Record Windows and Linux direct state editing acceptance

crates/oa-desktop/src/app.rs

@@ -642,7 +642,7 @@ impl App {
         if !self.project().contains(id) {
             return;
         }
-        let previous_owner = crate::behavior::selected_owner(self);
+        let previous_state_view = self.state_view_identity();
         self.selected = id;
         self.selected_node = None;
         if let Some(layer) = self.project().layer_of(id)
@@ -656,10 +656,11 @@ impl App {
             && let Some(owner) = crate::behavior::selected_behavior(self.project(), id)
         {
             self.behavior.active_owner = Some(owner);
-            if previous_owner != Some(owner) {
-                self.behavior.diagram = Default::default();
-                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
-            }
+        }
+        if self.reset_state_view_after_navigation(previous_state_view)
+            && self.page == Page::Behavior
+        {
+            self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
         }
         self.refresh_draft();
     }
@@ -1200,13 +1201,14 @@ impl App {
             Message::Page(page) => {
                 if page != Page::Text || !self.draft_dirty() || self.apply() {
                     if page == Page::Behavior && self.page != Page::Behavior {
+                        let previous_state_view = self.state_view_identity();
                         if let Some(owner) =
                             crate::behavior::selected_behavior(self.project(), self.selected)
                         {
                             self.behavior.active_owner = Some(owner);
                         }
                         self.behavior.active_owner = crate::behavior::selected_owner(self);
-                        self.behavior.diagram.fit = true;
+                        self.reset_state_view_after_navigation(previous_state_view);
                     }
                     self.page = page;
                     self.selected_node = if page == Page::Behavior {
@@ -1360,6 +1362,7 @@ impl App {
             }
             Message::Layer(layer) => {
                 if self.apply() {
+                    let previous_state_view = self.state_view_identity();
                     self.layer = layer;
                     self.create_kind = if layer == Layer::Oa {
                         Kind::Activity
@@ -1375,6 +1378,8 @@ impl App {
                         .map(|d| d.id);
                     self.selected = self.project().id;
                     self.selected_node = None;
+                    self.behavior.active_owner = crate::behavior::selected_owner(self);
+                    self.reset_state_view_after_navigation(previous_state_view);
                     self.refresh_draft();
                     self.fit();
                 }

crates/oa-desktop/src/app/state_diagram.rs

@@ -6,12 +6,35 @@ use crate::behavior::{
 };
 
 impl App {
+    /// The behavior view resolved independently of the current page. Capture
+    /// this before selection/layer changes, while it still identifies the view
+    /// whose camera and tool are retained during navigation.
+    pub(super) fn state_view_identity(&self) -> (Option<Id>, Option<Id>) {
+        let owner = behavior::selected_owner(self);
+        let diagram = owner.and_then(|owner| behavior::state_view::diagram(self, owner));
+        (owner, diagram)
+    }
+
+    pub(super) fn reset_state_view_after_navigation(
+        &mut self,
+        previous: (Option<Id>, Option<Id>),
+    ) -> bool {
+        let current = self.state_view_identity();
+        if current == previous {
+            return false;
+        }
+        self.behavior.diagram = behavior::state_view::State {
+            diagram: current.1,
+            ..Default::default()
+        };
+        true
+    }
+
     pub fn state_context(&self) -> Option<Context> {
         if self.page != Page::Behavior {
             return None;
         }
-        let owner = behavior::selected_owner(self)?;
-        let diagram = behavior::state_view::diagram(self, owner)?;
+        let diagram = self.state_view_identity().1?;
         Some(Context {
             document: self.canvas_document,
             diagram,

crates/oa-desktop/src/app/state_diagram_tests.rs

@@ -89,6 +89,232 @@ fn assert_source_model_agree(app: &App) {
     assert!(!app.source_dirty());
 }
 
+struct NavigationFixture {
+    app: App,
+    machine_a: Id,
+    diagram_a: Id,
+    state_a: Id,
+    transition_a: Id,
+    root_event: Id,
+    machine_b: Id,
+    diagram_b: Id,
+    state_b: Id,
+}
+
+fn navigation_fixture(layer_b: Layer) -> NavigationFixture {
+    let mut project = Project::empty();
+    let mut machine = |layer, name| {
+        let machine = project
+            .add_element(Kind::StateMachine, layer, name, None)
+            .unwrap();
+        let region = project
+            .add_element(Kind::Region, layer, "Main", Some(machine))
+            .unwrap();
+        let state = project
+            .add_element(Kind::State, layer, "Ready", Some(region))
+            .unwrap();
+        (machine, state)
+    };
+    let (machine_a, state_a) = machine(Layer::Sa, "Machine A");
+    let (machine_b, state_b) = machine(layer_b, "Machine B");
+    let root_event = project
+        .add_element(Kind::Event, Layer::Sa, "External event", None)
+        .unwrap();
+    let transition_a = project.relate(RelationKind::StateTransition, "Repeat", state_a, state_a);
+    let plan_a = state_edit::create_view(&project, machine_a).unwrap();
+    project = prepare_command(&project, &plan_a.command).unwrap().project;
+    let plan_b = state_edit::create_view(&project, machine_b).unwrap();
+    project = prepare_command(&project, &plan_b.command).unwrap().project;
+    let mut app = App::with_project(project);
+    send(&mut app, Message::Select(state_a));
+    send(&mut app, Message::Page(Page::Behavior));
+    send(
+        &mut app,
+        Message::BehaviorDiagram(Choice {
+            id: plan_a.diagram,
+            label: "A view".into(),
+        }),
+    );
+    let context = app.state_context().unwrap();
+    event(
+        &mut app,
+        Event::Viewport(context, iced::Size::new(820., 540.)),
+    );
+    event(&mut app, Event::Zoom(context, 0.65));
+    event(
+        &mut app,
+        Event::Pan(context, iced::Vector::new(-1_400., -800.)),
+    );
+    event(
+        &mut app,
+        Event::Choose(Tool::Reconnect {
+            relation: transition_a,
+            endpoint: Endpoint::Target,
+        }),
+    );
+    assert_eq!(app.state_context().unwrap().diagram, plan_a.diagram);
+    assert!(!app.behavior.diagram.fit);
+    NavigationFixture {
+        app,
+        machine_a,
+        diagram_a: plan_a.diagram,
+        state_a,
+        transition_a,
+        root_event,
+        machine_b,
+        diagram_b: plan_b.diagram,
+        state_b,
+    }
+}
+
+fn assert_switched_state_view(f: &mut NavigationFixture) {
+    assert_eq!(behavior::selected_owner(&f.app), Some(f.machine_b));
+    assert_eq!(f.app.state_context().unwrap().diagram, f.diagram_b);
+    let defaults = behavior::state_view::State::default();
+    let state = &f.app.behavior.diagram;
+    assert_eq!(state.diagram, Some(f.diagram_b));
+    assert_eq!(
+        state.tool,
+        Tool::Select,
+        "Reconnect from A must not be armed in B"
+    );
+    assert_eq!(state.pan, defaults.pan);
+    assert_eq!(state.zoom, defaults.zoom);
+    assert!(state.fit);
+    assert!(
+        state.viewport.is_none(),
+        "B needs its own first viewport measurement"
+    );
+    assert!(state.placement.is_none());
+    let context = f.app.state_context().unwrap();
+    event(
+        &mut f.app,
+        Event::Viewport(context, iced::Size::new(820., 540.)),
+    );
+    assert!(
+        f.app.behavior.diagram.pan != defaults.pan || f.app.behavior.diagram.zoom != defaults.zoom,
+        "The unchanged widget size still fits a newly selected view"
+    );
+}
+
+fn catalog_selects_another_machine(layer_b: Layer) {
+    let mut f = navigation_fixture(layer_b);
+    let before = f.app.document.snapshot();
+    send(&mut f.app, Message::Page(Page::Catalog));
+    send(&mut f.app, Message::Select(f.state_b));
+    assert_eq!(f.app.layer, layer_b);
+    send(&mut f.app, Message::Page(Page::Behavior));
+    assert_switched_state_view(&mut f);
+    assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
+    assert_source_model_agree(&f.app);
+}
+
+#[test]
+fn state_navigation_catalog_selection_of_another_machine_resets_camera_and_tool() {
+    catalog_selects_another_machine(Layer::Sa);
+}
+
+#[test]
+fn state_navigation_catalog_selection_across_layers_resets_camera_and_tool() {
+    catalog_selects_another_machine(Layer::Oa);
+}
+
+#[test]
+fn state_navigation_layer_change_resets_the_new_machine_at_the_same_viewport_size() {
+    let mut f = navigation_fixture(Layer::Oa);
+    let before = f.app.document.snapshot();
+    send(&mut f.app, Message::Layer(Layer::Oa));
+    assert_switched_state_view(&mut f);
+    assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
+    assert_source_model_agree(&f.app);
+}
+
+#[test]
+fn state_navigation_return_to_the_same_view_preserves_camera_tool_and_fit_mode() {
+    for fit in [false, true] {
+        let mut f = navigation_fixture(Layer::Sa);
+        if fit {
+            let context = f.app.state_context().unwrap();
+            event(&mut f.app, Event::Fit(context));
+        }
+        let state = &f.app.behavior.diagram;
+        let retained = (
+            state.diagram,
+            state.pan,
+            state.zoom,
+            state.tool,
+            state.fit,
+            state.viewport,
+        );
+        let before = f.app.document.snapshot();
+        send(&mut f.app, Message::Page(Page::Catalog));
+        send(&mut f.app, Message::Select(f.state_a));
+        send(&mut f.app, Message::Page(Page::Behavior));
+        let context = f.app.state_context().unwrap();
+        event(
+            &mut f.app,
+            Event::Viewport(context, iced::Size::new(820., 540.)),
+        );
+        assert_eq!(behavior::selected_owner(&f.app), Some(f.machine_a));
+        assert_eq!(context.diagram, f.diagram_a);
+        let state = &f.app.behavior.diagram;
+        assert_eq!(
+            (
+                state.diagram,
+                state.pan,
+                state.zoom,
+                state.tool,
+                state.fit,
+                state.viewport
+            ),
+            retained
+        );
+        assert_eq!(
+            state.tool,
+            Tool::Reconnect {
+                relation: f.transition_a,
+                endpoint: Endpoint::Target
+            }
+        );
+        assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
+    }
+}
+
+#[test]
+fn state_navigation_root_event_and_same_layer_keep_the_current_camera_and_tool() {
+    let mut f = navigation_fixture(Layer::Sa);
+    let state = &f.app.behavior.diagram;
+    let retained = (
+        state.diagram,
+        state.pan,
+        state.zoom,
+        state.tool,
+        state.fit,
+        state.viewport,
+    );
+    let before = f.app.document.snapshot();
+    send(&mut f.app, Message::Select(f.root_event));
+    assert_eq!(f.app.selected, f.root_event);
+    send(&mut f.app, Message::Page(Page::Catalog));
+    send(&mut f.app, Message::Page(Page::Behavior));
+    send(&mut f.app, Message::Layer(Layer::Sa));
+    assert_eq!(behavior::selected_owner(&f.app), Some(f.machine_a));
+    assert_eq!(f.app.state_context().unwrap().diagram, f.diagram_a);
+    let state = &f.app.behavior.diagram;
+    assert_eq!(
+        (
+            state.diagram,
+            state.pan,
+            state.zoom,
+            state.tool,
+            state.fit,
+            state.viewport
+        ),
+        retained
+    );
+    assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
+}
+
 #[test]
 fn create_view_places_only_its_machine_and_restores_exact_source_in_one_undo() {
     let mut f = fixture();

harness/DECISIONS.md

@@ -58,3 +58,8 @@ relative to a canvas whose origin may move when selection changes the toolbar.
 Viewport notifications fit only on actual size changes. Native testing also showed
 Iced WGPU places parent meshes after clipped child meshes; backgrounds must share
 their content clip to avoid hiding vector geometry while leaving text visible.
+
+State camera/tool lifetime follows effective machine and diagram identity, even
+when selection changes through Catalog or Layer outside Behavior. Reset only on
+actual context change; preserve same-view return. Independent review reproduced
+the leak and native Windows/Linux tests verified the correction in316dc55.

harness/PLAN.md

@@ -16,17 +16,30 @@ The current forms are a closed typed-record adapter, not a second metamodel. Exp
 
 Nested source ownership and persistent REST bundles are implemented and verified: Windows minimum-size source-to-graphics, nested reparent/source/Undo/Redo/Save/reopen, recovery, rebuilt Linux source/history/Save/reopen, independent review and both platform suites passed. Preserve the existing grammar/updater and separate allocation/order semantics.
 
-The user-directed contextual-menu/source-tree, movable-port and direct-connection milestone has scoped Windows/Linux native acceptance. See release-port-drawing.md for exact builds, saved trials and minimum-size boundaries. Continue direct state-machine editing in the isolated state-integration checkout: persist typed machine context, use shared state/route geometry, retain drafts until accepted document commit, then verify creation, movement, transition drawing/reconnection, undo and reopen. This first behavior slice precedes scenario/process gestures; all broader release milestones remain required.
+Explorer/port discovery, custom routing, direct palette connections, four-side port
+anchors, contextual menus and source folders have scoped Windows/Linux acceptance.
+See release-explorer-usability.md, release-routing-verification.md,
+release-routing-linux.md and release-port-drawing.md for exact evidence and limits.
 
-The user-directed actor/system port and model-navigation milestone is accepted: visible Add port → Connect boundary exchange, grouped roots, focused containment, breadcrumbs, contextual search and paging, clear full-depth outline, and separate allocations. Native Windows authoring/save/reopen, 251-root paging, 12-level navigation, 1440×900/1100×700 inspection, rebuilt Linux save/reopen and single-line font correction passed. Independent requirements, correctness, native UI and simplicity findings are addressed; release-explorer-usability.md records exact evidence and remaining performance boundaries. Resume source recovery acceptance and the release milestones below; the full scope remains intact.
+Direct state-machine editing is accepted through316dc55: typed persisted views,
+explicit-owner creation, movement, direct transitions/reconnection, typed detail
+forms, folding, placement and correct camera/tool lifetime. Windows default/minimum
+and Linux native acceptance plus independent reviews are recorded in
+release-state-editing.md. Direct scenario/process gestures remain required.
 
-Editable connection routing has passed code/native acceptance and independent follow-up at desktop checkpoint `23535b4`, with the Linux-discovered viewport correction in `366ce44` also verified on the actual rebuilt Linux app. Current WSL automated checks and routing runtime acceptance are recorded in release-routing-linux.md. Continue production source authoring under release-source-integration.md and direct behavior editing. Typed port integration and its native authoring/reopen checks are complete at `fa096ce`; `release-diagram-port-correction.md` records the domain correction. Existing R5 state authoring is preserved and still needs direct gestures and full native acceptance.
+R6 data contracts are active in the isolated data integration checkout. Freeze the
+full payload/dictionary shape as schema/source4, keep existing typed ports, migrate
+older formats explicitly while preserving lexical ownership/comments, then verify
+GUI/text/REST parity and real engineering workflows. See release-data-contract.md
+and the implementation plan in that checkout. R3 semantic drift/reconciliation
+follows the R6 freeze; its current prose-only behavior is insufficient.
 
-The user's routing correction is implemented as editable connection bend points with automatic obstacle-aware starting routes. Persistent commands, source/API parity, shared geometry and desktop gestures passed automated and native verification. `65fa9ab` resolves six default SA label-overlap pairs; follow-up typed reopen, short gestures and SVG export at 1100×700 passed. `release-routing-verification.md` records exact evidence, completed independent native follow-up and the 119 ms dense full-solve limitation. Route identity belongs to the diagram representation and does not alter semantic endpoints or ownership. Direct state gestures remain required and should reuse geometry/routing primitives only where semantics match.
-
-Drag selection, typed port/schema 3 and routing corrections are complete. Make behavior diagrams directly editable using shared persisted geometry and ordinary commands, and replace the single huge source editing experience with a modular project/include workflow. These are release requirements, not future limitations. The source bundle core and nested source experiments provide evidence and reusable foundations, not production editor acceptance. Source projects must preserve identity, precise per-file diagnostics, Git-friendly ownership of declarations, cycle/missing/duplicate include failures, safe local include resolution and GUI/API parity. Behavior acceptance requires actual canvas movement and contextual creation/editing, not only selection plus external menus. The proposed first state-machine slice is in `release-state-gesture-design.md`; verify its interfaces before changing the shared schema.
-
-Source direction: extend the production parser/span index and shared updater for selected nesting and shorthand constructs, retaining the existing virtual-bundle foundation. The 23-test experiment is evidence, not production code to copy: independent probes found item-comment misattachment, shorthand description rejection and unsupported deletion. Verify explicit comment ownership, all edit/delete paths, exact source Undo, invalid drafts and per-file diagnostics before adopting syntax. Direct behavior editing first tests a state-machine task (create in region, drag, draw/reconnect transition, edit guard, undo/reopen) before propagating the interaction design to scenarios/chains. Compare successful task completion, semantic clarity, mode switches and recoverability, not control counts.
+Continue source authoring improvements only through the production parser/updater.
+The23-test experiment is evidence, not architecture: independent probes exposed
+comment misattachment and unsupported edits. Additional shorthand must preserve
+complete edit/delete behavior and exact source history, and justify itself in real
+human authoring tasks. Shared state placements are now validated; scenario/chain
+interaction must preserve its own occurrence and ordering semantics.
 
 1. **Release coverage audit and interfaces.** Compare actual core/UI/API with official Capella OA/SA semantics and the new objective. Freeze a coverage table and concrete variant/reference/transition contracts before editing shared interfaces. Distinguish unsupported later layers from missing OA/SA workflows; V2 exclusions are reconsidered. Native audit exercises onboarding/help/authoring at supported sizes. Independent audits have separate file ownership.
 2. **Complete engineering semantics.** Fill verified gaps in capability relationships and mission involvement; operational process/functional-chain function/control topology; scenario/state/data constructs needed by OA/SA engineers. Add typed semantic-content drift and reviewed existing-counterpart reconciliation, including reference mapping and explicit dependency/ownership decisions. Every addition has a usable graphical authoring workflow, equivalent source/API representation, meaningful reject/undo/delete/reidentify/transition tests and a worked example. Exact additions and invariants are recorded in the coverage/interface artifact from milestone1, avoiding speculative LA/PA concepts.

harness/STATE.md

@@ -1,188 +1,113 @@
 # First release — current engineering state
 
-## Objective and current phase
+## Objective and phase
 
-The first-release goal remains active and incomplete. Deliver Rust/Iced Operational
-Analysis and System Analysis/System Architecture for system engineers, equivalent
-graphical/textual/REST semantics, hierarchical diagrams and typed ports, modular
-source projects, artifact traceability, editable behavior, useful offline help,
-and Windows/Linux release evidence. Later Arcadia layers remain future releases.
-Authoritative objective: attachment
-`07aee762-7d27-4cbe-81c3-2e82c7170711/goal-objective.md`, reread 2026-09-06.
-PLAN.md, TASK_LEDGER.md and release-semantics-audit.md retain full release scope.
+The first-release goal remains active and incomplete. Deliver usable Rust/Iced
+Operational Analysis and System Analysis/System Architecture, equivalent graphical,
+textual and REST semantics, artifact traceability, directly editable behavior,
+offline guidance, and Windows/Linux release evidence. Later Arcadia layers remain
+future releases. The full authoritative objective was reread on 2026-09-06:
+attachment07aee762-7d27-4cbe-81c3-2e82c7170711/goal-objective.md.
+PLAN.md retains the entire release scope; no subsystem acceptance completes it.
 
-The latest user-directed drawing/port/menu/source-tree milestone is accepted at
-`fef2e0d` plus tooltip-layer follow-up `ad7feb5`. It does not complete the release.
-Root now integrates direct state-machine editing in an isolated worktree. There
-is meaningful implementation, independent review and real runtime progress; no
-external blocker or disk blocker exists.
+Direct state-machine editing is accepted through production316dc55. The main
+checkout can fast-forward to this integration. R6 data/interface contracts are now
+being implemented in a separate checkout; they are not accepted or released.
+Meaningful implementation and runtime progress continues; no external blocker exists.
 
-## Accepted foundations and evidence
+## Accepted foundations
 
-- Typed OA/SA model, schema 3 ports, validated atomic commands and ordinary history
-  are shared across three Rust crates. Typed contracts and migration are documented
-  in release-port-contract.md, release-port-core.md and release-port-migration.md.
-  Desktop typed authoring checkpoint `fa096ce` passed native creation, generation,
-  undo/redo and persistence. Original Capella was operated in a disposable workspace;
-  exact observed semantics/workflows: release-capella-workflow-benchmark.md.
-- Explorer/port discovery `d364d3c`: visible Add port, grouped roots, focused children,
-  breadcrumbs, contextual search/paging and full-depth outline. Windows port/Standard
-  exchange, 251-root paging, 12-level navigation and 1100x700 trials passed; rebuilt
-  Linux save/reopen/font correction passed. See release-explorer-usability.md.
-- Editable routes `23535b4`, viewport fix `366ce44`, automatic labels `65fa9ab`:
-  authored bends/labels, nested group movement, folding/restoration, undo/redo,
-  save/reopen, SVG and minimum-size gestures passed native and independent review.
-  See release-routing-verification.md and release-routing-linux.md. Dense optimized
-  full solve measured119ms; arbitrary dense crossings remain possible.
-- Nested source and coupled hosted source/model checkpoint `4e8575b`: source3
-  element nesting/includes, token/provenance-aware structural writes, exact model
-  source history, retained drafts and safe Save All/recovery. Full422 Windows and
- 425 Linux tests, strict checks and builds passed at that checkpoint. Actual REST
-  import/comment-only revision/cross-file reparent/stale ETag/restart passed.
-  Windows/Linux source and nested graphical edits, save/reopen and recovery were
-  exercised. See release-source-integration.md. Experiments remain evidence only;
-  do not adopt their independent parser/writer.
+- Core typed OA/SA semantics, validated atomic commands and ordinary history are
+  shared by three Rust crates. Typed ports, explicit unresolved migration and
+  original Capella observations: release-port-{contract,core,migration}.md and
+  release-capella-workflow-benchmark.md.
+- Explorer/port discovery d364d3c: Add port on participants, grouped roots, focused
+  children, breadcrumbs, contextual paging/search and full-depth outline. Actual
+  Windows creation,251-root/12-level trials,1100x700 and Linux reopen/font fixes:
+  release-explorer-usability.md.
+- Routing23535b4, viewport366ce44, labels65fa9ab: authored bends/labels, group
+  movement, fold restoration, Undo/Redo, save/reopen and SVG, including minimum-size
+  native trials. Dense full solve measured119ms; arbitrary crossings remain possible.
+  See release-routing-verification.md and release-routing-linux.md.
+- Source4e8575b: nested lexical ownership/includes, provenance-aware token writes,
+  exact accepted source/model history, retained drafts, Save All/recovery and coupled
+  hosted source/model revisions. Windows/Linux native and actual REST restart,
+  stale ETag, comment-only edit and cross-file reparent passed. Full422 Windows /
+ 425 Linux tests at that checkpoint. See release-source-integration.md.
+- Direct drawing fef2e0d plus tooltip ad7feb5: OA Interaction, SA Functional and
+  Boundary Exchange by palette click-click or drag; compatible highlights, automatic
+  function ports, four-side draggable anchors, contextual menus and source folders.
+  Independent pointer/tooltip findings fixed and native retested. Windows193 desktop
+  and Linux189+4 focused tests followed earlier full485/488 suites. Scoped native
+  Windows/Linux acceptance: release-port-drawing.md and release-context-menus.md.
 
-## Drawing acceptance — current main checkout
+## Newly accepted state workspace
 
-`93fd32c` fixes candidate scaling without weakening validation; `35133de` supplies
-persisted four-side normalized port anchors. `fef2e0d` adds direct palette drawing,
-shared automatic labels, contextual menus and the source folder tree. OA Interaction,
-SA Functional Exchange and Boundary Exchange accept click-click or drag. Function
-cards create/reuse typed ports atomically. Compatible targets highlight; Standard
-and Flow contracts remain distinct. Pan retains source; Escape cancels.
+Production316dc55 includes typed machine views, shared persisted geometry, atomic
+region/symbol/state creation, group movement, direct transitions and reconnection,
+Internal rows, Local edges, typed detail forms, folding, placement and navigation.
+Architecture and Behavior view selections are separate. Drafts survive rejected
+source/model commits; passive camera events never apply a form.
 
-Independent review reproduced batched-pointer click corruption and overview port
-mispicking. Ordered CursorMoved coordinates, explicit context epochs and nearest
-port glyph picking fix these, with production regressions. Native review then
-reproduced port-tooltip overprint: separate Frames still share an Iced GPU layer.
-The fix uses a passive second stacked Canvas (a real renderer layer). It preserves
-interactive child state/input and resets held-button suppression on context change,
-matching releases, Escape and focus loss. CursorLeft alone does not end suppression.
+Independent/native findings fixed: covered GPU shapes, pseudo-label/edge collision,
+selection-relayout drag displacement, missing typed form access, folded-content
+access, wrong-view placement Apply, and camera/tool leakage on machine navigation.
+An actual owner/view change resets gesture state and fits; returning to the same
+view preserves camera/tool. Exact evidence and limitations: release-state-editing.md.
 
-Evidence is in release-port-drawing.md and release-context-menus.md. Exact native
-review report: `D:/CodexBuilds/Capella2-release1-01a06e2e/drawing-independent-native-review.md`.
-Windows independent trials passed Standard rejection/completion, automatic function
-ports, undo/redo, save/reopen and1100x700. Overprint was reproduced on9A7FF074 and
-closed on3F534C67 at1440x900 and1100x700. Root tested final1EEBDC3C: first port drag,
-menu outside dismissal, first repeated drag, direct FE, readable identity and Save.
-Saved trial: `ui-port-tooltip-final/project.arcadia`,41objects/26links/0checks.
+Verification: full551 Windows /554 Linux workspace tests and strict workspace
+Clippy at e0b2210. Final316dc55:241 desktop tests, strict all-target desktop Clippy,
+and desktop builds on each platform; five new navigation tests included. Two guide
+tests passed after help changes. Source/reST/API state contracts and actual HTTP
+rejection/revision/source/restart tests passed earlier in the integration.
 
-Root operated actual Linux7AC5EEE: first FE drag, Right-to-Bottom port drag, Reset/
-Undo, repeated Bottom-to-Left drag, source-offscreen arrow pan and completion,
-Save All/reopen, persisted geometry and source-tree expansion/open. Saved trial:
-`ui-port-tooltip-linux/project.arcadia`,41objects/27links/0checks. Runtime log empty;
-Linux window closed normally, exec13766 exit0. Linux was inspected at1440x900;
-minimum-size acceptance is Windows, not a claim of Linux minimum-size testing.
+Root and independent Windows native trials covered1440x900 and1100x700 creation,
+nested movement, first-drag transition, endpoint/menu reconnect, invalid target,
+Escape, timed Internal, Local/EntryPoint, placement Apply, Undo/Redo and save/reopen.
+Linux native covered1440x900 creation, first transition/move, Undo/Redo, fold and
+saved collapsed reopen. Final316dc55 native on both platforms proved same-view
+camera/tool preservation and different-machine Fit/Select reset. Logs are empty.
 
-Verification scopes: full485 Windows /488 Linux workspace tests preceded the last
-pointer/tooltip refinements. Latest main Windows193 desktop tests, strict desktop
-all-target Clippy and debug build passed. Latest Linux189 desktop tests, strict
-desktop Clippy and release build passed; four new tooltip lifecycle tests then
-passed separately. A142-test Linux result from a shared-worktree Cargo cache was
-identified and EXCLUDED; scoped package cleaning and explicit main recompilation
-established the valid189-test result. Use a distinct CARGO_TARGET_DIR per worktree.
+## Active R6 implementation and next actions
 
-## Active isolated state integration
+Checkout D:/CodexBuilds/Capella2-data-integration; branch
+codex/data-contract-integration, base5ce3eef+plan2bf4c54+navigation9118218.
+Dedicated target D:/CodexBuilds/Capella2-data-target. Contract freeze is schema/source4
+with full data payload and dictionary slices together; existing typed ports remain.
+See release-data-implementation.md and release-data-contract.md in that checkout.
 
-Worktree: `D:/CodexBuilds/Capella2-state-integration`, branch`codex/state-integration`.
-Target: `D:/CodexBuilds/Capella2-state-integration-target`. Main core is not yet changed.
+Ownership: data_core owns core model/data/validation/references/ports/transitions
+and non-source tests; state_architecture_review owns source/migration/persistence
+and their tests; drawing_correctness owns desktop. Root owns API/OpenAPI/reST,
+integration and native input. Do not edit workers' files or reset their changes.
 
-- `e7a8163` integrates reviewed core state-context commit a63654f, preserving latest
-  anchors and routing labels. State views skip semantic port layout after boundary
-  snapping; both routing and label passes reserve actual internal-row headers.
-- `2459581` retains behavior drafts until Document commit succeeds.
-- `53cd096` adds typed state-context forms, placement membership choices and normative
-  source/JSON/REST/OpenAPI contracts. Strict HTML generation passed. Two actual HTTP
-  tests passed, including malformed/invalid rejection, revision/source atomicity and
-  restart. Destination pickers permit intermediate invalid drafts so coordinated
-  element/diagram retargeting is reachable; Apply remains strict.
-- `e5660b8` integrates App dirty/Close/Save/navigation/mutation guards. Exact prepared
-  commands acknowledge drafts only after accepted source/model writes. Review found
-  passive viewport events applying properties, queued source controls creating
-  competing drafts and stale delete confirmations; all three fixes have App tests.
-  Six App lifecycle tests passed, including typed source-writeback rejection/retry
-  and one Undo. Clean detached buffers after Undo are intentional; reachable bundle
-  and accepted Document are restored exactly.
-- Integrated baseline:514 Windows workspace tests (277core,199desktop,38server),
-  strict workspace all-target Clippy passed. This baseline precedes direct gestures;
-  there is no native state-gesture acceptance yet.
+1. Commit state evidence and fast-forward main from ad7feb5; coordinate Git index
+   before carrying documentation into the active R6 checkout.
+2. Finish R6 core/source/desktop, integrate actual REST/schema/reST, independent
+   semantic/correctness/UX review, Windows/Linux checks and real data authoring.
+3. Implement R3 typed semantic drift/reconciliation after R6 freezes. Current
+   baselines/reconciliation only cover prose. Prefer historical typed-body snapshots
+   and finite proposals; avoid a duplicate recursive semantic schema without evidence.
+4. Complete direct scenario/process gestures, persistent coverage/filters,
+   Home/recent/recovery, hosted desktop ETag workflows and offline guidance.
+5. Fresh final requirements/domain/correctness/native UX/architecture review; full
+   Windows/Linux/MSRV checks, real runtime, reproducible docs and release packaging.
 
-Direct-state UI integration is now implemented (uncommitted): persisted canvas,
-creation within explicit regions, movement, direct transitions and endpoint
-reconnection, pan/zoom/Fit, typed detail forms, and contextual fold/unfold/hide.
-The old computed static state scene is removed. Source/model commands remain atomic.
-Independent review found removed typed-form access, unreachable folded contents,
-selection relayout altering drag deltas, fallback owner resetting the first drag,
-and same-size viewport events refitting the camera. Fixes preserve typed creation,
-use state-specific menus, window-space ordered gesture deltas, retained owner and
-actual-size resize checks. App tests also exposed Architecture placement leaking
-into Behavior selection; the two view selections are now separate.
+## Environment and native ownership
 
-First direct-state Windows verification:231 desktop tests and strict desktop
-all-target Clippy passed, logs `D:/CodexBuilds/Capella2-state-direct-{tests,clippy}.log`.
-Native trial2A4B5C11 created a new SA StateMachine and dedicated view; it reproduced
-missing box fills/borders while text remained. Iced WGPU appends parent meshes after
-clipped children: the opaque parent background covered every node. The fix moves
-the content background into the clip and restricts the outer fill to the guidance
-strip. Native re-verification remains required. Saved reproduction is
-`ui-state-direct-01/project.arcadia`,42objects/25links/2 expected incomplete-machine
-checks. Trial window1442250 received normal close after verified Save; re-inventory.
+Root exclusively owns native input. Latest saved Windows trial is window1706782,
+ui-state-navigation-windows,49objects/28links/1 expected missing-owner warning.
+Linux navigation trial3148598 closed normally, exec46107 exit0; baseline Linux
+trial721472 also closed normally, exec72680 exit0. Independent Windows3672536 is
+saved at1100x700. Older root drawing windows are saved. Re-inventory before input.
+Protected user7210312/6228978 were absent; do not reset/save/close if they return.
 
-Latest verification:551 Windows workspace tests (277core,236desktop,38server)
-and strict workspace all-target Clippy passed. A single let-and-return lint in the
-new label hit helper was fixed without changing behavior. Subsequent compact-toolbar
-changes passed desktop Clippy and build. Exact logs use `state-direct-workspace-*`
-and `state-compact-*` under D:/CodexBuilds.
+Evidence: D:/CodexBuilds/Capella2-release1-01a06e2e. State source checkout/target:
+D:/CodexBuilds/Capella2-state-integration and -target. Linux source/target:
+D:/CodexBuilds/Capella2-state-linux-review and -target. Use distinct Cargo targets
+per checkout; shared-cache results were previously caught and excluded.
 
-Native82AE5A2C closed the missing-shapes bug; root directly created Region, Initial,
-State, first-drag Initial→State transition, selected without motion, moved/undid the
-state, created Internal Monitor communications with generated After30s Event,
-Undo/Redo of both, and Fold/Unfold via right-click. Saved trial46objects/27links/1
-remaining model check uses ui-state-direct-01/project.arcadia; its original empty
-machine fixture is preserved in baseline-before-editing. Minimum1100x700 exposed
-excessive toolbar height; latest build removes selected-action row and shortens
-state heading. Native recheck is pending, along with reconnection, nested composite,
-Linux state runtime and independent final runtime review.
-
-Additional review/native fixes: Fold retains semantic selection; placement property
-Apply retains Behavior view without overwriting Architecture view. Initial names
-choose among12 deterministic route-aware positions, and label hit testing uses the
-same cached rectangle. This closes the observed rightward-line/name collision in
-code; native verification of this last refinement remains pending.
-
-Root owns integration/native input; all workers have returned files. Every worktree
-uses its own Cargo target. Main remains ad7feb5; state work is isolated and not yet
-accepted into main. No release-completion claim.
-
-## Exact next actions
-
-1. Rebuild and verify the state rendering fix on the saved native reproduction;
-   complete real state creation, connections, folding, form edit, Save/reopen and
-   minimum-size trials. Commit only after reviewed behavior is demonstrated.
-2. Finish state-edit acceptance with explicit retained
-   behavior view, creation in a region, movement, transition drawing/reconnection,
-   guarded forms, discoverable missing placements, pan/zoom and contextual actions.
-   Build/run/test native at default/minimum sizes; review/reproduce/fix findings.
-3. Continue direct scenario/process gestures, R3 semantic drift/reconciliation,
-   R6 data contracts, persistent coverage/filters, Home/recent/recovery, hosted ETag
-   workflows, offline guidance and normative contracts. All remain release work.
-4. Fresh final requirements/domain/correctness/native UX/architecture reviews;
-   Windows/Linux/MSRV checks, actual runtime, docs and packages/checksums before
-   completing the broad goal. V2 or a subsystem checkpoint is insufficient.
-
-## Native safety and environment
-
-Root owns native input. Final Windows1EEBDC3C window2100032/exec55548 is saved on
-its isolated41/26 trial. Earlier windows524634 and328292 are saved on the Standard
-and auto-port review fixtures. Re-inventory and inspect current dirty state before
-operating any window. Protected user7210312 and earlier6228978 were absent; root did
-not close them and makes no recovery claim. If either returns, do not save/reset/close.
-
-Main Windows target `D:/CodexBuilds/Capella2-01a06e2e`; Rust1.98.1. Use `cargo test
---locked --workspace`, `cargo clippy --locked --workspace --all-targets -- -D warnings`
-and `cargo build --locked -p oa-desktop -p oa-server`. WSL Ubuntu24.04 uses the
-existing target/linux-cargo.toml vendor config and its own linux-target; launch
-with WGPU_BACKEND=vulkan and the Mesa lvp ICD. Release evidence lives under
-`D:/CodexBuilds/Capella2-release1-01a06e2e`. No remote push or usage reset is authorized.
-Do not retry the previously rejected broad recursive target deletion.
+Windows: cargo test --locked --workspace; cargo clippy --locked --workspace
+--all-targets -- -D warnings; cargo build --locked -p oa-desktop -p oa-server.
+WSL Ubuntu24.04 uses target/linux-cargo.toml and Mesa software Vulkan for native
+WSLg. No remote push or usage reset authorized. No broad recursive target deletion.

harness/TASK_LEDGER.md

@@ -1,66 +1,65 @@
 # Task Ledger — first release
 
-Authoritative objective: attachment `07aee762-7d27-4cbe-81c3-2e82c7170711/goal-objective.md`, read fully on 2026-09-05. STATE.md records execution evidence; PLAN.md is the living strategy; DECISIONS.md and linked release contracts retain detailed rationale.
+Authoritative objective: attachment07aee762-7d27-4cbe-81c3-2e82c7170711/
+goal-objective.md, read fully2026-09-06. STATE.md records execution; PLAN.md retains
+scope; DECISIONS.md and linked contracts preserve rationale.
 
 ## Goal and success criteria
 
-System engineers can develop a coherent OA→SA system model, including iterative changes and evidence, through equivalent graphical, textual and REST workflows. Rust/Iced Windows and Linux release, strict reST semantics, navigable offline concepts/tutorials, and reproducible build/run/evaluation instructions. Later Arcadia layers are future releases. Completion requires actual native workflows, automated invariants, and fresh cross-disciplinary acceptance, not compilation or a feature count.
+System engineers develop and iteratively reconcile OA/SA models through equivalent
+graphical, textual and REST workflows. Rust/Iced Windows/Linux, strict reST,
+traceability, navigable offline guidance and reproducible deployment. Acceptance
+requires native workflows, semantic evaluators and fresh independent review.
 
 ## Given facts
 
-- User prioritizes engineering usability and Capella domain fidelity, hierarchical containment/allocation displays, real function/component ports and intuitive transitions in both directions.
-- Text-only model development must be practical; modular files/includes are the proposed answer to the current huge flat file.
-- Drag selection must remain stable; behavior/scenario canvases must support direct editing consistent with architecture.
-- Git and worktrees are authorized. Remote publication is not requested.
-- Connection routes need explicit bend points/customization or sufficiently effective automatic routing. User observed straight connections prevent readable diagrams. Treat saved per-diagram routes and practical obstacle avoidance as a primary requirement, not visual decoration.
+- User prioritizes Capella domain fidelity, hierarchy, typed ports and intuitive
+  transitions in both directions, without its clutter and navigation friction.
+- Direct exchange drawing must avoid large endpoint dropdowns; ports must move
+  between sides; contextual menus should replace persistent action clutter.
+- Modular source must be practical for humans/AI and Git. Text/graph/API parity is
+  required. Behavior canvases must support editing and preserve drag selection.
+- Git/worktrees are authorized. Remote publication is not requested.
 
 ## Verified facts
 
-- Native modular source editing/reopen/repair/recovery passed on Windows at 1100×700. Production nested ownership, structural writeback and coupled REST source bundles now pass an initial 416-test workspace run. Actual service import/comment-only revision/cross-file move/stale ETag passed. Comment fidelity needs independent checks: review exposed owner-opening-line comment reassignment; root reproduced it and all 12 updater tests pass after the fix. Equal-model delete/recreate provenance was also reproduced and fixed in desktop and REST. Native nested workflow and final integrated review/checks remain.
+- Original Capella SAB creates FE function input/output endpoints; component ports
+  are separately Standard/Flow with explicit allocation. Native observations are in
+  release-capella-workflow-benchmark.md; adopted contracts preserve that distinction.
+- Explorer/port discovery, editable routing, nested modular source and coupled REST
+  bundles have scoped Windows/Linux acceptance. Evidence links are in STATE.md.
+- Direct palette connections, four-side port anchors, context menus and source
+  folders passed real Windows/Linux operation. Passive stacked Canvas fixes native
+  tooltip overprint; separate Frames did not. See release-port-drawing.md.
+- Persisted state editing now passes Windows/Linux native and independent review:
+  creation, movement, direct transitions, typed forms, reconnection, fold/reopen.
+  See release-state-editing.md. Scenario/process canvases still need direct editing.
+- Ordinary Document commands atomically synchronize source/model; failed writes
+  retain drafts. Source comments require occurrence/provenance-aware edits, not
+  whole-model equality or flat reformatting. Independent counterexamples were fixed.
+- R3 existing-target reconciliation remains name/description only. R6 data shape
+  expansion is active implementation, not accepted functionality.
 
-- Explorer/port usability accepted at `d364d3c`: actual Windows Actor → Standard port → Boundary Exchange, save/reopen and Undo/Redo; contextual duplicate-name search, 251-root paging, 12-level ancestry and 1100×700 inspection. Linux port save/reopen and font-dependent outline wrapping correction were verified. Exact evidence: release-explorer-usability.md. This resolves the latest discovery/navigation complaint without claiming broader release completeness.
+## Assumptions and open questions
 
-- Native Capella SAB authoring creates function input/output endpoints with an FE. Component ports separately carry Standard/Flow kind, orientation, interface roles and explicit allocated function ports. Details and successfully performed versus merely observed operations are in release-capella-workflow-benchmark.md.
-- Studio uses one typed Project and validated atomic commands across Rust core/desktop/server. Hierarchy projection distinguishes actual allocation from inferred parent summaries; IDs and placement are separate.
-- Drag selection bug fixed and committed `2ef16dc`; 71 desktop tests and real moved-card selection/property editing passed before typed-port integration.
-- Typed ports/schema 3 migration merged at `757ab88`. Existing port identities survive as Legacy and missing FE endpoints are generated deterministically; migration and port tests provide scoped evidence in release-port-core.md/release-port-migration.md.
-- Independent core review reproduced alias reservation and same-transaction allocation replacement defects; fixes have focused regression evidence. Typed desktop integration `fa096ce` passed full checks and native creation/generation, undo/redo, save/reopen and no-op synchronization trials. Long-reference previews were inspected at 1440×900 and 1100×700; detailed evidence is in STATE.md.
-- Per-diagram pins and labels, source/API parity and shared orthogonal routing are implemented in `4e5a88d`, `a7c6f96`, `68b1eff` and `30c7db1`. `65fa9ab` resolves all six reproduced default SA label-overlap pairs. Native OA/SA editing, movement/undo, fold restoration, save/reopen, SVG inspection and short gestures at 1100×700 passed. Routing code/native acceptance and independent native follow-up are complete at `23535b4`; exact scope is recorded in release-routing-verification.md.
-- The source experiment passed 23 tests, but an independent probe reproduced positional item-comment misattachment, shorthand description rejection and unsupported deletion. Whole-model equality does not establish source-comment fidelity. The production updater retained comment attachment on the same reorder probe; extend its parser/updater instead of copying the experimental parallel implementation.
-- Current behavior diagrams derive geometry and only handle selection; direct behavior editing remains a product gap. The source editor retains modular accepted source; nested element syntax and cross-file graphical updates passed Windows/Linux native acceptance at4e8575b. Port/exchange/steps shorthand remains an independent future implementation slice required by the current authoring strategy.
-- Independent source review exposed declaration/comment reassignment during UUID changes and swaps, Linux FIFO hangs during disk admission, file-mode changes on save, and overlong detached-file receipt lifetimes. Command provenance, pre-open regular-file admission, permission retention and saved-detach receipt retirement resolve the reproduced cases. Exact probes and test scopes are in STATE.md.
+- Nested aggregate files reduce cognitive load; any additional port/exchange/step
+  shorthand must justify grammar complexity through real authoring tasks.
+- State placements proved viable without a second geometry system. Scenario/chain
+  gestures still need their own occurrence/order semantics and task verification.
+- Routing offers a usable initial path plus manual pins; arbitrary dense diagrams
+  are not guaranteed crossing-free. Measured dense full solve119ms remains a limit.
+- R3 typed historical bodies plus finite proposals appear simpler than a separate
+  recursive semantic-value schema. This candidate awaits R6 freeze and review.
 
-## Assumptions to test
+## Decisions and current strategy
 
-- Aggregate-oriented source files will reduce cognitive load enough for routine engineering edits; file splitting alone may leave declaration syntax too flat.
-- Behavior layout can reuse NodePlacement plus typed diagram context without duplicating semantic state; reconnection/reordering must preserve existing occurrence/relation identities.
-- Editable per-diagram bends and the automatic initial route passed the recorded workshop trials. This does not guarantee an ideal arrangement or zero crossings for arbitrary models; the measured dense release full solve is 119 ms, above the initial 100 ms target.
-- Source comments and ownership can survive graphical edits by replacing only changed declaration spans. Generated IDs must stabilize before subsequent text edits.
+Preserve one typed core and validated command boundary. Retain current typed ports;
+R6 uses schema/source4 with explicit1/2/3 migration and no intermediate public4
+shape. Freeze payload, defaults, inheritance, associations and identified interface
+allocations together. Preserve lexical includes/comments during migration.
 
-## Open questions
-
-- Which port/exchange/steps shorthand constructs add enough clarity to justify extending the accepted nested ownership syntax? Preserve comment attachment, exact source Undo and complete edit/delete support against the independent probe cases.
-- What remaining OA/SA gaps materially block target workflows? R3 semantic reconciliation, R6 data contracts, directly editable behavior, lifecycle/recovery and hosted editing remain in the release plan.
-
-## Candidate designs and current decisions
-
-- Source candidates compared explicit source3 aggregate files/includes with nested owner/context syntax lowering to the same model. The chosen implementation direction extends the production parser/span index and shared updater for selected constructs, preserving the pure bundle foundation. Do not copy the experiment's separate parser/writer. Freeze grammar only after comment ownership, edit/delete coverage, invalid drafts and exact source Undo pass their acceptance tasks.
-- Behavior alternatives: independent UI-only coordinates, new behavior-layout schema, or existing diagram placements with explicit context. Prefer the last candidate provisionally: it preserves text/API parity and command history without a second geometry system. Validate on direct state-machine creation/move/reconnect before extending all behavior views.
-- Ports: adopted typed separation based on official metamodel plus direct native evidence; rejected generic InOut/interface port conflation and inferred allocation facts. See release-port-contract.md. Revisit only with contradictory domain evidence or concrete usability failures.
-- Routing: a unique per-diagram route list references existing relation/trace IDs; pinned points and relative label placement are persisted, while orthogonal segments are derived by a shared pure router. This avoids duplicate semantic edge identities and preserves text/API/SVG parity. Folded endpoint promotion suspends custom geometry without deleting it. See release-routing-contract.md.
-
-## Current strategy and evaluators
-
-Accept native per-file editing, safe project saves and exact source Undo, then extend production source parsing/updating using the independent probe findings as regressions and integrate REST bundles. Linux routing is accepted with actual WSLg Save/reopen; all11 current Linux disk integration tests also pass. Full release Linux acceptance remains open. Prototype persisted direct behavior gestures next. Continue R3 reconciliation, R6 data contracts, lifecycle/recovery, hosted editing, offline guidance and fresh Windows/Linux release acceptance; no subsystem checkpoint constitutes release completion.
-
-Meaningful progress now includes verified drag and typed-port authoring, accepted editable routing with native save/reopen, group movement and minimum-size evidence, and tested source-bundle/nested-writeback foundations with independent limitations exposed. Production source and direct behavior usability remain open engineering tasks; feature counts alone do not establish completion.
-
-Current user-directed drawing evidence: palette creation and draggable per-placement port anchors passed scoped native Windows trials with Save/reopen; full485 Windows and488 Linux workspace suites passed before final pointer-release and hover refinements. Fresh independent review exposed post-release motion turning clicks into edits, nearest-port mispicking at overview zoom, and missing target identity feedback. The first two have production regressions and fixes; named owner/alias hover details and source-preserving pan are implemented, with final native acceptance pending. See release-port-drawing.md. The preceding goal turn made concrete progress through implementation, saved source/SVG artifacts, actual runtime verification and reproduced findings; it was not a wait or no-progress turn. Direct behavior and the broader release requirements remain active.
-2026-09-06 follow-up: direct drawing, movable ports, menus and source folders now
-have scoped native Windows/Linux acceptance. Independent QA falsified the initial
-separate-Frame tooltip fix; a real stacked GPU layer passed native retest. Current
-main Windows193 desktop tests and Linux189+4 focused tests passed. Independent
-state/representation/lifecycle integration passed514 Windows workspace tests and
-strict Clippy in its isolated checkout. Direct state-canvas authoring is underway;
-all broader release requirements remain active. This turn made concrete implementation,
-review and runtime progress, not a blocked or waiting-only turn. See STATE.md.
+Finish and independently verify R6, then semantic R3 reconciliation and direct
+scenario/process gestures. Complete lifecycle/recovery, hosted editing, guidance
+and fresh cross-disciplinary Windows/Linux acceptance. No subsystem checkpoint
+completes the first release. Current work is making measured implementation,
+review and runtime progress; no external blocker exists.

harness/release-state-editing.md

@@ -0,0 +1,91 @@
+# Direct state editing — acceptance evidence
+
+Accepted production source:316dc55,2026-09-06. This is the state-machine slice of
+direct behavior editing, not acceptance of scenario/process gestures or the release.
+
+## Delivered behavior and boundaries
+
+Dedicated typed StateMachine views reuse persistent placements and shared core
+projection/routing. Palette creation inside explicit owners, nested group movement,
+direct external transitions, endpoint reconnection, typed Local/Internal/timed
+forms, fold/unfold/hide, placement editing and pan/zoom/Fit use ordinary atomic
+Document commands. Behavior selection/view is independent of Architecture.
+Creation places missing ancestry in the same command; dragging never reparents.
+Internal transitions are rows; Entry/Exit symbols snap to the containing boundary.
+Reconnection preserves relation identity and other fields and validates atomically.
+
+Invalid drafts survive rejected writes. Save/Close/navigation/mutations account
+for behavior drafts; passive viewport events do not apply forms. Ordered window
+coordinates prevent selection-induced layout changes corrupting drag displacement.
+Same-view returns retain camera/tool; actual machine/view changes reset and fit.
+
+## Automated and independent evidence
+
+- Full551 Windows workspace tests (277core,236desktop,38server) and strict workspace
+  all-target Clippy at e0b2210; full554 Linux (280core,236desktop,38server), strict
+  workspace Clippy and optimized desktop build from an isolated checkout/target.
+- Final316dc55:241 desktop tests and strict desktop all-target Clippy on Windows
+  and Linux, plus successful desktop builds. Five navigation regressions supplement
+  the earlier suite. Four tested pre-fix navigation scenarios failed as predicted;
+  all14 state App tests passed after the fix.
+- Two guide tests passed after5ce3eef. State source/JSON round trips, reference and
+  membership rules, atomic command planners, draft lifecycle and two actual HTTP
+  state-contract tests passed in the earlier integration. HTTP tests exercised
+  rejection, revision/source atomicity and restart.
+- Independent native report:
+  D:/CodexBuilds/Capella2-release1-01a06e2e/state-independent-native-review.md.
+  Independent architecture review found camera/tool leakage after Catalog/Layer
+  owner changes;316dc55 closes it. No material review finding remains in this slice.
+
+## Actual Windows operation
+
+Root created a machine/view, Region, Initial and State, drew Initial→State by its
+first drag, moved/undid State, created a timed Internal transition and generated
+After30s event, undid/redid both, folded/unfolded and saved. Actual GPU shape hiding
+was reproduced, fixed and retested; route-aware Initial label placement was also
+verified through movement and selecting the relocated label.
+
+An independent reviewer operated DE2723E7 at1440x900 and1100x700: nested Region
+and State creation, composite descendant movement, semantic fold selection,
+actual target-handle reconnect, invalid Initial target/Escape, placement width Apply
+remaining in Behavior, EntryPoint creation, typed Local transition, contextual
+reconnect and Save All/actual reopen. Final fixture49objects/28links/1check.
+The remaining check explicitly asks for a machine owner on this root-level test
+machine; it is intentionally incomplete model content.
+
+Root operated final316dc55 binary31A7E8505838FE99B73072B90D32072C280AF494F039710448D8AE36651C05ED:
+created a second machine view, panned A, armed Region, left/returned through
+Architecture and observed preserved94% camera/tool. Selected B through Model
+explorer and returned to Behavior:78% Fit and Select/move, with no inherited pan.
+Save All completed; runtime.log0bytes.
+
+## Actual Linux operation
+
+Root operated e0b2210 ELF1525135FDA1C4A0E42DC6EB9CD6F8FE4DCB30A1690ABA48AD1F3E8E9528DFC05
+through WSLg at1440x900. Opened an isolated empty-machine baseline; created Region,
+Initial and State, first-drag Initial→State, first State movement with correct
+selection/reroute, Undo/Redo, Fold and Save. Actual reopen retained collapse;
+Unfold restored moved vertices and transition. Saved45objects/26links/1owner check.
+Empty runtime log; normal close, exec72680 exit0.
+
+Root then operated final316dc55 ELF
+e2c2945a2fc750774a925eee33b5b1620c6537580b7ab502e97f44cbb4c4bab8
+on the saved two-view49/28/1 fixture. Panned A and armed Region; Architecture round
+trip retained94% camera/tool. Model explorer selected B; Behavior fitted78% and
+reset to Select/move. Empty runtime log; normal close, exec46107 exit0.
+
+## Reproduction artifacts and limits
+
+Evidence root:D:/CodexBuilds/Capella2-release1-01a06e2e. Saved models and immutable
+binaries are in ui-state-direct-01, ui-state-direct-03, ui-state-linux,
+ui-state-navigation-windows and ui-state-navigation-linux. Final Linux directory
+contains build-manifest.json, SHA256SUMS, desktop test/Clippy/build logs. Windows
+logs use D:/CodexBuilds/Capella2-state-navigation-*; full baseline logs use
+Capella2-state-direct-workspace-* and ui-state-linux/VERIFICATION.md.
+
+Native Linux minimum-size testing is not claimed;1100x700 evidence is Windows.
+Independent native review did not cover every pseudo kind, source-handle or Local
+reconnection, concurrent regions, guard/effect edits or full dirty-close matrix.
+Automated checks cover relevant semantics/lifecycle but are not relabeled native
+trials. Fitting a nested diagram at55% produces small labels; use zoom/pan to work.
+Scenario/process direct editing remains required release work.

harness/release-state-gesture-design.md

@@ -1,7 +1,10 @@
 # Direct state editing — bounded design, 2026-09-05
 
-Read-only investigation; implementation and native verification remain pending.
-Connection routing became the user's next priority after this design handoff.
+Originally a read-only proposal. Implemented in the isolated state-integration
+checkout through e0b2210; current verification and outstanding acceptance are in
+STATE.md. The old file/line seams below describe the pre-implementation baseline.
+State layouts now use the typed context and commands proposed here; full scenario
+and process direct editing remain separate release work.
 
 ## Decision and first task
 
@@ -121,4 +124,6 @@ behavior view independently of selection, including root Events. Reconnect
 clones the relation and changes one endpoint; preserve all other data and reject
 invalid cardinalities. Keep form editing in a bounded panel so the canvas remains
 usable at 1100×700. These are decision-ready interfaces; no implementation or
-native gesture acceptance is claimed.
+native gesture acceptance is claimed by this design record. The implemented
+contract and subsequent acceptance evidence are in release-state-editing.md;
+production316dc55 closes the direct state slice, while scenario/process work remains.