Quad {
                 bounds: geometry.popup,
                 border: Border {
-                    color: style::BOUNDARY,
+                    color: style::LINE,
                     width: 1.,
                     radius: 8.into(),
                 },
@@ -751,22 +751,6 @@ impl<Message: Clone, R: text::Renderer<Font = Font>> overlay::Overlay<Message, T
                         },
                         Color::from_rgb8(218, 238, 235),
                     );
-                    // Labels begin at row.x. Keep the target cue below their
-                    // two text lines without changing measured or hit bounds.
-                    if row.width > 4. && row.height > 3. {
-                        renderer.fill_quad(
-                            renderer::Quad {
-                                bounds: Rectangle {
-                                    x: row.x + 2.,
-                                    y: row.y + row.height - 3.,
-                                    width: row.width - 4.,
-                                    height: 2.,
-                                },
-                                ..Default::default()
-                            },
-                            style::TEAL,
-                        );
-                    }
                 }
                 let alias_width = (row.width * 0.42).min(
                     measure::<R>(
@@ -1008,181 +992,3 @@ fn raw_label<R: text::Renderer<Font = Font>>(
         bounds,
     );
 }
-
-#[cfg(test)]
-mod paint_tests {
-    use super::super::{Candidate, Context, Current, Outcome};
-    use super::*;
-    use iced::advanced::renderer::Headless;
-    use iced_runtime::user_interface::{Cache, UserInterface};
-    use oa_core::Id;
-
-    fn named(key: keyboard::key::Named) -> Event {
-        Event::Keyboard(keyboard::Event::KeyPressed {
-            key: keyboard::Key::Named(key),
-            modified_key: keyboard::Key::Named(key),
-            physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Space),
-            location: keyboard::Location::Standard,
-            modifiers: keyboard::Modifiers::empty(),
-            text: None,
-            repeat: false,
-        })
-    }
-
-    fn view(chooser: &Chooser, anchor: Rectangle) -> Element<'_, ChoiceEvent> {
-        Popup::new(
-            iced::widget::Space::new()
-                .width(Length::Fill)
-                .height(Length::Fill),
-            Some(chooser),
-            anchor,
-            std::convert::identity,
-        )
-        .into()
-    }
-
-    fn lower_rule_coverage(pixels: &[u8], row: Rectangle) -> f32 {
-        let linear = |byte: u8| {
-            let value = f32::from(byte) / 255.;
-            if value <= 0.04045 {
-                value / 12.92
-            } else {
-                ((value + 0.055) / 1.055).powf(2.4)
-            }
-        };
-        let left = (row.x + 14.).ceil() as usize;
-        let right = (row.x + row.width - 14.).floor() as usize;
-        let count = (left..right)
-            .filter(|x| {
-                ((row.y + row.height - 4.).ceil() as usize
-                    ..(row.y + row.height - 1.).ceil() as usize)
-                    .any(|y| {
-                        let index = (y * 480 + x) * 4;
-                        let pixel = &pixels[index..index + 4];
-                        let luminance = 0.2126 * linear(pixel[0])
-                            + 0.7152 * linear(pixel[1])
-                            + 0.0722 * linear(pixel[2]);
-                        1.05 / (luminance + 0.05) >= 3.
-                    })
-            })
-            .count();
-        count as f32 / (right - left) as f32
-    }
-
-    #[tokio::test]
-    async fn mounted_chooser_keyboard_target_is_visible_and_enter_keeps_exact_identity() {
-        let mut renderer = <iced::Renderer as Headless>::new(Font::DEFAULT, 13.into(), None)
-            .await
-            .expect("custom chooser paint test requires WGPU headless rendering");
-        let context = Context::live(
-            Id::from_u128(1),
-            7,
-            Id::from_u128(2),
-            Id::from_u128(3),
-            "/body/SequenceUse/sequence",
-            false,
-        )
-        .unwrap();
-        let mut chooser = Chooser::open(
-            context.clone(),
-            [(13, "Gamma"), (12, "Beta"), (11, "Alpha")]
-                .into_iter()
-                .map(|(id, name)| Candidate {
-                    id: Id::from_u128(id),
-                    name: name.into(),
-                    alias: format!("candidate_{id}"),
-                    kind: "Function".into(),
-                    scope: "SA".into(),
-                    containment: "System / supply topology".into(),
-                })
-                .collect(),
-            Current::Unassigned,
-            "SA · compatible functions",
-        )
-        .unwrap();
-        let anchor = Rectangle {
-            x: 20.,
-            y: 20.,
-            width: 300.,
-            height: 30.,
-        };
-        let size = Size::new(480., 420.);
-        let geometry = Geometry::new(anchor, size);
-        let cursor = mouse::Cursor::Unavailable;
-        let theme = style::theme();
-        let paint_style = renderer::Style {
-            text_color: style::INK,
-        };
-        let mut cache = Cache::new();
-        let mut messages = vec![];
-        for active in 0..2 {
-            let mut ui = UserInterface::build(view(&chooser, anchor), size, cache, &mut renderer);
-            // Every controlled rebuild starts without a retained overlay layout.
-            // Run the normal update pass before observing the rendered popup.
-            let _ = ui.update(
-                &[],
-                cursor,
-                &mut renderer,
-                &mut iced::advanced::clipboard::Null,
-                &mut messages,
-            );
-            assert!(messages.is_empty(), "layout cannot browse or choose");
-            ui.draw(&mut renderer, &theme, &paint_style, cursor);
-            let pixels = Headless::screenshot(&mut renderer, Size::new(480, 420), 1., Color::WHITE);
-            for index in 0..3 {
-                let coverage = lower_rule_coverage(&pixels, geometry.row(index));
-                if index == active {
-                    assert!(
-                        coverage > 0.8,
-                        "the actual keyboard candidate needs a continuous shape cue"
-                    );
-                } else {
-                    assert!(
-                        coverage < 0.2,
-                        "the previous and ordinary candidates must not retain the cue"
-                    );
-                }
-            }
-            let events = if active == 0 {
-                vec![named(keyboard::key::Named::ArrowDown)]
-            } else {
-                vec![
-                    named(keyboard::key::Named::Enter),
-                    named(keyboard::key::Named::Enter),
-                ]
-            };
-            let _ = ui.update(
-                &events,
-                cursor,
-                &mut renderer,
-                &mut iced::advanced::clipboard::Null,
-                &mut messages,
-            );
-            cache = ui.into_cache();
-            assert_eq!(
-                messages.len(),
-                1,
-                "one movement or one exact choice, with no repeated Enter"
-            );
-            let outcome = chooser.update(messages.pop().unwrap());
-            if active == 0 {
-                assert_eq!(outcome, Outcome::Browsed);
-                assert_eq!(chooser.highlighted().unwrap().id, Id::from_u128(12));
-                assert_eq!(
-                    chooser.current,
-                    Current::Unassigned,
-                    "navigation cannot write a reference"
-                );
-            } else {
-                assert_eq!(
-                    outcome,
-                    Outcome::Write {
-                        context: context.clone(),
-                        value: Some(Id::from_u128(12))
-                    }
-                );
-                assert!(!chooser.is_open());
-            }
-        }
-    }
-}

crates/oa-desktop/src/guide.rs

@@ -188,7 +188,7 @@ fn article(topic: Topic) -> Article {
                                 "Choose New in the top bar. Use Project properties to name the model and describe its purpose. Apply changes commits the property draft.",
                                 "On Architecture, choose Create architecture view. Architecture · allocated work shows work inside its performer.",
                                 "Expand the diagram's side palette to see tool names. Choose Entity, click its position in the diagram, enter Rescue coordinator and press Enter. Escape cancels the draft. Use Actor for an external participant such as a Vessel in distress. Right-clicking a blank area also offers Create Entity here.",
-                                "Right-click Rescue coordinator and choose Add activity. Enter Assess incident and press Enter to create the activity and its performer allocation together. Ordinary Activity creation in the palette leaves work unallocated. In the allocated-work view, drag existing work into exposed space inside its performer to assign it; the highlighted performer and status explain the proposed change.",
+                                "Right-click Rescue coordinator and choose Add activity. Enter Assess incident and press Enter to create the activity and its performer allocation together. Ordinary Activity creation in the palette leaves work unallocated; use + Relationship with Allocation to assign existing work. The allocated-work view shows work inside its performer.",
                                 "Use Add existing to place an element that is already in the model. The initial choices match this view; no search is required. Include already shown offers Locate for elements already placed here.",
                                 "Add a second activity for another participant. Select an activity, choose + Relationship, select Interaction and choose the compatible target. Name the exchange after what is conveyed.",
                                 "Visit Model checks to review unfinished work. Save all writes the accepted model and applied drafts to your chosen file.",
@@ -263,7 +263,7 @@ fn article(topic: Topic) -> Article {
                             &[
                                 "Choose the Operational or System perspective. Create participants using Entity/Actor in OA or System/System actor in SA.",
                                 "In the diagram's side palette, choose Activity in OA or Function in SA, click its position, enter a name and press Enter. Escape cancels without creating an element. Select a card and press F2 to rename it in place. For semantic decomposition, use Model explorer, select existing work and use + In selected to create smaller work units.",
-                                "Right-click a participant and choose Add activity or Add function to create new work and its allocation together. In Architecture · allocated work, drag existing work into a performer to assign it, between performers to reassign it, or onto empty canvas to remove its direct assignment. + Relationship with Allocation and Model explorer's + Allocated provide explicit alternatives.",
+                                "Right-click a participant and choose Add activity or Add function to create new work and its allocation together. To assign existing leaf work, use + Relationship with Allocation from the participant to the work. Model explorer also offers + Allocated when a participant and the appropriate work kind are selected.",
                                 "Choose Architecture · allocated work to review responsibilities. Choose Functional dataflow to review the activity/function hierarchy and its exchanges independently.",
                             ],
                         ),
@@ -289,7 +289,7 @@ fn article(topic: Topic) -> Article {
             const {
                 Article {
                     summary: "A diagram is a view of the model. Its boxes, positions and nesting reveal selected relationships; moving a box does not redefine engineering ownership.",
-                    keywords: "containment semantic parent hierarchy nested nesting allocation deployment diagram placement arrange next drag Alt+A auto-layout fit fold hide zoom resize routing connection bend waypoint detour label reset selective visibility category categories coverage process context duplicate copy items",
+                    keywords: "containment semantic parent hierarchy nested nesting allocation deployment diagram placement arrange fit fold hide zoom resize routing connection bend waypoint detour label reset selective visibility category categories coverage process context duplicate copy items",
                     sections: &[
                         explain(
                             "Three things to distinguish",
@@ -309,22 +309,14 @@ fn article(topic: Topic) -> Article {
                                 "Use the diagram selector or + View to work with a focused diagram. View properties edits its name, perspective, projection and Saved view visibility. Apply changes commits the view settings.",
                                 "Choose Containment for semantic children, Architecture · allocated work for responsibilities, Functional dataflow for work and exchanges, or Missions & capabilities for outcomes. All relationships is a broader exploration view; OA ↔ SA traceability displays counterparts.",
                                 "Select an element and edit Semantic parent to change ownership. Use an Allocation relationship to change responsibility. Apply changes validates the semantic change.",
-                                "Scroll to zoom and use Fit to frame the current view. In allocated-work views, dragging work changes its assignment and placement together. Choose Arrange next drag or press Alt+A to move work without changing responsibility for that one drag; Escape cancels the armed action. Auto-layout arranges the whole view. Export SVG produces a shareable view.",
-                                "Select a diagram node to access Placement, Fold / unfold and Hide. With the canvas focused, Delete hides its placement; Shift+Delete asks to remove the model element. Other views retain a hidden element. Undo restores either change.",
+                                "Drag nodes to arrange the current view, scroll to zoom and use Fit to frame its contents. Arrange changes diagram geometry. Export SVG produces a shareable view.",
+                                "Select a diagram node to access Placement, Fold / unfold and Hide. Hide removes its view placement; Delete from model removes model records and requires review of the affected references.",
                             ],
                         ),
                         explain(
                             "Keep diagrams readable",
                             "Use separate views for responsibility, decomposition and cross-layer coverage. Place existing elements with Show in this diagram. A placement's Diagram field can relocate it while preserving its identity and artifact references. Do not duplicate a semantic element merely to show it in another view.",
                         ),
-                        walkthrough(
-                            "Move work between performers",
-                            &[
-                                "Finish or cancel property and source edits, then drag an Activity or Function body in Architecture · allocated work. Aim at exposed performer space, including a collapsed performer's header. Read Destination above the canvas and the outlined target before releasing; release outside the canvas or press Escape to cancel.",
-                                "The move preserves work ownership and identities. A uniformly assigned work group moves its leaves together; a group distributed across performers asks you to choose a leaf. Role responsibilities remain explicit: an outward drag that would leave a role-derived performer explains why it cannot remove that responsibility.",
-                                "Make room when work cards would overlap, and move the view or zoom in if the moving work is not readable. The destination name stays above the canvas while the target outline stays fixed during the drag. Hover Destination to inspect a long name: outside the canvas, the tooltip explicitly identifies the last target, and releasing cancels. Return to the canvas to choose the drop. A refused drop keeps the model and history unchanged. One Undo reverses an accepted assignment and placement together; Save all writes the corresponding source changes.",
-                            ],
-                        ),
                         walkthrough(
                             "Save a focused exchange view",
                             &[
@@ -344,7 +336,7 @@ fn article(topic: Topic) -> Article {
                             &[
                                 "Select an architecture connection and drag a segment to add a bend. Right-click a line for Add bend here; right-click a circle for Remove bend. With the canvas focused, Insert adds a bend and Delete removes the selected bend. Drag the label independently. Escape cancels a gesture; Undo reverses one completed drag. Shift+F10 opens the selected diagram item's context menu; use arrow keys and Enter to choose an action.",
                                 "Automatic orthogonal routing avoids cards and container headers where space permits. Amber connections need attention: move an obstructing element or a bend. In Select / move, drag a port to any border of its owner. Manual positions are per diagram; right-click Reset automatic position restores connection-aware placement. Ports remain attached to their actual owners. Manual routes are saved separately for each diagram and appear in source, API and SVG export.",
-                                "Right-click a connection and choose Reset routing to clear its pins and label position in this view. The Properties Actions menu provides the same commands. Auto-layout preserves pins. Moving one endpoint keeps pins fixed; moving a container carrying both endpoints translates their pins. When folding promotes an endpoint, expand it again to resume and edit its saved route.",
+                                "Right-click a connection and choose Reset routing to clear its pins and label position in this view. The Properties Actions menu provides the same commands. Arrange preserves pins. Moving one endpoint keeps pins fixed; moving a container carrying both endpoints translates their pins. When folding promotes an endpoint, expand it again to resume and edit its saved route.",
                             ],
                         ),
                         explain(
@@ -453,7 +445,7 @@ fn article(topic: Topic) -> Article {
                         walkthrough(
                             "Describe a path through exchanges",
                             &[
-                                "A blank path offers Add first activity/function contribution. You can use existing work or stage a new source in that form; exchanges still need explicit compatible source and target work.",
+                                "On an empty path, choose Work (W) from the right palette and click the canvas. You can use existing work or stage a new source in that form; exchanges still need explicit compatible source and target work.",
                                 "Open Behavior & scenarios → New. Choose Operational process in OA or Functional chain in SA, enter its exact name, then Create and open. The new behavior belongs at the layer root and opens immediately; Undo removes the creation as one edit.",
                                 "Choose Work (W) or Exchange (E) from the permanent palette on the right, then a highlighted position. Hover a palette button to read its tool name. In Work, Create new source keeps the contribution name and position while you name its Activity/Function and choose its semantic parent. Use this new source stages it; Create commits source and contribution in one Undo. An adjacent exchange may require a particular existing work identity.",
                                 "Choose Sequence link (->) and click or drag from the preceding contribution to the following contribution. Choose Select contributions or paths (S) to drag a selected path endpoint and reconnect it. A contribution's ↕ handle reorders contributions within the same column; links determine the columns. These are local contributions and sequence links, not new architecture exchanges.",
@@ -463,7 +455,7 @@ fn article(topic: Topic) -> Article {
                         ),
                         explain(
                             "Navigate the canvas",
-                            "The header and palette stay available while Details and creation forms overlay the canvas. Fit frames the contents; −/+ changes zoom and 100% restores working scale. Click in the canvas to give it wheel and keyboard focus; pan with middle-button drag or Space + left drag. F6 enters or leaves canvas keyboard controls; Tab moves to the next control, Enter/Space activates it, and Escape leaves canvas controls or cancels a gesture.",
+                            "The header and palette stay available while Details and creation forms overlay the canvas. Fit frames the contents; −/+ changes zoom and 100% restores working scale. Focus the canvas to zoom with the wheel or pan with middle-button drag or Space + left drag. F6 enters or leaves canvas controls; Tab moves to the next control, Enter/Space activates it, and Escape leaves canvas controls or cancels a gesture.",
                         ),
                         explain(
                             "Choose the right behavioral description",
@@ -476,7 +468,7 @@ fn article(topic: Topic) -> Article {
                         walkthrough(
                             "Connect a particular use of a procedure",
                             &[
-                                "Select a contribution directly inside a reusable preview, then open Details to read its complete caller and reference identity. The explorer and properties remain available alongside the canvas.",
+                                "Choose Focus canvas for more working space; Restore panels brings the explorer and properties back. Select a contribution inside a reusable preview, then open Details to read its complete caller and reference identity.",
                                 "In Details, use Expand nested reference or Fold nested reference to inspect that instance. Open source or Open contribution definition visits the shared definition; Back to caller returns to the original caller context.",
                                 "Open Details → Qualified link / assembly... and choose its source and target. Use Enter reference to open an instance's contributions, Up one reference for its caller scope, or Root for the link owner. Search and page through all contributions in that scope, then select the exact endpoint. The first and second uses of a procedure remain different choices even when their work has the same name.",
                                 "Choose Precedence to describe order and its guard, Exchange assembly to identify a work exchange between the contributions, or Common work incidence to state that both use the same work. Select the engineering identity when required, then Apply link.",
@@ -496,7 +488,7 @@ fn article(topic: Topic) -> Article {
             const {
                 Article {
                     summary: "Use a scenario to tell a concrete behavioral story, including repeated messages, actions, state observations and guarded alternatives.",
-                    keywords: "scenario sequence lifeline sender receiver fragment branch alternative loop guard parallel strict optional occurrence exchange action state interface operation allocation call reply unresolved",
+                    keywords: "scenario sequence lifeline lifetime lifecycle birth death capsule sender receiver fragment branch alternative loop guard parallel strict optional occurrence exchange action state interface operation allocation call reply unresolved",
                     sections: &[
                         walkthrough(
                             "Create a scenario",
@@ -522,6 +514,14 @@ fn article(topic: Topic) -> Article {
                                 "Inspect the scenario projection and Model checks. State exactly what each guard means, including units and assumptions where relevant.",
                             ],
                         ),
+                        explain(
+                            "Read lifeline creation and deletion",
+                            "The Lane header and dotted guide identify a lifeline; the guide alone does not establish its lifetime. The stronger solid line shows where the lifeline is known to exist on this scenario path. Create starts that line at a named capsule; Delete ends it at an X. Select the capsule or X to edit that message occurrence. Select the header or guide to inspect the lifeline.",
+                        ),
+                        explain(
+                            "Distinguish uncertain lifetime from an unanswered call",
+                            "A ? means lifetime depends on an alternative, optional, repeated or parallel path. Operands have independent lifetimes: Delete in one alternative does not delete a lifeline in another. Beyond such a fragment, the guide can continue without a definite solid line. This uncertainty is not by itself a model error. The … beside an activation marks a Call that remains unanswered on that path. A reused scenario's internal Create/Delete events appear when you choose Open definition; they do not create or delete the caller's lifelines.",
+                        ),
                         walkthrough(
                             "Invoke an interface operation",
                             &[
@@ -570,7 +570,7 @@ fn article(topic: Topic) -> Article {
                         ),
                         explain(
                             "Navigate and recover a view",
-                            "Middle-button drag pans; scroll or use −/+ to zoom, and Fit frames the diagram. Right-click a container for Fold contents or Unfold contents, or choose Placement properties for exact coordinates and size. With the canvas focused, Delete hides a selected state placement; Shift+Delete confirms model removal. Delete on an action or internal-transition row confirms removal of that relation, preserving its states and referenced work. Escape cancels a drawing gesture. Undo restores each completed edit, and Model checks identifies unfinished structures.",
+                            "Middle-button drag pans; scroll or use −/+ to zoom, and Fit frames the diagram. Right-click a container for Fold contents or Unfold contents, or choose Placement properties for exact coordinates and size. Hide from this diagram removes only its placement; Show an element not yet in this view restores missing elements. Escape cancels a drawing gesture. Undo restores each completed gesture or menu edit, and Model checks identifies unfinished structures.",
                         ),
                         explain(
                             "One saved diagram across editors",
@@ -999,10 +999,6 @@ fn article(topic: Topic) -> Article {
                             "Shortcuts act on the current project. In Textual model, undo and redo affect the source draft.",
                             "Ctrl+N          New project\nCtrl+O          Open model\nCtrl+S          Save all\nCtrl+Shift+S    Save as\nCtrl+Z          Undo\nCtrl+Shift+Z    Redo\nCtrl+Y          Redo\nEscape          Cancel the active dialog",
                         ),
-                        explain(
-                            "Remove a diagram item",
-                            "Click the diagram to give it keyboard focus. Delete hides an architecture or state placement; Shift+Delete asks to remove its model element. A selected route bend is removed first. Process and scenario items, links, and state action rows use confirmation for either key because they have no separate placement. Removing an occurrence preserves its reusable definition. Removing a scenario participant retains its messages with affected participant references cleared; removing a fragment also removes its owned branches and steps. Read the captured target and effect before confirming. Escape cancels, and Undo restores the complete change. Inside an expanded reusable process, open its definition to edit its contents, or select the outer reference to remove that use. Text fields keep their normal Delete behavior.",
-                        ),
                         walkthrough(
                             "Save and share a model",
                             &[

crates/oa-desktop/src/highlight.rs

@@ -61,13 +61,13 @@ impl Highlighter for ArcadiaHighlighter {
 
 pub fn format(class: &TokenClass, _theme: &Theme) -> Format<Font> {
     let color = match class {
-        TokenClass::Keyword => Color::from_rgb8(51, 23, 72),
-        TokenClass::Identifier => Color::from_rgb8(4, 39, 61),
-        TokenClass::String => Color::from_rgb8(4, 42, 27),
-        TokenClass::Number => Color::from_rgb8(63, 26, 6),
-        TokenClass::Comment => Color::from_rgb8(33, 37, 41),
-        TokenClass::Error => Color::from_rgb8(76, 9, 20),
-        TokenClass::Punctuation | TokenClass::Whitespace => Color::from_rgb8(32, 37, 44),
+        TokenClass::Keyword => Color::from_rgb8(118, 62, 160),
+        TokenClass::Identifier => Color::from_rgb8(20, 93, 139),
+        TokenClass::String => Color::from_rgb8(24, 113, 79),
+        TokenClass::Number => Color::from_rgb8(163, 78, 30),
+        TokenClass::Comment => Color::from_rgb8(111, 121, 132),
+        TokenClass::Error => Color::from_rgb8(186, 38, 62),
+        TokenClass::Punctuation | TokenClass::Whitespace => Color::from_rgb8(91, 101, 117),
     };
     Format {
         color: Some(color),

crates/oa-desktop/src/hosted/view.rs

@@ -67,12 +67,10 @@ fn dialog(app: &App) -> Element<'_, Message> {
     let mut content = column![
         label("SERVICE ADDRESS"),
         text_input("http://127.0.0.1:8787", &state.base)
-            .style(style::selectable_input)
             .padding(10)
             .on_input_maybe(enabled.then_some(|value| Message::Hosted(Event::Base(value)))),
         label("BEARER TOKEN - KEPT IN MEMORY ONLY"),
         text_input("Optional for a loopback service", &state.token.0)
-            .style(style::selectable_input)
             .secure(true)
             .padding(10)
             .on_input_maybe(
@@ -175,7 +173,6 @@ fn dialog(app: &App) -> Element<'_, Message> {
     content = content.push(text("Hosted model catalog").size(17)).push(
         row![
             text_input("Search model names", &state.query)
-                .style(style::selectable_input)
                 .padding(9)
                 .on_input_maybe(enabled.then_some(|value| Message::Hosted(Event::Query(value))))
                 .on_submit(Message::Hosted(Event::Connect)),